一句话：提出 PSP，用 fuzzing 样本概率近似可达状态，提升抽象解释与符号执行精度并辅助修复排序。
抽象解释与符号执行常因过近似或欠近似而不精确，导致误报与漏报。本文提出程序状态概率（PSP）数据结构，利用 fuzzing 执行样本对可达程序状态进行概率近似。其直觉是状态可达概率差异很大，因而可在仅承担小概率不 sound/不完备风险时显著提升面向缺陷发现的分析精度：忽略过近似判定可行但低概率的状态，并识别欠近似判定不可行但高概率的状态。PSP 在三类任务中有效：增强 Clam 抽象解释器，使 MCC 从 0.09 升至 0.27、F1 从 0.22 升至 0.34；指导符号执行搜索，优先高概率状态，发现更多缺陷并减少求解器调用；用于程序修复补丁排序，使平均补丁排名降低 26%。
Program analysis techniques such as abstract interpretation and symbolic execution suffer from imprecision due to over- and underapproximation, which results in false alarms and missed violations. To alleviate this imprecision, we propose a novel data structure, program state probability (PSP), that leverages execution samples to probabilistically approximate reachable program states. The core intuition of this approximation is that the probability of reaching a given state varies greatly, and thus we can considerably increase analysis precision at the cost of a small probability of unsoundness or incompleteness, which is acceptable when analysis targets bug-finding. Specifically, PSP enhances existing analyses by disregarding low-probability states deemed feasible by overapproximation and recognising high-probability states deemed infeasible by underapproximation. We apply PSP in three domains. First, we show that PSP enhances the precision of the Clam abstract interpreter in terms of MCC from 0.09 to 0.27 and F1 score from 0.22 to 0.34. Second, we demonstrate that a symbolic execution search strategy based on PSP that prioritises program states with a higher probability increases the number of found bugs and reduces the number of solver calls compared to state-of-the-art techniques. Third, a program repair patch prioritisation strategy based on PSP reduces the average patch rank by 26%.