首页 > 最新文献

2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)最新文献

英文 中文
Statistical Model Checking Meets Property-Based Testing 统计模型检查满足基于属性的测试
B. Aichernig, Richard Schumi
In recent years, statistical model checking (SMC) has become increasingly popular, because it scales well to larger stochastic models and is relatively simple to implement. SMC solves the model checking problem by simulating the model for finitely many executions and uses hypothesis testing to infer if the samples provide statistical evidence for or against a property. Being based on simulation and statistics, SMC avoids the state-space explosion problem well-known from other model checking algorithms. In this paper we show how SMC can be easily integrated into a property-based testing framework, like FsCheck for C#. As a result we obtain a very flexible testing and simulation environment, where a programmer can define models and properties in a familiar programming language. The advantages: no external modelling language is needed and both stochastic models and implementations can be checked. In addition, we have access to the powerful test-data generators of a property-based testing tool. We demonstrate the feasibility of our approach by repeating three experiments from the SMC literature.
近年来,统计模型检查(SMC)因其适用于更大的随机模型且相对简单而越来越受欢迎。SMC通过模拟有限次执行的模型来解决模型检查问题,并使用假设检验来推断样本是否提供了支持或反对某个属性的统计证据。SMC基于仿真和统计,避免了其他模型检查算法中常见的状态空间爆炸问题。在本文中,我们展示了如何将SMC轻松集成到基于属性的测试框架中,比如c#的FsCheck。因此,我们获得了一个非常灵活的测试和模拟环境,程序员可以在其中用熟悉的编程语言定义模型和属性。优点:不需要外部建模语言,随机模型和实现都可以检查。此外,我们还可以访问基于属性的测试工具的强大的测试数据生成器。我们通过重复SMC文献中的三个实验来证明我们方法的可行性。
{"title":"Statistical Model Checking Meets Property-Based Testing","authors":"B. Aichernig, Richard Schumi","doi":"10.1109/ICST.2017.42","DOIUrl":"https://doi.org/10.1109/ICST.2017.42","url":null,"abstract":"In recent years, statistical model checking (SMC) has become increasingly popular, because it scales well to larger stochastic models and is relatively simple to implement. SMC solves the model checking problem by simulating the model for finitely many executions and uses hypothesis testing to infer if the samples provide statistical evidence for or against a property. Being based on simulation and statistics, SMC avoids the state-space explosion problem well-known from other model checking algorithms. In this paper we show how SMC can be easily integrated into a property-based testing framework, like FsCheck for C#. As a result we obtain a very flexible testing and simulation environment, where a programmer can define models and properties in a familiar programming language. The advantages: no external modelling language is needed and both stochastic models and implementations can be checked. In addition, we have access to the powerful test-data generators of a property-based testing tool. We demonstrate the feasibility of our approach by repeating three experiments from the SMC literature.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"32 3","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114121071","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
Localizing and Fixing Faults in SQL Predicates 定位和修复SQL谓词中的错误
Yun Guo
Fault localization is very important to both researchers and practitioners. Running tests is a useful approach to identify the fault location. Researchers have studied how to automatically identify faults in database applications [1], [2], [3]. However, those research considers the entire SQL statement as one line of code, indicating that the whole SQL statement contains errors. Little attention has been paid to ?nding faults in individual components of SQL statements such as a predicate clause. My research includes two major aspects: 1) Finding an effective and ef?cient method to localize faults in SQL predicates 2) Automatically fixing the reported faults The effectiveness is defined in terms of the faults found and the efficiency is defined with regards to the execution time. I have proposed a new approach that is more effective in ?nding fault in SQL predicates than existing methods. This approach and evaluation has been accepted to ICST 2017 [4].
