Specify and measure, cover and reveal: A unified framework for automated test generation

Bardin, Sébastien; Kosmatov, Nikolaï; Marcozzi, Michaël; Delahaye, Mickaël

doi:10.1016/j.scico.2021.102641

Cited by 6 publications

(3 citation statements)

References 68 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most of these approaches face the problem of state space explosion when aiming to test systems with a marking graph containing thousands of states. From the work of Chusho [12], which introduces the notion of the essential branch, to that of Bardin et al [6], which defines a unified framework to identify essential test objectives, several works and theories have emerged to address this problem. They rely on graph theory, dynamic symbolic execution, weakest calculus, model-checking, proof, constraint-based techniques, and value analysis.…”

Section: Related Workmentioning

confidence: 99%

Symbolic Observation Graph-Based Generation of Test Paths

Klaï

Bennani

Arias

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The paper introduces a theoretical foundation for generating abstract test paths related to Petri net specifications. Based on the structure of the Petri net model of the system, we first define the notion of unobservable transition. Unless such a transition is unreachable, we prove that its firing is necessarily ensured by the firing of another transition (namely observable transition) of the Petri net. We show that the set of observable transitions is the smallest set that guarantees the coverage of all the transitions of the Petri net model, i.e., any set of firing sequences of the model, namely observable traces, involving all the observable transitions passes eventually through the unobservable transitions as well. If some unobservable transitions are mandatory to trigger the execution of a test sub-sequence, observable traces are completed with such transitions to enhance the controllability of the test scenario. In addition to structurally identifying observable (and unobservable) transitions, we mainly propose two algorithms: the first allows to generate a set of observable paths ensuring full coverage of all the system transitions. It is based on an on-the-fly construction of a hybrid graph called the symbolic observation graph. The second algorithm completes the observable paths in order to explicitly cover the whole set of system's transitions. The approach is implemented within an available prototype, and the preliminary experiments are promising.

show abstract

Section: Related Workmentioning

confidence: 99%

Symbolic Observation Graph-Based Generation of Test Paths

Klaï

Bennani

Arias

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Bardin et al [10] [20] [21] have proposed a generic mechanism for specifying the test objectives from many coverage criteria explicitly within the PUT code. This mechanism relies on labels, i.e., predicates attached to program locations.…”

Section: Making Test Objectives Explicit With Labelsmentioning

confidence: 99%

“…without changing their internals), by relying on a dedicated transformation of the code of the PUT (Sections II and IV). We take advantage of the fact that the coverage objectives defined by most fine-grained coverage metrics (like conditions to activate or mutants to kill) can be made explicit in the code of the PUT in a generic way and without modifying its semantics [10]. More precisely, given a PUT and a finegrained coverage metric, we instrument the code of the PUT with new branches corresponding to the objectives from the metric.…”

Section: Introductionmentioning

confidence: 99%

Fine-Grained Coverage-Based Fuzzing

Nongpoh¹,

Bardin²,

Nour³

et al. 2022

Proceedings FUZZING 2022 - 1st International Fuzzing Workshop

View full text Add to dashboard Cite

Fuzzing is an effective software testing method that discovers bugs by feeding target applications with (usually a massive amount of) automatically generated inputs. Many stateof-art fuzzers use branch coverage as a feedback metric to guide the fuzzing process. The fuzzer retains inputs for further mutation only if branch coverage is increased. However, branch coverage only provides a shallow sampling of program behaviours and hence may discard inputs that might be interesting to mutate. This work aims at taking advantage of the large body of research over defining finer-grained code coverage metrics (such as mutation coverage) and use these metrics as better proxies to select interesting inputs for mutation. We propose to make coveragebased fuzzers support most fine-grained coverage metrics out of the box (i.e., without changing fuzzer internals). We achieve this by making the test objectives defined by these metrics (such as mutants to kill) explicit as new branches in the target program. Fuzzing such a modified target is then equivalent to fuzzing the original target, but the fuzzer will also retain inputs covering the additional metrics objectives for mutation. We propose a preliminary evaluation of this novel idea using two state-of-art fuzzers, namely AFL++(3.14c) and QSYM with AFL(2.52b), on the four standard LAVA-M benchmarks. Significantly positive results are obtained on one benchmark and marginally negative ones on the three others. We discuss directions towards a strong and complete evaluation of the proposed approach and call for early feedback from the fuzzing community.

show abstract