Christoph's picture

Christoph Csallner

Associate Professor
Computer Science and Engineering Department
University of Texas at Arlington
Box 19015
Arlington, TX 76019-0015
Office: ERB 554 (in the Engineering Research Building), phone: 817-272-3334
Lab: ERB 513 (SERC lab)
Email: csallner@uta.edu

My main research interests are in software engineering, especially in program analysis and automated testing.

Upcoming Events
ASE 2015 ERP, ICST 2015, LT 2015.
Recent Events
WODA 2014, ICST 2014, ICST 2014 Testing Tools Track, TTC 2014, LT 2014.
Publications and citations
DBLP and Google Scholar.
ACM SIGSOFT Distinguished Paper Award [ISSTA 2012]
Best Paper Award [ISSRE 2010]
Best Paper Award + ACM SIGSOFT Distinguished Paper Award [ASE 2007]
ACM SIGSOFT Distinguished Paper Award [ISSTA 2006]
Funding
NSF.
Teaching
CSE 4322 Software Project Management: Fall 2014, Fa13, Fa12, Sp12.
CSE 5324 Software Engineering: Analysis, Design, and Testing: Sp14, Sp13, Sp12, Fa11, Sp11, Fa10, Sp10.
CSE 5325 Software Engineering: Management, Maintenance, and Quality Assurance: Fa12, Sp12.
CSE 6324 Advanced Topics in Software Engineering: Sp14.
CSE 6329 Program Analysis: Sp13, Sp11, Fa08
Software
JCrasher, Check 'n' Crash, DSD-Crasher, Pex/DySy, and Dsc
Ph.D. students
Tuan Anh Nguyen (internship: Software Engineer at Google)
Shabnam Aboughadareh (internship: Researcher at Symantec Research Labs)
Mainul Islam (internships: Software Engineer at TripAdvisor, Software Engineer at Google)
Ph.D. alumni
Ishtiaque Hussain (now: Software Engineer at Infor)
Tuli Nivas (now: Senior Performance Engineer at Athoc)
M.S. alumni
Asheq Hamid (now: Software Engineer at EBSCO Information Services)
Tuan Anh Nguyen (now: Ph.D. student)
If you are considering CSE@UTA for your M.S. or Ph.D. studies and have a question for me, please read Christoph's Answers to Frequently Asked Application Questions.

