CUTE: a concolic unit testing engine for C

By Koushik Sen, Darko Marinov, Gul A. Agha. ESEC/FSE-13, 2005

2,121 citations recorded by the source corpus.

Subfields: Computational Theory and Mathematics, Software

View Paper: https://www.semanticscholar.org/paper/398e6b26088cc62bf9bd8801146c3d6fa650b08a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computational Theory and Mathematics

In Software

Citations in the corpus

Higher Order Mutation Testing (2009, methodology): “Reaching all mutants of a program can be achieved by any branch adequate test set, so reachability is an instance of branch coverage, which is widely studied in literature [10, 111, 123, 241].”
TensorFuzz: Debugging Neural Networks with Coverage-Guided Fuzzing (2018, result): “Whereas our approach is analogous to AFL or libFuzzer, their approach is analogous to CUTE [38].”
S2E: a platform for in-vivo multi-path analysis of software systems (2011, methodology): “Likewise, CUTE, KLEE, and others cannot track the branch conditions in the concrete code (unlike S2 E),andthus cannotdeterminehowto redo callsin orderto enable overconstrained butfeasiblepaths.”
TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection (2010, background): “Since exhaustive enumeration of an application’s input space is typically infeasible, there are two main approaches to obtain malformed inputs: data mutation and data generation [58].”
Program sketching (2012, positive): “A second important property of cegis is that it separates the synthesis and verification tasks, making it possible to use off-the-shelf validation procedures, including incomplete but highly scalable procedures such as automated test generation [14].”
Combining unit-level symbolic execution and system-level concrete execution for testing nasa software (2008, methodology): “Furthermore, unlike our approach, the approaches described in [19, 32, 9] use code instrumentation and don’t use model checking (that we use for analyzing multithreading systematically).”
HAMPI: a solver for string constraints (2009, methodology): “Automatic test-case generation tools that use combined concrete and symbolic execution, also known as concolic execution [5,6,17, 18, 23, 34] have trouble creating test cases that achieve high coverage for programs that expect structured inputs, such as those that require input strings from a contex”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “2, we intentionally omit dynamic symbolic executors such as [92], [198], [63], [49], [218], [54] because their authors did not explicitly describe their work as a fuzzer.”
Unleashing Mayhem on Binary Code (2012, background): “Principle #1 is necessary for running complex applications, since most non-trivial programs will contain a potentially infinite number of paths to explore.”
Automated Whitebox Fuzz Testing (2008, methodology): “In fact, our algorithm ﬁnds so many defect occurrences that we must address the defect triage problem (see Section 4), which is common in static program analysis and blackbox fuzzing, but has not been faced until now in the context of dynamic test generation [14, 7, 29, 22, 20, 16].”
An Empirical Evaluation of Using Large Language Models for Automated Unit Test Generation (2023, methodology): “This fact has inspired extensive research on techniques for automated test generation including fuzzing [5], [6], feedback-directed random test generation [7], [8], [9], [10], [11], dynamic symbolic execution [12], [13], [14], [15], and search-based and evolutionary techniques [16], [17].”
Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, background): “Symbolic execution has been used to generate effective inputs as it can leverage off-the-shelf constraint solvers to solve path constraintswhich steer program execution along specific paths that improve coverage or expose new vulnerabilities [13, 14, 52, 67].”
Machine Learning Testing: Survey, Landscapes and Horizons (2019, methodology): “For example, the literature uses the terms ‘statebased testing’ [16] and ‘search-based testing’ [17], [18] to refer to testing techniques that make use of concepts of state and search space, whereas we use the terms ‘GUI testing’ [19] and ‘unit testing’ [20] to refer to test techniques that tackle c”
FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage (2017, methodology): “concolic testing) techniques [5, 7, 13, 16, 21, 22, 36, 45, 47].”
CUTE and jCUTE: Concolic Unit Testing and Explicit Path Model-Checking Tools (2006, methodology): “Our research on concolic testing [1, 6, 4] shows that we can combine random testing and symbolic testing of a program to provide a scalable tool for automatically generating test cases, which improves test coverage and avoids redundant test cases as well as false warnings.”
Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations (2014, methodology): “Our adversarial testing techniques for finding bugs in the client-side validation of server certificates can also be applied to the implementations of server-side validation of client certificates.”
Deep Learning Based Vulnerability Detection: Are We There Yet? (2020, background): “While dynamic analyzers execute the program on real inputs, symbolic analyzers analyze the program based on symbolic inputs [68], [73].”