故障定位对研究人员和实际操作人员都非常重要。运行测试是确定故障位置的有效方法。研究人员对数据库应用中的故障自动识别进行了研究[1],[2],[3]。然而,这些研究将整个SQL语句视为一行代码,这表明整个SQL语句包含错误。很少有人注意到在SQL语句的单个组件(如谓词子句)中发现错误。我的研究主要包括两个方面:1)寻找一个有效的和有效的?2)自动修复报告的错误。有效性是根据发现的错误来定义的,效率是根据执行时间来定义的。我提出了一种比现有方法更有效地解决SQL谓词错误的新方法。该方法和评估已被ICST 2017接受[4]。
{"title":"Localizing and Fixing Faults in SQL Predicates","authors":"Yun Guo","doi":"10.1109/ICST.2017.72","DOIUrl":"https://doi.org/10.1109/ICST.2017.72","url":null,"abstract":"Fault localization is very important to both researchers and practitioners. Running tests is a useful approach to identify the fault location. Researchers have studied how to automatically identify faults in database applications [1], [2], [3]. However, those research considers the entire SQL statement as one line of code, indicating that the whole SQL statement contains errors. Little attention has been paid to ?nding faults in individual components of SQL statements such as a predicate clause. My research includes two major aspects: 1) Finding an effective and ef?cient method to localize faults in SQL predicates 2) Automatically fixing the reported faults The effectiveness is defined in terms of the faults found and the efficiency is defined with regards to the execution time. I have proposed a new approach that is more effective in ?nding fault in SQL predicates than existing methods. This approach and evaluation has been accepted to ICST 2017 [4].","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"118 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124536755","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Enhancing Trust – Software Vulnerability Analysis Framework 增强信任-软件漏洞分析框架
Sultan S. Al-Qahtani
Open source projects and the globalization of the software industry have been a driving force in reuse of system components across traditional system boundaries. As a result, vulnerabilities and security concerns are no longer only impact individual but now also global software ecosystems. Known vulnerabilities and security concerns are reported in specialized vulnerability databases, which often remain information silos. In my PhD research, I introduce a modeling approach, which eliminates these information silos by linking the security knowledge with other software artifacts to improve traceability and trust in software products.
开源项目和软件产业的全球化已经成为跨传统系统边界重用系统组件的驱动力。因此,漏洞和安全问题不再只是影响个人,而是影响全球的软件生态系统。已知的漏洞和安全问题在专门的漏洞数据库中报告,这些数据库通常保持信息孤岛。在我的博士研究中,我介绍了一种建模方法,它通过将安全知识与其他软件构件联系起来,从而消除了这些信息孤岛,从而提高了软件产品的可追溯性和信任度。
{"title":"Enhancing Trust – Software Vulnerability Analysis Framework","authors":"Sultan S. Al-Qahtani","doi":"10.1109/ICST.2017.76","DOIUrl":"https://doi.org/10.1109/ICST.2017.76","url":null,"abstract":"Open source projects and the globalization of the software industry have been a driving force in reuse of system components across traditional system boundaries. As a result, vulnerabilities and security concerns are no longer only impact individual but now also global software ecosystems. Known vulnerabilities and security concerns are reported in specialized vulnerability databases, which often remain information silos. In my PhD research, I introduce a modeling approach, which eliminates these information silos by linking the security knowledge with other software artifacts to improve traceability and trust in software products.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"76 3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132069308","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Reflecting the Adoption of Software Testing Research in Open-Source Projects 反映开源项目中软件测试研究的采用
Fabian Trautsch
In the recent years, a lot of research has been done in the field of software testing. But, there exist few empirical studies which analyze, if results of software testing research are actually practiced in real software projects, why they are (not) practiced, and how this influences the quality of the project. Our proposed research project tries to close this gap by analyzing open-source software projects. We focus our work on a concept, which is well accepted and known in our community for a longer period of time: test levels. Hence, we propose a two step approach to tackle the problem. First, we want to determine if the concept of a unit is still up-to-date and propose alternatives otherwise. Furthermore, we aim to investigate, why developers think that the concept of a unit is (not) current. In the second step we intend to check, based on the unit definition determined in the ?rst step, how many tests on the different levels exist for the investigated projects. Additionally, based on the results, we want to examine, why developers are (not) developing tests for a certain test level and how this influences the software quality of the project. Our initial study showed, that very few projects have unit tests, using the unit definition of the IEEE and ISTQB. Furthermore, it revealed that developers intend to write unit tests, but they fail to do so.
