A Metric for Measuring the Impact of Rare Paths on Program Coverage
Fuzzing has become a popular technique for discovering bugs and vulnerabilities. To increase the probability of finding bugs, developers should apply fuzzers that maximize program coverage. Program coverage typically measures the percentage of program lines or branches a fuzzer executes. However, these metrics fail to communicate the value of hitting an individual line, branch, or path. Many bugs manifest only within non-trivial control flows. To improve software quality, fuzzing non-trivial program paths should be more important than fuzzing trivial ones. This paper introduces rare-path coverage (RP-Coverage), a novel program coverage metric to convey the value of discovering an unlikely control flow path. We have developed a new technique for estimating the probability of taking an execution path. Our technique relies on probabilistic logic programming to declaratively express the logic for constructing and analyzing a probabilistic control flow graph. We empirically evaluate the fitness of RP-Coverage as a metric for measuring fuzzing efficacy. Our experiments confirm that defects along rare paths—intuitively—substantially impact the effectiveness of fuzzers, while existing fuzzing metrics fail to convey that significance. Our evaluation demonstrates that the value of uncovering an unlikely path is better reflected by increases in RP-Coverage than existing metrics. Specifically, we observe an average increase of up to 49.5%, 11.1%, and 15.4% for RP-Coverage, line coverage, and branch coverage, respectively. This finding indicates that RP-Coverage is more elastic to path probabilities and thus more effectively quantifies a fuzzer’s ability to discover unlikely program paths. As such, RP-Coverage demonstrates promise as a program coverage metric that enhances fuzzer fitness measures when supplementing standard criteria.
Thu 6 MarDisplayed time zone: Eastern Time (US & Canada) change
11:00 - 12:30 | Program AnalysisResearch Papers at M-1410 Chair(s): Rrezarta Krasniqi University of North Carolina at Charlotte | ||
11:00 15mTalk | Adapting Knowledge Prompt Tuning for Enhanced Automated Program Repair Research Papers | ||
11:15 15mTalk | A Metric for Measuring the Impact of Rare Paths on Program Coverage Research Papers | ||
11:30 15mTalk | A Progressive Transformer for Unifying Binary Code Embedding and Knowledge Transfer Research Papers Hanxiao Lu Columbia University, Hongyu Cai Purdue University, Yiming Liang Purdue University, Antonio Bianchi Purdue University, Z. Berkay Celik Purdue University | ||
11:45 15mTalk | Is This You, LLM? Recognizing AI-written Programs with Multilingual Code Stylometry Research Papers Andrea Gurioli DISI - University of Bologna, Maurizio Gabbrielli DISI - University of Bologna, Stefano Zacchiroli Télécom Paris, Polytechnic Institute of Paris Pre-print | ||
12:00 15mTalk | SpeedGen: Enhancing Code Efficiency through Large Language Model-Based Performance Optimization Research Papers Nils Purschke Technical University of Munich, Sven Kirchner Technical University of Munich, Alois Knoll Technical University of Munich | ||
12:15 15mTalk | StriCT-BJ: A String Constraint Benchmark from Real Java Programs Research Papers Chi Zhang Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Jian Zhang Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences |