Extended Control Flow Graph Research Articles

Graphuzz: Data-driven Seed Scheduling for Coverage-guided Greybox Fuzzing

Seed scheduling is a critical step of greybox fuzzing, which assigns different weights to seed test cases during seed selection, and significantly impacts the efficiency of fuzzing. Existing seed scheduling strategies rely on manually designed models to estimate the potentials of seeds and determine their weights, which fails to capture the rich information of a seed and its execution and thus the estimation of seeds’ potentials is not optimal. In this paper, we introduce a new seed scheduling solution, Graphuzz, for coverage-guided greybox fuzzing, which utilizes deep learning models to estimate the potentials of seeds and works in a data-driven way. Specifically, we propose an extended control flow graph called e-CFG to represent the control-flow and data-flow features of a seed’s execution, which is suitable for graph neural networks (GNN) to process and estimate seeds’ potential. We evaluate each seed’s code coverage increment and use it as the label to train the GNN model. Further, we propose a self-attention mechanism to enhance the GNN model so that it can capture overlooked features. We have implemented a prototype of Graphuzz based on the baseline fuzzer AFLplusplus. The evaluation results show that our model can estimate the potential of seeds and has the robust capability to generalize to different targets. Further, the evaluation using 12 benchmarks from FuzzBench shows that Graphuzz outperforms AFLplusplus and the state-of-the-art seed scheduling solution K-Scheduler and other coverage-guided fuzzers in terms of code coverage, and the evaluation using 8 benchmarks from Magma shows that Graphuzz outperforms the baseline fuzzer AFLplusplus and SOTA solutions in terms of bug detection.

Verifiable Model Construction for Business Processes

Business process specified in Business Process Execution Language (BPEL), which integrates existing services to develop composite service for offering more complicated function, is error-prone. Verification and testing are necessary to ensure the correctness of business processes. SPIN, for which the input language is PROcess MEta-LAnguage (Promela), is one of the most popular tools for detecting software defects and can be used both in verification and testing. In this paper, an automatic approach is proposed to construct the verifiable model for BPEL-based business process with Promela language. Business process is translated to an intermediate two-level representation, in which eXtended Control Flow Graph (XCFG) describes the behavior of BPEL process in the first level and Web Service Description Models (WSDM) depict the interface information of composite service and partner services in the second level. With XCFG of BPEL process, XCFGs for partner services are generated to describe their behavior. Promela model is constructed by defining data types based on WSDM and defining channels, variables and processes based on XCFGs. The constructed Promela model is closed, containing not only the BPEL process but also its execution environment. Case study shows that the proposed approach is effective.

Test Case Selection for All-Uses Criterion-Based Regression Testing of Composite Service

Composite services evolve for various reasons. Test case selection in the regression testing is an effective technique to ensure the correctness of modified versions meanwhile to reduce the cost of testing. However, few work has studied the test case selection problem based on the data flow testing criteria. In addition, there are three observable kinds of changes during the evolution, including Process change, Binding change and Interface change, which all bring impact to the data flow. To address these issues, a test case selection approach is proposed for regression testing of BPEL (Business Process Execution Language) composite service where all-uses criterion is satisfied and all the three change types are involved. BPEL composite service is modeled with a two-level model in which XCFG (eXtended Control Flow Graph) describes the behavior of BPEL process in the first level and WSDM (Web Service Description Model) depicts the interface information of composite service and partner services in the second level. Change impact analysis is performed to identify the affected definition-use pairs by comparing and analyzing two-level models of the baseline and evolved versions. And testing paths are generated to cover the affected definition-use pairs and select test cases based on the path condition analysis. Empirical result shows that the proposed approach is effective.

Identifying functions in binary code with reverse extended control flow graphs

AbstractIn binary code analysis, current function identification approaches are challenged by functions without explicit call sites and handcrafted assembly without standard prologues/epilogues. We propose a new function representation called a reverse extended control flow graph (RECFG) and a RECFG‐based method for identifying functions in stripped binary code. A function has at least one return instruction (an instruction that makes the control flow leave a function). Therefore, return instructions are more reliable than the function prologues and epilogues used by traditional methods. We first build RECFGs from any values that can be interpreted as return instructions in a code range. Then, for each independent RECFG, the multiple‐decision method chooses a subgraph as the control flow graph of a function. A prototype tool is developed for evaluation on seven open source applications, 138 binaries in MASM32 code examples, and 292 binaries in Windows XP SP3. Experimental results show that the proposed method can identify functions that cannot be identified by current methods with high precision and stable recall. Copyright © 2015 John Wiley & Sons, Ltd.

Evolutionary algorithms for object-oriented test data generation

Identification of effective test data for testing a software application is a difficult task. The presence of a large number of decision nodes in a program makes it difficult to test all modules, and as a result consumes a lot of testers' time. The effort required for testing can be reduced by automatic generation of test data for particular modules. Out of numerous optimization algorithms, evolutionary algorithms can help in this scenario by generating relevant test data. The ability of evolutionary algorithms to obtain effective solutions from a very large search space of candidate solutions can be used for automatic test data generation. This paper explores the automatic generation of test data for object-oriented programs based on the concept of the extended control flow graph by utilizing the binary particle swarm optimization and artificial bee colony optimization algorithms. The proposed approach is applied to a bank ATM case study. The experimental results obtained, when compared with the clonal selection algorithm, reveal that the artificial bee colony optimization algorithm is more efficient for generating effective test data than the binary particle swarm optimization and clonal selection algorithms.

