SHF: Medium: Collaborative Research: HUGS: Human-Guided Software Testing and Analysis for Scalable Bug Detection and Repair

SHF：中：协作研究：HUGS：用于可扩展错误检测和修复的人工引导软件测试和分析

• 批准号: 1900968
• 负责人: Koushik Sen
• 金额: $ 40万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-08-01 至 2024-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1900968&HistoricalAwards=false
• 关键词: SHF; Medium; Collaborative; Research; HUGS

As all aspects of human society increasingly rely on software systems, there is an urgent need for scalable techniques and tools that can detect and eliminate software bugs effectively. In the last decade, hybrid approaches that combine software analysis techniques of different strengths have resulted in powerful tools for automated software testing and repair. However, despite the significant progress that has been made so far, fully automated techniques often fail to scale in practice. The key strength of automated techniques is their ability to quickly analyze many program behaviors by performing repetitive, computational tasks at a rate far beyond the human attention span and computation speed. However, they do not know how to intelligently navigate complex state spaces, which often requires contextual and common-sense reasoning that humans excel at. The goal of this project is to combine the strengths of human ingenuity and automated tools in order to achieve bug and vulnerability detection and repair at scale, while keeping the human intervention at a minimum. All the techniques developed within the context of this project will be transitionable to scalable software testing products by industry and government, leading to better software dependability in all application domains, including critical national infrastructures. The project will also seek to broaden participation in computing by training students from under-represented groups.The project will develop human-guided hybrid techniques that combine fuzz testing, symbolic execution, and search strategies that will aim to optimize the search towards efficient and scalable bug detection; annotations for controlling the search and for pruning the search space; input generation techniques and human-guided value generation; and automated and semi-automated synthesis of repairs. All these techniques will be integrated into open-source tools targeting multiple programming languages. To minimize the human effort, the framework will incorporate self-monitoring mechanisms to detect when the automatic analysis fails, which will provide detailed feedback to the developers to remedy the problem. This will result in an interactive testing and analysis process that leverages human input in a principled way to best guide the automated techniques, resulting in scalable bug detection and software repair.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

随着人类社会的各个方面越来越依赖于软件系统，迫切需要可扩展的技术和工具来有效地检测和消除软件缺陷。在过去的十年中，结合了不同强度的软件分析技术的混合方法已经产生了用于自动化软件测试和修复的强大工具。然而，尽管到目前为止已经取得了重大进展，但完全自动化的技术在实践中往往无法扩展。自动化技术的关键优势在于，它们能够以远远超出人类注意力广度和计算速度的速度执行重复的计算任务，从而快速分析许多程序行为。然而，它们不知道如何智能地导航复杂的状态空间，这通常需要人类擅长的上下文和常识推理。这个项目的目标是结合人类智慧和自动化工具的优势，以实现大规模的缺陷和漏洞检测和修复，同时将人为干预降到最低。在这个项目的背景下开发的所有技术都可以被工业和政府转换为可伸缩的软件测试产品，从而在所有应用领域（包括关键的国家基础设施）中带来更好的软件可靠性。该项目还将通过培训来自代表性不足群体的学生来扩大对计算机的参与。该项目将开发人类引导的混合技术，结合模糊测试、符号执行和搜索策略，旨在优化搜索，实现高效和可扩展的错误检测；用于控制搜索和修剪搜索空间的注释；输入生成技术和以人为导向的价值生成以及自动和半自动的综合维修。所有这些技术都将集成到针对多种编程语言的开源工具中。为了尽量减少人力，框架将结合自我监视机制来检测自动分析何时失败，这将向开发人员提供详细的反馈以纠正问题。这将导致一个交互式的测试和分析过程，以一种有原则的方式利用人工输入来最好地指导自动化技术，从而产生可伸缩的错误检测和软件修复。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

ItyFuzz: Snapshot-Based Fuzzer for Smart Contract

• DOI: 10.1145/3597926.3598059
• 发表时间: 2023-06
• 期刊: Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis
• 作者: Chaofan Shou;Shangyin Tan;Koushik Sen

Quickly Generating Diverse Valid Test Inputs with Reinforcement Learning ICSE 2020

使用强化学习快速生成多样化的有效测试输入 ICSE 2020

• DOI: 10.1145/3380399
• 发表时间: 2020
• 期刊: International conference on software engineering (ICSE'2020
• 作者: Sameer Reddy, Caroline Lemieux

Gauss: program synthesis by reasoning over graphs

高斯：通过图推理进行程序综合

• DOI: 10.1145/3485511
• 发表时间: 2021
• 期刊: Proceedings of the ACM on Programming Languages
• 作者: Bavishi, Rohan;Lemieux, Caroline;Sen, Koushik;Stoica, Ion
• 通讯作者: Stoica, Ion

VizSmith: Automated Visualization Synthesis by Mining Data-Science Notebooks

• DOI: 10.1109/ase51524.2021.9678696
• 发表时间: 2021-11
• 期刊: 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)
• 作者: Rohan Bavishi;Shadaj Laddad;H. Yoshida;M. Prasad;Koushik Sen

Growing a Test Corpus with Bonsai Fuzzing

• DOI: 10.1109/icse43902.2021.00072
• 发表时间: 2021-03
• 期刊: 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)
• 作者: Vasudev Vikram;Rohan Padhye;Koushik Sen