一句话:针对灰盒模糊测试无法判断何时停止的问题,提出估计其残存风险的方法。
对于任何未发现错误的模糊测试活动,无论运行多久,仍存在一种残存风险:如果活动再运行一小段时间,可能会发现软件错误。灰盒模糊测试工具近年来被广泛采用,但实践者只能猜测其残存风险何时降至某个特定的最大允许阈值以下。本文致力于估计灰盒模糊测试活动中的残存风险,以帮助实践者判断测试是否足够充分、何时可以安全停止。摘要未提供具体的估计方法细节与实验结果。
For any errorless fuzzing campaign, no matter how long, there is always some residual risk that a software error would be discovered if only the campaign was run for just a bit longer. Recently, greybox fuzzing tools have found widespread adoption. Yet, practitioners can only guess when the residual risk of a greybox fuzzing campaign falls below a specific, maximum allowable threshold.