Finding a boundary between valid and invalid regions of the input space

In the context of robustness testing, the boundary between the valid and invalid regions of the input space can be an interesting source of erroneous inputs. Knowing where a specific software under test (SUT) has a boundary is essential for validation in relation to requirements. However, finding where a SUT actually implements the boundary is a non-trivial problem that has not gotten much attention. This paper proposes a method of finding the boundary between the valid and invalid regions of the input space. The proposed method consists of two steps. First, test data generators, directed by a search algorithm to maximise distance to known, valid test cases, generate valid test cases that are closer to the boundary. Second, these valid test cases undergo mutations to try to push them over the boundary and into the invalid part of the input space. This results in a pair of test sets, one consisting of test cases on the valid side of the boundary and a matched set on the outer side, with only a small distance between the two sets. The method is evaluated on a number of examples from the standard library of a modern programming language. We propose a method of determining the boundary between valid and invalid regions of the input space and apply it on a SUT that has a non-contiguous valid region of the input space. From the small distance between the developed pairs of test sets, and the fact that one test set contains valid test cases and the other invalid test cases, we conclude that the pair of test sets described the boundary between the valid and invalid regions of that input space. Differences of behaviour can be observed between different distances and sets of mutation operators, but all show that the method is able to identify the boundary between the valid and invalid regions of the input space. This is an important step towards more automated robustness testing.Comment: 10 pages, conferenc

Towards Symbolic Model-Based Mutation Testing: Combining Reachability and Refinement Checking

Model-based mutation testing uses altered test models to derive test cases that are able to reveal whether a modelled fault has been implemented. This requires conformance checking between the original and the mutated model. This paper presents an approach for symbolic conformance checking of action systems, which are well-suited to specify reactive systems. We also consider nondeterminism in our models. Hence, we do not check for equivalence, but for refinement. We encode the transition relation as well as the conformance relation as a constraint satisfaction problem and use a constraint solver in our reachability and refinement checking algorithms. Explicit conformance checking techniques often face state space explosion. First experimental evaluations show that our approach has potential to outperform explicit conformance checkers.Comment: In Proceedings MBT 2012, arXiv:1202.582

Stochastic tunneling and metastable states during the somatic evolution of cancer

Tumors initiate when a population of proliferating cells accumulates a certain number and type of genetic and/or epigenetic alterations. The population dynamics of such sequential acquisition of (epi)genetic alterations has been the topic of much investigation. The phenomenon of stochastic tunneling, where an intermediate mutant in a sequence does not reach fixation in a population before generating a double mutant, has been studied using a variety of computational and mathematical methods. However, the field still lacks a comprehensive analytical description since theoretical predictions of fixation times are only available for cases in which the second mutant is advantageous. Here, we study stochastic tunneling in a Moran model. Analyzing the deterministic dynamics of large populations we systematically identify the parameter regimes captured by existing approaches. Our analysis also reveals fitness landscapes and mutation rates for which finite populations are found in long-lived metastable states. These are landscapes in which the final mutant is not the most advantageous in the sequence, and resulting metastable states are a consequence of a mutation-selection balance. The escape from these states is driven by intrinsic noise, and their location affects the probability of tunneling. Existing methods no longer apply. In these regimes it is the escape from the metastable states that is the key bottleneck; fixation is no longer limited by the emergence of a successful mutant lineage. We used the so-called Wentzel-Kramers-Brillouin method to compute fixation times in these parameter regimes, successfully validated by stochastic simulations. Our work fills a gap left by previous approaches and provides a more comprehensive description of the acquisition of multiple mutations in populations of somatic cells.Comment: 33 pages, 7 figure

Towards Smart Hybrid Fuzzing for Smart Contracts

Smart contracts are Turing-complete programs that are executed across a blockchain network. Unlike traditional programs, once deployed they cannot be modified. As smart contracts become more popular and carry more value, they become more of an interesting target for attackers. In recent years, smart contracts suffered major exploits, costing millions of dollars, due to programming errors. As a result, a variety of tools for detecting bugs has been proposed. However, majority of these tools often yield many false positives due to over-approximation or poor code coverage due to complex path constraints. Fuzzing or fuzz testing is a popular and effective software testing technique. However, traditional fuzzers tend to be more effective towards finding shallow bugs and less effective in finding bugs that lie deeper in the execution. In this work, we present CONFUZZIUS, a hybrid fuzzer that combines evolutionary fuzzing with constraint solving in order to execute more code and find more bugs in smart contracts. Evolutionary fuzzing is used to exercise shallow parts of a smart contract, while constraint solving is used to generate inputs which satisfy complex conditions that prevent the evolutionary fuzzing from exploring deeper paths. Moreover, we use data dependency analysis to efficiently generate sequences of transactions, that create specific contract states in which bugs may be hidden. We evaluate the effectiveness of our fuzzing strategy, by comparing CONFUZZIUS with state-of-the-art symbolic execution tools and fuzzers. Our evaluation shows that our hybrid fuzzing approach produces significantly better results than state-of-the-art symbolic execution tools and fuzzers

Rare germline variants in DNA repair genes and the angiogenesis pathway predispose prostate cancer patients to develop metastatic disease

Background Prostate cancer (PrCa) demonstrates a heterogeneous clinical presentation ranging from largely indolent to lethal. We sought to identify a signature of rare inherited variants that distinguishes between these two extreme phenotypes. Methods We sequenced germline whole exomes from 139 aggressive (metastatic, age of diagnosis < 60) and 141 non-aggressive (low clinical grade, age of diagnosis ≥60) PrCa cases. We conducted rare variant association analyses at gene and gene set levels using SKAT and Bayesian risk index techniques. GO term enrichment analysis was performed for genes with the highest differential burden of rare disruptive variants. Results Protein truncating variants (PTVs) in specific DNA repair genes were significantly overrepresented among patients with the aggressive phenotype, with BRCA2, ATM and NBN the most frequently mutated genes. Differential burden of rare variants was identified between metastatic and non-aggressive cases for several genes implicated in angiogenesis, conferring both deleterious and protective effects. Conclusions Inherited PTVs in several DNA repair genes distinguish aggressive from non-aggressive PrCa cases. Furthermore, inherited variants in genes with roles in angiogenesis may be potential predictors for risk of metastases. If validated in a larger dataset, these findings have potential for future clinical application

Challenging the evolutionary strategy for synthesis of analogue computational circuits

There are very few reports in the past on applications of Evolutionary Strategy (ES) towards the synthesis of analogue circuits. Moreover, even fewer reports are on the synthesis of computational circuits. Last fact is mainly due to the dif-ficulty in designing of the complex nonlinear functions that these circuits perform. In this paper, the evolving power of the ES is challenged to design four computational circuits: cube root, cubing, square root and squaring functions. The synthesis succeeded due to the usage of oscillating length genotype strategy and the substructure reuse. The approach is characterized by its simplicity and represents one of the first attempts of application of ES towards the synthesis of “QR” circuits. The obtained experimental results significantly exceed the results published before in terms of the circuit quality, economy in components and computing resources utilized, revealing the great potential of the technique pro-posed to design large scale analog circuits