Testing

Residual investigation: Predictive and precise bug detection (ACM Transactions on Software Engineering and Methodology (TOSEM), 2014)
This is a superset of our earlier ISSTA 2012 paper on residual investigation. The article adds more experiments on applying residual investigation to FindBugs (RFBI), describes the implementation complexity of RFBI, and applies residual investigation in a new context, i.e., static race detection.
Generating test cases for programs that are coded against interfaces and annotations (ACM Transactions on Software Engineering and Methodology (TOSEM), 2014)
Some code can only be invoked and tested with instances of classes that don't yet exist. However state-of-the-art test case generators such as Randoop and Pex do not generate such classes and therefore cannot cover such code. This article extends our WODA 2010 paper on generating (mock) classes during dynamic symbolic execution. This article adds a survey of third-party applications and extends the approach to generating annotations. Our implementation in Dsc covered code that state-of-the-art tools could not cover.
A distributed framework for demand-driven software vulnerability detection (Journal of Systems and Software (JSS), 2014)
While most heavy-weight symbolic program analysis tools are run before program release, this symbolic analysis framework runs while the analyzed program is in production use. Whenever a monitored program encounters an unexplored path, it submits the path to a central server for symbolic analysis. Analysis results are distributed back to other clients.
SEDGE: Symbolic example data generation for dataflow programs (Proc. 28nd IEEE/ACM International Conference on Automated Software Engineering (ASE), 2013)
Dynamic symbolic execution has traditionally been used on assembly code (e.g., x86) as well as procedural (i.e., C) and object-oriented programs (i.e., Java and C#). SEDGE adapts dynamic symbolic execution to the dataflow programming language Pig Latin. While Pig Latin programs are typically compiled to Hadoop MapReduce programs, SEDGE analyzes dataflow programs directly. In our experiments this yielded better results than either analyzing the generated MapReduce programs or using the most closely related test case generator for Pig Latin.
CarFast: Achieving higher statement coverage faster (Proc. 20th ACM SIGSOFT International Symposium on the Foundations of Software Engineering (FSE), 2012)
For a given branching statement encountered during program execution, CarFast estimates the number of statements that are yet uncovered but reachable from the respective branch outcomes. With the symbolic path condition collected during execution, CarFast selects input values such that a future execution will trigger a branch (path) that contains a high number of those yet uncovered statements.
Residual investigation: Predictive and precise bug detection (Proc. ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 2012)
Static bug detectors such as FindBugs produce false warnings. This paper describes RFBI, the Residual FindBugs Investigator. RFBI investigates each FindBugs warning for code location A with a set of residual dynamic analyses at code locations B to Z, such that a dynamic warning at code location X provides additional evidence that the static warning at code location A is likely a true warning. Received an ACM SIGSOFT Distinguished Paper Award.
Evaluating program analysis and testing tools with the RUGRAT random benchmark application generator (Proc. 10th International Workshop on Dynamic Analysis (WODA), 2012)
RUGRAT aims at generating random benchmark applications for evaluating program analysis and testing tools. The RUGRAT prototype can automatically generate large Java applications that consist of a user-specified mix of Java language features such as iteration, recursion, and the use of deep subtype hierarchies.
SimFuzz: Test case similarity directed deep fuzzing (Journal of Systems and Software (JSS), 2012)
SimFuzz is a black-box fuzzer for C programs that guides its test case generation with a test case similarity metric. The metric computes the edit distance between execution paths, where each path element corresponds to the out-edge of a branching node in the program's control-flow graph.
New Ideas Track: Testing MapReduce-style programs (Proc. 19th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE), New Ideas Track, 2011)
We formalize a MapReduce-specific correctness condition that all MapReduce applications have to satisfy, in order to be free of a certain class of bugs. To detect such bugs, we then design a technique that encodes the correctness condition as symbolic program constraints, checks them via dynamic symbolic execution, and generates corresponding test cases.
Managing performance testing with release certification and data correlation (19th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE), Industry Track, 2011)
Testing textbooks prescribe writing performance tests against performance goals. We observe that in practice business analysts may not be able to specify such performance goals at a level that is detailed enough for finding subtle performance bugs. We address this issue by running two different versions of the same application side-by-side in the same test environment, which allows us to use the performance profile of the previous version as the detailed performance specification of the version under test.
A combinatorial approach to detecting buffer overflow vulnerabilities (Proc. 41st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2011)
This paper describes the Tance tool, which found several new vulnerabilities in well-known open-source C programs.
Is data privacy always good for software testing? (Proc. 21st IEEE International Symposium on Software Reliability Engineering (ISSRE), 2010)
Software testing interacts with data anonymization in surprising ways. I.e., increasing data anonymity to protect data during testing can drastically decrease test coverage. One problem is that current anonymization techniques do not take into account how the application under test actually uses the data. We therefore propose to guide data anonymization techniques with program analysis. Received the Best Paper Award.
Dsc+Mock: A test case + mock class generator in support of coding against interfaces (Proc. 8th International Workshop on Dynamic Analysis (WODA), 2010)
Dsc+Mock is a dynamic symbolic test case generator that can reason about type constraints and can generate mock classes that satisfy such constraints. Our prototype implementation achieved higher code coverage than related test case generators that do not generate mock classes, such as Pex.
Dynamic symbolic database application testing (Proc. 3rd International Workshop on Testing Database Systems (DBTest), 2010)
We use dynamic symbolic execution to obtain a program path-condition. We then use this path-condition as a database query.
Detecting vulnerabilities in C programs using trace-based testing (Proc. 40th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2010)
This paper describes the SecTAC tool, which found several new vulnerabilities in well-known open-source C programs.
Scalable satisfiability checking and test data generation from modeling diagrams (Automated Software Engineering, 2009)
This is a superset of our earlier ASE 2007 paper, expanding the treatment of test data generation. Object-Role Modeling (ORM) is a popular language for specifying database schemas. It supports many constraints and is undecidable in general. We pick a restricted subset of ORM that is decidable in polynomial time and implement a fast automated solver. We found that our ORM subset covers the vast majority of constraints used in our sample of over 160 ORM diagrams from industrial practice. Our earlier 2007 paper received the Best Paper Award at ASE 2007.
Combining over- and under-approximating program analyses for automatic software testing (Ph.D. dissertation, 2008)
An existing static program analysis that over-approximates the execution paths of the analyzed program can be made more precise for automatic testing in an object-oriented programming language, by combining the over-approximating analysis with usage-observing and under-approximating analyses. This summarizes the DSD-Crasher, Check 'n' Crash, and JCrasher work. Unpublished material includes a critical review of the performed evaluation, lessons learnt, and how to generalize the approach.
DSD-Crasher: A hybrid analysis tool for bug finding (ACM Transactions on Software Engineering and Methodology (TOSEM), 2008)
This is a superset of our earlier ISSTA 2006 paper on DSD-Crasher, adding a high-level overview, experiments with subjects from the software-artifact infrastructure repository (SIR), more related work, and a discussion on increasing code coverage by reasoning about implicit control flow branches.
Scalable automatic test data generation from modeling diagrams (Proc. 22nd IEEE/ACM International Conference on Automated Software Engineering (ASE), 2007)
Object-Role Modeling (ORM) is a popular language for specifying database schemas. It supports many constraints and is undecidable in general. We pick a restricted subset of ORM that is decidable in polynomial time and implement a fast automated solver. We found that our ORM subset covers the vast majority of constraints used in our sample of over 160 ORM diagrams from industrial practice. Received the Best Paper Award.
Combining static and dynamic reasoning for bug detection (Proc. International Conference on Tests And Proofs (TAP), 2007)
This is an invited paper that reviews our bug finding tools: Check 'n' Crash addresses the language-level unsoundness of static bug finding tools whereas DSD-Crasher also addresses their user-level unsoundness. We use a small case study to compare JCrasher, ESC/Java, Check 'n' Crash, and DSD-Crasher.
DSD-Crasher: A hybrid analysis tool for bug finding (Proc. ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 2006)
DSD-Crasher first uses Daikon to capture the subject's intended execution behavior, then statically analyzes this restricted domain with ESC/Java, and finally lets Check 'n' Crash generate and execute concrete test-cases to verify the results of ESC/Java. Received an ACM SIGSOFT Distinguished Paper Award.
Check 'n' Crash: Combining static checking and testing (Proc. 27th ACM/IEEE International Conference on Software Engineering (ICSE), 2005)
Check 'n' Crash uses ESC/Java to statically search for problems like null dereference, illegal type cast, or illegal array manipulation. Check 'n' Crash compiles ESC's results to JUnit test cases and executes them to filter out ESC's false positives.
JCrasher: An automatic robustness tester for Java (Software -- Practice & Experience, 2004)
JCrasher generates random test cases by chaining object constructors. It filters test case execution and presents only those that expose a bug or lack of robustness. It also enables JUnit to efficiently undo the changes a test case has done to testee class fields.

