Engineering internet-centric software systems

Web2.0应用程序将给计算带来革命性的变化，尤其是在云计算环境中。然而，Web 2.0应用程序很容易出错。因此，这项研究计划提出了一种激进的新方法来验证。有人认为，这种方法需要以语言中立的方式考虑这些系统，而不是静态地分析它们的代码库。模糊测试是一种流行的、高度自动化的、与语言无关的验证技术。然而，传统的模糊方法存在代码和输入覆盖特性差的问题。研究表明，通过整合其他技术，如符号执行，可以成功地扩展传统的模糊化形式。然而，这样的扩展通常是计算成本很高的。最近，基于语法的白盒模糊测试被提出作为这样一种扩展，然而，这种扩展在其实现方面受到的关注有限。 这项研究计划建议探索这一实现，并在其最初的提议之外对其进行显著的探索。它的最终目标是产生一个高度自动化、工业强度(高度可扩展)的测试框架和流程。具体地说，它将解决以下问题： -如何利用对系统输入结构的描述来提高代码覆盖率； -如何生成有效覆盖工业实力软件输入空间的测试用例； -如何将这种计算代价高昂的方法并行化，以便在多核和云计算环境中高效执行； -如何将测试先知扩展到传统模糊中的简单通过/失败机制之外； -如何将这种自动化工具纳入(现有)生产过程；以及 -自动化指导如何帮助测试人员就此类验证过程中的输入和结果做出改进的决策。

Web 2.0 applications are set to revolutionize computing, especially within cloud computing environments. However, Web 2.0 applications are error prone. Hence, this research program proposes a radical new approach to verification. It is argued that this approach needs to consider these systems in a language-neutral fashion rather than statically analyze their code base. Fuzzing or Fuzz testing is a popular, highly automated, language-neutral verification technique. However, traditional fuzzing approaches suffer from poor code and input coverage characteristics. It has been shown that traditional forms of fuzzing can be successfully extended by integrating other techniques such as symbolic execution. However, such extensions are often computational highly expensive. Recently grammar-based white-box fuzz testing has been proposed as such an extension; however, this extension has received limited attention in terms of its actualization. This program of research proposes to explore this actualization, and explore it significantly beyond its initial proposal. Its ultimate goal is to produce a highly automated, industrial-strength (highly scalable) testing framework and process. Specifically, it will address the following questions: - How descriptions of the structure of the system's input can be used to improve code coverage; - How to produce test cases which efficiently cover the input space of industrial-strength software; - How such computationally expensive approaches can be parallelized for efficient execution on multi-core and cloud computing environments; - How test oracles can be extended beyond simple pass / fail mechanisms found in traditional fuzzing; - How such automated tools can be incorporated into (existing) production processes; and - How automated guidance can assist the tester to make improved decisions with respect to inputs into, and results from, such verification processes.