Browsing by Author "Lu, Han-Lin"

Now showing 1 - 9 of 9

Big Data Platform Configuration Using Machine Learning
(2020-05-01)
Yeh, Chao-Chun
;
Lu, Han-Lin
;
Zhou, Jiazheng
;
Chang, Sheng-An
;
Lin, Xuan-Yi
By ensuring well-developed complex big data platform architectures, data engineers provide data scientists and analysts infrastructure with computational and storage resources to perform their research. Based on such supports, data scientists are provided an opportunity to focus on their domain problems and design the required intelligent modules (i.e., prepare the data; select, train, and tune the machine-learning modules; and validate the results). However, there are still gaps between system engineering and data scientist/engineering teams. Generally, system engineers have limited knowledge on the application domains and the purposes of an analytical program. On the contrary, both data scientists and engineers are usually unfamiliar with the configuration of a computational system, file system, and database. However, the performance of an application can be affected by a system's configuration, and the data scientists and engineers have little information and knowledge about which of the system's properties can affect the application's performance. As a typical example, for Internet-scale applications that have thousands of computing nodes or billions of Internet of Things devices, even a slight improvement may have an enormous influence on energy management and environmental protection issues. To bridge the gap between system engineering and data scientist/engineering teams, we proposed the concept of a configuration layer based on a big data platform, Hadoop. We built a configuration tuner, BigExplorer, to collect and preprocess data. Furthermore, we also created golden configurations for performance improvement. Based on the processed data, we used a semi-automatic feature engineering technique to provide more features for data engineers and developed the performance model using three different machine learning algorithms (i.e., random forest, gradient boosting machine, and support vector machine). Using the commonly used benchmarks of Word-Count, TeraSort, and Pig workloads, our configuration tuner achieved a significant performance improvement of 28%-51% for different workloads than using the rule-of-thumb configuration.
CRAXDroid: Automatic Android System Testing by Selective Symbolic Execution
(2014-01-01)
Yeh, Chao-Chun
;
Lu, Han-Lin
;
Chen, Chun-Yen
;
Khor, Kee-Kiat
;
Huang, Shih-Kun
Mobile devices such as smart phones and tablet PCs are becoming common personal devices. The business model of a central software market is also thriving and turning into a major distribution source of software packages on those devices. However, these devices often contain personal private information and can be used to conduct operations involving data leakage and payment events like sending SMS. As a result, the quality of software on mobile devices becomes a critical issue. We aim at checking whether software off the shelf contains defective behavior or potential vulnerabilities, and aiding the official APP or third party markets to ensure their software without privacy issues. We have built a platform for android APP testing, by revising our software quality assurance and exploit generation platform, called CRAX, to apply in the Android platform. It is called the CRAXDroid that allows any inputs to be the testing sources to the APP without source code. These approaches are based on the symbolic execution technique and android emulator. By automatically exploring execution paths, we can find potential software defects. We perform several experiments on Android applications to prove the feasibility of our method.
CRAXTriage: A Coverage Based Triage System
(2017-01-01)
Yeh, Chao-Chun
;
Lu, Han-Lin
;
Lee, Yi-Hsuan
;
Chou, Wei-Sheng
;
Huang, Shih-Kun
Software is getting complicated due to the changing needs and flourishing development of software industry. To better improve software quality, we have to find the major reasons which cause the program crash. However, debugging by software developer is not an efficient method, especially in large software. Many automated tools are developed to enhance the fault localization efficiency and reduce the maintenance cost. Most researches focus on improving the software testing process, and the primary triage method is based on the stack-trace hash (e.g., smartfuzz, basic fuzzing framework and Failure Observation engine), and is unchanged for a long time. Therefore, we propose a new triage method based on binary block coverage. Our triage method is designed by analyzing the binary level coverage results, on every time the input causes the program crash. For the same crash input, we also use traditional stack-trace hash method to contrast the flaws with our method. Our experiment results reveal that our proposed method based on code coverage exhibits better triages in terms of the number of unique bugs identified and correct classifications of faults.
CRAXweb: Automatic Web Application Testing and Attack Generation
(2013)
Huang, Shih-Kun
;
Lu, Han-Lin
;
Leong, Wai-Meng
;
Liu, Huan
;
資訊技術服務中心
This paper proposes to test web applications and generate the feasible exploits automatically, including cross-site scripting and SQL injection attacks. We test the web applications with initial random inputs by detecting symbolic queries to SQL servers or symbolic responses to HTTP servers. After symbolic outputs detected, we are able to generate attack strings and reproduce the results, emulating the manual attack behavior. In contrast with other traditional detection and prevention methods, we can determine the presence of vulnerabilities and prove the feasibility of attacks. This automatic generation process is based on a dynamic software testing method-symbolic execution by (SE)-E-2. We have applied this automatic process to several known vulnerabilities on large-scale open source web applications, and generated the attack strings successfully. Our method is web platform independent, covering PHP, JSP, Rails, and Django due to the supports of the whole system environment of (SE)-E-2.
Diagnosing SDN Network Problems by Using Spectrum-based Fault Localization Techniques
(2015)
Chen, Hsia-Hsiang
;
Lu, Han-Lin
;
Huang, Shih-Kun
;
Gao, Ruizhi
;
Wong, W. Eric
Software-defined network (SDN) is the recent advances of mitigation on improving network management flexibility and dynamic configurability. It is due to the separation of control plane and data plane and the controller software for arbitrary network configurations. However, such a flexible architecture still suffers from the inherent traits of software quality issues. Software testing and software related fault localization methods should be applied. To the best of our knowledge, we are the first to apply spectrum-based fault localization (SFL) techniques for SDN problems and propose the SFL system framework to find the illogic rules and related procedure faults in SDN. We conduct evaluations on the standard SDN environment in OpenFlow and compare the related SFL techniques. The results show that the fault locations can be found precisely. In addition, we also develop a debugging tool that can search the error causes and feedback the information to the SDN controller for fixing the faulty conditions in time.
