首页 > 最新文献

2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)最新文献

英文 中文
Towards automatic validation of composite heterogeneous systems in edge situations 面向边缘情况下复合异构系统的自动验证
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00051
L. Cerný
Systems implementing safety functions are becoming more complex, which is also related to their communication and perception capabilities in an environment. Such systems, primarily seen in mobility, become more susceptible to failures in complex decision-making situations that are difficult to uncover. This paper presents an idea formed in a PhD topic on validating and verifying the system specified by formal logic models. We aim to do so by using automatically generated test scenarios including edge situations (as generalizations of edge cases) invoked by an environment in a simulation tool.
实现安全功能的系统正变得越来越复杂,这也与它们在环境中的通信和感知能力有关。这类系统主要用于移动出行,在复杂的决策情况下更容易出现故障,而这些情况很难发现。本文介绍了一个博士课题关于形式逻辑模型所指定的系统的验证和验证的思想。我们的目标是通过使用自动生成的测试场景来实现,包括由模拟工具中的环境调用的边缘情况(作为边缘情况的概括)。
{"title":"Towards automatic validation of composite heterogeneous systems in edge situations","authors":"L. Cerný","doi":"10.1109/ISSREW55968.2022.00051","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00051","url":null,"abstract":"Systems implementing safety functions are becoming more complex, which is also related to their communication and perception capabilities in an environment. Such systems, primarily seen in mobility, become more susceptible to failures in complex decision-making situations that are difficult to uncover. This paper presents an idea formed in a PhD topic on validating and verifying the system specified by formal logic models. We aim to do so by using automatically generated test scenarios including edge situations (as generalizations of edge cases) invoked by an environment in a simulation tool.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127923625","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
WoSAR 2022 Workshop Committee: ISSREW 2022 WoSAR 2022研讨会委员会:ISSREW 2022
Pub Date : 2022-10-01 DOI: 10.1109/issrew55968.2022.00013
{"title":"WoSAR 2022 Workshop Committee: ISSREW 2022","authors":"","doi":"10.1109/issrew55968.2022.00013","DOIUrl":"https://doi.org/10.1109/issrew55968.2022.00013","url":null,"abstract":"","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124156686","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
D2MoN: Detecting and Mitigating Real-Time Safety Violations in Autonomous Driving Systems D2MoN:自动驾驶系统中的实时安全违规检测与缓解
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00077
Bohan Zhang, Yafan Huang, Rachael Chen, Guanpeng Li
This paper proposes D2MON, a data-driven real-time safety monitor, to detect and mitigate safety violations of an autonomous vehicle (AV). The key insight is that traffic situations that lead to AV safety violations fall into patterns and can be identified by learning from existing safety violations. Our approach is to use machine learning techniques to model the traffic behaviors that result in safety violations and detect their symptoms in advance before the actual crashes happen. If D2MoN detects surroundings as dangerous, it will take safety actions to mitigate the safety violations so that the AV remains safe in the evolving traffic environment. Our steps are twofold: (1) We use software fuzzing and data augmentation techniques to generate efficient safety violation data for training our ML model. (2) We deploy the model as a plug-and-play module to the AV software, detecting and mitigating safety violations of the AV in runtime. Our evaluation demonstrates our proposed technique is effective in reducing over 99% of safety violations in an industry-level autonomous driving system, Baidu Apollo.
