A Comparison of Static Analysis and Fault Injection Techniques for Developing Robust System Services

Static source code analysis and software fault injection are two popular approaches to testing and verifying the robustness of software. We chose a set of commonly-used applications: CUPS, Berkeley DB, the GNU le utilities, Apache, MySQL, sudo and zlib, and tested them with both static analysis and fault injection tools to discover errors. The results of our tests provide insight into the strengths and weaknesses of each tech- nique. These results also suggest possibili- ties for improving each type of tool, as well as ways to form a synergistic combination of the two.