Fabrizio Pastore, PhD

• SMRL (now MST) – A Metamorphic Security Testing Tool for Web Systems (ICSE 2020 Companion)

o Description: SMRL alleviates the oracle problem in security testing through metamorphic testing. It provides a domain-specific language, with an Eclipse editor, to specify metamorphic relations (MRs) capturing security properties of Web systems; it automatically collects input data and translates the relations into executable Java code to detect vulnerabilities. It was evaluated on a commercial system and on Jenkins.

o Citation: Phu X. Mai, Arda Goknil, Fabrizio Pastore, and Lionel C. Briand. 2020. SMRL: A Metamorphic Security Testing Tool for Web Systems. In Proceedings of the 42nd ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion ’20). ACM, 9–12.

o Paper: https://orbilu.uni.lu/handle/10993/43205

o Video: https://youtu.be/9kx6u9LsGxs

o Tool: https://github.com/SNTSVV/SMRL

An MR for the Bypass Authorization Schema vulnerability, in the SMRL editor.

• DESIGNATOR – A Toolset for Automated GAN-enhanced Search-based Testing and Retraining of DNNs in Martian Environments (ASE 2025)

o Description: DESIGNATOR generates datasets for testing and retraining DNNs performing computer vision tasks in Martian-like environments. It integrates MarsSim, a simulator of the Mars environment, with DESIGNATE, an approach combining simulation, generative adversarial networks (GANs), and search-based test input generation; users can select a search strategy and observe the evolution of simulated and realistic images, ground truth labels, DNN predictions, and fitness values. MarsSim can also be used standalone.

DESIGNATOR’s Graphical User Interface.

o Citation: Mohammed Oualid Attaoui and Fabrizio Pastore. 2025. DESIGNATOR: A Toolset for Automated GAN-enhanced Search-based Testing and Retraining of DNNs in Martian Environments. In Proceedings of the 40th IEEE/ACM International Conference on Automated Software Engineering (ASE ’25). IEEE, 3981–3984.

o Paper: https://orbilu.uni.lu/handle/10993/66070

o Video: https://youtu.be/fGxgpgViPEo

o Tool: https://github.com/SNTSVV/DESIGNATOR, https://zenodo.org/records/17865409

• ClusterXplain – A Clustering-based Tool for DNN Components Debugging (FSE 2025 Companion)

o Description: Building on SAFE, ClusterXplain offers 36 pipelines for debugging DNN failures: it extracts features from failure-inducing images with transfer learning models and clusters them, combining different feature extraction methods, dimensionality reduction techniques, and clustering algorithms, to identify the distinct scenarios in which a DNN may fail.

ClusterXplain’s Graphical User Interface.

o Citation: Mohammed Attaoui and Fabrizio Pastore. 2025. ClusterXplain: A Clustering-based Tool for DNN Components Debugging. In Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering (FSE Companion ’25). ACM, 1065–1069.

o Paper: https://orbilu.uni.lu/handle/10993/69249

o Video: https://youtu.be/DU94c-lIwys

o Tool: https://zenodo.org/records/21249809

• MOTIF – A Tool for Mutation Testing with Fuzzing (ICST 2024)

o Description: MOTIF performs mutation testing of C software by leveraging grey-box fuzzing to generate unit test cases that detect the faults injected into mutants, thus overcoming the limitations of symbolic execution, on which the state-of-the-art tool relies. It detects up to 47 percentage points more faults than symbolic execution, when the latter is applicable.

The MOTIF process.

o Citation: Jaekwon Lee, Enrico Viganò, Fabrizio Pastore, and Lionel Briand. 2024. MOTIF: A Tool for Mutation Testing with Fuzzing. In Proceedings of the 17th IEEE Conference on Software Testing, Verification and Validation (ICST ’24). IEEE, 451–453.

o Paper: https://orbilu.uni.lu/handle/10993/61840

o Video: https://www.youtube.com/watch?v=peXB6oDOcMY

o Tool: https://github.com/SNTSVV/MOTIF

• DaMAT – A Data-driven Mutation Analysis Tool (ICSE 2023 Companion)

o Description: DaMAT implements data-driven mutation analysis: instead of modifying source code, it mutates the data exchanged by components, according to a user-provided fault model, to ensure that test suites appropriately exercise component interoperability. It was evaluated on software controlling a microsatellite and on libraries used in deployed CubeSats.

