Modeling software behavior via state profiling -

Abstract

Many software testing and fault localization techniques rely on analyzing execution profiles which comprise runtime coverage information such as statements, branches, definition-use pairs, etc. Coverage information could be used to evaluate the quality of testing, perform test suite minimization, devise distance metrics to compare test cases, and help pinpoint the faulty code by contrasting the execution profiles of passing and failing tests. This dissertation aims at proposing and evaluating new types of execution profiles to complement existing ones especially in the cases where the runtime scenario being considered is too complex to be modeled by traditional profiles. Specifically, the proposed approaches model the runtime behavior via complex structures that involve state information, combinations of structural elements, and sequence data. In this regard, we first introduce the concept of dependence chains to assist in automated fault localization. Dependence chains capture, in addition to statement coverage, the underlying data- and control-dependence information as well as predicates describing the values of the relevant variables. We also propose using combinations of simple program elements, as opposed to individual ones, for an online intrusion detection system. Similarly, we present a mechanism for regression testing that allows users to define test requirements characterizing specific behaviors to be covered at runtime instead of choosing from a pool of pre-defined and generic program elements. Such test requirements are automatically migrated across versions and are built using three types of constructs: structural elements, first-order logic predicates specifying the state of select program variables, and sequence information. In addition to proposing new types of execution profiles, we explore several ways to improve the effectiveness of coverage-based software analysis techniques. In particular, we present an approach that aims at identifying coincidentally-correct test cases which are shown to im