近年来,在软件测试领域进行了大量的研究。但是,很少有实证研究分析,如果软件测试研究的结果在实际的软件项目中实际应用,为什么(不)实践,以及这如何影响项目的质量。我们提出的研究项目试图通过分析开源软件项目来缩小这一差距。我们将工作重点放在一个概念上,这个概念在我们的社区中被广泛接受和熟知了很长一段时间:测试级别。因此,我们建议采取两步走的方法来解决这个问题。首先,我们要确定单元的概念是否仍然是最新的,并提出替代方案。此外,我们的目标是调查,为什么开发人员认为单位的概念是(不)当前的。在第二步中,我们打算根据在第一步中确定的单元定义,检查所调查的项目在不同层次上存在多少个测试。另外,基于结果,我们想要检查,为什么开发人员要(不)为某个测试级别开发测试,以及这如何影响项目的软件质量。我们最初的研究表明,很少有项目使用IEEE和ISTQB的单元定义进行单元测试。此外,它揭示了开发人员打算编写单元测试,但他们没有这样做。
{"title":"Reflecting the Adoption of Software Testing Research in Open-Source Projects","authors":"Fabian Trautsch","doi":"10.1109/ICST.2017.77","DOIUrl":"https://doi.org/10.1109/ICST.2017.77","url":null,"abstract":"In the recent years, a lot of research has been done in the field of software testing. But, there exist few empirical studies which analyze, if results of software testing research are actually practiced in real software projects, why they are (not) practiced, and how this influences the quality of the project. Our proposed research project tries to close this gap by analyzing open-source software projects. We focus our work on a concept, which is well accepted and known in our community for a longer period of time: test levels. Hence, we propose a two step approach to tackle the problem. First, we want to determine if the concept of a unit is still up-to-date and propose alternatives otherwise. Furthermore, we aim to investigate, why developers think that the concept of a unit is (not) current. In the second step we intend to check, based on the unit definition determined in the ?rst step, how many tests on the different levels exist for the investigated projects. Additionally, based on the results, we want to examine, why developers are (not) developing tests for a certain test level and how this influences the software quality of the project. Our initial study showed, that very few projects have unit tests, using the unit definition of the IEEE and ISTQB. Furthermore, it revealed that developers intend to write unit tests, but they fail to do so.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130236980","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
A Search-Based Testing Approach for XML Injection Vulnerabilities in Web Applications 基于搜索的Web应用中XML注入漏洞测试方法
S. Jan, Duy Cu Nguyen, Andrea Arcuri, L. Briand
In most cases, web applications communicate with web services (SOAP and RESTful). The former act as a front-end to the latter, which contain the business logic. A hacker might not have direct access to those web services (e.g., they are not on public networks), but can still provide malicious inputs to the web application, thus potentially compromising related services. Typical examples are XML injection attacks that target SOAP communications. In this paper, we present a novel, search-based approach used to generate test data for a web application in an attempt to deliver malicious XML messages to web services. Our goal is thus to detect XML injection vulnerabilities in web applications. The proposed approach is evaluated on two studies, including an industrial web application with millions of users. Results show that we are able to effectively generate test data (e.g., input values in an HTML form) that detect such vulnerabilities.
