More Like this

1. Bug synthesis: challenging bug-finding tools with deep faults

   https://doi.org/10.1145/3236024.3236084  

   Roy, Subhajit; Pandey, Awanish; Dolan-Gavitt, Brendan; Hu, Yu (November 2017, Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering)

   In spite of decades of research in bug detection tools, there is a surprising dearth of ground-truth corpora that can be used to evaluate the efficacy of such tools. Recently, systems such as LAVA and EvilCoder have been proposed to automatically inject bugs into software to quickly generate large bug corpora, but the bugs created so far differ from naturally occurring bugs in a number of ways. In this work, we propose a new automated bug injection system, Apocalypse, that uses formal techniques—symbolic execution, constraint-based program synthesis and model counting—to automatically inject fair (can potentially be discovered by current bug-detection tools), deep (requiring a long sequence of dependencies to be satisfied to fire), uncorrelated (each bug behaving independent of others), reproducible (a trigger input being available) and rare (can be triggered by only a few program inputs) bugs in large software code bases. In our evaluation, we inject bugs into thirty Coreutils programs as well as the TCAS test suite. We find that bugs synthesized by Apocalypse are highly realistic under a variety of metrics, that they do not favor a particular bug-finding strategy (unlike bugs produced by LAVA), and that they are more difficult to find than manually injected bugs, requiring up around 240× more tests to discover with a state-of-the-art symbolic execution tool. 

   more » « less
2. Automatically Extracting Bug Reproducing Steps from Android Bug Reports

   Yu Zhao, Kye Miller (January 2019, International Conference on Software and Systems Reuse)
3. Automated Duplicate Bug Report Detection in Large Open Bug Repositories

   https://doi.org/10.1109/COMPSAC65507.2025.00065  

   Laney, Clare E; Barovic, Andrew; Moin, Armin (July 2025, IEEE)

   Many users and contributors of large open-source projects report software defects or enhancement requests (known as bug reports) to the issue-tracking systems. However, they sometimes report issues that have already been reported. First, they may not have time to do sufficient research on existing bug reports. Second, they may not possess the right expertise in that specific area to realize that an existing bug report is essentially elaborating on the same matter, perhaps with a different wording. In this paper, we propose a novel approach based on machine learning methods that can automatically detect duplicate bug reports in an open bug repository based on the textual data in the reports. We present six alternative methods: Topic modeling, Gaussian Na¨ıve Bayes, deep learning, time-based organization, clustering, and summarization using a generative pre-trained transformer large language model. Additionally, we introduce a novel threshold-based approach for duplicate identification, in contrast to the conventional top-k selection method that has been widely used in the literature. Our approach demonstrates promising results across all the proposed methods, achieving accuracy rates ranging from the high 70%’s to the low 90%’s. We evaluated our methods on a public dataset of issues belonging to an Eclipse open-source project. 

   more » « less
4. Using bug descriptions to reformulate queries during text-retrieval-based bug localization

   https://doi.org/10.1007/s10664-018-9672-z  

   Chaparro, Oscar; Florez, Juan Manuel; Marcus, Andrian (October 2019, Empirical Software Engineering)
5. Bug Hunters’ Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem

   Akgul, Omer; Eghtesad, Taha; Elazari, Amit; Gnawali, Omprakash; Grossklags, Jens; Mazurek, Michelle L.; Votipka, Daniel; Laszka, Aron (July 2023, 32nd USENIX Security Symposium (USENIX Security 2023))

   Although researchers have characterized the bug-bounty ecosystem from the point of view of platforms and programs, minimal effort has been made to understand the perspectives of the main workers: bug hunters. To improve bug bounties, it is important to understand hunters’ motivating factors, challenges, and overall benefits. We address this research gap with three studies: identifying key factors through a free listing survey (n=56), rating each factor’s importance with a larger-scale factor-rating survey (n=159), and conducting semi-structured interviews to uncover details (n=24). Of 54 factors that bug hunters listed, we find that rewards and learning opportunities are the most important benefits. Further, we find scope to be the top differentiator between programs. Surprisingly, we find earning reputation to be one of the least important motivators for hunters. Of the challenges we identify, communication problems, such as unresponsiveness and disputes, are the most substantial. We present recommendations to make the bug-bounty ecosystem accommodating to more bug hunters and ultimately increase participation in an underutilized market. 

   more » « less