Automatic event sequence generation tools are widely used for testing GUI applications. With these tools, developers can easily test the target GUI applications with a large number of events and collect a group of crash-triggering sequences in a short time. However, some efficiency-oriented tools generate low-level events randomly based on coordinates of the screen instead of widgets, which leads to many ineffective events that have no contribution to the test. Besides, the randomly generated sequences may repeatedly operate on the same widget or jump to the same window, which increases the complexity of sequences and makes it difficult to extract key events that can lead to crashes. The sequence reduction technique can effectively help developers to understand the crashes and further improve the quality of code. In this paper, we propose a general model for the event sequence reduction problemon GUI applications. For better illustration, we take the random test generation tool Monkey as a concrete instance, which is widely used for testing Android applications, owing to its simplicity, effectiveness and good compatibility. To address the major drawbacks in original Monkey testing, in this paper, we attempt to enhance Monkey to support the sequence record-and-replay and propose a sequence reduction approach for Android apps, which helps the crash behavior comprehension and fault localization. By manually investigating the effectiveness of Monkey events, we find three types of ineffective events, including no-ops, single and combination of effect-free ones, and design nine reduction rules for them. To extract key events in one sequence for crash understanding, we analyze the state transition relation among events and propose a static GUI state hierarchy-tree-guided reduction approach. Additionally, we implement our approach in a tool CHARD to achieve event sequence reduction on real-world apps. We also design a semi-structured format to describe the actual behavior of events and improve the sequence comprehensibility. We collect 890 sequences from 74 applications as our benchmark, including 740 basic sequences, each of which contains 1,000 events, and 150 longer ones, each of which contains 10,000 events. CHARD can quickly identify 41.3% events as ineffective ones in the collected sequences. For sequences that can be stably replayed, over 94% of the reduced sequences keep the same functionalities as the original ones. By removing ineffective events, CHARD can be used as a pre-process part of the traditional delta-debugging process and make significant speed up. To evaluate the effectiveness of the key event extraction approach, we pick eight buggy applications and collect 40 crash-triggering event sequences generated by Monkey, the length of which varies from 19 to 2700. The results show that CHARD can successfully remove over 95.4% crash-irrelevant events in these crash-triggering sequences within around ten seconds, while the state-of-the-art delta-debugging tool removes 71.3% ones using over 27 hours, which indicates that CHARD can efficiently help the crash replay and sequence comprehension. (C) 2020 Elsevier B.V. All rights reserved.

Modal logic S5 has found various applications in artificial intelligence. With the advances in modern SAT solvers, SAT-based approach has shown great potential in solving the satisfiability problem of S5. The scale of the SAT encoding for S5 is strongly influenced by the upper bound on the number of possible worlds. In this paper, we present a novel SAT-based approach for S5 satisfiability problem. We show a normal form for S5 formulas. Based on this normal form, a conflict graph can be derived whose chromatic number provides an upper bound of the possible worlds and a lot of unnecessary search spaces can be eliminated in this process. A heuristic graph coloring algorithm is adopted to balance the efficiency and optimality. The number of possible worlds can be significantly reduced for many practical instances. Extensive experiments demonstrate that our approach outperforms state-of-the-art S5-SAT solvers.

Monkey, which is integrated with the Android system, becomes the most widely used test input generation tool, owing to the simplicity, effectiveness and good compatibility. However, Monkey is based on coordinates of screen and oblivious to the widgets and the GUI states, which results in a great many ineffective events that have no contribution to the test. To address the major drawbacks, this paper parses the events of 200 test sequences generated by Monkey into human-readable scripts and manually investigate the effects of these events. We find three types of patterns on the ineffective events, including no-ops, single and combination of effect-free ones, and summarize them into ten rules for sequence reduction. Then, we implement a tool CHARD to match these patterns in real-world traces and prune the redundant events. The evaluation on 923 traces from various apps covering 16 categories shows that CHARD can process 1,000 events in a few seconds and identifies 41.3% events as ineffective ones. Meanwhile, the reduced sequence keeps the same functionality with the original one that can trigger the same behaviors. Our work can be applied to lessen the diagnose effort for record-and-replay, and as a preprocessing step for other works on analyzing sequences. For instance, CHARD can remove 72.6% ineffective events and saves 67.6% time of delta debugging in our experiments.

In this paper we formalize the semantics of the Android multitasking mechanism and develop efficient static analysis methods with automated tool supports. For the formalization, we propose an extension of the existing Android Stack Machine model to capture all the core elements of the mechanism, in particular, the intent flags used in inter-component communication. For the static analysis, we consider the configuration reachability and stack boundedness problem, designing new algorithms and developing a prototype tool TaskDroid to fully support automated model construction and analysis of Android apps. The experimental results show that TaskDroid is effective and efficient in analyzing Android apps in practice.

Exported Activity (EA), a kind of activities in Android apps that can be launched by external components, is one of the most important inter-component communication (ICC) mechanisms to realize the interaction and cooperation among multiple apps. Existing works have pointed out that, once exposed, an activity will be vulnerable to malicious ICC attacks, such as permission leakage attack. Unfortunately, it is observed that a considerable number of activities in commercial apps are exposed inadvertently, while few works have studied the necessity and reasonability of such exposure. This work takes the first step to systematically study the exposing behavior of EAs through analyzing 13,873 Android apps. It utilizes the EA associated call relationships extracted from byte-code via data-flow analysis, as well as the launch conditions obtained from the manifest files, to guide the study on the usage and misexposure of EAs. The empirical findings are that the EA mechanism is widely adopted in development and the activities are liable to be misexposed due to the developers' misunderstanding or carelessness. Further study on subsets of apps selected according to different criteria indicates that the misexposed EAs have specific characteristics, which are manually summarized into six typical misuse patterns. As a consequence, ten heuristics are designed to decide whether an activity should be exposed or not and are implemented into an automatic tool called Mist. Experiments on the collected apps show that around one fifth EAs are unnecessarily exposed and there are more than one third EAs whose exposure may not be suggested.