Symbolic execution method and apparatus assisted by online grammar synthesis

Abstract

This invention discloses an online grammar synthesis-assisted symbolic execution method and apparatus. The method includes the following steps: Step S1. Performing character-level symbolic execution on the lexical analysis code of the test program to extract a token digest; Step S2. The symbolic execution engine receives the initial input or candidate input generated from the grammar, performs token-level symbolization, collects token-level path constraints, and continues to explore uncovered path branches using a grammar-oriented search strategy after the initial input or candidate input generated from the grammar has been explored; Step S3. When a valid input that cannot be received by the original grammar is found, grammar synthesis is performed and the input grammar of the test program is updated; Step S4. Samples and generates multiple new candidate inputs from the currently updated input grammar and feeds them back to the symbolic execution engine. This invention can improve the effectiveness and efficiency of symbolic execution of programs with complex input formats.

Description

Technical Field

[0001] This invention relates to the field of automated software program testing technology, and in particular to an online grammar synthesis-assisted symbolic execution method and apparatus. Background Technology

[0002] As software systems continue to grow in size and complexity, ensuring software quality and security becomes increasingly important. Symbolic execution, as an advanced technique that automatically generates test cases by systematically exploring the program path space, has received widespread attention and application in software testing, vulnerability discovery, and automated program repair. Dynamic symbolic execution technology uses symbolic values ​​instead of concrete values ​​as program input, collects path constraints in real time during program execution, and uses a constraint solver to solve the constraints corresponding to the branches to be explored, thereby generating new inputs that can cover specific paths.

[0003] However, although symbolic execution theoretically possesses powerful pathfinding capabilities, in practical applications, when analyzing programs with complex input formats (such as compilers and interpreters) using symbolic execution, the majority of test inputs generated by the symbolic execution engine are blocked in the parsing phase because such programs typically include a strict input checking phase in the early stages of their execution flow, namely lexical analysis and syntax analysis. If the input test cases do not conform to specific grammatical rules, the program will throw exceptions or refuse to process them during the parsing phase. This results in the vast majority of test inputs generated by the symbolic execution engine being blocked in the parsing phase, unable to execute the subsequent core functional code.

[0004] Specifically, existing symbolic execution techniques suffer from the following main problems when applied to analyze programs with complex input formats: 1. Existing symbolic execution techniques struggle to penetrate the lexical and syntax analysis stages; even summarizing the tokens rarely bypasses the syntax analysis phase. Traditional symbolic execution, when handling complex inputs, often results in the vast majority of generated test cases being rejected during the parsing phase due to violations of lexical or grammatical rules, failing to reach the deeper functional code of the program. To address this issue, some practitioners have proposed token-based symbolic execution methods, which generate inputs by extracting summaries from the lexical analyzer and symbolizing them at the token level. While this approach can penetrate the lexical analysis stage to some extent, the generated token sequences often lack grammatical correctness when faced with complex syntax rules.

[0005] 2. Existing symbolic execution techniques typically generate input directly from the grammar. This approach relies on manually providing the grammar, but high-quality formal grammars are often difficult to obtain. Some practitioners have proposed using predefined formal grammars to directly generate test input to ensure it conforms to format requirements; however, this method still suffers from the limitation of heavily relying on manually provided accurate grammar specifications. In practical software engineering, formal input grammars are often missing, incomplete, or exist only in the developer's mind or in informal natural language documents (such as multi-page protocol specifications), making them difficult for machines to directly read and utilize. Manually writing or refactoring these formal grammars is not only time-consuming, labor-intensive, and costly, but also highly error-prone. This makes testing methods based directly on given grammars face significant data acquisition obstacles in practical implementation.

[0006] Therefore, how to efficiently generate test cases that can pass complex parsing checks without relying on pre-provided formal grammars, and how to delve into the functional logic of the test program, is a key technical problem that urgently needs to be solved in the field of software automation testing. Summary of the Invention

[0007] The technical problem to be solved by this invention is: In view of the technical problems existing in the prior art, this invention provides an online input grammar synthesis-assisted symbolic execution method and apparatus that is simple to implement, highly automated, and has high coverage and testing efficiency. It can efficiently generate test cases that can pass complex parsing checks without relying on pre-provided formal grammars, and deeply test the functional logic of the program, thereby improving the efficiency, coverage and effectiveness of symbolic execution.

