Enhancing Dynamic Symbolic Execution by Automatically Learning Search Heuristics

by   Sooyoung Cha, et al.

We present a technique to automatically generate search heuristics for dynamic symbolic execution. A key challenge in dynamic symbolic execution is how to effectively explore the program's execution paths to achieve high code coverage in a limited time budget. Dynamic symbolic execution employs a search heuristic to address this challenge, which favors exploring particular types of paths that are most likely to maximize the final coverage. However, manually designing a good search heuristic is nontrivial and typically ends up with suboptimal and unstable outcomes. The goal of this paper is to overcome this shortcoming of dynamic symbolic execution by automatically learning search heuristics. We define a class of search heuristics, namely a parametric search heuristic, and present an algorithm that efficiently finds an optimal heuristic for each subject program. Experimental results with industrial-strength symbolic execution tools (e.g., KLEE) show that our technique can successfully generate search heuristics that significantly outperform existing manually-crafted heuristics in terms of branch coverage and bug-finding.


page 1

page 2

page 3

page 4


Towards Symbolic Pointers Reasoning in Dynamic Symbolic Execution

Dynamic symbolic execution is a widely used technique for automated soft...

Learning Robust Search Strategies Using a Bandit-Based Approach

Effective solving of constraint problems often requires choosing good or...

Learning Heuristic Selection with Dynamic Algorithm Configuration

A key challenge in satisfying planning is to use multiple heuristics wit...

Automatic Firmware Emulation through Invalidity-guided Knowledge Inference (Extended Version)

Emulating firmware for microcontrollers is challenging due to the tight ...

SynFuzz: Efficient Concolic Execution via Branch Condition Synthesis

Concolic execution is a powerful program analysis technique for explorin...

Failure-Directed Program Trimming (Extended Version)

This paper describes a new program simplification technique called progr...

Mini-Bucket Heuristics for Improved Search

The paper is a second in a series of two papers evaluating the power of ...