EMPEROR: Learning Causes of Program Behavior

所有的程序行为都是由一些程序输入触发的。输入的哪些部分触发程序行为，以及如何触发？在EMPEROR项目中，我们的目标是自动生成程序行为的解释——特别是程序失败。为此，我们(1)使用将输入分离为单个元素的语法；(2)学习输入元素特征与程序行为之间的统计关系；(3)使用系统测试来加强或驳斥推断关联，包括执行的内部特征。因此，我们获得了一种方法：(1)自动推断特定行为发生的（输入）条件：“只要邮件地址包含引号字符，程序就会失败”；(2)通过生成的测试输入自动（重新）产生感兴趣的行为：“andr'e@foo.com”；(3)通过生成的测试用例提炼和产生因果关系，包括执行特性：“输入foo''''''''@bar.com”导致递归深度超过128，导致崩溃”。EMPEROR是EMPRESS的继承者，在EMPRESS中，我们展示了输入元素和程序行为之间存在的统计关系，以及原型实现如何利用它们进行测试和调试。EMPEROR采用皇后的方法，并以单一的模块化方法统一和扩展它们，远远超出了简单的统计关系。通过学习和改进预测和生成模型，EMPEROR将能够推断和改进涉及任意的关系

All program behavior is triggered by some program input. Which parts of the input do trigger program behaviors, and how? In the EMPEROR project, we aim to automatically produce explanations for program behaviors—notably program failures. To this end, we (1) use grammars that separate inputs into individual elements; (2) learn statistical relations between features of input elements and program behavior; and (3) use systematic tests to strengthen or refute inferred associations, including internal features of the execution. As a result, we obtain an approach that (1) automatically infers the (input) conditions under which a specific behavior occurs: “The program fails whenever the mail address contains a quote character”; (2) automatically (re)produces behaviors of interest via generated test inputs: “andr'e@foo.com”; and (3) refines and produces cause-effect relationships via generated test cases, involving execution features: “The input foo''''''''@bar.com” causes a recursion depth of more than 128, leading to a crash”.EMPEROR is the successor to EMPRESS, in which we showed that statistical relations between input elements and program behavior exist, and how prototypical implementations would exploit them for testing and debugging. EMPEROR takes the approaches from EMPRESS and unifies and extends them in a single modular approach, going way beyond simple statistical relations. By learning and refining predictive and generative models, EMPEROR will be able to infer and refine relationships involving arbitrary