Software model checking is a verification technique which is widely used for checking temporal properties of software systems. Even though it is a property verification technique, its common usage in practice is in bug finding, that is, finding viola
tions of temporal properties. Motivated by this observation and leveraging the recent progress in fuzzing, we build a greybox fuzzing framework to find violations of Linear-time Temporal Logic (LTL) properties. Our framework takes as input a sequential program written in C/C++, and an LTL property. It finds violations, or counterexample traces, of the LTL property in stateful software systems; however, it does not achieve verification. Our work substantially extends directed greybox fuzzing to witness arbitrarily complex event orderings. We note that existing directed greybox fuzzing approaches are limited to witnessing reaching a location or witnessing simple event orderings like use-after-free. At the same time, compared to model checkers, our approach finds the counterexamples faster, thereby finding more counterexamples within a given time budget. Our LTL-Fuzzer tool, built on top of the AFL fuzzer, is shown to be effective in detecting bugs in well-known protocol implementations, such as OpenSSL and Telnet. We use LTL-Fuzzer to reproduce known vulnerabilities (CVEs), to find 15 zero-day bugs by checking properties extracted from RFCs (for which 10 CVEs have been assigned), and to find violations of both safety as well as liveness properties in real-world protocol implementations. Our work represents a practical advance over software model checkers -- while simultaneously representing a conceptual advance over existing greybox fuzzers. Our work thus provides a starting point for understanding the unexplored synergies between software model checking and greybox fuzzing.
Photodetectors with high responsivity, broadband response to mid-infrared range are in a great demand in optical detection area. Topological charge-density-wave (CDW) semimetal materials with high carrier mobility and near zero bandgap provide an eme
rging route to meet the demand. Here we firstly investigated the photo/magnetic field reshaped CDW melting phenomenon of quasi one dimensional (1D) topological CDW semimetal (TaSe4)2I. Two orders of magnitude of hysteretic resistance variation is achieved due to CDW melting, which can be manipulated by electric, magnetic field or photoexcitation. In situ polarized Raman scattering spectroscopy reveals the concurrent occurrence of both electronic and structural phase transition. Surprisingly, the phase transition could be driven by applying a minimum voltage interval of 10 {mu}V or a magnetic field interval of 83 Oe at a moderate temperature 120 K. The sharpness of the transition is manifested by single point current jumping (SPCJ). Photodetectors based on this transition has much superior performance than that of quasi two dimensional (2D) TaS2 reported in literature, which is also elaborated by our density functional theory (DFT) calculation. Photoresponsivity at 120 K from visible (405 A/W @ 532 nm) to mid-infrared (31.67 A/W @ 4.73 um) and detectivity (7.2E9 Jones @ 532 nm, 5.6E8 Jones @ 4.73 um) are both one order of magnitude higher than that of TaS2 while the photoresponsivity and detectivity also outperforms commercialized HgCdTe material. Our work not only reveals the important role of dimensionality in CDW phase transition, but also paves a new way for implementing ultrasensitive, broadband photodetector as well as transconductance transistor, memory devices by exploiting quasi-1D topological CDW materials
Search-based procedural content generation methods have recently been introduced for the autonomous creation of bullet hell games. Search-based methods, however, can hardly model patterns of danmakus -- the bullet hell shooting entity -- explicitly a
nd the resulting levels often look non-realistic. In this paper, we present a novel bullet hell game platform named Keiki, which allows the representation of danmakus as a parametric sequence which, in turn, can model the sequential behaviours of danmakus. We employ three types of generative adversarial networks (GANs) and test Keiki across three metrics designed to quantify the quality of the generated danmakus. The time-series GAN and periodic spatial GAN show different yet competitive performance in terms of the evaluation metrics adopted, their deviation from human-designed danmakus, and the diversity of generated danmakus. The preliminary experimental studies presented here showcase that potential of time-series GANs for sequential content generation in games.
We introduce a procedural content generation (PCG) framework at the intersections of experience-driven PCG and PCG via reinforcement learning, named ED(PCG)RL, EDRL in short. EDRL is able to teach RL designers to generate endless playable levels in a
n online manner while respecting particular experiences for the player as designed in the form of reward functions. The framework is tested initially in the Super Mario Bros game. In particular, the RL designers of Super Mario Bros generate and concatenate level segments while considering the diversity among the segments. The correctness of the generation is ensured by a neural net-assisted evolutionary level repairer and the playability of the whole level is determined through AI-based testing. Our agents in this EDRL implementation learn to maximise a quantification of Kosters principle of fun by moderating the degree of diversity across level segments. Moreover, we test their ability to design fun levels that are diverse over time and playable. Our proposed framework is capable of generating endless, playable Super Mario Bros levels with varying degrees of fun, deviation from earlier segments, and playability. EDRL can be generalised to any game that is built as a segment-based sequential process and features a built-in compressed representation of its game content.
Procedural content generation in video games has a long history. Existing procedural content generation methods, such as search-based, solver-based, rule-based and grammar-based methods have been applied to various content types such as levels, maps,
character models, and textures. A research field centered on content generation in games has existed for more than a decade. More recently, deep learning has powered a remarkable range of inventions in content production, which are applicable to games. While some cutting-edge deep learning methods are applied on their own, others are applied in combination with more traditional methods, or in an interactive setting. This article surveys the various deep learning methods that have been applied to generate game content directly or indirectly, discusses deep learning methods that could be used for content generation purposes but are rarely used today, and envisages some limitations and potential future directions of deep learning for procedural content generation.
