Synergizing Specification Miners through Model Fissions and Fusions (T)

Abstract

Software systems are often developed and released without formal specifications. For those systems that are formally specified, developers have to continuously maintain and update the specifications or have them fall out of date. To deal with the absence of formal specifications, researchers have proposed techniques to infer the missing specifications of an implementation in a variety of forms, such as finite state automaton (FSA). Despite the progress in this area, the efficacy of the proposed specification miners needs to improve if these miners are to be adopted.We propose SpecForge, a new specification mining approach that synergizes many existing specification miners. SpecForge decomposes FSAs that are inferred by existing miners into simple constraints, through a process we refer to as model fission. It then filters the outlier constraints and fuses the constraints back together into a single FSA (i.e., model fusion). We have evaluated SpecForge on execution traces of 10 programs, which includes 5 programs from DaCapo benchmark, to infer behavioral models of 13 library classes. Our results show that SpecForge achieves an average precision, recall and F-measure of 90.57%, 54.58%, and 64.21% respectively. SpecForge outperforms the best performing baseline by 13.75% in terms of F-measure.

Discovering specification violations in networked software systems

“…APE uses Synoptic [9] to convert observed execution traces into a finite state machine (FSM) model of the target's behavior. (While APE could instead use other model-inference algorithms [6], [7], [8], [20], [23], [25], [32], [37], [39], [40], [41], [42], [43], [48], our experience showed that Synoptic model's enforcement of observed temporal invariants leads to sufficiently precise models for APE's purposes.) Each path through the FSM model represents an execution, in terms of the sequence of messages sent and received by APE.…”

“…APE uses predictive model inference to abstract the observed executions into a concise and predictive model. In general, inferring the most concise model from observed examples is NP-complete [1], [17], [26], and most modelinference algorithms approximate a solution [6], [7], [8], [9], [10], [15], [20], [22], [23], [25], [31], [32], [34], [37], [39], [42], [47], [49].…”

Network-Clustered Multi-Modal Bug Localization

“…Also, Rahman et al [55] used static bug-finding to improve the performance of statistical defect prediction (and vice versa). Le et al [34] proposed SpecForge that combines different automaton based specification miners using model fission and model fusion in order to create a more effective specification miner. Kellogg et al [32] presents N-Prog that combines static bug detection and test case generation to avoid unnecessary human effort.…”

Enhancing Automated Program Repair with Deductive Verification

“…Also, our approach requires complete specifications in order to completely ensure the soundness of generated patches. We expect that employing advances in specification inference and mining could help reduce this burden [10]. Future work would be to use the history of bug fixes to mine specifications of past patches and inform the future patch generation process in a way that generated patches are likely to conform to desired behaviours.…”