Perspectives on search strategies in automated test input generation

1 Introduction Automatically generating a limited number of high-quality inputs to reveal bugs,crashes,and hangs becomes a central problem in software testing research [1].The two most extensively studied approaches to automated test input generation are fuzzing [2] and dynamic symbolic execution [3,4] (DSE). Both fuzzing and DSE can effectively generate structural test inputs for non-trivial programs without human aids,and are extensively studied in existing literatures [3-5].However,they are also considerably different.To further understand in what sense they are similar or different,and to understand the strengths and limitations of both techniques,we raise the following two questions: (Q1) How do existing fuzzing and DSE techniques model the input space and manage the search procedure?