Symbolic Execution Enhanced System Testing

Abstract

Abstract. We describe a testing technique that uses information computed by symbolic execution of a program unit to guide the generation of inputs to the system containing the unit, in such a way that the unit's, and hence the system's, coverage is increased. The symbolic execution computes unit constraints at run-time, along program paths obtained by system simulations. We use machine learning techniques -treatment learning and function fitting-to approximate the system input constraints that will lead to the satisfaction of the unit constraints. Execution of system input predictions either uncovers new code regions in the unit under analysis or provides information that can be used to improve the approximation. We have implemented the technique and we have demonstrated its effectiveness on several examples, including one from the aerospace domain.

An empirical investigation into path divergences for concolic execution using CREST

“…In recent years, path divergences have been observed by many researchers in the field of concolic execution . But none of them have studied the problem in detail.…”

A unit-based symbolic execution method for detecting memory corruption vulnerabilities in executable codes

“…A well-known example of these challenges is path explosion that emerges since the number of program execution paths grows exponentially, and it makes storing and exploring the paths of large programs infeasible. Some researchers have applied machine learning techniques to improve symbolic execution and prevent path explosion [4][5][6][7][8][9]. For instance, in [8], symbolic execution is applied to a test unit rather than the entire program to limit the scope of symbolic analysis and avoid path explosion.…”

“…Some researchers have applied machine learning techniques to improve symbolic execution and prevent path explosion [4][5][6][7][8][9]. For instance, in [8], symbolic execution is applied to a test unit rather than the entire program to limit the scope of symbolic analysis and avoid path explosion. In the suggested method, a combination of concrete and symbolic execution is applied to calculate the constraints of execution paths in each test unit and generate appropriate test data to explore these paths by solving the calculated constraints.…”

“…We extend the idea presented in [8] and propose a method for detecting four classes of memory corruption vulnerabilities in executable codes, i.e., heap-based buffer overflow, stack-based buffer overflow, use-afterfree, and double-free. We present formal specifications for these vulnerability classes to be used to automatically locate test units in executable codes.…”

“…Then, a set of unit input data is generated by solving the calculated constraints to explore test units, reach vulnerable statements, and activate their vulnerabilities. Similar to the method in [8], we estimate the relationship between the program and unit inputs by simulating the program execution and using machine learning techniques. Thereby, we generate test data that enter into the program from the beginning and reveal vulnerabilities in the desired instructions of a test unit.…”