一句话：提出基于迁移的自动化测试生成方法，帮助项目判断是否受第三方库漏洞影响。
第三方库在软件开发中被广泛复用，但当新库漏洞披露时，项目维护者必须判断自身项目是否受影响，这通常需要大量人工评估。现有方法各有局限：静态分析工具容易产生误报，动态分析依赖已有测试，而测试生成工具在复杂漏洞上成功率低。针对这一问题，本文提出一种基于迁移的自动化测试生成方法，旨在自动构造能够暴露库漏洞影响的测试，从而辅助项目维护者判定受影响情况。摘要未报告具体实现细节与实验数值；其核心思路是把迁移机制用于测试生成，以缓解复杂漏洞下测试生成困难的问题。
In software development, developers extensively utilize third-party libraries to avoid implementing existing functionalities. When a new third-party library vulnerability is disclosed, project maintainers need to determine whether their projects are affected by the vulnerability, which requires developers to invest substantial effort in assessment. However, existing tools face a series of issues: static analysis tools produce false alarms, dynamic analysis tools require existing tests and test generation tools have low success rates when facing complex vulnerabilities.
@inproceedings{paperbot11310,
title = {Exploiting Library Vulnerability via Migration Based Automating Test Generation},
author = {Zirui Chen and Xing Hu and Xin Xia and Yi Gao and Tongtong Xu and David Lo and Xiaohu Yang},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639583}
}