一句话：提出Mu2框架，将变异分析融入灰盒模糊测试循环，以合成高变异得分的回归测试输入语料。
灰盒模糊测试与变异测试长期基本独立。前者用于找新bug，多以代码覆盖率选择输入；后者用于评估回归测试质量。论文提出Mu2，一个Java框架，把变异分析纳入灰盒模糊测试循环，目标是生成高变异得分的测试输入语料。Mu2用差分预言识别能触发有趣程序行为但不致崩溃的输入。为克服逐个输入做变异分析的高开销，论文实现若干动态优化，在模糊测试吞吐量与变异杀死能力间存在权衡，并在五个真实Java基准上实证评估。总体上，Mu2变体合成的语料变异得分高于最先进Java模糊测试器Zest。
Greybox fuzzing and mutation testing are two popular but mostly independent fields of software testing research that have so far had limited overlap. Greybox fuzzing, generally geared towards searching for new bugs, predominantly uses code coverage for selecting inputs to save. Mutation testing is primarily used as a stronger alternative to code coverage in assessing the quality of regression tests; the idea is to evaluate tests for their ability to identify artificially injected faults in the target program. But what if we wanted to use greybox fuzzing to synthesize high-quality regression tests? In this paper, we develop and evaluate Mu2, a Java-based framework for incorporating mutation analysis in the greybox fuzzing loop, with the goal of producing a test-input corpus with a high mutation score. Mu2 makes use of a differential oracle for identifying inputs that exercise interesting program behavior without causing crashes. This paper describes several dynamic optimizations implemented in Mu2 to overcome the high cost of performing mutation analysis with every fuzzer-generated input. These optimizations introduce trade-offs in fuzzing throughput and mutation killing ability, which we evaluate empirically on five real-world Java benchmarks. Overall, variants of Mu2 are able to synthesize test-input corpora with a higher mutation score than state-of-the-art Java fuzzer Zest.
@inproceedings{VikramLLNOSP23,
title = {Guiding Greybox Fuzzing with Mutation Testing},
author = {Vasudev Vikram and Isabella Laybourn and Ao Li and Nicole Nair and Kelton OBrien and Rafaello Sanna and Rohan Padhye},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598107}
}