本文提出了一种数据驱动的实时安全监视器D2MON,用于检测和减轻自动驾驶汽车(AV)的安全违规行为。关键的观点是,导致自动驾驶安全违规的交通状况具有一定的模式,可以通过学习现有的安全违规行为来识别。我们的方法是使用机器学习技术来模拟导致安全违规的交通行为,并在实际碰撞发生之前提前检测其症状。如果D2MoN检测到周围环境有危险,它将采取安全措施减轻安全违规行为,使自动驾驶汽车在不断变化的交通环境中保持安全。我们的步骤有两个方面:(1)我们使用软件模糊测试和数据增强技术来生成有效的安全违规数据来训练我们的ML模型。(2)我们将该模型作为即插即用模块部署到自动驾驶软件中,在运行时检测和减轻自动驾驶汽车的安全违规行为。我们的评估表明,我们提出的技术有效地减少了行业级自动驾驶系统百度阿波罗99%以上的安全违规行为。
{"title":"D2MoN: Detecting and Mitigating Real-Time Safety Violations in Autonomous Driving Systems","authors":"Bohan Zhang, Yafan Huang, Rachael Chen, Guanpeng Li","doi":"10.1109/ISSREW55968.2022.00077","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00077","url":null,"abstract":"This paper proposes D2MON, a data-driven real-time safety monitor, to detect and mitigate safety violations of an autonomous vehicle (AV). The key insight is that traffic situations that lead to AV safety violations fall into patterns and can be identified by learning from existing safety violations. Our approach is to use machine learning techniques to model the traffic behaviors that result in safety violations and detect their symptoms in advance before the actual crashes happen. If D2MoN detects surroundings as dangerous, it will take safety actions to mitigate the safety violations so that the AV remains safe in the evolving traffic environment. Our steps are twofold: (1) We use software fuzzing and data augmentation techniques to generate efficient safety violation data for training our ML model. (2) We deploy the model as a plug-and-play module to the AV software, detecting and mitigating safety violations of the AV in runtime. Our evaluation demonstrates our proposed technique is effective in reducing over 99% of safety violations in an industry-level autonomous driving system, Baidu Apollo.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125746889","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A Page-mapping Consistency Protecting Method for Soft Error Damage in Flash-based Storage 基于flash存储的软错误损坏页映射一致性保护方法
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00032
Jung-Hoon Kim, Young-Sik Lee
A soft error in flash-based storage might impair a host system. For instance, if the soft error infiltrates the storage mapping function, the host system could experience severe operation failures, such as data corruption or a drive freeze. To harden the storage against soft errors, we propose a novel page-mapping consistency checker (PCK) method implemented with a lightweight redundancy. Our PCK exploits a small page tracing table written previously and only performs mapping-related functions again with the time redundant. Then, with that redundancy result, the storage detects page mapping corruption and finally recovers it. Consequently, the flash-based storage keeps the page-mapping consistency and improves the host system's reliability.
基于闪存的存储中的软错误可能会损害主机系统。例如,如果软错误渗透到存储映射功能中,主机系统可能会出现严重的操作故障,如数据损坏或驱动器冻结。为了防止软错误,我们提出了一种基于轻量级冗余的页面映射一致性检查器(PCK)方法。我们的PCK利用了之前编写的一个小的页面跟踪表,并且只在时间冗余的情况下再次执行映射相关的功能。然后,通过冗余结果,存储检测页面映射损坏并最终恢复它。因此,使用flash存储可以保持页面映射的一致性,提高主机系统的可靠性。
{"title":"A Page-mapping Consistency Protecting Method for Soft Error Damage in Flash-based Storage","authors":"Jung-Hoon Kim, Young-Sik Lee","doi":"10.1109/ISSREW55968.2022.00032","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00032","url":null,"abstract":"A soft error in flash-based storage might impair a host system. For instance, if the soft error infiltrates the storage mapping function, the host system could experience severe operation failures, such as data corruption or a drive freeze. To harden the storage against soft errors, we propose a novel page-mapping consistency checker (PCK) method implemented with a lightweight redundancy. Our PCK exploits a small page tracing table written previously and only performs mapping-related functions again with the time redundant. Then, with that redundancy result, the storage detects page mapping corruption and finally recovers it. Consequently, the flash-based storage keeps the page-mapping consistency and improves the host system's reliability.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133549009","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Automated Test Case Generation from Input Specification in Natural Language 用自然语言从输入规范中自动生成测试用例
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00076
Tianyu Li, Xiuwen Lu, Hui Xu
This paper studies the problem of automated test case generation for online coding test, i.e., given an input specification in natural language, how can we generate test cases automatically to examine the correctness of the code implemented by the testee? To tackle the problem, this paper proposes an approach that first extracts noun phrases from an input specification; then it removes irrelevant noun phrases and only retains the key phrases related to input construction; by reorganizing these key phrases, it can form an information tree and generate test cases accordingly. We have evaluated our approach with two datasets from LeetCode and ACM and achieved promising results.
