Bug-Injector

Bug-Injector generates test cases to stress-test cyber defense tools. It works by injecting known bug templates into real-world code, and seamlessly weaving the bug into the surrounding code. Bug-Injector can be used to generate, on demand, test cases for a particular type of bug in a particular host program. Every test case comes with a witness - an input that allows the injected bug to manifest.

In contrast with cyber defense benchmarks created through other means, Bug-Injector test cases are realistic, come with ground truth and a triggering input for each bug, and can be generated on demand in large quantities. They are also not biased towards or against any specific bug finding techniques.

Bug-Injector can support continuous software assurance by assuring the quality of DevSecOps pipelines, as shown below.

Engineers use Bug-Injector to add bugs, flaws, and vulnerabilities into the source code of the software project. The buggy code passes through the DevSecOps process, including on-commit checks, the build process, and all assurance processes including Static and Dynamic Application Security Testing. At the end, engineers compare the list of injected bugs against testing reports to identify caught bugs, missed bugs, and any blind spots in the DevSecOps pipeline. This process is fully automated, allowing it to be repeated regularly for continuous assessment of the health of the DevSecOps pipeline as it undergoes updates and reconfigurations.