Engineering internet-centric software systems

工程以互联网为中心的软件系统

• 批准号: 239627-2011
• 负责人: Miller, James
• 金额: $ 2.4万
• 依托单位: University of Alberta
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2015
• 资助国家: 加拿大
• 起止时间: 2015-01-01 至 2016-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=570598
• 关键词: Engineering; internet; centric; software; systems

Web 2.0 applications are set to revolutionize computing, especially within cloud computing environments. However, Web 2.0 applications are error prone. Hence, this research program proposes a radical new approach to verification. It is argued that this approach needs to consider these systems in a language-neutral fashion rather than statically analyze their code base. Fuzzing or Fuzz testing is a popular, highly automated, language-neutral verification technique. However, traditional fuzzing approaches suffer from poor code and input coverage characteristics. It has been shown that traditional forms of fuzzing can be successfully extended by integrating other techniques such as symbolic execution. However, such extensions are often computational highly expensive. Recently grammar-based white-box fuzz testing has been proposed as such an extension; however, this extension has received limited attention in terms of its actualization. This program of research proposes to explore this actualization, and explore it significantly beyond its initial proposal. Its ultimate goal is to produce a highly automated, industrial-strength (highly scalable) testing framework and process. Specifically, it will address the following questions: - How descriptions of the structure of the system's input can be used to improve code coverage; - How to produce test cases which efficiently cover the input space of industrial-strength software; - How such computationally expensive approaches can be parallelized for efficient execution on multi-core and cloud computing environments; - How test oracles can be extended beyond simple pass / fail mechanisms found in traditional fuzzing; - How such automated tools can be incorporated into (existing) production processes; and - How automated guidance can assist the tester to make improved decisions with respect to inputs into, and results from, such verification processes.

Web 2.0应用程序将彻底改变计算，特别是在云计算环境中。然而，Web 2.0应用程序容易出错。 因此，这项研究计划提出了一种全新的验证方法。有人认为，这种方法需要考虑这些系统中的语言中立的方式，而不是静态地分析他们的代码库。模糊测试是一种流行的、高度自动化的、语言中立的验证技术。然而，传统的模糊方法遭受差的代码和输入覆盖特性。它已被证明，传统形式的模糊可以成功地扩展通过集成其他技术，如符号执行。然而，这样的扩展通常是计算上非常昂贵的。最近，基于语法的白盒模糊测试已被提出作为这样的扩展，然而，这种扩展已收到有限的关注，在其实现。 本研究计划旨在探索这种现实化，并对其进行超越其最初建议的探索。它的最终目标是产生一个高度自动化的，工业强度（高度可扩展）的测试框架和过程。具体而言，它将处理以下问题： - 如何使用系统输入结构的描述来提高代码覆盖率; - 如何生成有效覆盖工业级软件输入空间的测试用例; - 如何将这种计算成本高的方法并行化，以便在多核和云计算环境中高效执行; - 如何将测试预言机扩展到传统模糊测试中的简单通过/失败机制之外 - 如何将此类自动化工具纳入（现有）生产流程;以及 - 自动化指导如何帮助测试人员做出关于输入和来自验证过程的结果的改进决策。