1 research outputs found
Directing a Search Towards Execution Properties with a Learned Fitness Function
Search based software testing is a popular and successful approach both in academia and industry. SBST methods
typically aim to increase coverage whereas searching for executions with specific properties is largely unresearched. Fitness
functions for execution properties often possess search landscapes
that are difficult or intractable. We demonstrate how machine
learning techniques can convert a property that is not searchable,
in this case crashes, into one that is. Through experimentation
on 6000 C programs drawn from the Codeflaws repository, we
demonstrate a strong, program independent correlation between
crashing executions and library function call patterns within
those executions as discovered by a neural net. We then exploit
the correlation to produce a searchable fitness landscape to
modify American Fuzzy Lop, a widely used fuzz testing tool. On
a test set of previously unseen programs drawn from Codeflaws,
a search strategy based on a crash targeting fitness function
outperformed a baseline in 80.1% of cases. The experiments were
then repeated on three real world programs: the VLC media
player, and the libjpeg and mpg321 libraries. The correlation
between library call traces and crashes generalises as indicated
by ROC AUC scores of 0.91, 0.88 and 0.61. The produced search
landscape however is not convenient due to plateaus. This is likely
because these programs do not use standard C libraries as often
as do those in Codeflaws. This limitation can be overcome by
considering a more powerful observation domain and a broader
training corpus in future work. Despite limited generalisability
of the experimental setup, this research opens new possibilities in
the intersection of machine learning, fitness functions, and search
based testing in general