Memoized symbolic execution

Yang, Guowei; Păsăreanu, Corina S.; Khurshid, Sarfraz

doi:10.1145/2338965.2336771

Cited by 82 publications

(69 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our approach first performs a simple normalization to eliminate the effect of memory relocation and instruction idioms. Yang et al [21] proposed Memoise, a trie-based data structure to cache the key elements of symbolic execution, so that successive forward symbolic execution can reuse previously computed results. Our union-find structure is like Memoise in that we both maintain an efficient tree-based data structure to avoid re-computation.…”

Section: Related Workmentioning

confidence: 99%

Memoized Semantics-Based Binary Diffing with Application to Malware Lineage Inference

Jiang

2015

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Abstract. Identifying differences between two executable binaries (binary diffing) has compelling security applications, such as software vulnerability exploration, "1-day" exploit generation and software plagiarism detection. Recently, binary diffing based on symbolic execution and constraint solver has been proposed to look for the code pairs with the same semantics, even though they are ostensibly different in syntactics. Such logical-based method captures intrinsic differences of binary code, making it a natural choice to analyze highly-obfuscated malicious program. However, semantics-based binary diffing suffers from significant performance slowdown, hindering it from analyzing large-scale malware samples. In this paper, we attempt to mitigate the high overhead of semantics-based binary diffing with application to malware lineage inference. We first study the key obstacles that contribute to the performance bottleneck. Then we propose basic blocks fast matching to speed up semantics-based binary diffing. We introduce an union-find set structure that records semantically equivalent basic blocks. Managing the union-find structure during successive comparisons allows direct reuse of previously computed results. Moreover, we purpose to concretize symbolic formulas and cache equivalence queries to further cut down the invocation times of constraint solver. We have implemented our technique on top of iBinHunt and evaluated it on 12 malware families with respect to the performance improvement when performing intra-family comparisons. Our experimental results show that our methods can accelerate symbolic execution from 2.8x to 5.3x (with an average 4.0x), and reduce constraint solver invocation by a factor of 3.0x to 6.0x (with an average 4.3x).

show abstract

Section: Related Workmentioning

confidence: 99%

Memoized Semantics-Based Binary Diffing with Application to Malware Lineage Inference

Jiang

2015

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

show abstract

“…The cost of method p's "re-execution" can be reduced by compositional symbolic execution, where we first build a memoization tree of method p, and then efficiently perform symbolic execution of method q by replaying the symbolic execution of p in the two calling contexts using p's memoization tree. Figure 3 (a) shows the memoization tree for method p. A memoization tree succinctly summarizes all the choices taken during symbolic execution [25]. Other than the root node n0, each node is created whenever a conditional statement is executed, recording the branch that is taken during symbolic execution, e.g., node n1 in Figure 3 (a) indicates that the true (1) branch of the conditional statement at line 2 in program p is executed.…”

Section: Example Compositional Analysismentioning

confidence: 99%

Compositional Symbolic Execution with Memoized Replay

Qiu

Yang

Păsăreanu

et al. 2015

2015 IEEE/ACM 37th IEEE International Conference on Software Engineering

Self Cite

View full text Add to dashboard Cite

Abstract-Symbolic execution is a powerful, systematic analysis that has received much visibility in the last decade. Scalability however remains a major challenge for symbolic execution. Compositional analysis is a well-known general purpose methodology for increasing scalability. This paper introduces a new approach for compositional symbolic execution. Our key insight is that we can summarize each analyzed method as a memoization tree that captures the crucial elements of symbolic execution, and leverage these memoization trees to efficiently replay the symbolic execution of the corresponding methods with respect to their calling contexts. Memoization trees offer a natural way to compose in the presence of heap operations, which cannot be dealt with by previous work that uses logical formulas as summaries for compositional symbolic execution. Our approach also enables efficient target oriented symbolic execution for error detection or program coverage. Initial experimental evaluation based on a prototype implementation in Symbolic PathFinder shows that our approach can be up to an order of magnitude faster than traditional non-compositional symbolic execution.

show abstract

“…[2,3,19,22,25]. This paper provides additional information about the constraints encountered during symbolic execution (and in KLEE in particular), the effect of caching on solving time, and the relative performance of different solvers on several real benchmarks.…”

Section: Related Workmentioning

confidence: 99%

Multi-solver Support in Symbolic Execution

Palikareva

Cadar

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. One of the main challenges of dynamic symbolic executionan automated program analysis technique which has been successfully employed to test a variety of software-is constraint solving. A key decision in the design of a symbolic execution tool is the choice of a constraint solver. While different solvers have different strengths, for most queries, it is not possible to tell in advance which solver will perform better. In this paper, we argue that symbolic execution tools can, and should, make use of multiple constraint solvers. These solvers can be run competitively in parallel, with the symbolic execution engine using the result from the best-performing solver. We present empirical data obtained by running the symbolic execution engine KLEE on a set of real programs, and use it to highlight several important characteristics of the constraint solving queries generated during symbolic execution. In particular, we show the importance of constraint caching and counterexample values on the (relative) performance of KLEE configured to use different SMT solvers. We have implemented multi-solver support in KLEE, using the metaSMT framework, and explored how different state-of-the-art solvers compare on a large set of constraint-solving queries. We also report on our ongoing experience building a parallel portfolio solver in KLEE.

show abstract

Memoized symbolic execution

Cited by 82 publications

References 28 publications

Memoized Semantics-Based Binary Diffing with Application to Malware Lineage Inference

Memoized Semantics-Based Binary Diffing with Application to Malware Lineage Inference

Compositional Symbolic Execution with Memoized Replay

Multi-solver Support in Symbolic Execution

Contact Info

Product

Resources

About