Effective Test Generation for Combinatorial Decision Coverage
(2016)
Gao, Ruizhi
;
Hu, Linghuan
;
Wong, W. Eric
;
Lu, Han-Lin
;
Huang, Shih-Kun
Complex software systems present significant challenges to existing software testing techniques. Simply applying exhaustive testing will lead to the execution of a prohibitively large number of test cases. Furthermore, many testing techniques today provide neither promising coverage achievement nor reliable fault detection strength. In this paper, we propose a technique, which represents an innovative synthesis of combinatorial testing and symbolic execution, to generate test cases based on a novel coverage criterion, namely combinatorial decision coverage (CDC). Strength t (or t-way) CDC requires each t-tuple of decision outcomes to be executed by at least one test case. Given a program, our CDC-based technique first uses a revised version of a symbolic executor, (SE)-E-2, to collect all program decisions with symbolic variables as well as their corresponding constraints and then applies a combinatorial test generation tool, ACTS, to generate t-way combinations for the outcomes of these decisions. A test case can be generated with respect to each combination that represents a single path-condition of the program. Case studies were conducted on three versions of photo editing applications. Our results indicate that a test set generated using the proposed technique has higher statement, decision, and all-use coverage as well as better fault detection strength than a test set of the same size generated by random testing and genetic algorithm-based test generation.
Path Exploration Based on Monte Carlo Tree Search for Symbolic Execution
(2017-01-01)
Yeh, Chao-Chun
;
Lu, Han-Lin
;
Yeh, Jia-Jun
;
Huang, Shih-Kun
;
資訊工程學系
Symbolic Execution is a widely used technique for program testing and analysis. When a program executes a trace symbolically, it simulates all possible paths. This results in an exponential growth of the number of states within the problem, which is commonly referred to as "path explosion." We therefore propose novel strategies that only require limited resources to give priority to more valuable paths. In this paper, we utilize a method based on the Monte Carlo tree search (MCTS) strategy to resolve the problem. We then compare the proposed MCTS-based strategy with other methods such as depth-first search (DFS) and breadth-first search (BFS). We also perform different scales of experiments based on time and space resource constraints. For smaller test cases, we found that MCTS performs on average 1.4 times better than BFS and DFS in terms of the block discovery rate. In addition, for larger test cases, MCTS performs on average 2.8 times better than DFS and BFS in terms of the block discovery rate.
Software Crash Analysis for Automatic Exploit Generation on Binary Programs
(2014-03-01)
Huang, Shih-Kun
;
Huang, Min-Hsiang
;
Huang, Po-Yen
;
Lu, Han-Lin
;
Lai, Chung-Wei
This paper presents a new method, capable of automatically generating attacks on binary programs from software crashes. We analyze software crashes with a symbolic failure model by performing concolic executions following the failure directed paths, using a whole system environment model and concrete address mapped symbolic memory in (SE)-E-2 We propose a new selective symbolic input method and lazy evaluation on pseudo symbolic variables to handle symbolic pointers and speed up the process. This is an end-to-end approach able to create exploits from crash inputs or existing exploits for various applications, including most of the existing benchmark programs, and several large scale applications, such as a word processor (Microsoft office word), a media player (mpalyer), an archiver (unrar), or a pdf reader (foxit). We can deal with vulnerability types including stack and heap overflows, format string, and the use of uninitialized variables. Notably, these applications have become software fuzz testing targets, but still require a manual process with security knowledge to produce mitigation-hardened exploits. Using this method to generate exploits is an automated process for software failures without source code. The proposed method is simpler, more general, faster, and can be scaled to larger programs than existing systems. We produce the exploits within one minute for most of the benchmark programs, including mplayer. We also transform existing exploits of Microsoft office word into new exploits within four minutes. The best speedup is 7,211 times faster than the initial attempt. For heap overflow vulnerability, we can automatically exploit the unlink() macro of glibc, which formerly requires sophisticated hacking efforts.
Spectrum-Base Fault Localization by Exploiting the Failure Path
(2016-01-01)
Lu, Han-Lin
;
Gao, Ruizhi
;
Huang, Shih-Kun
;
Wong, W. Eric
;
交大名義發表
Software security is crucial in every aspect of information technology. As today's software has become larger and more complex than ever before, software fault localization has become more time consuming and labor intensive accordingly. Consequently, a broad spectrum of software fault localization techniques are proposed and implemented. However, most of these techniques assume the existence of a test suite to enable their execution traces and results to be used in locating program bugs. However, this is not always true in practice. After the release of software, programmers begin debugging immediately after one failure is detected. Only the test case that results in the failure is available for programmers. In such a situation, fault localization techniques, which require multiple failed and successful test cases, cannot be applied. Hence, in this paper, we propose an innovative fault localization framework, CRAXfault, based on single-path concolic execution, which exploits the execution path of one failed test case to automatically generate numerous test cases that are then used in a fault localization technique (e.g., Tarantula, Ochiai, Crosstab, and DStar). CRAXfault is evaluated across 15 real-life programs. The results demonstrate a remarkable effectiveness of CRAXfault in the number of statements that must be examined before the first faulty statement for a given bug is identified and acceptable efficiency in the time cost for generating test cases.