Abstract: Disclosed is a novel computer implemented system, on demand service, computer program product and a method for fault-localization techniques that apply statistical analyses to execution data gathered from multiple tests. The present invention determines the fault-localization effectiveness of test suites generated according to several test-generation techniques based on combined concrete and symbolic (concolic) execution. These techniques are evaluated by applying the Ochiai fault-localization technique to generated test suites in order to localize 35 faults in four PHPWeb applications. The results show that the test-generation techniques under consideration produce test suites with similar high fault-localization effectiveness, when given a large time budget.

Abstract: The present invention provides a system, computer program product, and a computer implemented method for analyzing a set of two or more communicating applications. The method begins with receiving a first second application that communicates with each other during execution. Next, an initial input for executing the first application and the second application is received. The initial input is added to a set of inputs. An iterative execution loop is performed at least once. The loop begins with selecting inputs out of the set of inputs for execution. Next, using the selected inputs, the first and/or the second application is executed while information regarding the execution and information communicated to the other application are recorded. A set of one or more new application inputs for either applications is generated based the second application recorded information and the first application information. These new inputs are added to the set of inputs.

Abstract: A method includes determining selected global variables in a program for which flow of the selected global variables through the program is to be tracked. The selected global variables are less than all the global variables in the program. The method includes using a static analysis performed on the program, tracking flow through the program for the selected global variables. In response to one or more of the selected global variables being used in security-sensitive operations in the flow, use is analyzed of each one of the selected global variables in a corresponding security-sensitive operation. In response to a determination the use may be a potential security violation, the potential security violation is reported. Apparatus and computer program products are also disclosed.

Abstract: Systems and methods are provided for creating a data structure associated with a software application that is based on at least one framework. According to the method, source code and at least one configuration file of the software application is analyzed by at least one framework-specific processor so as to determine entry point information indicating entry points in the source code, request attribute access information indicating where attributes attached to a request data structure are read and written, and forward information indicating forwards performed by the software application. A data structure for a static analysis engine is created based on this information. The data structure includes a list of synthetic methods that model framework-related behavior of the software application, and a list of entry points indicating the synthetic methods and/or application methods of the software application that can be invoked by the framework.

Abstract: Systems and methods are provided for statically analyzing a software application that is based on at least one framework. According to the method, source code of the software application and a specification associated with the software application are analyzed. The specification includes a list of synthetic methods that model framework-related behavior of the software application, and a list of entry points indicating the synthetic methods and/or application methods of the software application that can be invoked by the framework. Based on the source code and the specification, intermediate representations for the source code and the synthetic methods are generated. Based on the intermediate representations and the specification, call graphs are generated to model which application methods of the software application invoke synthetic methods or other application methods of the software application.

Abstract: Disclosed is a novel computer implemented system, on demand service, computer program product and a method for fault-localization techniques that apply statistical analyses to execution data gathered from multiple tests. The present invention determines the fault-localization effectiveness of test suites generated according to several test-generation techniques based on combined concrete and symbolic (concolic) execution. These techniques are evaluated by applying the Ochiai fault-localization technique to generated test suites in order to localize 35 faults in four PHPWeb applications. The results show that the test-generation techniques under consideration produce test suites with similar high fault-localization effectiveness, when given a large time budget.

Abstract: Disclosed is a novel computer implemented system, on demand service, computer program product and a method that leverages combined concrete and symbolic execution and several fault-localization techniques to create a uniquely powerful tool that automatically detects failures and localizes faults in PHP Web applications. The fault-localization techniques evaluated combine variations on the Tarantula algorithm with a technique based on maintaining a mapping between executed statements and the fragments of output they produce, mapping of conditional results, and values returned from function calls. These techniques have been implemented in a tool called Apollo, and evaluated by localizing 75 randomly selected faults that were exposed by automatically generated tests in four PHP applications. Our findings indicate that, using our best technique, 87.

Abstract: The present invention provides a system, computer program product, and a computer implemented method for analyzing a set of two or more communicating applications. The method includes executing a first application, such as a client application, and executing a second application, such as a server application. The applications are communicating with each other. A correlation is recorded between the applications and an execution characteristic exhibited on execution. An oracle is used to determine an analysis of the first application that has been executed. The execution of the first application causes a change of state in the second application and/or a change control flow in the second application. Code fragment in the first application and/or the second application are prioritized based on an evaluation produced by the oracle, and based on the correlation between the code fragments that have been executed and the execution characteristic exhibited by the code fragments.

Abstract: The present invention provides a system, computer program product and a computer implemented method for prioritizing code fragments based on the use of a software oracle and on a correlation between the executed code fragments and the output they produce. Also described is a computer-implemented method generates additional user inputs based on execution information associated with path constraints and based on information from the oracle. Advantageously, the embodiment is useful in a test generation tool that generated many similar inputs when a failure-inducing input is found, in order to enhance fault localization. Further, described is a computer-implemented flow for extending the existing idea of concolic testing to applications that interact with persistent state.

Abstract: The present invention provides a system, computer program product and a computer implemented method for prioritizing code fragments based on the use of a software oracle and on a correlation between the executed code fragments and the output they produce. Also described is a computer-implemented method generates additional user inputs based on execution information associated with path constraints and based on information from the oracle. Advantageously, the embodiment is useful in a test generation tool that generated many similar inputs when a failure-inducing input is found, in order to enhance fault localization. Further, described is a computer-implemented flow for extending the existing idea of concolic testing to applications that interact with persistent state.

Abstract: The present invention provides a system, computer program product and a computer implemented method for prioritizing code fragments based on the use of a software oracle and on a correlation between the executed code fragments and the output they produce. Also described is a computer-implemented method generates additional user inputs based on execution information associated with path constraints and based on information from the oracle. Advantageously, the embodiment is useful in a test generation tool that generated many similar inputs when a failure-inducing input is found, in order to enhance fault localization. Further, described is a computer-implemented flow for extending the existing idea of concolic testing to applications that interact with persistent state.