在大多数情况下,web应用程序与web服务(SOAP和RESTful)通信。前者充当后者的前端,后者包含业务逻辑。黑客可能无法直接访问这些web服务(例如,它们不在公共网络上),但仍然可以向web应用程序提供恶意输入,从而可能危及相关服务。典型的例子是针对SOAP通信的XML注入攻击。在本文中,我们提出了一种新颖的、基于搜索的方法,用于为web应用程序生成测试数据,试图向web服务传递恶意XML消息。因此,我们的目标是检测web应用程序中的XML注入漏洞。所提出的方法在两项研究中进行了评估,其中包括一个具有数百万用户的工业web应用程序。结果表明,我们能够有效地生成检测此类漏洞的测试数据(例如,HTML表单中的输入值)。
{"title":"A Search-Based Testing Approach for XML Injection Vulnerabilities in Web Applications","authors":"S. Jan, Duy Cu Nguyen, Andrea Arcuri, L. Briand","doi":"10.1109/ICST.2017.39","DOIUrl":"https://doi.org/10.1109/ICST.2017.39","url":null,"abstract":"In most cases, web applications communicate with web services (SOAP and RESTful). The former act as a front-end to the latter, which contain the business logic. A hacker might not have direct access to those web services (e.g., they are not on public networks), but can still provide malicious inputs to the web application, thus potentially compromising related services. Typical examples are XML injection attacks that target SOAP communications. In this paper, we present a novel, search-based approach used to generate test data for a web application in an attempt to deliver malicious XML messages to web services. Our goal is thus to detect XML injection vulnerabilities in web applications. The proposed approach is evaluated on two studies, including an industrial web application with millions of users. Results show that we are able to effectively generate test data (e.g., input values in an HTML form) that detect such vulnerabilities.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"79 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121827205","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
Efficient Safety Proofs for Industry-Scale Code Using Abstractions and Bounded Model Checking 使用抽象和有界模型检查的工业规模代码的有效安全证明
P. Darke, Bharti Chimdyalwar, Avriti Chauhan, R. Venkatesh
Loop Abstraction followed by Bounded Model Checking, or LABMC in short, is a promising recent technique for proving safety of large programs. In an experimental setup proposed last year [14], LABMC was combined with slicing and Iterative Context Extension (ICE) with the aim of achieving scalability over industrial code. In this paper, we address two major limitations of that set-up, namely i) the inability of ICE to prune redundant code in a verification context, and ii) the unavailability of a tool that implements the set-up. We propose an improvement over ICE called Iterative Function Level Slicing (IFLS) and incorporate it in our tool called ELABMC, to offer an efficient implementation of [14]. We substantiate our claim with two sets of experiments over industrial applications as well as academic benchmarks. Quantifying the benefits of IFLS over traditional ICE in one, our results report that IFLS leads to 34.9% increase in efficiency, 17.7% improvement in precision, and scales in 14.2% more cases. With the second experiment, we show that ELABMC outperforms state-of-the-art verification techniques in the task of identifying static analysis warnings as false alarms.
循环抽象之后是有界模型检查,简称LABMC,是最近证明大型程序安全性的一种很有前途的技术。在去年提出的实验设置[14]中,LABMC与切片和迭代上下文扩展(ICE)相结合,目的是实现工业代码的可扩展性。在本文中,我们解决了该设置的两个主要限制,即i) ICE无法在验证上下文中修剪冗余代码,以及ii)实现该设置的工具不可用。我们提出了对ICE的改进,称为迭代功能级切片(IFLS),并将其纳入我们的工具ELABMC中,以提供有效的实现[14]。我们通过工业应用和学术基准的两组实验来证实我们的主张。综合量化IFLS与传统ICE相比的优势,我们的研究结果表明,IFLS的效率提高了34.9%,精度提高了17.7%,并且在14.2%的病例中增加了量表。通过第二个实验,我们表明ELABMC在将静态分析警告识别为假警报的任务中优于最先进的验证技术。
{"title":"Efficient Safety Proofs for Industry-Scale Code Using Abstractions and Bounded Model Checking","authors":"P. Darke, Bharti Chimdyalwar, Avriti Chauhan, R. Venkatesh","doi":"10.1109/ICST.2017.53","DOIUrl":"https://doi.org/10.1109/ICST.2017.53","url":null,"abstract":"Loop Abstraction followed by Bounded Model Checking, or LABMC in short, is a promising recent technique for proving safety of large programs. In an experimental setup proposed last year [14], LABMC was combined with slicing and Iterative Context Extension (ICE) with the aim of achieving scalability over industrial code. In this paper, we address two major limitations of that set-up, namely i) the inability of ICE to prune redundant code in a verification context, and ii) the unavailability of a tool that implements the set-up. We propose an improvement over ICE called Iterative Function Level Slicing (IFLS) and incorporate it in our tool called ELABMC, to offer an efficient implementation of [14]. We substantiate our claim with two sets of experiments over industrial applications as well as academic benchmarks. Quantifying the benefits of IFLS over traditional ICE in one, our results report that IFLS leads to 34.9% increase in efficiency, 17.7% improvement in precision, and scales in 14.2% more cases. With the second experiment, we show that ELABMC outperforms state-of-the-art verification techniques in the task of identifying static analysis warnings as false alarms.