With the development of Pre-trained Language Models (PLMs), a wide variety of Chinese NLP tasks benefit from the BERT structure. Unfortunately, Chinese BERT-based PLMs are vulnerable to adversarial attacks and expose robustness issues. It inspired numerous defense works devoted to improving the model robustness. However, existing pre-training methods incur substantial time costs, while fine-tuning methods need more evidence to demonstrate how well the target model has been defended. This work aims to bridge this gap. We propose RoFuBERT, a robust fine-tuning framework using fuzz testing for Chinese BERT-based PLMs. We extract Chinese pinyin, glyph, and synonym features of downstream NLP tasks during fine-tuning. We integrate them into fuzz testing and evaluate the testing completeness of the model under adversarial attacks. Finally, we retrain the model for robust fine-tuning. Our evaluation shows that RoFuBERT improves adversarial robustness efficiently. Compared with the two baselines, RoFuBERT takes only 0.13 times more time. The reduction of adversarial attack success rate is improved by 41.26 %, and the modification rate of the adversarial samples is improved by 16.19 %, on average.

ABSTRACT Image segmentation software (SegSoftware) is a kind of DNN‐based image analysis software that aims to recognize the shapes and categories of instances according to their implicit semantic information. SegSoftware frequently uses in safety‐critical fields. Therefore, we should provide adequate testing to SegSoftware. Due to the high cost of manually acquiring the testing oracle for SegSoftware, we employ metamorphic testing to detect its erroneous behaviour. This paper proposes SegTest, a metamorphic testing method that primarily addresses two major challenges in applying metamorphic testing to SegSoftware: (1) devising a method for generating derived test cases, which is the data augmentation approach, and (2) finding effective metamorphic relations for automatically generating the testing oracle. Regarding the former, SegTest utilizes an instance‐level data augmentation method. It generates new test data by inserting annotated instances into the existing images. For ease of exposing erroneousness, we statistically analysed thousands of SegSoftware erroneous behaviours and formulated the guidance strategy of instance selecting and insertion positioning. As for the latter, this paper proposes a metamorphic relation to insert an instance at a position in an original image, where SegSoftware should accurately segment the inserted instance's contour and assign it the appropriate category while preserving the segmentation results of other regions unchanged. Our empirical study shows that SegTest can effectively detect thousands of erroneous behaviours of SegSoftware, and the formulated augmentation strategy achieves a 12.1%–14.1% improvement in SegSoftware erroneousness detection. SegTest also detects 7135 erroneous behaviours on the commercial IBM Segmenter, which verifies the effectiveness of erroneousness detection in practice.

Smart contracts manage numerous digital assets, their security requirements are particularly prominent. Testing is an effective way to ensure the reliability of smart contracts. Current test case generation methods do not consider the impact of state variables and cross-contract calls on constraint conditions, leading to low test coverage for cross-contracts. In this regard, we propose a Cross-contract Data flow Analysis based Test case Generation (CDA-TG) method for Ethereum smart contracts. First, for each function in the target contract, CDA-TG generates its invocation sequence based on the principle of prioritizing functions that define or modify state variables. Then, for each parameter, CDA-TG performs cross-contract data flow analysis on the target contract, extracting the hard-coded values to build its parameter input pool. On this basis, CDA-TG applies the function invocation sequences to generate an initial set of test cases, where the value of each parameter is selected randomly from its parameter input pool. Finally, to further improve the branch coverage, CDA-TG applies the multiobjective sorting algorithm DynaMOSA to optimize the initial test cases. Our empirical study on 66 real smart contracts verified that CDA-TG can significantly improve the branch coverage of smart contracts, with a 8.86% improvement compared to the state-of-the-art test case generation method AGSolT in cross-contract scenario.

Abstract Recent advances in artificial intelligence technology and perception components have promoted the rapid development of autonomous vehicles. However, as safety‐critical software, autonomous driving systems often make wrong judgments, seriously threatening human and property safety. LiDAR is one of the most critical sensors in autonomous vehicles, capable of accurately perceiving the three‐dimensional information of the environment. Nevertheless, the high cost of manually collecting and labeling point cloud data leads to a dearth of testing methods for LiDAR‐based perception modules. To bridge the critical gap, we introduce MetaLiDAR, a novel automated metamorphic testing methodology for LiDAR‐based autonomous driving systems. First, we propose three object‐level metamorphic relations for the domain characteristics of autonomous driving systems. Next, we design three transformation modules so that MetaLiDAR can generate natural‐looking follow‐up point clouds. Finally, we define corresponding evaluation metrics based on metamorphic relations. MetaLiDAR automatically determines whether source and follow‐up test cases meet the metamorphic relations based on the evaluation metrics. Our empirical research on five state‐of‐the‐art LiDAR‐based object detection models shows that MetaLiDAR can not only generate natural‐looking test point clouds to detect 181,547 inconsistent behaviors of different models but also significantly enhance the robustness of models by retraining with synthetic point clouds.

