ISSTA 2022
Mon 18 - Fri 22 July 2022 Online
Wed 20 Jul 2022 17:00 - 17:20 at ISSTA 2 - Session 3-2: Fuzzing and Friends C Chair(s): Behnaz Hassanshahi
Fri 22 Jul 2022 00:00 - 00:20 at ISSTA 1 - Session 1-9: Fuzzing and Friends A

Real-life programs contain multiple operations whose semantics are unavailable to verification engines, like third-party library calls, inline assembly and SIMD instructions, special compiler-provided primitives, and queries to uninterpretable machine learning models. Even with the exceptional success story of program verification, synthesis of inductive invariants for such open" programs has remained a challenge. Currently, this problem is handled by manuallyclosing" the program—by providing hand-written \textit{stubs} that attempt to capture the behavior of the unmodelled operations; writing stubs is not only difficult and tedious, but the stubs are often incorrect—raising serious questions on the whole endeavor.

In this work, we propose \textit{Almost Correct Invariants} as an automated strategy for synthesizing inductive invariants for such ``open" programs. We adopt an active learning strategy where a data-driven learner proposes candidate invariants. In deviation from prior work that attempt to \textit{verify} invariants, we attempt to \textit{falsify} the invariants: we reduce the falsification problem to a set of reachability checks on non-deterministic programs; we ride on the success of modern fuzzers to answer these reachability queries. Our tool, $\textit{ACHAR}$, automatically synthesizes inductive invariants that are sufficient to prove the correctness of the target programs. We compare $\textit{ACHAR}$ with a state-of-the-art invariant synthesis tool that employs theorem proving on formulae built over the program source. Though $\textit{ACHAR}$ is without strong soundness guarantees, our experiments show that even when we provide almost no access to the program source, $\textit{ACHAR}$ outperforms the state-of-the-art invariant generator that has complete access to the source. We also evaluate $\textit{ACHAR}$ on programs that current invariant synthesis engines cannot handle—programs that invoke external library calls, inline assembly, and queries to convolution neural networks; $\textit{ACHAR}$ successfully infers the necessary inductive invariants within a reasonable time.

Wed 20 Jul

Displayed time zone: Seoul change

16:20 - 17:20
Session 3-2: Fuzzing and Friends CTechnical Papers at ISSTA 2
Chair(s): Behnaz Hassanshahi Oracle Labs, Australia
16:20
20m
Talk
SnapFuzz: High-Throughput Fuzzing of Network Applications
Technical Papers
Anastasios Andronidis Imperial College London, UK, Cristian Cadar Imperial College London, UK
DOI
16:40
20m
Talk
SLIME: Program-sensitive Energy Allocation for Fuzzing
Technical Papers
Chenyang Lyu Zhejiang University, Hong Liang Zhejiang University, Shouling Ji Zhejiang University, Xuhong Zhang Zhejiang University, Binbin Zhao Georgia Institute of Technology, Meng Han Binjiang Institute of Zhejiang University & Zhejiang University, Yun Li Huawei Technologies Co., Ltd., Zhe Wang State Key Laboratory of Computer Architecture, Institute of Computing Technology, Chinese Academy of Sciences, Wenhai Wang Zhejiang University, Raheem Beyah Georgia Institute of Technology
DOI
17:00
20m
Talk
Almost Correct Invariants: Synthesizing Inductive Invariants by Fuzzing Proofs
Technical Papers
Sumit Lahiri Indian Institute Of Technology Kanpur, Subhajit Roy IIT Kanpur, India
DOI

Fri 22 Jul

Displayed time zone: Seoul change

00:00 - 01:00
Session 1-9: Fuzzing and Friends ATechnical Papers at ISSTA 1
00:00
20m
Talk
Almost Correct Invariants: Synthesizing Inductive Invariants by Fuzzing Proofs
Technical Papers
Sumit Lahiri Indian Institute Of Technology Kanpur, Subhajit Roy IIT Kanpur, India
DOI
00:20
20m
Talk
MDPFuzz: Testing Models Solving Markov Decision Processes
Technical Papers
Qi Pang HKUST, Yuanyuan Yuan The Hong Kong University of Science and Technology, Shuai Wang Hong Kong University of Science and Technology
DOI
00:40
20m
Talk
SnapFuzz: High-Throughput Fuzzing of Network Applications
Technical Papers
Anastasios Andronidis Imperial College London, UK, Cristian Cadar Imperial College London, UK
DOI