Testing Program Segments to Detect Software Faults during Programming

doi:10.23940/ijpe.21.11.p1.907917

Abstract

Abstract: Fault detection is a process of quality assurance which aims to identify where a fault has occurred and pinpoint the type of fault. However, in the field of software engineering, researchers mainly focus on statically or dynamically analyzing faults or vulnerabilities after the program is completed, and there are few works proposed to detect hidden faults that can only be discovered during program execution during the programming process. In this paper, we propose an automatic fault detection technology called Program Segment Testing (PST) based on the idea of Human-Machine Pair Programming (HMPP), which can automatically detect program segments during the programming process and give prompts when there are vulnerabilities or faults that trigger runtime exceptions. First, we introduce some preliminary definitions and notations that are used in our technology. Then, we use the array index overflow exception as a case to introduce the PST in detail, point out the issues that need to be resolved in order to complete this technology and the corresponding solutions.

Key words: program segment testing, fault detection, runtime exception, segmenting criterion, segmentation rule

Lei Rao, Shaoying Liu, and Ai Liu. Testing Program Segments to Detect Software Faults during Programming [J]. Int J Performability Eng, 2021, 17(11): 907-917.

Add to citation manager EndNote|Reference Manager|ProCite|BibTeX|RefWorks

References

1. Wong W.E., Li X., andLaplante P.A,Be more Familiar with our Enemies and Pave the Way forward: A Review of the Roles Bugs played in Software Failures. Journal of Systems and Software, vol. 133, pp. 68-94, 2017.
2. Wong W.E., Debroy V., Surampudi A., Kim H., andSiok M.F,Recent Catastrophic Accidents: Investigating how Software was Responsible. In 2010 Fourth International Conference on Secure Software Integration and Reliability Improvement, IEEE, pp. 14-22, June 2010.
3. Wichmann B.A., Canning A.A., Clutterbuck D.L., Winsborrow L.A., Ward N.J., andMarsh D.W.R, Industrial Perspective on Static Analysis. Software Engineering Journal, vol. 10, no. 2, pp. 69-75, 1995.
4. Viega J., Bloch J.T., Kohno Y., andMcGraw, G, ITS4: A Static Vulnerability Scanner for C and C++ Code. In Proceedings 16th Annual Computer Security Applications Conference (ACSAC'00), IEEE, pp. 257-267, December. 2000.
5. Su, Z. and Wassermann, G, The Essence of Command Injection Attacks in Web Applications. Acm Sigplan Notices, vol. 41, no. 1, pp. 372-382, 2006.
6. Andrade G., Cirilo E., Durelli V., Cafeo B., andAdachi E.Data-Flow Analysis Heuristic for Vulnerability Detection on Configurable Systems. In Anais do VIII Workshop de Visualização, Evolução e Manutenção de Software, SBC, pp. 25-32, October 2020.
7. Sampaio, L. and Garcia, A.Exploring Context-sensitive Data Flow Analysis for Early Vulnerability Detection. Journal of Systems and Software, vol. 113, pp. 337-361, 2016.
8. Wang, L., Zhang, Q. and Zhao, P, Automated Detection of Code Vulnerabilities based on Program Analysis and Model Checking. In 2008 Eighth IEEE International Working Conference on Source Code Analysis and Manipulation, IEEE., pp. 165-173, September 2008.
9. Liu S., Chen Y., Nagoya F., andMcDermid, J.A, Formal Specification-based Inspection for Verification of Programs. IEEE Transactions on software engineering, vol. 38, no. 5, pp. 1100-1122, 2011.
10. Li Y., Wong W.E., Lee S.Y. and Wotawa F,Using Tri-relation Networks for Effective Software Fault-proneness Prediction. IEEE Access, vol. 7, pp. 63066-63080, 2019.
11. Given-Wilson, T., Jafri, N., and Legay, A. Combined Software and Hardware Fault Injection Vulnerability Detection. Innovations in Systems and Software Engineering, vol. 16, no. 2, pp. 101-120, 2020.
12. Du, W. and Mathur, A.P, Vulnerability Testing of Software System using Fault Injection.Purdue University, West Lafayette, Indiana, Technique Report COAST TR, pp. 98-02, 1998.
13. Dai H., Murphy C., andKaiser G.E,Confu: Configuration Fuzzing Testing Framework for Software Vulnerability Detection. In Security-Aware Systems Applications and Software Development Methods, IGI Global, pp. 152-167, 2012.
14. Mues M., Schallau T., andHowar F,Jaint: A Framework for User-Defined Dynamic Taint-Analyses based on Dynamic Symbolic Execution of Java Programs. In International Conference on Integrated Formal Methods, Springer, Cham, pp. 123-140, November 2020.
15. Balzarotti D., Cova M., Felmetsger V., Jovanovic N., Kirda E., Kruegel C., andVigna G,Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications. In 2008 IEEE Symposium on Security and Privacy (sp 2008), IEEE, pp. 387-401, May 2008.
16. Liu, S, Software Construction Monitoring and Predicting for Human-Machine Pair Programming. In International Workshop on Structured Object-Oriented Formal Language and Method, Springer, Cham. pp. 3-20, November 2018.
17. Weiser, M, Program Slicing. IEEE Transactions on software engineering, vol. 4, pp. 352-357, 1984.
18. Chimdyalwar, B, Survey of Array out of Bound Access Checkers for C Code. InProceedings of the 5th India Software Engineering Conference, pp. 45-48, February 2012.
19. Ferschke O., Gurevych I., andRittberger M,FlawFinder: A Modular System for Predicting Quality Flaws in Wikipedia. InCLEF (Online Working Notes/Labs/Workshop), pp. 1-10, 2012.
20. Kim H., Choi T.H., Jung S.C., Kim H.C., Lee O., andDoh K.G,Applying dataflow analysis to detecting software vulnerability. In 2008 10th International Conference on Advanced Communication Technology, IEEE, vol. 1, pp. 255-258, February 2008
21. Livshits, V.B. and Lam, M.S.Finding Security Vulnerabilities in Java Applications with Static Analysis. In USENIX security symposium, vol. 14, pp. 18-18, August 2005.
22. Chess, B. and West, J, Dynamic Taint Propagation: Finding Vulnerabilities without Attacking. Information Security Technical Report, vol. 13, no. 1, pp. 33-39, 2008.
23. McAllister, S., Kirda, E., and Kruegel, C, Expanding Human Interactions for in-depth Testing of Web Applications. In 11th Symposium on Recent Advances in Intrusion Detection (RAID), vol. 10, pp. 978-3, September 2008.
24. Wotawa, F, On the Relationship between Model-based Debugging and Program Slicing. Artificial Intelligence, vol.135, no. 1-2, pp. 125-143, 2002.
25. Wotawa, F, On the use of constraints in dynamic slicing for program debugging. In 2011 IEEE Fourth International Conference on Software Testing, Verification and Validation Workshops, IEEE, pp. 624-633, March 2011.
26. Jiang S., Zhang H., Wang Q., andZhang Y,A Debugging Approach for Java Runtime Exceptions based on Program Slicing and Stack Traces. In 2010 10th international conference on quality software, IEEE, pp. 393-398, July 2010.
27. Kargén, U. and Shahmehri, N, Turning Programs against each other: High Coverage Fuzz-testing using Binary-code Mutation and Dynamic Slicing. InProceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering, pp. 782-792, August 2015.
28. Jiang S., Yi D., Ju X., Wang L., andLiu Y,An Approach for Test Data Generation using Program Slicing and Particle Swarm Optimization. Neural Computing and Applications, vol. 25, no. 7, pp. 2047-2055, 2014.
29. Soremekun E., Kirschner L., Böhme M., andZeller A,Locating Faults with Program Slicing: an Empirical Analysis. Empirical Software Engineering, vol. 26, no. 3, pp. 1-45, 2021.
30. Sun C.A., Ran Y., Zheng C., Liu H., Towey D., andZhang X,Fault Localisation for WS-BPEL Programs based on Predicate switching and Program Slicing. Journal of Systems and Software, vol. 135, pp. 191-204, 2018.
31. Wong W.E., Shi Y., Qi Y. and Golden R,Using an RBF Neural Network to Locate Program Bugs. In 2008 19th International Symposium on Software Reliability Engineering (ISSRE), IEEE, pp. 27-36, November 2008.

