REAP: Reporting Errors Using Alternative Paths

Abstract

Software testing is often unable to detect all program flaws. These bugs are most commonly reported to programmers in error reports containing core dumps and/or execution traces that frequently reveal users' private information without providing all necessary information for effective debugging. Hence, these mechanisms are sparsely used due to users' data privacy concerns. This paper presents REAP, a new fault replication method, which allows for enhancing privacy protection while still providing software developers with the 'steps-to-reproduce" errors. REAP uses symbolic execution and randomized search heuristics to identify alternative execution paths leading to an observed error. We evaluated REAP using a testbed including real bugs of popular, large scale applications. The results show the high effectiveness of REAP in anonymizing user input: on average, REAP reveals only 16.78% of the bits in the original input, achieving an average residue (the number of common characters in the original and anonymized input) of 15.07%. Our evaluation also highlights that REAP significantly outperforms state of the art techniques in terms of achieved privacy and/or scalability.

DESENSITIZATION: Privacy-Aware and Attack-Preserving Crash Report

“…A different input triggering the same execution path as the original one may still leak some private information, especially the path constraints that contain strict requirement on the inputs. To further protect user privacy, several works search for alternative execution paths that have relaxed constraints on inputs while triggering the same crash [52], [53], [54]. MPP relies on symbolic execution to explore program states to find all paths that induce the same crash [52].…”

“…MPP relies on symbolic execution to explore program states to find all paths that induce the same crash [52]. REAP and RESPA improve the practicability of MPP by limiting the scope of symbolic execution [53], [54]. Specifically, REAP places randomized, bounded detours around the original path to avoid the path explosion issue.…”

Record and Replay GUI-Based Applications with Less Overhead

“…[2], [3], [4], [5], [6], [17]). Furthermore, to enhance privacy within faultreplication, the following solutions should be considered [18], [19], [20], [21], [22], [23].…”