Exact and approximate probabilistic symbolic execution for nondeterministic programs

Abstract

Probabilistic software analysis seeks to quantify the likelihood of reaching a target event under uncertain environments. Recent approaches compute probabilities of execution paths using symbolic execution, but do not support nondeterminism. Nondeterminism arises naturally when no suitable probabilistic model can capture a program behavior, e.g., for multithreading or distributed systems.In this work, we propose a technique, based on symbolic execution, to synthesize schedulers that resolve nondeterminism to maximize the probability of reaching a target event. To scale to large systems, we also introduce approximate algorithms to search for good schedulers, speeding up established random sampling and reinforcement learning results through the quantification of path probabilities based on symbolic execution.We implemented the techniques in Symbolic PathFinder and evaluated them on nondeterministic Java programs. We show that our algorithms significantly improve upon a stateof-the-art statistical model checking algorithm, originally developed for Markov Decision Processes.

Model Counting for Complex Data Structures

“…In the computation above we have followed the approach in [15] and computed the effects of the UP after the path constraints have been collected. An alternative way introduced in [28] consists in embedding the usage profile as "preconditions" (assume statements) in the code. Listing 1.3 shows an example of embedded UP for the analysis of the swapNode method.…”

“…Filieri et al used the LattEtool to compute probabilities. Follow-on work provides treatment of nondeterminism [28] and describes statistical exploration of symbolic paths [16]. Another simulation-based approach for the analysis of probabilistic programs has been proposed in [31].…”

“…Recent PSA techniques [18,15,16,28] use symbolic execution of the program to collect symbolic constraints on the inputs that lead to the occurrence of target program events. The number of satisfying assignments for these constraints are then calculated using model counting procedures.…”

“…LattE [2], to compute probabilities [18,15,16,28]. Recent techniques have been introduced to estimate the (approximate) number of solutions for floating point constraints [7].…”

Semantic Importance Sampling for Statistical Model Checking

“…Luckow et al [12] have developed techniques for exact and approximate analysis of stochastic systems with non-determinism. They use symbolic execution and learning to iteratively construct schedulers under which worst-case (or bestcase) behavior of the system is observed.…”