JQF: coverage-guided property-based testing in Java
JQF: coverage-guided property-based testing in Java
复制标题
DOI：
10.1145/3293882.3339002
复制
发表时间：
2019-07
期刊：
影响因子：
--
通讯作者：
Rohan Padhye;Caroline Lemieux;Koushik Sen
中科院分区：
文献类型：
--
作者：
Rohan Padhye;Caroline Lemieux;Koushik Sen
我们提出了JQF，一个在Java中执行覆盖引导的模糊测试的平台。JQF既为希望在Java程序中查找漏洞的从业者设计，也为希望实现新的模糊测试算法的研究人员设计。从业者编写接受输入作为形式参数的QuickCheck风格的测试方法。JQF对测试程序的字节码进行插装，并使用在覆盖引导的模糊测试循环中生成的输入持续执行测试。JQF的输入生成机制是可扩展的。研究人员可以通过扩展JQF的Guidance接口来实现自定义的模糊测试算法。一个Guidance实例对在测试用例执行期间生成的代码覆盖事件（例如函数调用和条件跳转）做出响应，并提供下一个输入。我们描述了JQF当前附带的几种引导方式，例如：使用Zest进行语义模糊测试，使用AFL进行二进制模糊测试，以及使用PerfFuzz进行复杂度模糊测试。JQF是一个成熟的开源工具，可公开获取。在撰写本文时，JQF已成功在广泛使用的开源软件（如OpenJDK、Apache Commons和Google Closure Compiler）中发现了42个以前未知的漏洞。
We present JQF, a platform for performing coverage-guided fuzz testing in Java. JQF is designed both for practitioners, who wish to find bugs in Java programs, as well as for researchers, who wish to implement new fuzzing algorithms. Practitioners write QuickCheck-style test methods that take inputs as formal parameters. JQF instruments the test program's bytecode and continuously executes tests using inputs that are generated in a coverage-guided fuzzing loop. JQF's input-generation mechanism is extensible. Researchers can implement custom fuzzing algorithms by extending JQF's Guidance interface. A Guidance instance responds to code coverage events generated during the execution of a test case, such as function calls and conditional jumps, and provides the next input. We describe several guidances that currently ship with JQF, such as: semantic fuzzing with Zest, binary fuzzing with AFL, and complexity fuzzing with PerfFuzz. JQF is a mature tool that is open-source and publicly available. At the time of writing, JQF has been successful in discovering 42 previously unknown bugs in widely used open-source software such as OpenJDK, Apache Commons, and the Google Closure Compiler.