Mobile Software Engineering

GROPG: A graphical on-phone debugger (Proc. 35th ACM/IEEE International Conference on Software Engineering (ICSE), New Ideas and Emerging Results (NIER) track, 2013)
GROPG is the first graphical on-phone debugger. Developers can use GROPG to debug Android phone applications directly on an Android phone.
An experiment in developing small mobile phone applications comparing on-phone to off-phone development (Proc. 1st International Workshop on User Evaluation for Software Engineering Researchers (USER), 2012)
TouchDevelop represents a radically new mobile application development model, as TouchDevelop enables mobile application development on a mobile device. We describe a first experiment on independent, non-expert subjects to compare programmer productivity using TouchDevelop vs. using a more traditional approach to mobile application development.

Security

Poster: Automatic profiling of evasive mixed-mode malware with SEMU (33rd IEEE Symposium on Security and Privacy (Oakland), Poster session, 2013)
We describe a combination of user- and kernel-mode malware that can subvert state-of-the-art dynamic malware analysis techniques, such as those built on the popular TEMU and Ether analysis frameworks. We present an alternative malware analysis framework, SEMU, which cannot be subverted by such attacks as it performs whole-system analysis outside the analyzed (guest) OS.
Dynamic analysis of evasive modular malware (28th Annual Computer Security Applications Conference (ACSAC), Works In Progress (WiP) Track, 2012)
Dynamic malware analysis is hard as kernel-level malware may manipulate kernel data and thereby derail malware analysis. To address this problem we propose a kernel data duplication scheme that redirects malware to a copy of the kernel data and thus shields the kernel data used by all other applications from malicious manipulation.

Repair

DSDSR: A tool that uses dynamic symbolic execution for data structure repair (Proc. 8th International Workshop on Dynamic Analysis (WODA), 2010)
This paper discusses the implementation of our dynamic symbolic data structure repair tool, DSDSR. We provide initial empirical results of applying DSDSR on different formulations of the same correctness condition and compare DSDSR with a state-of-the-art tool, Juzi.
Dynamic symbolic data structure repair (Proc. 32nd ACM/IEEE International Conference on Software Engineering (ICSE), Volume 2, Emerging Results Track, 2010)
We motivate how dynamic symbolic techniques enable generic repair to support a wider range of correctness conditions and present DSDSR, a novel repair algorithm based on dynamic symbolic execution. We implement the algorithm for Java and report initial empirical results to demonstrate the promise of our approach for generic repair.

Invariant Detection

DySy: Dynamic symbolic execution for invariant inference (Proc. 30th ACM/IEEE International Conference on Software Engineering (ICSE), 2008)
DySy uses the concolic execution system Pex to detect invariants in arbitrary .Net programs. DySy can derive much better targeted invariants than previous, template-based approaches, such as Daikon.
Dynamically discovering likely interface invariants (Proc. 28th ACM/IEEE International Conference on Software Engineering (ICSE), Emerging Results Track, 2006)
We propose a two-pass algorithm to support interfaces and method overriding in dynamic invariant detection. The first pass associates a method call with the method executed and all methods it overrides up to and including the static receiver to derive the methods' preconditions. The second pass associates a method call with every supertype whose precondition is met to derive non-conflicting postconditions.

Information Visualization

FundExplorer: Supporting the diversification of mutual fund portfolios using Context Treemaps (Proc. 9th IEEE Symposium on Information Visualization (InfoVis), 2003)
FundExplorer distorts a treemap to visualize positive values and zeros.

Career Advice

This Website

This website was updated on 26 August 2014 with bibtex2web and visited recently.