Learning extended FSA from software: An empirical assessment

A number of techniques that infer finite state automata from execution traces have been used to support test and analysis activities. Some of these techniques can produce automata that integrate information about the data-flow, that is, they also represent how data values affect the operations executed by programs. The integration of information about operation sequences and data values into a unique model is indeed conceptually useful to accurately represent the behavior of a program. However, it is still unclear whether handling heterogeneous types of information, such as operation sequences and data values, necessarily produces higher quality models or not. ehavioral models In this paper, we present an empirical comparative study between techniques that infer simple automata and techniques that infer automata extended with information about data-flow. We investigate the effectiveness of these techniques when applied to traces with different levels of sparseness, produced by different software systems. To the best of our knowledge this is the first work that quantifies both the effect of adding data-flow information within automata and the effectiveness of the techniques when varying sparseness of traces. quantified constraints, compared to simple FSAs. However it is . Introduction In the recent years, several techniques that automatically derive ehavioral models from execution traces have been used to suport validation and verification activities (Lorenzoli et al., 2008; allmeier et al., 2006; Ernst et al., 2001; Hangal and Lam, 2002; enkel and Diwan, 2003; Mariani and Pastore, 2008; Raz et al., 002; Ammons et al., 2002). A kind of model that is both comonly used to represent program behaviors and largely supported y model generation techniques is Finite State Automaton (FSA) Lorenzoli et al., 2008; Dallmeier et al., 2006; Mariani and Pastore, 008; Ammons et al., 2002; Biermann and Feldman, 1972). Recent results highlighted that many program behaviors canot be accurately represented with FSAs, but require models that nclude not only the information about the possible sequences f events executed by programs but also data-flow information Lorenzoli et al., 2008; Mariani and Pastore, 2008; Mariani et al., 011a). For instance, the parameters that a program uses to open file can influence the way the file will be successively used (e.g., pening a file with the read option does not allow values to be writen into the file). Simple FSAs can represent the different ways a file ∗ Corresponding author. E-mail address: [email protected] (L. Mariani). 164-1212/$ – see front matter © 2012 Elsevier Inc. All rights reserved. ttp://dx.doi.org/10.1016/j.jss.2012.04.001 © 2012 Elsevier Inc. All rights reserved. can be used (e.g., reading or writing), but cannot relate the specific usage to the opening mode. For instance gkTail (Lorenzoli et al., 2008) and KLFA (Mariani and Pastore, 2008) are two techniques that can extract FSAs that incorporate data-flow information. In particular, gkTail builds FSAs where transitions are annotated with data-flow information consisting of algebraic constraints. The algebraic constraints associated with transitions specify the concrete values that can be assigned to attributes, thus representing with a single transition a large (possibly infinite) set of events. Fig. 1 shows an example EFSA1 inferred by gkTail. KLFA builds simple FSAs with transition labels that incorporate data-flow information consisting of universally quantified constraints. Universally quantified constraints specify how data values can reoccur across events. Also in this case the inferred FSA can represent a (possibly infinite) set of events with a single transition. Fig. 2 shows an example EFSA inferred by KLFA. The models generated by KLFA and gkTail can effectively represent data-flow information through algebraic and universally still unclear whether automatically inferred models extended with data-flow information are generally more accurate than simple 1 In the rest of the paper we will interchangeably use the terms extended FSA (EFSA) and FSA with data-flow information to indicate models extended with either algebraic or universally quantified constraints. 2064 D. Lo et al. / The Journal of Systems and