More Like this

1. Same Coverage, Less Bloat: Accelerating Binary-only Fuzzing with Coverage-preserving Coverage-guided Tracing

   https://doi.org/10.1145/3460120.3484787  

   Nagy, Stefan; Nguyen-Tuong, Anh; Hiser, Jason D.; Davidson, Jack W.; Hicks, Matthew (November 2021, Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security)

   Coverage-guided fuzzing's aggressive, high-volume testing has helped reveal tens of thousands of software security flaws. While executing billions of test cases mandates fast code coverage tracing, the nature of binary-only targets leads to reduced tracing performance. A recent advancement in binary fuzzing performance is Coverage-guided Tracing (CGT), which brings orders-of-magnitude gains in throughput by restricting the expense of coverage tracing to only when new coverage is guaranteed. Unfortunately, CGT suits only a basic block coverage granularity---yet most fuzzers require finer-grain coverage metrics: edge coverage and hit counts. It is this limitation which prohibits nearly all of today's state-of-the-art fuzzers from attaining the performance benefits of CGT.This paper tackles the challenges of adapting CGT to fuzzing's most ubiquitous coverage metrics. We introduce and implement a suite of enhancements that expand CGT's introspection to fuzzing's most common code coverage metrics, while maintaining its orders-of-magnitude speedup over conventional always-on coverage tracing. We evaluate their trade-offs with respect to fuzzing performance and effectiveness across 12 diverse real-world binaries (8 open- and 4 closed-source). On average, our coverage-preserving CGT attains near-identical speed to the present block-coverage-only CGT, UnTracer; and outperforms leading binary- and source-level coverage tracers QEMU, Dyninst, RetroWrite, and AFL-Clang by 2--24x, finding more bugs in less time. 

   more » « less
2. Mutation Coverage is not Strongly Correlated with Mutation Coverage

   https://doi.org/10.1145/3644032.3644442  

   Alblwi, Samia; Ayad, Amani; Mili, Ali (April 2024, ACM)

   Several metrics have been proposed in the past to quantify the effectiveness of a test suite; they are usually based on some measure of coverage because it is sensible to quantify the effectiveness of a test suite by the extent to which it exercises (covers) various syntactic features of the program under test. Though no coverage metric has emerged as the gold standard of test suite effectiveness, mutation coverage is widely perceived as a reliable measure of test suite effectiveness because the ability of a test suite to detect program mutations can be used as an indication of its ability to detect actual faults. In this paper we aim to challenge the superiority of mutation coverage, by showing that the same test suite may have vastly different values of mutation coverage depending on the mutation operators that are used in the estimation. 

   more » « less
3. Optimal coverage control of stationary and moving agents under effective coverage constraints

   https://doi.org/10.1016/j.automatica.2023.111236  

   Sun, Xinmiao; Ren, Mingli; Ding, Da_Wei; Cassandras, Christos G. (November 2023, Automatica)
4. Semantic Coverage: Measuring Test Suite Effectiveness [Semantic Coverage: Measuring Test Suite Effectiveness]

   https://doi.org/10.5220/0012063900003538  

   Al_Blwi, Samia; Ayad, Amani; Khaireddine, Besma; Marsit, Imen; Mili, Ali (January 2023, SCITEPRESS - Science and Technology Publications)

   To reduce the cost of mutation testing, researchers have sought to find minimal mutant sets. As an optimization problem, mutant set minimization is defined by two parameters: the objective function that we must optimize; and the constraint under which the optimization is carried out. Whereas the objective function of this optimization problem is clear (minimizing the cardinality of the mutant set), the constraint under which this optimization is attempted has not been clearly articulated in the literature. In this paper, we propose a formal definition of this constraint and discuss in what sense, and to what extent, published algorithms of mutant set minimization comply with this constraint. 

   more » « less
5. Place in Disaster Coverage: Newspaper Coverage of Hurricane Maria in Puerto Rico

   https://doi.org/10.1080/17512786.2023.2190150  

   Takahashi, Bruno; Zhang, Qucheng (March 2023, Journalism Practice)

   Natural hazard news coverage research has examined frames, sources, and journalistic roles. An examination of place in such coverage is missing. Using the hierarchy of influences model, this study analyzes the coverage of place during Hurricane Maria in three major newspapers in Puerto Rico in the pre-crisis and crisis stages of the event. The study examined the roles of routines, organizational factors, and social systems factors in the coverage of Puerto Rican municipalities and the topics covered. Results show a primary focus on highly populated areas, reliance on governmental sources, and differences across the three newspapers studied. Implications for disaster coverage as well as theoretical arguments about the hierarchy of influences are discussed. 

   more » « less