Resolving the oracle problem for identifying high-level security properties

Identify effective methods to specify and operationalize the high-level security properties that must hold for a given software system by developing test oracles capable of detecting violations of these properties, thereby addressing the unresolved oracle problem.

Background

Dynamic analyses (testing, fuzzing, monitoring) rely on oracles to decide whether executions violate desired properties. However, determining what high-level properties should hold for a system, and how to encode them into actionable oracles, is a core challenge.

The paper explicitly notes that this challenge is captured by the oracle problem, which, despite extensive paper, remains unsolved.