Enhancing Symbolic Execution by Machine Learning Based Solver Selection

Abstract

Constraint solving creates a serious performance bottleneck in symbolic execution. Examining a plethora of SMT solvers with diverse capabilities, we address the following research questions: How can the performance of symbolic execution improve if it can pick a priori the best solver for a given path constraint? How can such a prediction oracle be practically implemented? In this work, we first define the solver selection problem in symbolic execution and its evaluation metrics, and perform a preliminary study to gauge potential performance improvement through solver selection. We then present the design and implementation of Path Constraint Classifier (PCC), a machine learning based meta-solver that aims to reduce overall constraint solving latency by dynamically selecting a solver per query. Using machine learning seems straightforward, yet surprisingly underexplored; one main technical challenge is how to avoid excessive overhead introduced by feature extraction. We address this challenge by taking advantage of the structural characteristics of symbolic execution. Our experiments confirm that the overall solver time can be reduced by 10.3% in the KLEE dataset and 46% in the benchmark dataset, while the solver prediction procedure only accounts for 2% to 10% of overall solving time.

MachSMT: A Machine Learning-based Algorithm Selector for SMT Solvers

“…In the setting of SMT solver applications, symbolic execution tools have used algorithm selection strategies [64] and portfolio strategies [33] for the specific classes of instances within the context of the bit-vector theory. This would be an ideal use case of MachSMT, since we provide a more complete solution.…”

“…While algorithm selection has been considered in the broad setting of solvers (e.g., QBF solvers [50] and SAT solvers [67]) as well as certain specific SMT theories [57,5,64], we are not aware of previous work on algorithm selection aimed at the entirety of SMT-LIB [7]. Our results demonstrate that the MachSMT algorithm selector is highly effective, in that it outperforms the competition winners on the majority of tracks from the SMT-COMP in 2019 and 2020.…”

MEUZZ: Smart Seed Scheduling for Hybrid Fuzzing

“…Symbolic execution: In addition to promoting black/graybox fuzzing, ML has been applied to enhance white-box fuzzing approaches, namely symbolic execution. These lines of work mostly struggle to solve constraint equations [57,64,66]. For example, Bunz et al, [24] trained a model to recognize features of satisfiability.…”