Reentrancy vulnerabilities in Ethereum smart contracts have caused huge financial losses in recent years, promoting the development of reentrancy detection tools. Evaluation of reentrancy detection tools has emerged as an essential research focus consequently. However, despite numerous reentrancy detection evaluation approaches, there is no systematically classified set of reentrancy vulnerabilities in evaluation. This oversight may result in a limited understanding of the actual effectiveness of reentrancy detection tools. This paper employs mutation testing to generate classified sets of reentrancy vulnerabilities and evaluate reentrancy detection tools. To determine the types of reentrancy that can be mutated, we use symbolic execution to identify potential reentrancy paths in smart contracts. For each reentrancy type, we design one to three mutation operators. Then, we employ pattern matching to locate statements where mutation operators can be applied, thus generating sets of reentrancy vulnerabilities of different types. We implemented and compared our mutation testing tool with other tools. Results show that we generated at least 29% more classified reentrancy mutants. Furthermore, we evaluated two state-of-the-art reentrancy detection tools based on the classified reentrancy mutants. The findings provide directions for advancing reentrancy detection tools.

Blockchain effectively solves the security problem in the information sharing process of Internet of Vehicles (IoV). However, the additional information consensus process inevitably affects the information sharing performance of the Blockchain-based Internet of Vehicles (BlockIoV). In order to satisfies BlockIoV’s performance requirements such as transactions per second, latency, and block utilization, it is necessary to pay attention to the blockchain configuration. Since there exist conflicts among these performance requirements, increasing a single hand may cause other indicators to decrease. Therefore, the performance optimization problem for the information sharing process of BlockIoV can be regarded as a multiobjective optimization problem. In this regard, we propose a BlockIoV-oriented performance optimization method, namely BlockIoVOpt, which utilizes the multi-objective particle swarm optimization algorithm to find the Pareto optimal blockchain configuration. Specifically, we construct the objective functions for each of the performance indicators and design the iterative evolution rules for particle swarms. To obtain the performance results of the objective function under a given blockchain configuration, we also designed a BlockIoV-oriented information sharing process simulator, BlockIoVPref. The experimental results show that: BlockIoVOpt can effectively find the Pareto optimal configuration of the blockchain in a given test scenario and effectively optimize the transactions per second, latency of transaction, and block utilization rate of BlockIoV. This study provides an essential reference for the design of blockchain configuration schemes in information sharing of BlockIoV.

An Ethereum smart contract is an agreement reached by multiple parties, which is guaranteed by blockchain technology to be executed in accordance with the terms expressed in the form of code. Its security needs are particularly prominent due to a large number of digital assets under management. Testing is an effective way to find flaws that threaten the security of smart contracts. However, current smart contract test case generation methods do not regard the impact of other functions in the smart contract on state variables, resulting in the inaccessibility of the control statements related to state variables and low branch coverage of the function under test. To alleviate this problem, this paper proposes SV-Gen. SV-Gen generates test cases for smart contracts through two steps: static analysis and dynamic search. In the first step, SV-Gen considers the read-write relationship between functions and state variables in the smart contract to generate a function invocation sequence for the function to be tested through a backtracking algorithm on state variables. Then the arguments of transactions to invoke each function in the sequence are generated through regex matching to form the primitive test case. In the second step, the primitive test cases constitute an initial population, and a genetic algorithm undertakes the task of evolving them to high branch coverage. The experimental results on one of the VeriSmart datasets show that SV-Gen can effectively enter the control constraints related to state variables and improve the branch coverage of smart contracts.

Blockchain Digital Assets (BDAs) are intangible assets issued based on blockchain, providing a new paradigm for managing digital assets. Smart contracts are programs running on the blockchain and enhance the flexibility of BDA in a programmable way. However, scarcity defects in smart contracts can lead to abnormal changes in the number of BDA and affect their worth. Software invariants are logical assertions that a program fragment needs to remain faithful during execution and work well in defect detection. This paper studies the scarcity defect detection method of smart contract digital assets based on invariant analysis for the first time. First, we point out eight scarcity defects in three categories and describe their examples. Next, we propose two invariants—transfer invariant and swap invariant—that should be maintained in digital assets’ management and transaction process. Then, we use the two invariants as test oracles and propose an oracle-based method to detect scarcity defects in smart contract. Finally, we evaluate the proposed method on a real-world smart contract dataset. The experimental results show that our method can effectively detect scarcity defects in smart contracts and improve the scarcity defect detection capability of existing smart contract testing tools.

