paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Enhancing Symbolic Execution with Self-Configuring Parameters

利用自配置参数增强符号执行
ICSE Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering2026匹配度 3/10 · 该论文研究符号执行参数自动配置,属于程序分析与测试方向,但未涉及用户核心关注的 LLM/Agent 与静态分析交叉、浮点程序分析或贝叶斯程序分析。仅与静态分析/形式化验证有间接关联,因此匹配度较低。引用 0 inbox
Minjong Kim, Sooyoung Cha
crossref: 2026-09-12

AI 速览

一句话:提出 PARASUIT,自动识别并配置符号执行参数,无需人工调参,从而提升分支覆盖与缺陷发现。

现代符号执行工具依赖大量外部参数,用户需为不同程序手动调参,既难使用又限制效果;现有调参技术不能自配置,也无法动态识别应调参数,且候选值集固定。本文提出 PARASUIT:先自动枚举工具参数并交互评估其影响,再用专门算法迭代选择有潜力参数、构造采样空间,并根据符号执行运行数据更新采样概率,从而从零开始为每个程序配置参数。作者在 KLEE 上实现并评估 12 个开源 C 程序。结果显示,分支覆盖率比最先进方法平均高 26%,发现 11 个缺陷,其中 4 个仅由 PARASUIT 发现。

问题
符号执行工具参数众多,用户需手动调参,现有方法无法针对每个程序自配置并动态选择参数和采样空间。
方法
PARASUIT 自动枚举参数、评估影响,并用迭代算法选择参数、构造采样空间,再根据符号执行运行数据更新采样概率。
评估
在 KLEE 上对 12 个开源 C 程序评估,分支覆盖率平均提升 26%,发现 11 个缺陷,其中 4 个为 PARASUIT 独有发现。
原文摘要(Abstract)

We present \({{\rm\small {PARASUIT}}}\), a self-configuring technique that enhances symbolic execution by autonomously adjusting its parameters tailored to each program under test. Modern symbolic execution tools are typically equipped with various external parameters to effectively test real-world programs. However, the need for users to fine-tune a multitude of parameters for optimal testing outcomes makes these tools harder to use and limits their potential benefits. Despite recent efforts to improve this tuning process, existing techniques are not self-configuring; they cannot dynamically identify which parameters to tune for each target program, and for each manually selected parameter, they sample a value from a fixed, user-defined set of candidate values that is specific to that parameter and remains unchanged across programs. The goal of this paper is to automatically configure symbolic execution parameters from scratch for each program. To this end, \({{\rm\small {PARASUIT}}}\) begins by automatically identifying all available parameters in the symbolic execution tool and evaluating each parameter’s impact through interactions with the tool. It then applies a specialized algorithm to iteratively select promising parameters, construct sampling spaces for each, and update their sampling probabilities based on data accumulated from symbolic execution runs using sampled parameter values. We implemented \({{\rm\small {PARASUIT}}}\) on KLEE and assessed it across 12 open-source C programs. The results demonstrate that \({{\rm\small {PARASUIT}}}\) significantly outperforms the state-of-the-art method without self-configuring parameters, achieving an average of 26% higher branch coverage. Remarkably, \({{\rm\small {PARASUIT}}}\) identified 11 unique bugs, four of which were exclusively discovered by \({{\rm\small {PARASUIT}}}\).

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@inproceedings{paperbot11910,
  title = {Enhancing Symbolic Execution with Self-Configuring Parameters},
  author = {Minjong Kim and Sooyoung Cha},
  booktitle = {ICSE},
  year = {2026},
  doi = {10.1145/3744916.3773264}
}