Path reduction of multiple test points in dynamic symbolic execution

Dynamic symbolic execution (DSE) is widely used to generate test cases for automated test. However, the practicability of DSE is greatly decreased by path explosion, which is an unavoidable challenge caused by that the number of execution paths increases exponentially with the increase in the size of program. To alleviate this problem, dynamic symbolic execution based on multiple test points (MPDSE) is proposed in this paper to improve the efficiency of DSE by reducing redundant paths. Through analyzing the dependences between test points and branches, the equivalent paths are figured out so that MPDSE can eliminate exploring redundant paths. Our experiments show that MPDSE has advantages in generating test cases compared to traditional DSE.

[1]  George Candea,et al.  S2E: a platform for in-vivo multi-path analysis of software systems , 2011, ASPLOS XVI.

[2]  Corina S. Pasareanu,et al.  A survey of new trends in symbolic execution for software testing and analysis , 2009, International Journal on Software Tools for Technology Transfer.

[3]  William E. Howden,et al.  Symbolic Testing and the DISSECT Symbolic Evaluation System , 1977, IEEE Transactions on Software Engineering.

[4]  Ting Chen,et al.  State of the art: Dynamic symbolic execution for automated test generation , 2013, Future Gener. Comput. Syst..

[5]  James C. King,et al.  Symbolic execution and program testing , 1976, CACM.

[6]  Nikolai Tillmann,et al.  Fitness-guided path exploration in dynamic symbolic execution , 2009, 2009 IEEE/IFIP International Conference on Dependable Systems & Networks.

[7]  Koushik Sen.  DART: Directed Automated Random Testing , 2009, Haifa Verification Conference.

[8]  Yang Zhang,et al.  Complexity analysis and comparison of test paths based on DSE , 2016, 2016 17th IEEE/ACIS International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD).

[9]  Dawei Qi,et al.  Path exploration based on symbolic output , 2013, TSEM.

[10]  Qinghua Zheng,et al.  Dependence Guided Symbolic Execution , 2017, IEEE Transactions on Software Engineering.

[11]  Koushik Sen,et al.  CUTE: a concolic unit testing engine for C , 2005, ESEC/FSE-13.

[12]  Karl N. Levitt,et al.  SELECT—a formal system for testing and debugging programs by symbolic execution , 1975 .

[13]  Mary Lou Soffa,et al.  Generating test data for branch coverage , 2000, Proceedings ASE 2000. Fifteenth IEEE International Conference on Automated Software Engineering.

[14]  Christopher Krügel,et al.  Exploring Multiple Execution Paths for Malware Analysis , 2007, 2007 IEEE Symposium on Security and Privacy (SP '07).