一句话:提出 LISP,用 LLM 理解库 API 代码并划分输入空间,生成高覆盖测试套件。
库 API 自动测试需探索包含复杂数据类型对象的大量参数输入,现有搜索方法因缺乏对象状态与程序分支关系知识而效率低、易生成无效输入;符号执行能识别关系但难扩展到大程序。本文提出基于 LLM 的输入空间划分测试方法 LISP:将待测 API 签名与代码提供给 LLM,获得各输入空间分区的文本描述,再据此从每个分区采样输入,形成系统探索 API 行为的测试套件。作者在 10 个流行开源 Java 库的 2205 个以上库 API 方法上评估 LISP。结果显示,LISP 平均达到 67.82% 分支覆盖,超过 EvoSuite 1.21 倍,触发 404 个异常或错误,并发现 13 个获 CVE 编号的未知漏洞。
Automated library APIs testing is difficult as it requires exploring a vast space of parameter inputs that may involve objects with complex data types. Existing search based approaches, with limited knowledge of relations between object states and program branches, often suffer from the low efficiency issue, i.e., tending to generate invalid inputs. Symbolic execution based approaches can effectively identify such relations, but fail to scale to large programs. In this work, we present an LLM-based input space partitioning testing approach, LISP, for library APIs. The approach lever-ages LLMs to understand the code of a library API under test and perform input space partitioning based on its understanding and rich common knowledge. Specifically, we provide the signature and code of the API under test to LLMs, with the expectation of obtaining a text description of each input space partition of the API under test. Then, we generate inputs through employing the generated text description to sample inputs from each partition, ultimately resulting in test suites that systematically explore the program behavior of the API. We evaluate LISP on more than 2,205 library API meth-ods taken from 10 popular open-source Java libraries (e.g.,$a$p$a$che/commons-lang with 2.6k stars, guava with 48.8k stars on GitHub). Our experiment results show that LISP is effective in library API testing. It significantly outperforms state-of-the-art tool EvoSuite in terms of edge coverage. On average, LISP achieves 67.82 % branch coverage, surpassing EvoSuite by 1.21 times. In total, LISP triggers 404 exceptions or errors in the experiments, and discovers 13 previously unknown vulnerabilities during evaluation, which have been assigned CVE IDs.
DOI 原文 ·
@inproceedings{paperbot8741,
title = {LLM Based Input Space Partitioning Testing for Library APIs},
author = {Jiageng Li and Zhen Dong and Chong Wang and Haozhen You and Cen Zhang and Yang Liu and Xin Peng},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00153}
}