一句话：提出 HOMI，用学习驱动的激进状态剪枝只保留少量有前景状态，显著提升符号执行的覆盖率与缺陷发现能力。
符号执行在实践中通常尽可能保留大量状态，以防丢失重要状态，但这会导致状态爆炸和效率低下。本文提出 HOMI，通过只维护少量“有前景”状态来增强符号执行。作者观察到，在符号执行中只有极少数状态对提升代码覆盖率或到达缺陷点起关键作用。基于这一观察，HOMI 以最小化状态总数为目标，同时保留有前景状态；它利用学习算法在测试过程中不断累积数据，并据此持续更新概率式剪枝策略，从而识别并保留有前景状态。实验结果表明，在开源 C 程序上，HOMI 大幅提升了 KLEE 的代码覆盖率和缺陷发现能力。
We present HOMI, a new technique to enhance symbolic execution by maintaining only a small number of promising states. In practice, symbolic execution typically maintains as many states as possible in a fear of losing important states. In this paper, however, we show that only a tiny subset of the states plays a significant role in increasing code coverage or reaching bug points. Based on this observation, HOMI aims to minimize the total number of states while keeping “promising” states during symbolic execution. We identify promising states by a learning algorithm that continuously updates the probabilistic pruning strategy based on data accumulated during the testing process. Experimental results show that HOMI greatly increases code coverage and the ability to find bugs of KLEE on open-source C programs.
DOI 原文 ·
@inproceedings{paperbot5706,
title = {Making symbolic execution promising by learning aggressive state-pruning strategy},
author = {Sooyoung Cha and Hakjoo Oh},
booktitle = {FSE},
year = {2020},
doi = {10.1145/3368089.3409755}
}