一句话：用渐进式符号执行提升训练覆盖率，实现无需插桩、可恢复预测误差的完整执行轨迹预测。
本文针对此前提出的零开销剖析（ZOP）技术的局限展开改进。ZOP 利用硬件产生的电磁辐射对程序进行无插桩剖析，但其训练阶段需要能达成广泛代码覆盖的测试输入，且只能预测路径轮廓而非完整执行轨迹，预测错误还可能无法恢复。作者提出 ZOP-2，通过渐进式符号执行（PSE）——即对不断缩小的程序片段进行符号执行——在训练阶段获得高覆盖率；同时将预测目标扩展为完整执行轨迹，并采用无状态方法从路径误预测中恢复。作者在一组基准程序上进行了评估：ZOP-2 的路径预测准确率超过 90%，且 PSE 覆盖了传统符号执行遗漏的可达路径，从而进一步提升了预测准确率。
In previous work, we introduced zero-overhead profiling (ZOP), a technique that leverages the electromagnetic emissions generated by the computer hardware to profile a program without instrumenting it. Although effective, ZOP has several shortcomings: it requires test inputs that achieve extensive code coverage for its training phase; it predicts path profiles instead of complete execution traces; and its predictions can suffer unrecoverable accuracy losses. In this paper, we present zero-overhead path prediction (ZOP-2), an approach that extends ZOP and addresses its limitations. First, ZOP-2 achieves high coverage during training through progressive symbolic execution (PSE)-symbolic execution of increasingly small program fragments. Second, ZOP-2 predicts complete execution traces, rather than path profiles. Finally, ZOP-2 mitigates the problem of path mispredictions by using a stateless approach that can recover from prediction errors. We evaluated our approach on a set of benchmarks with promising results; for the cases considered, (1) ZOP-2 achieved over 90% path prediction accuracy, and (2) PSE covered feasible paths missed by traditional symbolic execution, thus boosting ZOP-2's accuracy.
@inproceedings{RutledgePKOPZ19,
title = {Zero-Overhead Path Prediction with Progressive Symbolic Execution},
author = {Richard Rutledge and Sunjae Park and Haider Khan and Alessandro Orso and Milos Prvulovic and Alenka Zajic},
booktitle = {ICSE},
year = {2019},
doi = {10.1109/icse.2019.00039}
}