DEMINER: test generation for high test coverage through mutant exploration. (28th October 2019) - Kim, Yunho; Hong, Shin
Summary: Most software testing techniques test a target program as it is and fail to utilize valuable information of diverse test executions on many variants/mutants of the original program in test generation. This paper proposes a new test generation technique DEMINER, which utilizes mutant executions to guide test generation on the original program for high test coverage. DEMINER first generates various mutants of an original target program and then extracts runtime information of mutant executions, which covered unreached branches by the mutation effects. Using the obtained runtime information, DEMINER inserts guideposts, artificial branches to replay the observed mutation effects, to the original target programs. Finally, DEMINER runs automated test generation on the original program with guideposts and achieves higher test coverage. We implemented DEMINER for C programs through software mutation and guided test generation such as concolic testing and fuzzing. We have shown the effectiveness of DEMINER on six real‐world target programs: Busybox‐ls, Busybox‐printf, Coreutils‐sort, GNU‐find, GNU‐grep and GNU‐sed . The experiment results show that DEMINER improved branch coverage by 63.4% and 19.6% compared with those of the conventional concolic testing techniques and the conventional fuzzing techniques on average, respectively. Abstract : This paper proposes DEMINER, a new test generation technique that utilizes mutant executions to guide test generation for high test coverage. DEMINER first explores new behaviors of a target program by changing the program structure (i.e., by mutation), extracting path conditions under which new branches are achieved, as guideposts, and then feeding guideposts to test generation to lead path exploration to achieve high test coverage. The experimental results show that DEMINER improves branch‐coverage by up to 63.4% than do the existing test generation techniques.