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132790222","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
How to Test in Sixteen Languages? Automation Support for Localization Testing 如何用16种语言进行测试?自动化支持本地化测试
R. Ramler, R. Hoschek
Developing for a global market requires the internationalization of software products and their localization to different countries, regions, and cultures. Localization testing verifies that the localized software variants work, look and feel as expected. Localization testing is a perfect candidate for automation. It has a high potential to reduce the manual effort in testing of multiple language variants and to speed-up release cycles. However, localization testing is rarely investigated in scientific work. There are only a few reports on automation approaches for localization testing providing very little empirical results or practical advice. In this paper we describe the approach we applied for automated testing of the different localized variants of a large industrial software system, we report on the various bugs found, and we discuss our experiences and lessons learned.
面向全球市场的发展需要软件产品的国际化以及针对不同国家、地区和文化的本地化。本地化测试验证本地化的软件变体是否如预期的那样工作、外观和感觉。本地化测试是自动化的完美选择。它具有很大的潜力,可以减少测试多种语言变体的手工工作,并加快发布周期。然而,定位测试在科学工作中很少被研究。只有少数关于本地化测试自动化方法的报告提供了很少的经验结果或实用建议。在本文中,我们描述了我们应用于大型工业软件系统的不同本地化变体的自动化测试的方法,我们报告了发现的各种错误,并讨论了我们的经验和教训。
{"title":"How to Test in Sixteen Languages? Automation Support for Localization Testing","authors":"R. Ramler, R. Hoschek","doi":"10.1109/ICST.2017.63","DOIUrl":"https://doi.org/10.1109/ICST.2017.63","url":null,"abstract":"Developing for a global market requires the internationalization of software products and their localization to different countries, regions, and cultures. Localization testing verifies that the localized software variants work, look and feel as expected. Localization testing is a perfect candidate for automation. It has a high potential to reduce the manual effort in testing of multiple language variants and to speed-up release cycles. However, localization testing is rarely investigated in scientific work. There are only a few reports on automation approaches for localization testing providing very little empirical results or practical advice. In this paper we describe the approach we applied for automated testing of the different localized variants of a large industrial software system, we report on the various bugs found, and we discuss our experiences and lessons learned.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129841383","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Debugging Multithreaded Programs Using Symbolic Analysis 使用符号分析调试多线程程序
Xiaodong Zhang
Debugging multithreaded software is challenging because the basic assumption that underlies sequential software debugging, i.e. the program behavior is deterministic under fixed inputs, is no longer valid due to the nondeterminism brought by thread scheduling. To restore this basic assumption, we propose a proactive debugging method so that programmers can debug multithreaded programs as if they were sequential. Our approach is based on the synergistic integration of a set of new symbolic analysis and dynamic analysis techniques. In particular, symbolic analysis is used to investigate the program behavior under multiple thread interleavings and then drive the dynamic execution to new branches. Dynamic analysis is used to execute these new branches and in turn guide the symbolic analysis further. The net effect of applying this feedback loop is a systematic and complete coverage of the program behavior under a fixed test input.
