Grammar-based whitebox fuzzing

ACM SIGPLAN Notices

Volumn 43, Issue 6, 2008, Pages 206-215

  Godefroid, Patrice ^a   Kiezun, Adam ^b   Levin, Michael Y ^c  

^a MICROSOFT RESEARCH   (United States)

^b MASSACHUSETTS INSTITUTE OF TECHNOLOGY   (United States)

^c MICROSOFT   (United States)

Author keywords

Automatic Test Generation; Grammars; Program Verification; Software Testing

Indexed keywords

AUTOMATIC PROGRAMMING; HIGH LEVEL LANGUAGES; LOGIC PROGRAMMING; MODEL CHECKING;

AUTOMATIC TEST GENERATION; BASED SPECIFICATION; CODE GENERATION MODULES; CONSTRAINT SOLVING; GRAMMARS; INPUT APPLICATIONS; PROGRAM VERIFICATION; SECURITY CRITICAL APPLICATIONS;

SOFTWARE TESTING;

EID: 67650067282     PISSN: 15232867     EISSN: None     Source Type: Journal    
DOI: 10.1145/1379022.1375607     Document Type: Article

References (39)

1. D. Aitel. The Advantages of Block-Based Protocol Analysis for Security Testing. Immunity Inc., February, 2002.
2. S. Artzi, A. Kieżun, J. Dolby, F. Tip, D. Dig, A. Paradkar, and M. D. Ernst. Finding bugs in dynamic Web applications. Technical Report MIT-CSAIL-TR-2008-006, MIT Computer Science and Artificial Intelligence Laboratory, Cambridge, MA, Feb. 2008.
3. D. Bird and C. Munoz. Automatic Generation of Random Self-Checking Test Cases. IBM Systems Journal, 22(3):229-245, 1983.
4. N. Borisov, D. Brumley, H. Wang, J. Dunagan, P. Joshi, and C. Guo. Generic application-level protocol analyzer and its language. In NDSS, 2007.
5. C. Boyapati, S. Khurshid, and D. Marinov. Korat: automated testing based on Java predicates. In ISSTA, 2002.
6. C. Cadar, V. Ganesh, P. Pawlowski, D. Dill, and D. Engler. EXE: automatically generating inputs of death. In CCS, 2006.
7. K. Claessen and J. Hughes. QuickCheck: A lightweight tool for random testing of Haskell programs. In ICFP, 2000.
8. D. Coppit and J. Lian. yagg: an easy-to-use generator for structured test inputs. In ASE, 2005.
9. W Cui, J. Kannan, and H. J. Wang. Discoverer: Automatic protocol reverse engineering from network traces. In USENIX Security Symposium, 2007.
10. B. Daniel, D. Dig, K. Garcia, and D. Marinov. Automated testing of refactoring engines. In FSE, 2007.
11. M. Emmi, R. Majumdar, and K. Sen. Dynamic test input generation for database applications. In ISSTA, 2007.
12. J. E. Forrester and B. P. Miller. An Empirical Study of the Robustness of Windows NT Applications Using Random Testing. In Proceedings of the 4th USENIX Windows System Symposium, Seattle, August 2000.
13. P. Godefroid. Compositional Dynamic Test Generation. In POPL, 2007.
14. P. Godefroid, N. Klarlund, and K. Sen. DART: Directed automated random testing. In PLDI, 2005.
15. P. Godefroid, M. Levin, and D. Molnar. Active property checking. Technical Report MSR-TR-2007-91, Microsoft, 2007.
16. P. Godefroid, M. Levin, and D. Molnar. Automated whitebox fuzz testing. In NDSS, 2008.
17. K. Hanford. Automatic Generation of Test Cases. IBM Systems Journal, 9(4), 1970.
18. J. Hopcroft and J. Ullman. Introduction to automata theory, languages and computation. Addison-Wesley Series in Computer Science, 1979.
19. S. Khurshid and D. Marinov. TestEra: Specification-Based Testing of Java Programs Using SAT. In ASE, 2004.
20. J. King. Symbolic execution and program testing. Communications of the ACM, 19(7):385-394, 1976.
21. R. Lämmel and W Schulte. Controllable combinatorial coverage in grammar-based testing. In TestCom, 2006.
22. R. Majumdar and K. Sen. LATEST: Lazy dynamic test input generation. Technical Report UCB/EECS-2007-36, EECS Department, University of California, Berkeley, 2007.
23. R. Majumdar and R.-G. Xu. Directed test generation using symbolic grammars. In ASE, 2007.
24. B. Malloy and J. Power. An interpretation of Purdom's algorithm for automatic generation of test cases. In ICIS, 2001.
25. P. Maurer. Generating test data with enhanced context-free grammars. IEEE Software, 7(4), 1990.
26. B. McKenzie. Generating strings at random from a context free grammar. Technical Report TR-COSC 10/97, Department of Computer Science, University of Canterbury, 1997.
27. D. Melski and T. Reps. Interconvertbility of set constraints and context-free language reachability. In PEPM, 1997.
28. B. P. Miller, L. Fredriksen, and B. So. An empirical study of the reliability of UNIX utilities. Communications of the ACM, 33(12), 1990.
29. R. C. Moore. Removing left recursion from context-free grammars. In Proceedings of the first conference on North American chapter of the Association for Computational Linguistics, 2000.
30. C. Pacheco, S. K. Lahiri, M. D. Ernst, and T. Ball. Feedback-directed random test generation. In ICSE, 2007.
31. R. Pang, V. Paxson, R. Sommer, and L. Peterson. binpac: a yacc for writing application protocol parsers. In IMC, 2006.
32. P. Purdom. A sentence generator for testing parsers. BIT Numerical Mathematics, 12(3), 1972.
33. D. J. Salomon and G. V. Cormack. Scannerless NSLR(1) parsing of programming languages. In PLDI, 1989.
34. K. Sen, D. Marinov, and G. Agha. CUTE: a concolic unit testing engine for C. In FSE, 2005.
35. E. Sirer and B. Bershad. Using production grammars in software testing. In DSL, 1999.
36. K. Sullivan, J. Yang, D. Coppit, S. Khurshid, and D. Jackson. Software assurance by bounded exhaustive testing. In ISSTA, 2004.
37. M. Sutton, A. Greene, and P. Amini. Fuzzing: Brute Force Vulnerability Discovery. Addison-Wesley, 2007.
38. M. Utting, A. Pretschner, and B. Legeard. A Taxonomy of Model-Based Testing. Department of Computer Science, The University of Waikato, New Zealand, Tech. Rep, 4, 2006.
39. G. Wassermann and Z. Su. Sound and precise analysis of Web applications for injection vulnerabilities. In PLDI, 2007.