本文研究了在线编码测试的自动测试用例生成问题,即,给定自然语言的输入规范,我们如何自动生成测试用例来检查被测试者实现的代码的正确性?为了解决这个问题,本文提出了一种首先从输入规范中提取名词短语的方法;然后删除无关的名词短语,只保留与输入结构相关的关键短语;通过重新组织这些关键短语,它可以形成一个信息树,并相应地生成测试用例。我们用来自LeetCode和ACM的两个数据集评估了我们的方法,并取得了令人鼓舞的结果。
{"title":"Automated Test Case Generation from Input Specification in Natural Language","authors":"Tianyu Li, Xiuwen Lu, Hui Xu","doi":"10.1109/ISSREW55968.2022.00076","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00076","url":null,"abstract":"This paper studies the problem of automated test case generation for online coding test, i.e., given an input specification in natural language, how can we generate test cases automatically to examine the correctness of the code implemented by the testee? To tackle the problem, this paper proposes an approach that first extracts noun phrases from an input specification; then it removes irrelevant noun phrases and only retains the key phrases related to input construction; by reorganizing these key phrases, it can form an information tree and generate test cases accordingly. We have evaluated our approach with two datasets from LeetCode and ACM and achieved promising results.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134038850","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Improving Fuzzing Coverage with Execution Path Length Selection 用执行路径长度选择改进模糊覆盖
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00057
Wenxian Zhang, Kazunori Sakamoto, H. Washizaki, Y. Fukazawa
Coverage-guided fuzzing is one of the most effective types of fuzz testing. Code coverage is an important parameter of performance evaluation of the coverage-guided fuzzing tools since normally higher coverage result means a higher chance of fault detection. To expand the overall code covered, based on previous basic block analysis, we propose a method for selecting the mutants of inputs that are able to execute some specific length of the execution path.
覆盖引导的模糊测试是最有效的模糊测试类型之一。代码覆盖率是覆盖率引导的模糊测试工具性能评估的一个重要参数,因为通常较高的覆盖率结果意味着较高的故障检测机会。为了扩展所涵盖的整体代码,基于前面的基本块分析,我们提出了一种方法,用于选择能够执行某些特定长度的执行路径的输入突变。
{"title":"Improving Fuzzing Coverage with Execution Path Length Selection","authors":"Wenxian Zhang, Kazunori Sakamoto, H. Washizaki, Y. Fukazawa","doi":"10.1109/ISSREW55968.2022.00057","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00057","url":null,"abstract":"Coverage-guided fuzzing is one of the most effective types of fuzz testing. Code coverage is an important parameter of performance evaluation of the coverage-guided fuzzing tools since normally higher coverage result means a higher chance of fault detection. To expand the overall code covered, based on previous basic block analysis, we propose a method for selecting the mutants of inputs that are able to execute some specific length of the execution path.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"54 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131067574","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Classification Analysis of Bearing Contrived Dataset under Different Levels of Contamination 不同污染程度下轴承人工数据集的分类分析
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00097
Shamanth Manjunath, Ethan Wescoat, Vinita Jansari, Matthew Krugh, L. Mears
Bearings are a common failure component found in roto-dynamic equipment. As a bearing fails, tell-tale signs in collected data indicate progressing damage, depending on the operating conditions and bearing failure mode. This paper classifies bearing damage under different damage levels and operating conditions for contamination failure and focuses on differentiating the collected signals between different contamination levels against the baseline data. A contaminate was measured and mixed into the bearing grease before applying it to the rolling elements. An increasing amount of contamination was mixed into the bearing grease to simulate progressing damage and failure mode. Five classifiers are used to diagnose the condition: Random Forest, Multilayer Perceptron, K-Nearest Neighbor, Decision Tree, and Naive Bayes. The algorithms are compared using four different metrics: weighted average, Precision, Recall, and F-Measure. The algorithms are trained to diagnose failures over multiple operating conditions to circumvent possible operation changes in the real world. The algorithms were trained on the training dataset, and the model was deployed on unseen test data to evaluate the performance of the classifiers. Random forest classifier provided the best classification results with an overall accuracy of 96 % for the test data.