Verifying the Concurrent Properties in BPEL Based Web Service Composition Process

The relatively new web service software paradigm involves services which are loosely coupled, highly reusable and flexible. By specifying the workflow of individual services, Web service composition enhances the ability to handle more complex business processes and provides many value-added services. In this article, we propose an extended control flow graph (XCFG) to formally model the workflow of Web service composition specified in BPEL, and corresponding techniques to verify concurrent properties, such as deadlock-free, non-conflict, and link non-redundant. XCFG can model not only the workflow of BPEL but also the synchronization control dependencies among concurrent activities. Meanwhile, each element of XCFG keeps record of related information of corresponding activity in BPEL so as to support further analysis and verification. Experimental study validates the effectiveness and efficiency of the proposed XCFG-based technique.

EXTENDED CONTROL FLOW GRAPH BASED PERFORMANCE AND ENERGY CONSUMPTION OPTIMIZATION USING SCRATCH-PAD MEMORY

A Scratch-Pad memory (SPM) allocation method to improve the performance of a specified application while reducing its energy consumption is presented in this paper. Integrated in the design is an extended control flow graph (ECFG) built directly from the application's instruction flow. The application of the design is transformed into a directed graph that consists of nodes and relationships. Likewise, to provide a solution in decreasing the overhead of moving nodes to SPM, the design is enhanced with a refined greedy algorithm based on ECFG. An experiment is conducted to prove the feasibility and efficiency of the method. The results indicate that the method indeed improves performance by an average of 11% and consumes lesser energy by an average of 28%. This is in comparison to previous research which based on the control flow graph (CFG) method. The latter was discovered to have disregarded the relationships of nodes. In conclusion, the application's execution time and energy consumption were reduced by an average up to 56% and 69% respectively, compared to a non-SPM environment.

CTOC에서 루프 트리 구성하기

최근 많이 사용되고 있는 자바 바이트코드의 분석과 최적화를 효율적으로 수행하기 위해 CTOC 프레임워크가 구현되었다. CTOC에서는 바이트코드에 대해 분석과 최적화를 수행하기 위해 가장 먼저 eCFG를 생성하였다. 분석하기 어렵다는 바이트코드의 특성 때문에 기존의 바이트 코드를 제어 흐름 분석에 적합하게 확장하여 제어 흐름 그래프를 작성하였다. 이를 확장된 제어 흐름 그래프인 eCFG라 부른다. 또한 정적으로 분석하기 위해 eCFG를 SSA Form으로 변환 하였다. 변환 시 많은 프로그램에서 루프가 발견되었다. 이전 CTOC에서는 루프에 대한 처리를 수행하지 않은 상태에서 직접 SSA Form으로 변환을 수행하였다. 하지만 SSA Form으로 변환하기 이전에 루프에 대한 부분을 처리하면 더욱 효율적인 SSA Form을 생성할 수 있게 된다. 본 논문은 루프에 대한 처리를 효율적으로 하기 위해 eCFG를 SSA Form으로 변환하는 과정 이전에 루프를 발견하고 이와 관련된 루프 트리를 생성하는 과정을 보인다. The CTOC framework was implemented to efficiently perform analysis and optimization of the Java bytecode that is often being used lately. In order to analyze and optimize the bytecode from the CTOC, the eCFG was first generated. Due to the bytecode characteristics of difficult analysis, the existing bytecode was expanded to be suitable for control flow analysis, and the control flow graph was drawn. We called eCFG(extended Control Flow Graph). Furthermore, the eCFG was converted into the SSA Form for a static analysis. Many loops were found in the conversion program. The previous CTOC performed conversion directly into the SSA Form without processing the loops. However, processing the loops prior to the SSA Form conversion allows more efficient generation of the SSA Form. This paper examines the process of finding the loops prior to converting the eCFG into the SSA Form in order to efficiently process the loops, and exhibits the procedures for generating the loop tree.

Code Based Analysis for Object-Oriented Systems

The basic features of object-oriented software makes it difficult to apply traditional testing methods in object-oriented systems. Control Flow Graph (CFG) is a well-known model used for identification of independent paths in procedural software. This paper highlights the problem of constructing CFG in object-oriented systems and proposes a new model named Extended Control Flow Graph (ECFG) for code based analysis of Object-Oriented (OO) software. ECFG is a layered CFG where nodes refer to methods rather than statements. A new metrics --Extended Cyclomatic Complexity (E-CC) is developed which is analogous to McCabe's Cyclomatic Complexity (CC) and refers to the number of independent execution paths within the OO software. The different ways in which CFG's of individual methods are connected in an ECFG are presented and formulas for E-CC for these different cases are proposed. Finally we have considered an example in Java and based on its ECFG, applied these cases to arrive at the E-CC of the total system as well as proposed a methodology for calculating the basis set, i.e., the set of independent paths for the OO system that will help in creation of test cases for code testing.