The DaMAT workflow.

o Citation: Enrico Viganò, Oscar Cornejo, Fabrizio Pastore, and Lionel Briand. 2023. DaMAT: A Data-driven Mutation Analysis Tool. In Proceedings of the 45th IEEE/ACM International Conference on Software Engineering: Companion Proceedings (ICSE-Companion ’23). IEEE, 165–169.

o Paper: https://orbilu.uni.lu/handle/10993/54578

o Video: https://youtu.be/s5M52xWCj84

o Tool: https://github.com/SNTSVV/DAMAT

• MASS – A Tool for Mutation Analysis of Space CPS (ICSE 2022 Companion)

o Description: MASS is a mutation analysis tool for embedded software in space cyber-physical systems and similar CPS (e.g., UAVs). It implements optimisation techniques that address the scalability and accuracy challenges of mutation analysis in the CPS context. It was evaluated on the on-board software of a microsatellite currently on orbit, libraries used in deployed CubeSats, and a mathematical library provided by ESA.

Workflow of the MASS approach.

o Citation: Oscar Cornejo, Fabrizio Pastore, and Lionel Briand. 2022. MASS: A Tool for Mutation Analysis of Space CPS. In Proceedings of the 44th ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion ’22). ACM, 134–138.

o Paper: https://orbilu.uni.lu/handle/10993/50092

o Video: https://www.youtube.com/watch?v=gC1x9cU0-tU

o Tool: https://github.com/SNTSVV/FAQAS_MASS

• FISTS – A Field-based Security Testing Tool for Updates in Software-Defined Networks (FSE 2026 Companion)

o Description: FISTS enables black-box security testing of configuration updates in software-defined networks (SDNs), which makes it applicable to the proprietary SDN frameworks typically used in industry. It probes the network hosts before and after a reconfiguration, automatically identifies corresponding nodes, determines their port-state changes, and relies on anomaly detection to prioritise the inspection of hosts, minimising the number of inspected nodes while maximising the vulnerabilities found.

Overview of FISTS, with the steps of the tool and example outputs.

o Citation: Jahanzaib Malik and Fabrizio Pastore. 2026. FISTS: A Field-based Security Testing Tool for Updates in Software-Defined Networks. In Proceedings of the 34th ACM International Conference on the Foundations of Software Engineering (FSE Companion ’26). ACM, 97–101.

o Paper: https://orbilu.uni.lu/handle/10993/68710

o Video: https://youtu.be/AQqADfrRXtI

o Tool: https://doi.org/10.5281/zenodo.18201382

• SAFE – Safety Analysis and Retraining of DNNs (ICSE 2024 Companion)

o Description: SAFE automatically characterises the root causes of DNN failures with a black-box approach: it extracts features from error-inducing images using VGGNet-16 pre-trained on ImageNet, applies density-based clustering to identify plausible causes of failures, and selects additional images to retrain and improve the DNN efficiently.

SAFE’s GUI: Root Cause Clusters visualized as animated gifs.

o Citation: Mohammed Attaoui, Fabrizio Pastore, and Lionel Briand. 2024. SAFE: Safety Analysis and Retraining of DNNs. In Proceedings of the 46th IEEE/ACM International Conference on Software Engineering: Companion Proceedings (ICSE-Companion ’24). ACM, 74–78.

o Paper: https://orbilu.uni.lu/handle/10993/60732

o Video: https://youtu.be/8QD-PPFTZxs

o Tool: https://github.com/SNTSVV/SAFE

• HUDD – A Tool to Debug DNNs for Safety Analysis (ICSE 2022 Companion)

o Description: HUDD (Heatmap-based Unsupervised Debugging of DNNs) supports safety analysis of DNN-based systems by clustering heatmaps that capture the relevance of each DNN neuron, thus automatically grouping error-inducing images with a common root cause. It also retrains the DNN with automatically selected images related to the identified clusters.

