Catching More Bugs with Fewer False Alarms
summary
Work that builds practical JVM tools: VROOM test isolation reinitializes classes to run thousands of fast unit tests in one JVM and cut per-test overhead; Phosphor taint tracking instruments bytecode to track user-controlled data; Crochet provides cheap micro-checkpoints for fast rollback; and Rivulet amplifies tests combines taint-driven analysis with test-case replay to generate exploits, finds six new web-app vulnerabilities, reproduces the Equifax-style bug, and yields essentially zero false positives versus ~100 from a static tool.
AI-written summary · about
chapters (24)
- 0:00Intro
- 1:16BUGS ARE BAD
- 2:07VULNERABILITIES ARE EVEN WORSE
- 2:43WHAT WENT WRONG?
- 3:27HIRE MORE TESTERS?
- 4:43SUPPORTING OPEN SOURCE CREATING OPEN SOURCE TOOLS FOR USE BY ALL, BUT ESPECIALLY FOR THE OPEN SOURCE COMMUNITY
- 5:11SUPPORTING OSS SUPPORTS INDUSTRY PROPRIETARY CODE
- 6:22MY WORK
- 8:55TEST INDEPENDENCE
- 10:30A TALE OF TWO TESTS
- 11:37JUNIT TEST EXECUTION
- 13:06VMVM: UNIT TEST VIRTUALIZATION
- 13:53VMVM'S REINITIALIZATION
- 15:27PERFORMANCE EVALUATION
- 17:48VMVM + ELECTRICCLOUD
- 18:52VMVM: 6 YEARS LATER ICSE 2014
- 22:11TEST ISOLATION: ANOTHER STORY (2009)
- 29:282012: DIVERSION FROM IN-VIVO TESTING
- 31:57PHOSPHOR
- 32:22IN-VIVO TESTING: NOT DEAD YET
- 34:01TAINT TRACKING FOR VULNERABILITY DETECTION
- 35:13RIVULET LEVERAGES EXISTING TESTS
- 36:24RIVULET: DYNAMIC TAINT TRACKING + TESTS
- 38:30RIVULET: BENCHMARK EVALUATION Number of Test Cases RIVULET Benchmark Suite Type True Alarm False Alarm TP FP TN EN Time
related talks
40mCatching More Bugs with Fewer False Alarms
41mPragmatic Testing
24mFrom Bugs to Brilliance: Testing Toolbox in Action
18mPreview: Verification (Correctness & Debugging)
40mAssuring top-notch code quality in the Java Universe
47mFrom Bugs to Brilliance: Testing Toolbox in Action
46mModern Testing Tools for Java Developers
55mNext-Gen Testing Tools for Java