CAREER: Scalable and Trustworthy Automatic Program Repair

职业：可扩展且值得信赖的自动程序修复

• 批准号: 0954024
• 负责人: Westley Weimer
• 金额: $ 40万
• 依托单位: University of Virginia Main Campus
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-09-01 至 2017-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0954024&HistoricalAwards=false
• 关键词: CAREER; Scalable; Trustworthy; Automatic; Program

Fixing software bugs is a difficult and time-consuming process, accounting for up to 90% of the lifetime cost of a typical program. Because the number of defects outstrips the resources available for repairing them, most software is shipped with both known and unknown bugs. This research builds upon a novel, fully-automated method for repairing bugs in existing software, producing trustworthy repairs for real-world programs. The research will be broadly applicable, targeting large legacy applications with many testcases.The technical focus of the work is a scalable and trustworthy technique to automatically repair program bugs. Program variants are evolved, using analogues of biological processes such as mutation, until one is found that both retains required functionality and avoids the defect. Thousands of standard software testcases, program invariants, mined specifications, and "fuzz" inputs are used to represent bugs, encode program requirements, and build trusted repairs. Empirical evaluations include an automated hardening scenario: programs and attacks against them are coevolved over time, simulating parts of the security arms race. Significant potential outcomes include: a scalable and trustworthy automated program repair methodology and freely available tools; advances in formal program analyses; significant efforts in outreach and education; and dissemination of the results.

修复软件错误是一个困难和耗时的过程，占典型程序生命周期成本的90%。因为缺陷的数量超过了可用于修复它们的资源，所以大多数软件都附带了已知和未知的错误。这项研究建立在一种新颖的、全自动的方法之上，用于修复现有软件中的错误，为现实世界的程序产生可靠的修复。这项研究将具有广泛的适用性，针对具有许多测试案例的大型遗留应用程序。工作的技术重点是一种可扩展的、可靠的自动修复程序错误的技术。使用生物过程的类似物，如突变，进化程序变体，直到发现既保留了必需的功能又避免了缺陷的程序变体。数以千计的标准软件测试用例、程序不变量、挖掘的规范和“模糊”输入被用来表示错误、编码程序需求和构建可信的修复。经验评估包括一个自动强化的场景：随着时间的推移，针对它们的程序和攻击是共同进化的，模拟了安全军备竞赛的一部分。重要的潜在成果包括：可扩展和值得信赖的自动化程序修复方法和免费可用的工具；在正式程序分析方面的进展；在外联和教育方面的重大努力；以及结果的传播。