轴承是旋转动力设备中常见的故障部件。当轴承失效时,根据运行条件和轴承失效模式,收集数据中的指示标志表明正在进行的损坏。本文对不同损伤程度和污染失效工况下的轴承损伤进行了分类,重点研究了不同污染程度下采集到的信号与基线数据的区别。在将其应用于滚动元件之前,测量了污染物并将其混合到轴承润滑脂中。在轴承润滑脂中掺入越来越多的污染物,以模拟不断发展的损伤和破坏模式。五种分类器用于诊断疾病:随机森林、多层感知器、k近邻、决策树和朴素贝叶斯。算法使用四个不同的指标进行比较:加权平均值,精度,召回率和F-Measure。这些算法经过训练,可以在多种操作条件下诊断故障,以规避现实世界中可能发生的操作变化。算法在训练数据集上进行训练,模型在未见过的测试数据上部署,以评估分类器的性能。随机森林分类器为测试数据提供了最好的分类结果,总体准确率为96%。
{"title":"Classification Analysis of Bearing Contrived Dataset under Different Levels of Contamination","authors":"Shamanth Manjunath, Ethan Wescoat, Vinita Jansari, Matthew Krugh, L. Mears","doi":"10.1109/ISSREW55968.2022.00097","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00097","url":null,"abstract":"Bearings are a common failure component found in roto-dynamic equipment. As a bearing fails, tell-tale signs in collected data indicate progressing damage, depending on the operating conditions and bearing failure mode. This paper classifies bearing damage under different damage levels and operating conditions for contamination failure and focuses on differentiating the collected signals between different contamination levels against the baseline data. A contaminate was measured and mixed into the bearing grease before applying it to the rolling elements. An increasing amount of contamination was mixed into the bearing grease to simulate progressing damage and failure mode. Five classifiers are used to diagnose the condition: Random Forest, Multilayer Perceptron, K-Nearest Neighbor, Decision Tree, and Naive Bayes. The algorithms are compared using four different metrics: weighted average, Precision, Recall, and F-Measure. The algorithms are trained to diagnose failures over multiple operating conditions to circumvent possible operation changes in the real world. The algorithms were trained on the training dataset, and the model was deployed on unseen test data to evaluate the performance of the classifiers. Random forest classifier provided the best classification results with an overall accuracy of 96 % for the test data.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"63 1-2","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120926792","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Crash Injection to Persistent Memory for Recovery Code Validation 为恢复代码验证而向持久内存注入崩溃
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00065
Soichiro Sakamoto, Keita Suzuki, K. Kono
Persistent Memory(PM) has non-volatilability and byte-addressability, and it can be used in many situations due to its high reliability and high performance. However, the persis-tent nature of PM has great impact on “rejuvenation”. Crash consistency bugs, which result in inconsistent data structures inside PM after system crashes, cannot be recovered by restarting the crashed program because the data structures in PM are not initialized with the restarts. Most of existing tools for detecting crash consistency bugs adopt static analysis that can explore a wider range of PM code regions and can detect bugs effectively, but it is hard for these tools to consider all the possible states because of the combinatorial explosion. In addition, PM programs usually have recovery code, which recovers PM data from inconsistent states, hence a crash consistency bug can be recovered to a correct state and it should not be reported as a bug. To simulate the execution of PM programs and detect crash consistency bugs dynamically, we propose PM Crash Injector, the first crash injection tool for PM programs to check the correctness of the recovery code. Like fault injection tools, PM Crash Injector injects system crashes into PM programs to cause crash consistency bugs intentionally. If the recovery code works correctly, inconsistent states in PM will be recovered, but if not, they will be left in PM regions and detected as unexpected behavior the program. PM Crash Injector has found 3 bugs in real-world PM systems and 6 manually inserted bugs in the sample programs of PMDK.
持久性内存(PM)具有非易失性和字节寻址性,由于其高可靠性和高性能,可以在许多情况下使用。然而,PM的持续性对“返老还童”有很大的影响。系统崩溃后导致PM内部数据结构不一致的崩溃一致性错误无法通过重新启动崩溃的程序来恢复,因为PM中的数据结构没有随着重新启动而初始化。现有的大多数检测崩溃一致性错误的工具都采用静态分析,可以探索更大范围的PM代码区域,并且可以有效地检测错误,但是由于组合爆炸,这些工具很难考虑所有可能的状态。此外,PM程序通常具有恢复代码,用于从不一致的状态中恢复PM数据,因此可以将崩溃一致性错误恢复到正确的状态,并且不应将其作为错误报告。为了模拟PM程序的执行并动态检测崩溃一致性错误,我们提出了PM崩溃注入器,这是PM程序的第一个崩溃注入工具,用于检查恢复代码的正确性。与故障注入工具一样,PM崩溃注入器有意将系统崩溃注入到PM程序中,以导致崩溃一致性错误。如果恢复代码工作正确,则将恢复PM中的不一致状态,但如果没有,则将它们留在PM区域中,并将其检测为程序的意外行为。PM Crash Injector在真实的PM系统中发现了3个bug,在PMDK的示例程序中发现了6个手动插入的bug。
