Techniques for identifying elusive . . .

Modern software is plagued by elusive corner-case bugs (e.g., security vulnerabilities). There are no scalable, automated ways of finding them, therefore such bugs can remain hidden until software is deployed in production. This thesis proposes approaches to solve this problem. First, we present black-box and white-box fault injection mechanisms, which allow developers to test the behavior of their code in the face of failures in external components, e.g., in libraries, in the kernel, or in remote nodes of a distributed system. We describe a feedback-guided exploration algorithm that prioritizes black-box fault injection tests based on their estimated impact, thus discovering more bugs than random injection. For white-box testing, we proposed and implemented a technique to find Trojan messages in distributed systems, i.e., messages that are accepted as valid by receiver nodes, yet cannot be sent by any correct sender node. We show that Trojan messages can lead to subtle semantic bugs. Our fault injection techniques found new bugs in systems such as the MySQL database, the Apache HTTP server, the FSP file service protocol suite, and the PBFT Byzantine-fault-tolerant replication library. Testing can find bugs and build confidence in the correctness of a system. However, exhaustiv