Guiding dynamic symbolic execution toward unverified program executions

Christakis, Maria; Müller, Péter; Wüstholz, Valentin

doi:10.1145/2884781.2884843

Cited by 69 publications

(51 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our previous work, an explicit assumption of the form assumed P as a expresses that an analysis assumed property P to hold at this point in the code without checking it [6,8,5,30]. The unique assumption identifier a may be used to refer to this explicit assumption at other program points.…”

Section: Verification Annotationsmentioning

confidence: 99%

“…It could be the same analysis as before, an analysis with a more precise abstract domain, or one with higher bounds. It could even be dynamic test generation [5,8]. This second analysis can benefit from the existing verification results since the assertion has already been fully verified for the else-branch (the explicit assumption always holds on that branch).…”

Section: Bounding Spurious Errorsmentioning

confidence: 99%

“…This second analysis can benefit from the existing verification results since the assertion has already been fully verified for the else-branch (the explicit assumption always holds on that branch). By applying a very inexpensive instrumentation from our previous work [5,8], we can prune away the fully-verified else-branch. This allows even an analysis of the same precision to verify the resulting instrumented program.…”

Section: Bounding Spurious Errorsmentioning

confidence: 99%

“…As demonstrated in this section, the encoded intermediate results make it possible to ignore certain parts of the program state or even entire program paths. Our previous work has specifically shown that this instrumentation is suitable for subsequent analyses, in the context of dynamic test generation [6,8] and deductive verification [25].…”

Section: Bounding Spurious Errorsmentioning

confidence: 99%

See 3 more Smart Citations

Bounded Abstract Interpretation

Christakis

Wüstholz

2016

Static Analysis

Self Cite

View full text Add to dashboard Cite

Abstract. In practice, software engineers are only able to spend a limited amount of resources on statically analyzing their code. Such resources may refer to their available time or their tolerance for imprecision, and usually depend on when in their workflow a static analysis is run. To serve these different needs, we propose a technique that enables engineers to interactively bound a static analysis based on the available resources. When all resources are exhausted, our technique soundly records the achieved verification results with a program instrumentation. Consequently, as more resources become available, any static analysis may continue from where the previous analysis left off. Our technique is applicable to any abstract interpreter, and we have implemented it for the .NET static analyzer Clousot. Our experiments show that bounded abstract interpretation can significantly increase the performance of the analysis (by up to 8x) while also increasing the quality of the reported warnings (more definite warnings that detect genuine bugs).

show abstract

Section: Verification Annotationsmentioning

confidence: 99%

Section: Bounding Spurious Errorsmentioning

confidence: 99%

Section: Bounding Spurious Errorsmentioning

confidence: 99%

Section: Bounding Spurious Errorsmentioning

confidence: 99%

See 2 more Smart Citations

Bounded Abstract Interpretation

Christakis

Wüstholz

2016

Static Analysis

Self Cite

View full text Add to dashboard Cite

show abstract

“…Another related work is [12], where concolic testing is guided towards program parts that a static analyzer was not able to verify. In contrast to our approach, the abstraction is not refined.…”

Section: Related Workmentioning

confidence: 99%

Abstraction-driven Concolic Testing

Daca

Gupta

Henzinger

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Concolic testing is a promising method for generating test suites for large programs. However, it suffers from the path-explosion problem and often fails to find tests that cover difficult-to-reach parts of programs. In contrast, model checkers based on counterexample-guided abstraction refinement explore programs exhaustively, while failing to scale on large programs with precision. In this paper, we present a novel method that iteratively combines concolic testing and model checking to find a test suite for a given coverage criterion. If concolic testing fails to cover some test goals, then the model checker refines its program abstraction to prove more paths infeasible, which reduces the search space for concolic testing. We have implemented our method on top of the concolic-testing tool Crest and the model checker CpaChecker. We evaluated our tool on a collection of programs and a category of SvComp benchmarks. In our experiments, we observed an improvement in branch coverage compared to Crest from 48% to 63% in the best case, and from 66% to 71% on average.

show abstract

DEMINER: test generation for high test coverage through mutant exploration

Kim

Hong

2019

Software Testing Verif & Rel

View full text Add to dashboard Cite

Summary Most software testing techniques test a target program as it is and fail to utilize valuable information of diverse test executions on many variants/mutants of the original program in test generation. This paper proposes a new test generation technique DEMINER, which utilizes mutant executions to guide test generation on the original program for high test coverage. DEMINER first generates various mutants of an original target program and then extracts runtime information of mutant executions, which covered unreached branches by the mutation effects. Using the obtained runtime information, DEMINER inserts guideposts, artificial branches to replay the observed mutation effects, to the original target programs. Finally, DEMINER runs automated test generation on the original program with guideposts and achieves higher test coverage. We implemented DEMINER for C programs through software mutation and guided test generation such as concolic testing and fuzzing. We have shown the effectiveness of DEMINER on six real‐world target programs: Busybox‐ls, Busybox‐printf, Coreutils‐sort, GNU‐find, GNU‐grep and GNU‐sed. The experiment results show that DEMINER improved branch coverage by 63.4% and 19.6% compared with those of the conventional concolic testing techniques and the conventional fuzzing techniques on average, respectively.

show abstract

Guiding dynamic symbolic execution toward unverified program executions

Abstract: The version in the Kent Academic Repository may differ from the final published version. Users are advised to check http://kar.kent.ac.uk for the status of the paper. Users should always cite the published version of record.

Cited by 69 publications

References 49 publications

Bounded Abstract Interpretation

Bounded Abstract Interpretation

Abstraction-driven Concolic Testing

DEMINER: test generation for high test coverage through mutant exploration

Contact Info

Product

Resources

About