Example of clustering results for two DNNs.

o Citation: Hazem Fahmy, Fabrizio Pastore, and Lionel Briand. 2022. HUDD: A Tool to Debug DNNs for Safety Analysis. In Proceedings of the 44th ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion ’22). ACM, 100–104.

o Paper: https://orbilu.uni.lu/handle/10993/50137

o Video: https://youtu.be/drjVakP7jdU

o Tool: https://github.com/SNTSVV/HUDD

• ATUA – An Update-driven App Testing Tool (ISSTA 2022)

o Description: ATUA is an open-source, model-based testing tool for Android Apps that achieves high coverage of the updated App code with a small number of test inputs, thus reducing the outputs to be inspected. It synthesises App models with static analysis, integrates a dynamically-refined state abstraction function, and combines complementary testing strategies.

An action output being reported to the end-user.

o Citation: Chanh-Duc Ngo, Fabrizio Pastore, and Lionel C. Briand. 2022. ATUA: An Update-driven App Testing Tool. In Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA ’22). ACM, 765–768.

o Paper: https://orbilu.uni.lu/handle/10993/51984

o Video: https://youtu.be/RqQ1z_Nkaqo

o Tool: https://github.com/SNTSVV/ATUA

• CPSDebug – A Tool for Explanation of Failures in Cyber-Physical Systems (ISSTA 2020)

o Description: CPSDebug supports engineers in debugging failures in MATLAB Simulink/Stateflow models. It implements a grey-box approach that combines testing, specification mining, and failure analysis to identify the causes of failures and explain their propagation in time and space.

o Citation: Ezio Bartocci, Niveditha Manjunath, Leonardo Mariani, Cristinel Mateis, Dejan Ničković, and Fabrizio Pastore. 2020. CPSDebug: A Tool for Explanation of Failures in Cyber-Physical Systems. In Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA ’20). ACM, 569–572.

o Paper: https://orbilu.uni.lu/handle/10993/44794

o Video: not available

o Tool: not available

• MCP – A Security Testing Tool Driven by Requirements (ICSE 2019 Companion)

o Description: MCP automatically generates executable security test cases from misuse case specifications in natural language (i.e., use case specifications capturing the behaviour of malicious users). It relies on NLP to identify the activities performed by the malicious user and the control flow of the specifications, and matches these activities to the methods of a test driver API. It was evaluated on an industrial case study.

MCP Overview.

o Citation: Phu X. Mai, Fabrizio Pastore, Arda Goknil, and Lionel C. Briand. 2019. MCP: A Security Testing Tool Driven by Requirements. In Proceedings of the 41st IEEE/ACM International Conference on Software Engineering: Companion Proceedings (ICSE-Companion ’19). IEEE, 55–58.

o Paper: https://orbilu.uni.lu/handle/10993/39603

o Video: https://youtu.be/Ys5ESAMFH-Q

o Tool: https://github.com/SNTSVV/MCP

• VART – A Tool for the Automatic Detection of Regression Faults (arXiv 2017)

o Description: VART automatically reveals regression faults missed by regression test suites, including faults that violate application-specific correctness properties rather than causing crashes or exceptions, by combining static and dynamic program analysis. It is integrated into Eclipse.

Eclipse with VART views.

o Citation: Fabrizio Pastore and Leonardo Mariani. 2017. VART: A Tool for the Automatic Detection of Regression Faults. arXiv preprint arXiv:1708.02052 (2017).

o Paper: https://arxiv.org/abs/1708.02052

o Video: https://youtu.be/E6eUraMc0x0

o Tool: https://github.com/lta-disco-unimib-it/BCT_TOOLSET/tree/master/it.unimib.disco.lta.eclipse.vart

• UMTG – A Toolset to Automatically Generate System Test Cases from Use Case Specifications (ESEC/FSE 2015)

o Description: UMTG automatically generates executable and traceable system test cases from use case specifications. It relies on NLP to capture the control flow described in use case specifications following a restricted template, and on constraint solving of OCL constraints on the domain model to generate test inputs. It is integrated with IBM Doors and Rhapsody and was evaluated on an industrial case study.