{"title":"Crash Injection to Persistent Memory for Recovery Code Validation","authors":"Soichiro Sakamoto, Keita Suzuki, K. Kono","doi":"10.1109/ISSREW55968.2022.00065","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00065","url":null,"abstract":"Persistent Memory(PM) has non-volatilability and byte-addressability, and it can be used in many situations due to its high reliability and high performance. However, the persis-tent nature of PM has great impact on “rejuvenation”. Crash consistency bugs, which result in inconsistent data structures inside PM after system crashes, cannot be recovered by restarting the crashed program because the data structures in PM are not initialized with the restarts. Most of existing tools for detecting crash consistency bugs adopt static analysis that can explore a wider range of PM code regions and can detect bugs effectively, but it is hard for these tools to consider all the possible states because of the combinatorial explosion. In addition, PM programs usually have recovery code, which recovers PM data from inconsistent states, hence a crash consistency bug can be recovered to a correct state and it should not be reported as a bug. To simulate the execution of PM programs and detect crash consistency bugs dynamically, we propose PM Crash Injector, the first crash injection tool for PM programs to check the correctness of the recovery code. Like fault injection tools, PM Crash Injector injects system crashes into PM programs to cause crash consistency bugs intentionally. If the recovery code works correctly, inconsistent states in PM will be recovered, but if not, they will be left in PM regions and detected as unexpected behavior the program. PM Crash Injector has found 3 bugs in real-world PM systems and 6 manually inserted bugs in the sample programs of PMDK.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"88 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120980124","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Safety Assessment: From Black-Box to White-Box 安全评估:从黑盒到白盒
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00083
Iwo Kurzidem, Adam Misik, Philipp Schleiss, S. Burton
Safety assurance for Machine-Learning (ML) based applications such as object detection is a challenging task due to the black-box nature of many ML methods and the associated uncertainties of its output. To increase evidence in the safe behavior of such ML algorithms an explainable and/or interpretable introspective model can help to investigate the black-box prediction quality. For safety assessment this explainable model should be of reduced complexity and humanly comprehensible, so that any decision regarding safety can be traced back to known and comprehensible factors. We present an approach to create an explainable, introspective model (i.e., white-box) for a deep neural network (i.e., black-box) to determine how safety-relevant input features influence the prediction performance, in particular, for confidence and Bounding Box (BBox) regression. For this, Random Forest (RF) models are trained to predict a YOLOv5 object detector output, for specifically selected safety-relevant input features from the open context environment. The RF predicts the YOLOv5 output reliability for three safety related target variables, namely: softmax score, BBox center shift and BBox size shift. The results indicate that the RF prediction for softmax score are only reliable within certain constrains, while the RF prediction for BBox center/size shift are only reliable for small offsets.
基于机器学习(ML)的应用程序(如对象检测)的安全保证是一项具有挑战性的任务,因为许多ML方法的黑箱性质及其输出的相关不确定性。为了增加这种机器学习算法安全行为的证据,一个可解释和/或可解释的内省模型可以帮助研究黑箱预测质量。对于安全评估,这种可解释的模型应该降低复杂性并使人易于理解,以便任何有关安全的决策都可以追溯到已知和可理解的因素。我们提出了一种方法,为深度神经网络(即黑箱)创建一个可解释的、内省的模型(即白盒),以确定与安全相关的输入特征如何影响预测性能,特别是对于置信度和边界盒(BBox)回归。为此,随机森林(RF)模型被训练来预测YOLOv5对象检测器输出,用于从开放上下文环境中特别选择与安全相关的输入特征。RF预测了三个与安全相关的目标变量,即softmax评分、BBox中心移位和BBox大小移位,YOLOv5输出可靠性。结果表明,softmax分数的射频预测仅在一定的约束条件下是可靠的,而BBox中心/尺寸偏移的射频预测仅在小偏移条件下是可靠的。
{"title":"Safety Assessment: From Black-Box to White-Box","authors":"Iwo Kurzidem, Adam Misik, Philipp Schleiss, S. Burton","doi":"10.1109/ISSREW55968.2022.00083","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00083","url":null,"abstract":"Safety assurance for Machine-Learning (ML) based applications such as object detection is a challenging task due to the black-box nature of many ML methods and the associated uncertainties of its output. To increase evidence in the safe behavior of such ML algorithms an explainable and/or interpretable introspective model can help to investigate the black-box prediction quality. For safety assessment this explainable model should be of reduced complexity and humanly comprehensible, so that any decision regarding safety can be traced back to known and comprehensible factors. We present an approach to create an explainable, introspective model (i.e., white-box) for a deep neural network (i.e., black-box) to determine how safety-relevant input features influence the prediction performance, in particular, for confidence and Bounding Box (BBox) regression. For this, Random Forest (RF) models are trained to predict a YOLOv5 object detector output, for specifically selected safety-relevant input features from the open context environment. The RF predicts the YOLOv5 output reliability for three safety related target variables, namely: softmax score, BBox center shift and BBox size shift. The results indicate that the RF prediction for softmax score are only reliable within certain constrains, while the RF prediction for BBox center/size shift are only reliable for small offsets.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"321 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122620015","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Continuous Verification of Open Source Components in a World of Weak Links 薄弱环节世界中开源组件的持续验证
