Statically-directed dynamic automated test generation

2011 International Symposium on Software Testing and Analysis, ISSTA 2011 - Proceedings

Volumn , Issue , 2011, Pages 12-22

  Babić, Domagoj ^a   Martignoni, Lorenzo ^a   McCamant, Stephen ^a   Song, Dawn ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

automated testing; dynamic analysis; prioritization; static analysis

Indexed keywords

AUTOMATED TEST GENERATIONS; AUTOMATED TESTING; BINARY PROGRAMS; CONTROL-FLOW; PRIORITIZATION; PUSH-DOWN AUTOMATA; REAL APPLICATIONS; SHORTEST-PATH; TARGET POTENTIAL; TEST INPUTS; THREE-STAGE PROCESS; TRUE POSITIVE;

AUTOMATA THEORY; AUTOMATION; BENCHMARKING; COMPUTER SOFTWARE SELECTION AND EVALUATION; DYNAMIC ANALYSIS; STATIC ANALYSIS; TESTING;

SOFTWARE TESTING;

EID: 80051934403     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2001420.2001423     Document Type: Conference Paper

References (49)

1. R. Alur and P. Madhusudan. Adding nesting structure to words. Journal of the ACM, 56(3), May 2009. Article 16.
2. G. Balakrishnan and T. Reps. Analyzing memory accesses in x86 executables. In Proc. of the Int. Conf. on Compiler Construction, LNCS, pages 5-23. Springer, 2004.
3. G. Balakrishnan and T. Reps. WYSINWYX:What you see is not what you eXecute. ACM Trans. Program. Lang. Syst., 32(6), August 2010. Article 23.
4. G. Balakrishnan and T. W. Reps. Recency-abstraction for heap-allocated storage. In Proc. of the Int. Symp. on Static Analysis, volume 4134 of LNCS, pages 221-239. Springer, 2006.
5. T. Ball, R. Majumdar, T. Millstein, and S. K. Rajamani. Automatic predicate abstraction of C programs. In Proc. of the Conf. on Programming Language Design and Implementation, pages 203-213. ACM Press, 2001.
6. D. L. Bird and C. U. Munoz. Automatic generation of random self-checking test cases. IBM System Journal, 22:229-245, 1983.
7. D. Brumley, C. Hartwig, Z. Liang, J. Newsome, D. Song, and H. Yin. Automatically identifying trigger-based behavior in malware. In Botnet Detection, volume 36 of Advances in Information Security, pages 65-88. Springer, 2008.
8. J. Burnim and K. Sen. Heuristics for scalable dynamic test generation. In Proc. of the Int. Conf. on Automated Software Engineering, pages 443-446. IEEE Comp. Soc., 2008.
9. C. Cadar, D. Dunbar, and D. Engler. KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs. In Proc. of the Conf. on Operating Systems Design and Implementation, pages 209-224. USENIX Association, 2008.
10. C. Cadar, V. Ganesh, P. M. Pawlowski, D. L. Dill, and D. R. Engler. EXE: automatically generating inputs of death. In Proc. of the Conf. on Computer and Communications Security, pages 322-335. ACM, 2006.
11. D. R. Chase, M. Wegman, and F. K. Zadeck. Analysis of pointers and structures. In Proc. of the Conf. on Programming Language Design and Implementation, pages 296-310. ACM, 1990.
12. E. M. Clarke, O. Grumberg, and D. A. Peled. Model checking. MIT Press, Cambridge, MA, USA, 1999.
13. S. A. Cook. The complexity of theorem-proving procedures. In Proc. of the Symp. on Theory of Computing, pages 151-158. ACM Press, 1971.
14. P. Cousot and R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Proc. of the Symp. on Principles of Programming Languages, pages 238-252. ACM, 1977.
15. C. Csallner and Y. Smaragdakis. DSD-Crasher: a hybrid analysis tool for bug finding. In Proc. of the Int. Symp. on Software Testing and Analysis, pages 245-254. ACM, 2006.
16. L. de Moura and N. Bjørner. Z3: An efficient SMT solver. In Proc. of the Int. Conf. on Tools and Algorithms for the Construction and Analysis of Systems, volume 4963 of LNCS, pages 337-340. Springer, 2008.
17. E. W. Dijkstra. A note on two problems in connexion with graphs. Numerische Mathematik, 1:269-271, 1959.
18. S. Edelkamp, S. Leue, and A. Lluch-Lafuente. Directed explicit-state model checking in the validation of communication protocols. Int. J. Softw. Tools Technol. Transf., 5(2):247-267, 2004.
19. S. Eker. Associative-commutative rewriting on large terms. In Proc. of the Int. Conf. on Rewriting Techniques and Applications, pages 14-29. Springer-Verlag, 2003.
20. P. Godefroid and S. Khurshid. Exploring very large state spaces using genetic algorithms. Int. J. Softw. Tools Technol. Transf., 6(2):117-127, 2004.
21. P. Godefroid, N. Klarlund, and K. Sen. DART: directed automated random testing. In Proc. of the Conf. on Programming Language Design and Implementation, pages 213-223. ACM, 2005.
22. A. Groce and W. Visser. Heuristic model checking for Java programs. In Proc. of the Int. SPIN Workshop on Model Checking of Software, pages 242-245. Springer-Verlag, 2002.
