一句话：提出测试模仿方法，用于判断客户端项目依赖中的库漏洞是否可被实际触发利用。
现代软件项目依赖大量开源库，因而易受依赖库安全漏洞影响。开发者需要判断某个库漏洞是否会在自己的项目中可被利用。现有工具存在不足：仅基于调用图的可达性分析可能误报，因为客户端未必以触发漏洞的方式使用脆弱代码；基于测试生成的方法则难以克服漏洞利用本身的复杂性，往往需要大量领域知识才能生成触发输入。论文因此提出“测试模仿”（test mimicry）来评估库漏洞的可利用性。摘要未报告具体实验与量化结果，但从问题设定看，其目标是在可达性与测试生成之间提供更贴近真实触发条件的可利用性判定。
Modern software engineering projects often depend on open-source software libraries, rendering them vulnerable to potential security issues in these libraries. Developers of client projects have to stay alert of security threats in the software dependencies. While there are existing tools that allow developers to assess if a library vulnerability is reachable from a project, they face limitations. Call graph-only approaches may produce false alarms as the client project may not use the vulnerable code in a way that triggers the vulnerability, while test generation-based approaches faces difficulties in overcoming the intrinsic complexity of exploiting a vulnerability, where extensive domain knowledge may be required to produce a vulnerability-triggering input.
@inproceedings{paperbot7414,
title = {Test mimicry to assess the exploitability of library vulnerabilities},
author = {Hong Jin Kang and Truong Giang Nguyen and Bach Le and Corina S. Păsăreanu and David Lo},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534398}
}