About Me

I do software research. My students and I create tools and techniques that help developers build better software—by automatically testing, analyzing, and debugging its code and its development process.

Our approaches have proven quite influential in academia and industry. My Curriculum Vitae lists the most important achievements.

Quick Links

• Open positions at CISPA
• What’s it like working at CISPA?
• Doing a BSc or MSc thesis with me
• Recent papers
• My CV

Latest News

Find more posts on BlueSky and on Mastodon

Current Projects

Our research projects involve generating software tests, automated debugging and repair, analyzing mobile systems, analyzing user interfaces, and more. Essentially, our research focuses on the following questions:

• How can we systematically test complex software systems?
• How can we accurately determine and characterize input formats?
• How can we explain causes and circumstances of software failures?

Our solutions typically apply and combine several techniques including dynamic analysis, static analysis, specification mining, test generation, natural language processing, machine learning, constraint solving, and formal languages:

• Since 2024, most of our projects focus on language-based fuzzing and debugging, centered around our all-new Fandango fuzzer.
• Fandango is a result of my 2023 ERC Advanced Grant of 2.5 million EUR for the project “Semantics of Software Systems” (S3) on massive generation of tests and oracles for software.
• Since 2021, my Fuzzing Book introduces test generation (“fuzzing”) techniques, and the Debugging Book presents and implements techniques for automated debugging and repair. Both books are interactive – you can execute and edit the code right in your browser.

Current Papers

My papers can be found on Google Scholar, in the ACM Digital Library, and in DBLP. For recent works and preprints, check out my CISPA publication list.

My Courses

• In Winter 2024/25, we offer our advanced course on automated debugging, based on The Debugging Book.
• In Winter 2025/26, we will offer our advanced course on security testing, based on The Fuzzing Book.

Every semester, we also offer seminars and proseminars around automated testing and debugging.

Check out all our courses here.

My Group

At CISPA and Saarland University, I work with great students and Post-Docs from across the world on cutting-edge research:

• Dr. Rafael Dutra (Post-Doc)
• Dr. Alexi Turcotte (Post-Doc)
• Leon Bettscheider (Ph.D. student)
• Bernd Gruner (Ph.D. student @ DLR)
• Alexander Liggesmeyer (Ph.D. student)
• Haoyang Liu (Ph.D. student)
• Kuangxiangzi Liu (Ph.D. student @ Volkswagen)
• Tural Mammadov (Ph.D. student)
• Laura Plein (Ph.D. student)
• Marius Smytzek (Ph.D. student)
• José Antonio Zamudio Amaya (Ph.D. student)
• Fengmin “Paul” Zhu (Ph.D. student)

All the PhD positions in my group are currently filled, but my colleagues at CISPA are constantly looking out for great students and Postdocs. Our positions are well paid and allow for highly productive research. If you are interested in a Ph.D. or Postdoc position, please apply at CISPA

Here is a list of former group members.

Theses

If you are a student of Saarland University and have fun with automated program analysis, testing, and debugging, you might want to do a thesis with us. Here are the details on how to do a thesis with us.

My Blog

My blog has a mixture of various topics from academia and software development, often with a humorous touch. Here is a selection of popular posts:

• The Virtue of Simplicity (2025-01-25)
• How do different fields review papers? Experiences from ICSE, PLDI, and CCS (2021-07-27)
• The Devil's Guide to Incremental Research (2021-04-15)
• What's it like to be a PhD student in Germany (2020-07-01)
• When Results Are All That Matters: The Case of the Angora Fuzzer (2019-10-10)
• Where your conference fees go to (2018-02-01)
• Mit dem Fahrrad aus der Saarbrücker Innenstadt zur Uni (2017-04-26)
• Twelve LaTeX packages to get your paper accepted (2017-01-13)
• My first talk at a scientific conference: A complete and utter disaster (2016-05-23)
• Summarizing your presentation with miniature slides (2013-10-22)
• Twelve tips on how to prepare an ERC grant proposal (2013-02-23)
• What makes good research? (2012-10-16)
• Patterns for writing good rebuttals (2012-10-01)

All blog posts

Watch Me

I am a frequent speaker at events. Here are two recorded talks I am particularly proud of.

2020: Learning the Language of Failure

In my 2020 CASA Distinguished Lecture “Learning the Language of Failure”, I show some highlights of our current work:

• how to automatically learn circumstances of a given failure, expressed over features of input elements;
• how to automatically infer input languages as readable grammars, and how to use them for massive fuzzing; and
• how to systematically and precisely characterize the set of inputs that causes a given failure – the “language of failure”.

Enjoy the show! Annotated slides are available, too.

2018: Outstanding Research Award Keynote

These days, I also spend quite some time giving career advice. In my ICSE 2018 SIGSOFT Award keynote, I unfold three lessons on impact in software engineering research:

1. Do relevant work
2. Strive for simplicity
3. Keep on innovating

Again, detailed slides and full manuscript are available.

Stay Tuned

Follow me on Bluesky or on Mastodon to stay updated about current work and relevant events.

I do not collect any data from this site, but GitHub may do. See the GitHub Privacy Statement for details.