UMTG’s Consistency Check Report.

o Citation: Chunhui Wang, Fabrizio Pastore, Arda Goknil, Lionel C. Briand, and Zohaib Iqbal. 2015. UMTG: A Toolset to Automatically Generate System Test Cases from Use Case Specifications. In Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering (ESEC/FSE ’15). ACM, 942–945.

o Paper: https://orbilu.uni.lu/handle/10993/21772

o Video: not available

o Tool: https://github.com/SNTSVV/UMTG

• RADAR – A Tool for Debugging Regression Problems in C/C++ Software (ICSE 2013)

o Description: RADAR combines change identification and dynamic analysis to automatically explain regression problems with a list of suspicious differences between the behaviour of the base and the upgraded version of a program.

The Eclipse workbench augmented with the editors and views provided by RADAR.

o Citation: Fabrizio Pastore, Leonardo Mariani, and Alberto Goffi. 2013. RADAR: A Tool for Debugging Regression Problems in C/C++ Software. In Proceedings of the 35th International Conference on Software Engineering (ICSE ’13). IEEE, 1335–1338.

o Paper: https://doi.org/10.1109/ICSE.2013.6606711

o Video: https://youtu.be/tKirorsbwSM

o Tool: https://github.com/lta-disco-unimib-it/BCT_TOOLSET

• AVA – Supporting Debugging with Failure Interpretations (ICST 2013)

o Description: AVA automatically identifies the runtime events likely responsible for a failure and, unlike other automated debugging approaches, generates explanations of why these events are considered suspicious, so that developers can quickly discard imprecise outputs and focus on the relevant anomalies.

The AVA Anomaly Interpretations Editor.

o Citation: Fabrizio Pastore and Leonardo Mariani. 2013. AVA: Supporting Debugging with Failure Interpretations. In Proceedings of the 6th IEEE International Conference on Software Testing, Verification and Validation (ICST ’13). IEEE, 416–421.

o Paper: https://doi.org/10.1109/ICST.2013.58

o Video: not available

o Tool: https://github.com/lta-disco-unimib-it/BCT/tree/master/src-ava

• MASH – A Tool for End-User Plug-In Composition (ICSE 2012)

o Description: MASH eases the extension of plug-in-based IDEs by enabling the definition of workflows that integrate the functionalities of multiple plug-ins, without knowledge of the IDE internals and without writing and deploying Java code; workflows can be quickly reshaped when an analysis must be modified.

A screen capture of MASH.

o Citation: Leonardo Mariani and Fabrizio Pastore. 2012. MASH: A Tool for End-User Plug-In Composition. In Proceedings of the 34th International Conference on Software Engineering (ICSE ’12). IEEE, 1387–1390.

o Paper: https://doi.org/10.1109/ICSE.2012.6227241

o Video: https://youtu.be/wQGDOOJY97U

o Tool: not available

• BCT – A Toolset for Automated Failure Analysis (ICSE 2009)

o Description: The toolset automatically identifies the anomalous events that likely caused a failure, filters false positives, and presents the results as views showing chains of cause-effect relations among anomalous events. Its use to investigate a fault in the Tomcat application server is presented in the paper.

BCT’s environment.

o Citation: Leonardo Mariani, Fabrizio Pastore, and Mauro Pezzè. 2009. A Toolset for Automated Failure Analysis. In Proceedings of the 31st International Conference on Software Engineering (ICSE ’09). IEEE, 563–566.

o Paper: https://doi.org/10.1109/ICSE.2009.5070556

o Video: https://youtu.be/kv14X1tTZjk

o Tool: https://github.com/lta-disco-unimib-it/BCT, https://github.com/lta-disco-unimib-it/BCT_TOOLSET

Page updated

Google Sites

Report abuse