一句话：Columbus 自动识别 Android 回调并生成有效参数，借助数据依赖与崩溃引导反馈提升崩溃发现与覆盖率。
Android 应用是事件驱动程序，自动生成所有可能事件十分困难。回调驱动测试通过直接调用应用回调绕开事件生成，但现有技术依赖人工专家预先了解 Android 回调并编写 stub 代码来准备参数，难以覆盖庞大且不断演进的 Android API。本文提出 Columbus：它同时分析 Android 框架与被测应用来自动识别回调，并组合使用欠约束符号执行（生成原始类型参数）与类型引导的动态堆内省（生成对象参数）来构造有效输入。此外，Columbus 在测试过程中引入数据依赖和崩溃引导两种新颖反馈机制，以提高触发崩溃的概率并最大化覆盖率。评估表明，Columbus 在崩溃发现和覆盖率两方面均优于当前最先进的模型驱动、基于 checkpoint 以及回调驱动的测试工具。
With the continuous rise in the popularity of Android mobile devices, automated testing of apps has become more important than ever. Android apps are event-driven programs. Unfortunately, generating all possible types of events by interacting with an app's interface is challenging for an automated testing approach. Callback-driven testing eliminates the need for event generation by directly invoking app callbacks. However, existing callback-driven testing techniques assume prior knowledge of Android callbacks, and they rely on a human expert, who is familiar with the Android API, to write stub code that prepares callback arguments before invocation. Since the Android API is very large and keeps evolving, prior techniques could only support a small fraction of callbacks present in the Android framework. In this work, we introduce Columbus, a callback-driven testing technique that employs two strategies to eliminate the need for human involvement: (i) it automatically identifies callbacks by simultaneously analyzing both the Android framework and the app under test; (ii) it uses a combination of under-constrained symbolic execution (primitive arguments), and type-guided dynamic heap introspection (object arguments) to generate valid and effective inputs. Lastly, Columbus integrates two novel feedback mechanisms-data dependency and crash-guidance- during testing to increase the likelihood of triggering crashes and maximizing coverage. In our evaluation, Columbus outperforms state-of-the-art model-driven, checkpoint-based, and callback-driven testing tools both in terms of crashes and coverage.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{BoseDVMGCBKV23,
title = {Columbus: Android App Testing Through Systematic Callback Exploration},
author = {Priyanka Bose and Dipanjan Das and Saastha Vasan and Sebastiano Mariani and Ilya Grishchenko and Andrea Continella and Antonio Bianchi and Christopher Kruegel and Giovanni Vigna},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00121}
}