一句话：提出 FOCAL：以单元测试发现的目标故障为驱动，反向组合并精化函数摘要生成系统级测试输入，显著提升缺陷检测能力。
混合执行测试（concolic testing）在单元测试中能快速发现缺陷，但在系统级测试中面临符号路径爆炸，常漏掉缺陷。为此，作者提出聚焦式组合混合执行测试技术 FOCAL：以单元测试检测到的目标故障 v（崩溃或断言违反）为焦点，从引发 v 的函数向 main 逐层反向组合函数摘要，构建并求解表示系统级执行路径的符号公式，从而生成可复现 v 的系统级测试输入；当某函数摘要与其他摘要冲突时，利用冲突中学到的精化约束对该摘要进行精化。在 SIR 基准的 100 个真实缺陷上，FOCAL 检出 71 个，而 AFL-fast、KATCH、Mix-CCBSE 等前沿技术最多检出 40 个；此外还在常用文件解析程序中发现了 13 个新的崩溃缺陷。
Concolic testing is popular in unit testing because it can detect bugs quickly in a relatively small search space. But, in system-level testing, it suffers from the symbolic path explosion and often misses bugs. To resolve this problem, we have developed a focused compositional concolic testing technique, FOCAL, for effective bug detection. Focusing on a target unit failure v (a crash or an assert violation) detected by concolic unit testing, FOCAL generates a system-level test input that validates v. This test input is obtained by building and solving symbolic path formulas that represent system-level executions raising v. FOCAL builds such formulas by combining function summaries one by one backward from a function that raised v to main. If a function summary φa of function a conflicts with the summaries of the other functions, FOCAL refines φa to φa′ by applying a refining constraint learned from the conflict. FOCAL showed high system-level bug detection ability by detecting 71 out of the 100 real-world target bugs in the SIR benchmark, while other relevant cutting edge techniques (i.e., AFL-fast, KATCH, Mix-CCBSE) detected at most 40 bugs. Also, FOCAL detected 13 new crash bugs in popular file parsing programs.
DOI 原文 ·
@inproceedings{paperbot5158,
title = {Target-driven compositional concolic testing with function summary refinement for effective bug detection},
author = {Yunho Kim and Shin Hong and Moonzoo Kim},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3338934}
}