调试多线程软件是具有挑战性的,因为串行软件调试的基本假设,即在固定输入下程序行为是确定性的,由于线程调度带来的不确定性而不再有效。为了恢复这个基本假设,我们提出了一种主动调试方法,以便程序员可以调试多线程程序,就好像它们是连续的一样。我们的方法是基于一套新的符号分析和动态分析技术的协同整合。特别是,使用符号分析来研究多线程交错下的程序行为,然后将动态执行驱动到新的分支。动态分析用于执行这些新的分支,并反过来进一步指导符号分析。应用此反馈回路的净效果是在固定的测试输入下系统地、完整地覆盖程序行为。
{"title":"Debugging Multithreaded Programs Using Symbolic Analysis","authors":"Xiaodong Zhang","doi":"10.1109/ICST.2017.73","DOIUrl":"https://doi.org/10.1109/ICST.2017.73","url":null,"abstract":"Debugging multithreaded software is challenging because the basic assumption that underlies sequential software debugging, i.e. the program behavior is deterministic under fixed inputs, is no longer valid due to the nondeterminism brought by thread scheduling. To restore this basic assumption, we propose a proactive debugging method so that programmers can debug multithreaded programs as if they were sequential. Our approach is based on the synergistic integration of a set of new symbolic analysis and dynamic analysis techniques. In particular, symbolic analysis is used to investigate the program behavior under multiple thread interleavings and then drive the dynamic execution to new branches. Dynamic analysis is used to execute these new branches and in turn guide the symbolic analysis further. The net effect of applying this feedback loop is a systematic and complete coverage of the program behavior under a fixed test input.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114912598","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
NIVAnalyzer: A Tool for Automatically Detecting and Verifying Next-Intent Vulnerabilities in Android Apps NIVAnalyzer:用于自动检测和验证Android应用程序中的下一个意图漏洞的工具
Junjie Tang, Xingmin Cui, Ziming Zhao, Shanqing Guo, Xin-Shun Xu, Chengyu Hu, Tao Ban, Bing Mao
In the Android system design, any app can start another app's public components to facilitate code reuse by sending an asynchronous message called Intent. In addition, Android also allows an app to have private components that should only be visible to the app itself. However, malicious apps can bypass this system protection and directly invoke private components in vulnerable apps through a class of newly discovered vulnerability, which is called next-intent vulnerability. In this paper, we design an intent flow analysis strategy which accurately tracks the intent in smali code to statically detect next-intent vulnerabilities efficiently and effectively on a large scale. We further propose an automated approach to dynamically verify the discovered vulnerabilities by generating exploit apps. Then we implement a tool named NIVAnalyzer and evaluate it on 20,000 apps downloaded from Google Play. As the result, we successfully confirms 190 vulnerable apps, some of which even have millions of downloads. We also confirmed that an open-source project and a third-party SDK, which are still used by other apps, have next intent vulnerabilities.
在Android系统设计中,任何应用都可以通过发送一个名为Intent的异步消息来启动另一个应用的公共组件,从而促进代码重用。此外,Android还允许应用程序拥有私有组件,这些组件应该只对应用程序本身可见。然而,恶意应用可以绕过这种系统保护,通过一类新发现的漏洞直接调用易受攻击应用中的私有组件,这类漏洞被称为下一意图漏洞。在本文中,我们设计了一种意图流分析策略,能够准确地跟踪小代码中的意图,从而在大范围内高效地静态检测下一个意图漏洞。我们进一步提出了一种自动化的方法,通过生成利用应用程序来动态验证发现的漏洞。然后我们实现了一个名为NIVAnalyzer的工具,并在从Google Play下载的2万个应用程序中对其进行了评估。结果,我们成功确认了190个易受攻击的应用程序,其中一些甚至有数百万的下载量。我们还确认了一个开源项目和第三方SDK,它们仍然被其他应用程序使用,有下一个意图漏洞。
{"title":"NIVAnalyzer: A Tool for Automatically Detecting and Verifying Next-Intent Vulnerabilities in Android Apps","authors":"Junjie Tang, Xingmin Cui, Ziming Zhao, Shanqing Guo, Xin-Shun Xu, Chengyu Hu, Tao Ban, Bing Mao","doi":"10.1109/ICST.2017.56","DOIUrl":"https://doi.org/10.1109/ICST.2017.56","url":null,"abstract":"In the Android system design, any app can start another app's public components to facilitate code reuse by sending an asynchronous message called Intent. In addition, Android also allows an app to have private components that should only be visible to the app itself. However, malicious apps can bypass this system protection and directly invoke private components in vulnerable apps through a class of newly discovered vulnerability, which is called next-intent vulnerability. In this paper, we design an intent flow analysis strategy which accurately tracks the intent in smali code to statically detect next-intent vulnerabilities efficiently and effectively on a large scale. We further propose an automated approach to dynamically verify the discovered vulnerabilities by generating exploit apps. Then we implement a tool named NIVAnalyzer and evaluate it on 20,000 apps downloaded from Google Play. As the result, we successfully confirms 190 vulnerable apps, some of which even have millions of downloads. We also confirmed that an open-source project and a third-party SDK, which are still used by other apps, have next intent vulnerabilities.