AFL

QuickcCheck-type tools (generators for tests that know about the edge cases of a domain - e. g. for the domain of numbers considering things like 0, the infinities, various almost-and-just-over powers of two, NaN and mantissas for floats, etc.): * QuickCheck: https://hackage.haskell.org/package/QuickCheck * Hypothesis: https://hypothesis.readthedocs.io/en/latest/ * JUnit QuickCheck: https://github.com/pholser/junit-quickcheck Fuzz testing tools (tools which mutate the inputs to a program in order to find interesting / failing states in that program). Generally paired with code coverage: * American Fuzzy Lop (AFL): https://github.com/google/AFL * JQF: https://github.com/rohanpadhye/JQF Mutation / Fault based test tools (review your existing unit coverage and try to introduce changes to your _production_ code that none of your tests catch)

For anyone interested there is something called fuzzing that uses usually code coverage based heuristics to generate data to find bugs. For example LLVM's lib fuzzer uses instrumentation to track code coverage and mutates data to find invalid behaviour. https://llvm.org/docs/LibFuzzer.html It uses a compiler pass to insert code to branch points functions calls etc. I think it uses genetic algorithms to increase coverage by changing the data. There are others that work in similar ways one of them is. https://github.com/google/AFL