Guiding Greybox Fuzzing with Mutation Testing
Guiding Greybox Fuzzing with Mutation Testing
复制标题
DOI：
10.1145/3597926.3598107
复制
发表时间：
2023-07
期刊：
影响因子：
--
通讯作者：
Vasudev Vikram;Isabella Laybourn;Ao Li;Nicole Nair;Kelton OBrien;Rafaello Sanna;Rohan Padhye
中科院分区：
文献类型：
--
作者：
Vasudev Vikram;Isabella Laybourn;Ao Li;Nicole Nair;Kelton OBrien;Rafaello Sanna;Rohan Padhye
Greybox的模糊和突变测试是两个流行但主要是独立的软件测试研究领域，到目前为止，重叠的重叠率有限。 Greybox Fuzzing，通常旨在搜索新的错误，主要使用代码覆盖范围来选择要保存的输入。突变测试主要用作评估回归测试质量的代码覆盖范围的更强替代方法。这个想法是评估测试的能力，可以识别目标程序中人为注入的故障。但是，如果我们想使用Greybox Fuzzing综合高质量回归测试该怎么办？在本文中，我们开发和评估MU2，这是一种基于JAVA的框架，用于将突变分析纳入Greybox模糊循环中，目的是产生具有高突变评分的测试输入语料库。 MU2利用差分甲骨文来识别行使有趣的程序行为的输入而不会引起崩溃。本文介绍了MU2中实施的几种动态优化，以克服每个模糊生成的输入的高成本。这些优化引入了模糊吞吐量和突变杀死能力的权衡，我们在五个现实世界中的Java基准测试中对此进行了经验评估。总体而言，MU2的变体能够合成比最先进的Java Fuzzer Zest的突变评分的测试输入语料库。
Greybox fuzzing and mutation testing are two popular but mostly independent fields of software testing research that have so far had limited overlap. Greybox fuzzing, generally geared towards searching for new bugs, predominantly uses code coverage for selecting inputs to save. Mutation testing is primarily used as a stronger alternative to code coverage in assessing the quality of regression tests; the idea is to evaluate tests for their ability to identify artificially injected faults in the target program. But what if we wanted to use greybox fuzzing to synthesize high-quality regression tests? In this paper, we develop and evaluate Mu2, a Java-based framework for incorporating mutation analysis in the greybox fuzzing loop, with the goal of producing a test-input corpus with a high mutation score. Mu2 makes use of a differential oracle for identifying inputs that exercise interesting program behavior without causing crashes. This paper describes several dynamic optimizations implemented in Mu2 to overcome the high cost of performing mutation analysis with every fuzzer-generated input. These optimizations introduce trade-offs in fuzzing throughput and mutation killing ability, which we evaluate empirically on five real-world Java benchmarks. Overall, variants of Mu2 are able to synthesize test-input corpora with a higher mutation score than state-of-the-art Java fuzzer Zest.