TabuFuzz finds more software crashes by changing which inputs get tested
A peer-reviewed computer-science study reports that TabuFuzz, a software-testing system developed in China, uncovered more execution paths and crashes than comparison tools on its test set. It uses a short memory of previous choices to guide further tests. The results come from nine programs and repeated day-long trials, with important limits on how broadly the gains apply.
Science··Midday
A memory for repetitive software tests
Researchers in China have developed TabuFuzz, a system that tests software by varying inputs and watching how programs respond. Their peer-reviewed experimental paper in Scientific Reports changes the choice of which existing inputs receive more testing. A short memory temporarily puts recently selected inputs aside, while allowing an especially promising candidate to return. Feedback about the program’s behaviour also changes how much testing effort each input receives.[1]
Nine programs show higher counts
The principal comparison used nine programs, with six separate day-long trials for each. Against American Fuzzy Lop, the existing testing tool on which TabuFuzz was built, the new system increased the summed mean path count from 14,050 to 16,844. Paths describe different routes through a program’s execution. The corresponding crash counts were 138 and 360. Some crashes matched known vulnerabilities; a crash count does not count distinct new security flaws.[1]
More selective testing carries a cost
Additional measurements found fewer executions per second, reflecting the processing cost of scheduling tests. The authors also identify circumstances in which the method may lose effectiveness, including tightly structured inputs and very large queues. Several tested versions were old. They call for longer trials, more repetitions and evaluation on current programs to establish how reliably the gains extend beyond this experiment.[1]
