Jun 2026· Proceedings of the ACM on Software Engineering· Vol 3, pp. 3415 - 3438· 0 citations· 78 references
TL;DR
TraceDroid is proposed, a novel automated GUI testing approach that leverages suspicious code-level signals to guide dynamic exploration and successfully detects 21 previously unknown crash bugs in 116 popular Google Play apps, demonstrating its effectiveness in real-world scenarios.
Abstract
Mobile applications frequently suffer from crash bugs that are triggered under specific GUI interaction sequences. Existing automated GUI testing techniques mainly emphasize increasing coverage through diverse exploration strategies, but they often fail to reach the precise interaction contexts that lead to crashes, resulting in low bug detection efficiency. This paper proposes TraceDroid, a novel automated GUI testing approach that leverages suspicious code-level signals to guide dynamic exploration. Instead of treating static analysis as an independent detection method, TraceDroid uses heuristic rules distilled from real crash reports to detect suspicious code segments, associate them with GUI widgets, and collect code-level interaction signals. It then constructs the Activity Transition Graph (ATG), performs rough path generation, and employs LLM-based executable path completion to produce a set of suspicious paths. Finally, TraceDroid executes these paths through global path planning, local path generation, and execution-aware monitoring to efficiently expose crashes. We evaluate TraceDroid on 70 real crash bugs across 42 open-source apps, comparing it with 15 state-of-the-art baselines. TraceDroid achieves the best performance, with a recall of 77%, exceeding the best baseline by 28%, while maintaining comparable or higher coverage. Furthermore, TraceDroid successfully detects 21 previously unknown crash bugs in 116 popular Google Play apps, of which 15 have been fixed and 6 confirmed by developers, demonstrating its effectiveness in real-world scenarios.
Verification-aware languages, like Dafny, integrate formal specifications directly into source code to enable static correctness checks. However, when verification fails, the feedback provided is often limited to the specific condition of the error, such as a violated postcondition, rather than the root cause of the fault. While Dafny's counterexample features provide concrete execution traces, these typically expose a single failing path per assertion failure, leaving the developer to manually look through the entire trace to locate the error. This paper investigates automated fault localization for verification-aware languages by comparing two paradigms: state-based and counterexample-based localization. Our state-based localization strategy replicates the ``snapshot''methodology of AutoFix by inferring invariants and predicates to identify suspicious program states. The counterexample-based strategy consists of a family of techniques that progressively enrich the use of verifier output: from raw counterexample extraction, to structured single-trace ranking, and to multi-trace aggregation. To validate these methods, we present an evaluation framework using MutDafny to generate a diverse mutant dataset from DafnyBench and measure localization effectiveness using the EXAM score. Our results show that counterexample-based approaches substantially outperform state-based localization in this setting. Structured ranking over a single trace yields the largest improvement over raw counterexample output, while multi-trace aggregation provides additional gains in robustness and debugging utility by increasing coverage and reducing path bias introduced by the solver. These findings demonstrate that effective fault localization in verification-aware languages depends both on using counterexample information, and how that information is structured and diversified.
Álvaro F. Silva, Isabel Amaral, João Pascoal Faria et al.· 0 citations
This work presents CodeMechanic, a bug-property-guided system for generating constrained mit- igations for spatial memory corruption that combines a two-dimensional static and dynamic context extractor with in-prompt debugging knowledge and stepwise val- idation to limit the effect of LLM errors.
Han Zheng, Rafaila Galanopoulou, Ilia Shumailov et al.· 0 citations
Open source software is vulnerable to supply-chain attacks through transitive dependencies, especially malicious code injected into NPM packages. Existing detectors often inadequately model obfuscated behavior, overlook JavaScript's object-centric features, poorly coordinate static and dynamic analysis, and lose semantic information during behavior abstraction. We propose ProfMalPlus, a malicious NPM package detector combining object-sensitive behavior graphs with coordinated LLM reasoning over annotated code slices. It identifies installation commands and entry files, then constructs graphs capturing sensitive APIs, third-party calls, and unresolved calls. From these graphs, ProfMalPlus extracts security-relevant slices and adds inline static analysis evidence. Local judge agents independently assess each slice. Self-consistency consolidates repeated judgements to reduce LLM variance, while a global judge synthesizes their reports into an entry-level verdict. For undetermined cases, a router selects either third-party enrichment, which adds registry derived module and method semantics, or dynamic augmentation, which executes the package in a sandbox to resolve runtime dependent behavior. The enriched evidence is fed back for reassessment. Finally, a localization agent reports malicious code snippets with explanations. ProfMalPlus achieves a 98.1% F1-score, outperforming state-of-the-art detectors by 3.5% to 52.6%. It also identified 597 previously unknown malicious packages, all confirmed and removed from NPM.
