Model learning (a.k.a. active automata learning) is a highly effective technique for obtaining black-box finite state models of software components. Thus far, generalisation to infinite state systems with inputs/outputs that carry data parameters has been challenging. Existing model learning tools for infinite state systems face scalability problems and can only be applied to restricted classes of systems (register automata with equality/inequality). In this article, we show how we can boost the performance of model learning techniques by extracting the constraints on input and output parameters from a run, and making this grey-box information available to the learner. More specifically, we provide new implementations of the tree oracle and equivalence oracle from RALib, which use the derived constraints. We extract the constraints from runs of Python programs using an existing tainting library for Python, and compare our grey-box version of RALib with the existing black-box version on several benchmarks, including some data structures from Python's standard library. Our proof-of-principle implementation results in almost two orders of magnitude improvement in terms of numbers of inputs sent to the software system. Our approach, which can be generalised to richer model classes, also enables RALib to learn models that are out of reach of black-box techniques, such as combination locks.

中文翻译：

---

寄存器自动机的灰盒学习

模型学习（又名主动自动机学习）是一种用于获取软件组件的黑盒有限状态模型的高效技术。到目前为止，泛化到具有携带数据参数的输入/输出的无限状态系统一直具有挑战性。用于无限状态系统的现有模型学习工具面临可扩展性问题，并且只能应用于受限类别的系统（注册自动机具有等式/不等式）。在本文中，我们展示了如何通过从运行中提取输入和输出参数的约束，并使学习者可以使用这些灰盒信息来提高模型学习技术的性能。更具体地说，我们提供了来自 RALib 的树预言机和等价预言机的新实现，它们使用了派生约束。我们使用现有的 Python 污染库从 Python 程序的运行中提取约束，并在多个基准测试（包括 Python 标准库中的一些数据结构）上比较我们的 RALib 灰盒版本与现有黑盒版本。我们的原理验证实现导致发送到软件系统的输入数量几乎提高了两个数量级。我们的方法可以推广到更丰富的模型类，还使 RALib 能够学习黑盒技术无法实现的模型，例如密码锁。我们的原理验证实现导致发送到软件系统的输入数量几乎提高了两个数量级。我们的方法可以推广到更丰富的模型类，还使 RALib 能够学习黑盒技术无法实现的模型，例如密码锁。我们的原理验证实现导致发送到软件系统的输入数量几乎提高了两个数量级。我们的方法可以推广到更丰富的模型类，还使 RALib 能够学习黑盒技术无法实现的模型，例如密码锁。