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133772353","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Incremental Deductive Verification for Relational Model Transformations 关系模型转换的增量演绎验证
Zheng Cheng, M. Tisi
In contract-based development of model transformations, continuous deductive verification may help the transformation developer in early bug detection. However, because of the execution performance of current verification systems, re-verifying from scratch after a change has been made would introduce impractical delays. We address this problem by proposing an incremental verification approach for the ATL model-transformation language. Our approach is based on decomposing each OCL contract into sub-goals, and caching the sub-goal verification results. At each change we exploit the semantics of relational model transformation to determine whether a cached verification result may be impacted. Consequently, less postconditions/sub-goals need to be re-verified. When a change forces the re-verification of a postcondition, we use the cached verification results of sub-goals to construct a simplified version of the postcondition to verify. We prove the soundness of our approach and show its effectiveness by mutation analysis. Our case study presents an approximate 50% reuse of verification results for postconditions, and 70% reuse of verification results for sub-goals. The user perceives about 56% reduction of verification time for postconditions, and 51% for sub-goals.
在基于契约的模型转换开发中,连续的演绎验证可以帮助转换开发人员早期发现错误。但是,由于当前核查系统的执行性能,在做出更改后重新进行核查将会带来不切实际的延误。我们通过为ATL模型转换语言提出一种增量验证方法来解决这个问题。我们的方法是基于将每个OCL契约分解为子目标,并缓存子目标验证结果。在每次更改时,我们利用关系模型转换的语义来确定缓存的验证结果是否可能受到影响。因此,需要重新验证的后置条件/子目标更少。当变更迫使对后置条件进行重新验证时,我们使用子目标的缓存验证结果来构造要验证的后置条件的简化版本。通过突变分析,证明了该方法的有效性。我们的案例研究显示后置条件的验证结果重用了大约50%,子目标的验证结果重用了70%。用户认为后置条件的验证时间减少了56%,子目标的验证时间减少了51%。
{"title":"Incremental Deductive Verification for Relational Model Transformations","authors":"Zheng Cheng, M. Tisi","doi":"10.1109/ICST.2017.41","DOIUrl":"https://doi.org/10.1109/ICST.2017.41","url":null,"abstract":"In contract-based development of model transformations, continuous deductive verification may help the transformation developer in early bug detection. However, because of the execution performance of current verification systems, re-verifying from scratch after a change has been made would introduce impractical delays. We address this problem by proposing an incremental verification approach for the ATL model-transformation language. Our approach is based on decomposing each OCL contract into sub-goals, and caching the sub-goal verification results. At each change we exploit the semantics of relational model transformation to determine whether a cached verification result may be impacted. Consequently, less postconditions/sub-goals need to be re-verified. When a change forces the re-verification of a postcondition, we use the cached verification results of sub-goals to construct a simplified version of the postcondition to verify. We prove the soundness of our approach and show its effectiveness by mutation analysis. Our case study presents an approximate 50% reuse of verification results for postconditions, and 70% reuse of verification results for sub-goals. The user perceives about 56% reduction of verification time for postconditions, and 51% for sub-goals.","PeriodicalId":112258,"journal":{"name":"2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133882119","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
期刊
2017 IEEE International Conference on Software Testing, Verification and Validation (ICST)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1