[1]	Ziyuan Wang, Yanliang Zhang, Peng Gao, and Shiyong Shuang. Comparing Fault Detection Efficiencies of Adaptive Random Testing and Greedy Combinatorial Testing for Boolean-Specifications [J]. Int J Performability Eng, 2021, 17(1): 114-122.
[2]	Han Xu, William Cheng Chung Chu, and Jie Luo. Application of Ontology and Multivariate Decision Diagram in Cloud Monitor Systems [J]. Int J Performability Eng, 2019, 15(12): 3227-3236.
[3]	Wenpeng Li, Sance Gao, Renjie Ding, Yanjun Hao, and Cheng Yang. Fault Detection Method for Energy Routing Nodes of Smart Grids Oriented to Electricity Information Security [J]. Int J Performability Eng, 2019, 15(12): 3304-3311.
[4]	Ziyuan Wang, Yang Li, Xueqing Gu, Xiaojia Zheng, and Min Yu. Fault Detection Capabilities of Combinatorial Testing and Random Testing for Boolean-Specifications [J]. Int J Performability Eng, 2019, 15(11): 2952-2961.
[5]	Lijun Zhou, Haiyan Lv, Kai Liu, and Jie Zhang. Survivability of Distributed Fault Detection Systems [J]. Int J Performability Eng, 2019, 15(11): 3008-3015.