Different from within-project software defect prediction (WPDP), cross-project software defect prediction (CPDP) does not require sufficient training data and can help developers in the early stages of software development. Recent studies tried to learn semantic features for CPDP by feeding neural networks with abstract syntax tree (AST) token vectors. However, the ASTs directly parsed from software modules usually have complex structures, which are reflected on more nodes and deeper size, and the transfer learning is not regularly adopted to further reduce the data distribution difference between the source project and the target project. To solve these problems, we aim to joint learn the statement level trees (SLT) and alleviate data distribution difference with maximum mean discrepancy (MMD) to improve defect prediction performance on CPDP. Specifically, we propose a novel cross-project defect prediction method S2LMMD via statement semantic learning and MMD. We first construct the SLT by splitting the original AST on specified node. Then we generate more effective semantic features by learning of sequence embedding with Bi-GRU neural network. Finally, a transfer loss MMD is carried out to keep more common characteristics across different project datasets to further improve CPDP performance. To verify the effectiveness of our proposed method, we conducted experiments on ten widely used open-source projects and evaluated the experimental performance by using AUC measures. Our empirical results show that our proposed method S2LMMD can significantly outperform eight state-of-the-art baselines. In addition, for semantic learning, SLT has a higher influence on CPDP, while MMD is of great significance in transfer learning.

Blockchain enjoys a rapid development over current years, penetrating multiple areas of application. However, despite the active evolvement of blockchain systems, no special attention is attached to such a hot spot. To gain a clear image of their evolution process, we conducted an empirical study on six open-source blockchain projects with long life span, covering a total of 504 versions. We attempted to verify whether Lehman's Laws are still applicable to blockchain applications over the passage of time with multiple metrics, and found that there do exist laws like declining quality are not confirmed. We raised our new findings---the centralized trends of revisions and non-smooth growth based on the experimental results as well. By this paper, we hope to provide future researcher on blockchain with an overview of its evolution and reveals the points on which special effort should pay during the periods of development and maintenance.

The smart contract cannot be modified when it has been deployed on a blockchain. Therefore, it must be given thorough test before its being deployed. Mutation testing is considered as a practical test methodology to evaluate the adequacy of software testing. In this paper, we introduce MuSC, a mutation testing tool for Ethereum Smart Contract (ESC). It can generate numerous mutants at a fast speed and supports the automatic operations such as creating test nets, deploying and executing tests. Specially, MuSC implements a set of novel mutation operators w.r.t ESC programming language, Solidity. Therefore, it can expose the defects of smart contracts to a certain degree. The demonstration video of MuSC is available at https: //youtu.be/3KBKXJPVjbQ, and the source code can be downloaded at https://github.com/belikout/MuSC-Tool-Demo-repo.

In Ethereum, many accounts and funds have been managed by smart contracts, thereby making them easy to be targeted. Due to the persistence characteristic of blockchain, revising a deployed smart contract is almost impossible. Both realities heighten the risks of managing funds and thus increase the demand for conducting sufficient testing to Ethereum Smart Contracts (ESC). Different from the conventional software, ESC is a gas-driven program, where developers must charge gases for deploying and testing it. Therefore, it is important to provide a cost-effective yet representative test suite, where its representativeness can be typically measured by its branch coverage. In this paper, we deem the problem of ESC test generation as a Pareto minimization problem, and three objectives, minimizing (1) uncovered branch coverage, (2) time cost, and (3) gas cost are considered. Then, we propose a random based and an NSGA-II based multi-objective approach to seek cost-effective test-suites. Our empirical study on a set of smart contracts in eight of the most widely used Ethereum Decentralized Applications (DApps) verified that the proposed approaches could significantly reduce the gas cost as well as the time cost while retaining the ability to cover branches.

The recent studies indicate that predicate-based statistical fault localization suffered from the control dependence confounding effect and the failure flow confounding effect, which decrease the measurement accuracy of fault localization. However, the extent of the potentially confounding effect of data dependence is uncertain. This paper presents a novel approach that accounts for the effects of program dependences to mitigate the confounding effect during statistical predicate-based fault localization. First, we present a variable type-based predicate designation technique to improve the ability of fault-relevant predicate identification. Then, we conduct dependence analysis to examine the extent of the potentially confounding effect of data dependence in fault localization. Finally, we propose a linear regression-based method to mitigate both the data dependence confounding effect and the control dependence confounding effect. Using the open-source software systems, we find that the fault-relevant predicate can be identified effectively by the proposed predicate design technique, and the effectiveness of fault localization can be significantly improved after mitigating the dependence confounding effect.