We are developing a model-based fuzzing framework that employs mathematical models of system behavior to guide the fuzzing process. Whereas traditional fuzzing frameworks generate tests randomly, a model-based framework can deduce tests from a behavioral model using a constraint solver. Because the state space being explored by the fuzzer is often large, the rapid generation of test vectors is crucial. The need to generate tests quickly, however, is antithetical to the use of a constraint solver. Our solution to this problem is to use the constraint solver to generate an initial solution, to generalize that solution relative to the system model, and then to perform rapid, repeated, randomized sampling of the generalized solution space to generate fuzzing tests. Crucial to the success of this endeavor is a generalization procedure with reasonable size and performance costs that produces generalized solution spaces that can be sampled efficiently. This paper describes a generalization technique for logical formulae expressed in terms of Boolean combinations of linear constraints that meets the unique performance requirements of model-based fuzzing. The technique represents generalizations using trapezoidal solution sets consisting of ordered, hierarchical conjunctions of linear constraints that are more expressive than simple intervals but are more efficient to manipulate and sample than generic polytopes. Supporting materials contain an ACL2 proof that verifies the correctness of a low-level implementation of the generalization algorithm against a specification of generalization correctness. Finally a post-processing procedure is described that results in a restricted trapezoidal solution that can be sampled (solved) rapidly and efficiently without backtracking, even for integer domains. While informal correctness arguments are provided, a formal proof of the correctness of the restriction algorithm remains as future work.
[1]
Helmut Veith,et al.
Counterexample-guided abstraction refinement for symbolic model checking
,
2003,
JACM.
[2]
Stefan M. Silverston,et al.
Extensions to SNOBOL4 in the SNOBAT implementation
,
1977,
SIGP.
[3]
David Greve.
Assuming termination
,
2009,
ACL2 '09.
[4]
Pascal Raymond,et al.
The synchronous data flow programming language LUSTRE
,
1991,
Proc. IEEE.
[5]
David A. Greve.
Parameterized congruences in ACL2
,
2006,
ACL2 '06.
[6]
Patrick Cousot,et al.
Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints
,
1977,
POPL.
[7]
Andreas Kuehlmann,et al.
QF BV model checking with property directed reachability
,
2013,
2013 Design, Automation & Test in Europe Conference & Exhibition (DATE).
[8]
Konrad Slind,et al.
A Step-Indexing Approach to Partial Functions
,
2013,
ACL2.
[9]
Antoine Mid.
The Octagon Abstract Domain
,
2001
.
[10]
John D. Backes,et al.
The JKind Model Checker
,
2017,
CAV.
[11]
Radhia Cousot,et al.
Static determination of dynamic properties of generalized type unions
,
1977,
Language Design for Reliable Software.