Yiheng Huang, Zhijia Zhao, Bihuan Chen et al.· 1 citation
Attack trace datasets reflecting each organization's network and device configuration are essential for evaluating detection rules and incident response procedures, yet generalized datasets abstract such configurations away. To address this, we proposed a method that automatically selects, executes, and collects traces from feasible MITRE ATT&CK techniques within an operator-prepared virtual environment. However, its prototype collected only file differences and the Target's standard event logs, and did not account for volatile or post-cleanup traces. In this paper, we extend the trace collection mechanism with file-I/O API hooks and router-side communication log collection, and systematically evaluate the 747 Atomic Red Team techniques applicable to our experimental environment, quantifying per tactic and per log source the trace evidence captured before and after attacker cleanup. Approximately 86% of techniques were executable to completion, and traces remained after cleanup for about 76% of the executable techniques (rising to 83% under full-traffic logging). The resulting per-tactic, per-source coverage characterization provides a baseline for optimizing organizational monitoring configurations and prioritizing incident response.
In large-scale systems, fault localization remains expensive because bug reports are often ambiguous and incomplete. In practice, developers rely heavily on runtime logs and coverage data as critical clues for reasoning about how faults propagate through systems. However, these rich diagnostic signals are rarely integrated systematically into automated localization frameworks. To address this gap, we propose LogHound, a practical debugging assistant that combines call-graph-based execution path reconstruction with static coverage estimates to rank suspicious program entities. We evaluate LogHound across 5 representative distributed systems, comparing it against recent baselines including COCA, ReAct, and RCACopilot. The results show that LogHound consistently outperforms prior approaches, particularly in Top-3 and Top-5 accuracy. An ablation study further reveals that execution path reconstruction is essential for recovering causal chains of failures, while coverage scores provide complementary evidence that sharpens the ranking. These findings validate our design choices and highlight the importance of combining multiple forms of diagnostic clues. By reducing manual investigation costs and accelerating debugging cycles, LogHound contributes to enhancing the reliability of long-lived, evolving software systems.
Zheyuan Lin, Yang Feng, Jian-Jun Chen et al.· Fall Joint Computer Conferen...· 0 citations
Symbolic execution effectively discovers security violations but suffers from path explosion. Engines like KLEE therefore use path prioritization heuristics to order state exploration, typically optimizing code coverage. However, path prioritization can become trapped in cyclic control-flow regions, where repeated branching consumes the exploration budget before exploration reaches vulnerable code beyond these cyclic regions. We propose KLEECopilot, a Large Language Model (LLM)-guided directed symbolic execution approach built on KLEE. KLEECopilot uses LLMs to mark potentially vulnerable code and guide path prioritization. It also integrates loop-exit prioritization to escape potentially non-vulnerable cycles and progress toward deeper vulnerabilities. Compared with baselines such as Empc, KLEECopilot improves basic block coverage by 42.24% and line coverage by 125.82%. It discovers 1,335 total violations and 87 unique violations, outperforming the second-best baseline by 32.2% in total violations and Empc by 24.3% in unique violations. Although KLEECopilot is sensitive to model family, it exhibits only marginal sensitivity to model scale, supporting the efficacy of integrating security semantics and loop-exit prioritization. Ablation studies further show that individual components contribute to effectiveness: alternative configurations involving searchers, internal components, marking sources, and prompt variants yield only 54--61 unique violations, while KLEECopilot maintains competitive code coverage.
Lingfeng Chen, Tao Xiao, Masanari Kondo et al.· 0 citations