Random Testing

Question 1

MUTATE stage

Answer 1

mutate the minimized input using a
variety of traditional heuristic-based fuzzing strategies

Question 2

feedback to AUGMENT

Answer 2

the set of seeds if any of the generated
mutations resulted in a new state transition, and continue the process.

Question 3

A mutation strategy

Answer 3

makes very small conservative changes will suffer from poor
code coverage while an aggressive mutation strategy will make too many changes to
the input seed such that it no longer conforms to the input specifications of the target
program and will be discarded during input sanitization. Mutation strategies must be
carefully engineered to exist in a sweet spot between changes that are too small and
changes that are too large.

Question 4

Cuzz

Answer 4

The idea behind Cuzz is to automate the approach of introducing calls to Sleep() in
order to find concurrency bugs more effectively.
In a realistic program, there is a large number of possible places at which to introduce
Sleep() calls.

Question 5

The depth of a concurrency bug

Answer 5

The depth of a concurrency bug is the number of ordering constraints that a thread
schedule has to satisfy in order for the bug to be triggered.