arXiv:2501.11086cs.SEcs.AI2025-01被引 11

用大模型生成代码变更测试,效率远超传统方法。

Evaluating LLM-Based Regression Test Generation

  • 将代码变更转为测试用例,仅凭提交信息和格式生成测试。
  • 2分钟内发现的漏洞数相当于24小时模糊测试的结果。
  • 提交信息越详细,生成的测试越有效,可提升漏洞发现率。

大型语言模型在自动化软件工程中展现出巨大潜力。本文研究了针对解析器、解释器或编译器等处理结构化输入程序的即时回归测试生成。当代码变更提交后,仓库在CI/CD中运行大模型几分钟,生成能覆盖变更代码并触发潜在缺陷的回归测试。我们将该任务建模为机器翻译问题:输入开发者提交信息、代码变更和输入格式名(如XML),输出对应格式的测试用例。在对Mujs、Libxml2、Poppler、JerryScript、Z3、PHP、JQ和MicroPython共72个提交的测试中,我们的反馈驱动零样本原型Cleverest表现优异,甚至无需代码变更。平均2分钟内发现的漏洞数量与状态领先灰盒模糊测试工具WAFLGo在24小时内的结果相当,且后者多数情况下已有可执行种子语料库。将Cleverest生成的测试作为种子用于覆盖率引导的灰盒模糊测试,可使漏洞发现数翻倍,这一集成方案称为ClevFuzz。我们还发现提交信息表达性差异显著影响效果:增强信息量(平均增加17词,最多43词)可显著提升漏洞发现数。

原文摘要 · Abstract (English)

Large Language Models (LLMs) have shown tremendous promise in automated software engineering. In this paper, we investigate LLMs for just-in-time regression test generation for programs, like parsers, interpreters, or compilers, that take highly structured, human-readable inputs. When a bug fix or code change is committed, the repository (as part of CI/CD) runs an LLM for a few minutes to generate regression tests that exercise the changed code and potentially trigger bugs. We frame LLM-based regression test generation as a machine translation task that takes the developer-provided commit message, the code change, and the input format name (e.g., XML), and produces regression tests for the described change in that format. Testing 72 commits to Mujs, Libxml2, Poppler, JerryScript, Z3, PHP, JQ, and MicroPython, our feedback-directed, zero-shot prototype Cleverest performed well, even without the code change. In under 2 minutes on average, Cleverest found as many bugs as the state-of-the-art directed greybox fuzzer WAFLGo did in 24 hours, even though WAFLGo started with a commit-reaching seed corpus in most cases. Using the Cleverest-generated tests as a seed corpus in coverage-guided greybox fuzzing doubles the number of bugs found; we call this integration ClevFuzz. We also find that some commit messages are more expressive than others, thus we ask how it impacts Cleverest's effectiveness. Cleverest picks up on the change intention: e.g., given a commit message that a patch changes how floating point variables are treated in the Mujs JavaScript interpreter, Cleverest generates JavaScript programs that contain floating point variables. Minimally changing commit messages to reduce or increase their information substantially impacts effectiveness: adding 17 words on average (max. 43) to make ineffective commit messages more expressive significantly increased the number of bugs found.

大模型测试生成模糊测试代码安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。