paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Dependency-aware Residual Risk Analysis

依赖感知的残余风险分析
ICSE Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering2026匹配度 2/10 · 该论文研究软件测试中的残余风险估计,聚焦覆盖率和 Good-Turing 估计器的统计偏差,属于测试与概率分析方向;但用户核心方向是静态分析、LLM/Agent 与程序分析交叉、浮点程序分析及贝叶斯程序分析,本文未涉及静态分析、LLM 或浮点分析,仅与概率建模有微弱关联。引用 2 inbox
Seongmin Lee, Marcel Böhme
crossref: 2026-09-12

AI 速览

一句话:揭示现有 GoTu 估计器因覆盖率为松上界且忽略覆盖元素依赖而高估残余风险,并提出依赖感知的残余风险分析。

软件测试只能降低但不能消除缺陷,残余风险可定义为下一个测试输入发现缺陷的概率。该风险上界是发现概率(DP),即下一个测试输入覆盖新代码的概率,而 DP 又上界为覆盖率,即每个测试输入期望发现的新覆盖元素数。已有工作用 Good-Turing 估计器(GoTu)通过覆盖率估计残余风险。本文发现 GoTu 会显著高估残余风险,导致对缺陷发现的过度乐观,原因有二:覆盖率本身只是松上界,且 GoTu 忽略覆盖元素之间的依赖。为此,论文开展依赖感知的残余风险分析,旨在利用覆盖元素依赖获得更准确的残余风险估计。

问题
软件测试后仍存在未发现缺陷的残余风险;现有 GoTu 基于覆盖率估计该风险,但会显著高估,导致对缺陷发现的过度乐观。
方法
论文提出依赖感知的残余风险分析,指出 GoTu 高估源于覆盖率上界过松以及忽略覆盖元素间依赖,并据此改进残余风险估计。
评估
摘要未报告具体实验设置与结果;作者通过分析发现 GoTu 存在显著高估,并将其归因于覆盖率松上界和覆盖元素依赖缺失。
原文摘要(Abstract)

However much we test a software system, some residual risk of undiscovered bugs always remains. If we model test generation as a sampling process, the residual risk can be defined as the probability that the next test input reveals a bug. This risk is upper-bounded by the discovery probability (DP), i.e., the probability that the next test input covers new code, which itself is upper-bounded by the coverage rate, i.e., the expected number of new coverage elements per test input. Prior work introduced the Good-Turing estimator (GoTu) to estimate residual risk via coverage rate. However, we find that GoTu substantially overestimates, leading to undue optimism in bug finding because (i) the coverage rate is only a loose upper bound, and (ii) GoTu ignores dependencies among coverage elements.

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@inproceedings{paperbot11747,
  title = {Dependency-aware Residual Risk Analysis},
  author = {Seongmin Lee and Marcel Böhme},
  booktitle = {ICSE},
  year = {2026},
  doi = {10.1145/3744916.3773180}
}