23. B. S. Gulavani, T. A. Henzinger, Y. Kannan, A. V. Nori, and S. K. Rajamani. SYNERGY: a new algorithm for property checking. In Proc. of the Int. Symp. on Foundations of Software Engineering, pages 117-127. ACM, 2006.
24. Hex-Rays. IDAPro disassembler, 2010.
25. G. J. Holzmann. Design and Validation of Computer Protocols. Prentice-Hall, Inc., 1991.
26. ISO. ISO C standard 1999. Technical report, ISO, 1999.
27. J. Kinder, F. Zuleger, and H. Veith. An abstract interpretation-based framework for control flow reconstruction from binaries. In Proc. of the Int. Conf. on Verification, Model Checking, and Abstract Interpretation, volume 5403 of LNCS, pages 214-228. Springer, 2009.
28. J. C. King. Symbolic execution and program testing. Communications of the ACM, 19(7):385-394, 1976.
29. A. Lal, J. Lim, M. Polishchuk, and B. Liblit. Path optimization in programs and its application to debugging. In Proc. of the Eur. Symp. on Programming Languages and Systems, pages 246-263. Springer, 2006.
30. J. R. Larus and P. N. Hilfinger. Detecting conflicts between structure accesses. In Proc. of the Conf. on Programming Language Design and Implementation, pages 24-31. ACM, 1988.
31. C. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser, G. Lowney, S. Wallace, V. J. Reddi, and K. Hazelwood. PIN: Building customized program analysis tools with dynamic instrumentation. In Proc. of the Conf. on Programming Language Design and Implementation, pages 190-200. ACM, 2005.
32. J. P. Marques-Silva and K. A. Sakallah. GRASP: A search algorithm for propositional satisfiability. IEEE Transactions on Computers, 48(5):506-521, 1999.
33. M. Müller-Olm and H. Seidl. Analysis of modular arithmetic. ACM Trans. Program. Lang. Syst., 29(5), 2007.
34. F. Nielson, H. R. Nielson, and C. Hankin. Principles of Program Analysis. Springer, 2005.
35. C. Okasaki. Red-black trees in a functional setting. Journal of Functional Programming, 9(4):471-477, July 1999.
36. G. Ramalingam, J. Field, and F. Tip. Aggregate structure identification and its application to program analysis. In Proc. of the Symp. on Principles of Programming Languages, pages 119-132. ACM, 1999.
37. T. Reps, G. Balakrishnan, and J. Lim. Intermediate-representation recovery from low-level code. In Proc. of the Symp. on Partial Evaluation and Semantics-based Program Manipulation, pages 100-111. ACM, 2006.
38. T. Reps, S. Horwitz, and M. Sagiv. Precise interprocedural dataflow analysis via graph reachability. In Proc. of the Symp. on Principles of Programming Languages, pages 49-61. ACM, 1995.
39. T. Reps, S. Schwoon, S. Jha, and D. Melski. Weighted pushdown systems and their application to interprocedural dataflow analysis. Sci. Comput. Program., 58:206-263, 2005. (Pubitemid 41261382)
40. A. Rybalchenko and R. Singh. Subsumer-first: Steering symbolic reachability analysis. In Proc. of the Int. SPIN Workshop on Model Checking Software, pages 192-204. Springer-Verlag, 2009.
41. P. Saxena, P. Poosankam, S. McCamant, and D. Song. Loop-extended symbolic execution on binary programs. In Proc. of the Int. Symp. on Software Testing and Analysis, pages 225-236. ACM, 2009.
42. B. Schwarz, S. Debray, and G. Andrews. Disassembly of executable code revisited. In Proc. of the Working Conference on Reverse Engineering, pages 45-55. IEEE Comp. Soc., 2002.
43. M. Sharir and A. Pnueli. Two approaches to interprocedural data flow analysis. In Program Flow Analysis: Theory and Applications, chapter 7, pages 189-234. Prentice-Hall, 1981.
44. D. Song, D. Brumley, H. Yin, J. Caballero, I. Jager, M. G. Kang, Z. Liang, J. Newsome, P. Poosankam, and P. Saxena. BitBlaze: A new approach to computer security via binary analysis. In Proc. of the Int. Conf. on Information Systems Security, volume 5352 of LNCS, pages 1-25. Springer, 2008.
45. F. Tip. A survey of program slicing techniques. Technical report, CWI (Centre for Mathematics and Computer Science), Amsterdam, The Netherlands, 1994.
46. H. S. Warren. Hacker's Delight. Addison-Wesley, 2002.
47. M. Weiser. Program slicing. In Proc. of the Int. Conf. on Software Engineering, pages 439-449. IEEE Press, 1981.
48. C. H. Yang and D. L. Dill. Validation with guided search of the state space. In Proc. of the Annual Design Automation Conference, pages 599-604. ACM, 1998.
49. M. Zitser, R. Lippmann, and T. Leek. Testing static analysis tools using exploitable buffer overflows from open source code. In Proc. of the Int. Symp. on Foundations of Software Engineering, pages 97-106. ACM, 2004.