Pub Date : 2022-10-01 DOI: 10.1109/ISSREW55968.2022.00068
T. Hastings, Kristen R. Walcott
We are heading for a perfect storm, making open source software poisoning and next-generation supply chain attacks much easier to execute, which could have major im-plications for organizations. The widespread adoption of open source (99% of today's software utilizes open source), the ease of today's package managers, and the best practice of implementing continuous delivery for software projects provide an unprece-dented opportunity for attack. Once an adversary compromises a project, they can deploy malicious code into production under the auspicious of a software patch. Downstream projects will ingest the compromised patch, and now those projects are potentially running the malicious code. The impact could be implementing backdoors, gathering intelligence, delivering malware, or denying a service. According to Sonatype, a leading commercial software security company, these next-generation supply chain attacks have increased 430 % in the last year and there is not a good way to vet or monitor an open-source project prior to incorporating the project. In this paper, we analyzed two case studies of compromised open source components. We propose six continuous verification controls that enable organizations to make data-driven decisions and mitigate breaches, such as analyzing community metrics and project hygiene using scorecards and monitoring the boundary of the software in production. In one case study, the controls identified high levels of risk immediately even though the package is widely used and has over 7 million downloads a week. In both case studies we found that the controls could have prevented malicious actions despite the project breaches.
我们正在走向一场完美的风暴,使开源软件中毒和下一代供应链攻击更容易执行,这可能对组织产生重大影响。开放源码的广泛采用(今天99%的软件都利用开放源码),今天的包管理器的易用性,以及为软件项目实现持续交付的最佳实践为攻击提供了前所未有的机会。一旦攻击者破坏了项目,他们就可以在软件补丁的掩护下将恶意代码部署到生产环境中。下游项目将摄取受损的补丁,现在这些项目可能正在运行恶意代码。其影响可能是实施后门、收集情报、传递恶意软件或拒绝服务。根据Sonatype(一家领先的商业软件安全公司)的说法,这些下一代供应链攻击在去年增加了430%,并且在合并项目之前没有一个好的方法来审查或监控一个开源项目。在本文中,我们分析了两个受损的开源组件的案例研究。我们提出了六种连续的验证控制,使组织能够做出数据驱动的决策并减轻破坏,例如使用记分卡分析社区度量标准和项目卫生,并监视生产中的软件边界。在一个案例研究中,尽管该软件包被广泛使用,每周下载量超过700万次,但控制人员还是立即识别出了高风险。在这两个案例研究中,我们发现控制可以阻止恶意行为,尽管项目破坏。
{"title":"Continuous Verification of Open Source Components in a World of Weak Links","authors":"T. Hastings, Kristen R. Walcott","doi":"10.1109/ISSREW55968.2022.00068","DOIUrl":"https://doi.org/10.1109/ISSREW55968.2022.00068","url":null,"abstract":"We are heading for a perfect storm, making open source software poisoning and next-generation supply chain attacks much easier to execute, which could have major im-plications for organizations. The widespread adoption of open source (99% of today's software utilizes open source), the ease of today's package managers, and the best practice of implementing continuous delivery for software projects provide an unprece-dented opportunity for attack. Once an adversary compromises a project, they can deploy malicious code into production under the auspicious of a software patch. Downstream projects will ingest the compromised patch, and now those projects are potentially running the malicious code. The impact could be implementing backdoors, gathering intelligence, delivering malware, or denying a service. According to Sonatype, a leading commercial software security company, these next-generation supply chain attacks have increased 430 % in the last year and there is not a good way to vet or monitor an open-source project prior to incorporating the project. In this paper, we analyzed two case studies of compromised open source components. We propose six continuous verification controls that enable organizations to make data-driven decisions and mitigate breaches, such as analyzing community metrics and project hygiene using scorecards and monitoring the boundary of the software in production. In one case study, the controls identified high levels of risk immediately even though the package is widely used and has over 7 million downloads a week. In both case studies we found that the controls could have prevented malicious actions despite the project breaches.","PeriodicalId":178302,"journal":{"name":"2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"297 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128608247","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
期刊
2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1