SHF: Medium: Collaborative Research: HUGS: Human-Guided Software Testing and Analysis for Scalable Bug Detection and Repair

SHF：中：协作研究：HUGS：用于可扩展错误检测和修复的人工引导软件测试和分析

• 批准号: 1900968
• 负责人: Koushik Sen
• 金额: $ 40万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-08-01 至 2024-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1900968&HistoricalAwards=false
• 关键词: SHF; Medium; Collaborative; Research; HUGS

As all aspects of human society increasingly rely on software systems, there is an urgent need for scalable techniques and tools that can detect and eliminate software bugs effectively. In the last decade, hybrid approaches that combine software analysis techniques of different strengths have resulted in powerful tools for automated software testing and repair. However, despite the significant progress that has been made so far, fully automated techniques often fail to scale in practice. The key strength of automated techniques is their ability to quickly analyze many program behaviors by performing repetitive, computational tasks at a rate far beyond the human attention span and computation speed. However, they do not know how to intelligently navigate complex state spaces, which often requires contextual and common-sense reasoning that humans excel at. The goal of this project is to combine the strengths of human ingenuity and automated tools in order to achieve bug and vulnerability detection and repair at scale, while keeping the human intervention at a minimum. All the techniques developed within the context of this project will be transitionable to scalable software testing products by industry and government, leading to better software dependability in all application domains, including critical national infrastructures. The project will also seek to broaden participation in computing by training students from under-represented groups.The project will develop human-guided hybrid techniques that combine fuzz testing, symbolic execution, and search strategies that will aim to optimize the search towards efficient and scalable bug detection; annotations for controlling the search and for pruning the search space; input generation techniques and human-guided value generation; and automated and semi-automated synthesis of repairs. All these techniques will be integrated into open-source tools targeting multiple programming languages. To minimize the human effort, the framework will incorporate self-monitoring mechanisms to detect when the automatic analysis fails, which will provide detailed feedback to the developers to remedy the problem. This will result in an interactive testing and analysis process that leverages human input in a principled way to best guide the automated techniques, resulting in scalable bug detection and software repair.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

随着人类社会的各个方面越来越依赖软件系统，迫切需要可扩展的技术和工具可以有效地检测和消除软件错误。在过去的十年中，结合了不同优势的软件分析技术的混合方法为自动化软件测试和维修提供了强大的工具。但是，尽管到目前为止取得了重大进展，但完全自动化的技术通常无法在实践中扩展。自动化技术的关键优势在于它们能够通过以超出人体注意力跨度和计算速度执行重复的计算任务来快速分析许多程序行为。 但是，他们不知道如何智能地浏览复杂的状态空间，这通常需要人类表现出的上下文和常识性推理。该项目的目的是结合人类创造力和自动化工具的优势，以实现漏洞和脆弱性检测和修复，同时将人类干预保持在最低限度。在该项目背景下开发的所有技术都可以通过行业和政府过渡到可扩展的软件测试产品，从而在包括关键的国家基础架构（包括关键的国家基础架构）中获得更好的软件可靠性。该项目还将旨在扩大来自代表性不足小组的学生的培训学生的参与。该项目将开发人类引导的混合技术，以结合模糊测试，象征性执行和搜索策略，旨在优化搜索范围朝着高效且可扩展的错误检测；控制搜索和修剪搜索空间的注释；输入生成技术和人类指导的价值产生；以及自动化和半自动化的维修合成。所有这些技术将集成到针对多种编程语言的开源工具中。为了最大程度地减少人类的努力，该框架将结合自我监控机制，以检测何时自动分析失败，这将为开发人员提供详细的反馈以解决问题。这将导致交互式测试和分析过程，该过程以原则性的方式利用人类的投入来指导自动化技术，从而实现可扩展的错误检测和软件维修。该奖项反映了NSF的法定任务，并被认为是值得通过基金会的知识分子优点和更广泛的影响审查标准来通过评估来获得支持的。

项目成果

ItyFuzz: Snapshot-Based Fuzzer for Smart Contract

• DOI: 10.1145/3597926.3598059
• 发表时间: 2023-06
• 期刊: Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis
• 作者: Chaofan Shou;Shangyin Tan;Koushik Sen

Quickly Generating Diverse Valid Test Inputs with Reinforcement Learning ICSE 2020

使用强化学习快速生成多样化的有效测试输入 ICSE 2020

• DOI: 10.1145/3380399
• 发表时间: 2020
• 期刊: International conference on software engineering (ICSE'2020
• 作者: Sameer Reddy, Caroline Lemieux

Gauss: program synthesis by reasoning over graphs

高斯：通过图推理进行程序综合

• DOI: 10.1145/3485511
• 发表时间: 2021
• 期刊: Proceedings of the ACM on Programming Languages
• 作者: Bavishi, Rohan;Lemieux, Caroline;Sen, Koushik;Stoica, Ion
• 通讯作者: Stoica, Ion

VizSmith: Automated Visualization Synthesis by Mining Data-Science Notebooks

• DOI: 10.1109/ase51524.2021.9678696
• 发表时间: 2021-11
• 期刊: 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)
• 作者: Rohan Bavishi;Shadaj Laddad;H. Yoshida;M. Prasad;Koushik Sen

Growing a Test Corpus with Bonsai Fuzzing

• DOI: 10.1109/icse43902.2021.00072
• 发表时间: 2021-03
• 期刊: 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)
• 作者: Vasudev Vikram;Rohan Padhye;Koushik Sen