A Good Analysis of Test Coverage
Test coverage, especially for fuzzing, is always a challenge. The three most common dimensions for analyzing test coverage in software fault injection (robustness testing or fuzzing) are interface coverage, protocol coverage and input coverage. But those are often difficult to measure, therefore simplification helps. A recent white paper on this topic breaks down this analysis into simple things like:
- Attack surface
- Specifications
- Statefulness
Attack surface is a simple to do process of analyzing the interfaces and protocols, whereas specifications and statefulness look at how well those protocols are tested. Understanding these simple metrics helps you understand how well your own fuzzing tool actually does its test. Good luck in fuzzing!