[0008] To solve the above-mentioned technical problems, the technical solution proposed by this invention is as follows: An online grammar synthesis-assisted symbolic execution method includes the following steps: Step S1. Tag digest acquisition: Perform symbolic execution on the lexical analysis code of the program under test to extract the tag digest, which includes tags and the mapping relationship between tag values ​​and character constraints; Step S2. Tag-based symbolic execution: The symbolic execution engine receives a given input or a feedback candidate input as the current input, and performs tag-level symbolic execution on the program under test according to the extracted tag digest. During the symbolic execution process, the input is symbolized into a tag sequence and the tag-level path constraints are collected. The symbolic execution engine is configured to prioritize exploring the path corresponding to the feedback candidate input, so as to use grammatically correct input to traverse the parsing stage and cover the functional logic code of the program. After the exploration of the given input is completed, the symbolic execution engine continues to explore the uncovered path branches in the path constraint tree and solves to generate new test cases. If the path constraint tree coverage is completed or resources are exhausted, the engine exits. Step S3. Online Grammar Synthesis: When a valid input that can be successfully parsed by the program is found, the tag sequence corresponding to the current valid input is obtained, and the input grammar of the tested program is updated to obtain the updated input grammar, wherein the input grammar is represented as a context-free grammar; Step S4. Input Feedback and Iteration: Sample multiple new candidate inputs from the currently updated input grammar, feed each candidate input back to the symbolic execution engine, and return to step S2.

[0009] Furthermore, in step S2, when exploring the uncovered path branches in the path constraint tree, a grammar-oriented search strategy is adopted to calculate the index position of the symbolic tag on which each branch condition depends in the input sequence, and the unexplored branch with the smallest tag index is selected first.

[0010] Furthermore, the steps for exploring uncovered path branches in the path constraint tree using a grammar-oriented search strategy include: In the path constraint tree constructed by symbolic execution, maintain the set of all unexplored branch nodes; Identify the tag index corresponding to each unexplored branch in the set of branch nodes, where the tag index represents the position subscript of the tag involved in the branch condition in the input tag sequence; When selecting the next path constraint to be solved to generate a new test case, the unexplored branch with the smallest tag index is selected first. If multiple branches have the same smallest tag index, the branch with the shallowest depth in the path constraint tree is selected first among the explored branches with the smallest tag index.

[0011] Further, step S3 includes: The current valid input tag sequence is used as a sample, and the tag sequence is generalized to a tag-level context-free grammar to obtain a tag-level grammar; The specific character value range corresponding to each tag is calculated based on the tag digest, so as to instantiate the tag-level grammar into a character-level input grammar and obtain the updated input grammar.

[0012] Furthermore, after step S2 and before step S3, there is also a step to determine whether the valid input brings new grammar information and trigger a grammar update. The grammar update is only triggered when the input contains a structure that is unknown to the current grammar.

[0013] Furthermore, the step of determining whether the valid input brings new grammar information to trigger a grammar update includes: Maintain a global list of currently learned grammars; When a valid input is found, check whether the current valid input can be accepted or generated by the currently learned grammar. If not, it is determined that the current input contains a new grammar structure, triggering the update and expansion of the current grammar, and proceeding to step S3. If it can, it is determined that the current input does not bring new grammar information, and the symbolic execution of step S2 is continued without triggering the grammar update.

[0014] Furthermore, after step S4 feeds back the generated new candidate input to the symbolic execution engine, step S2 also includes prioritizing symbolic execution of the target valid input generated from the new grammar. The target valid input is the input that can directly reach the semantic analysis and functional code region of the program under test without triggering a parsing error. When performing path search in step S2, the configuration is such that after the exploration of the target valid input is completed, the next path is selected from the path constraint tree for exploration.

[0015] An online grammar synthesis-assisted symbolic execution device includes: The tag digest acquisition module is used to perform symbolic execution on the lexical analysis code of the program under test and extract the tag digest, which includes tags and the mapping relationship between tag values ​​and character constraints. The tag-based symbolic execution module is used by the symbolic execution engine to receive a given input or a feedback candidate input as the current input, and to perform symbolic execution on the program under test according to the extracted tag digest. During the symbolic execution process, the input is symbolized into a tag sequence and path constraints at the tag level are collected. The symbolic execution engine is configured to prioritize exploring the path corresponding to the feedback candidate input in order to utilize grammatically correct input to traverse the parsing stage and cover the functional logic code of the program. Once the exploration of the given input is complete, the symbolic execution engine continues to explore the uncovered path branches in the path constraint tree and solves to generate new test cases. If the path constraint tree coverage is completed, it exits. The online grammar synthesis module is used to obtain the tag sequence corresponding to the current valid input when a valid input that can be successfully parsed by the program is found, and to update the input grammar of the tested program to obtain the updated input grammar, wherein the input grammar is represented as a context-free grammar; The input feedback and iteration module is used to sample and generate multiple new candidate inputs from the currently updated input grammar, feed each candidate input back to the symbolic execution engine, and return to execute the tag-based symbolic execution module.

[0016] A computer device includes a processor and a memory, the memory being used to store a computer program, and the processor being used to execute the computer program to perform the method described above.

[0017] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described above.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: The present invention extracts the tag digest of the lexical analysis code of the test program, and uses the tag digest to perform tag-based symbolic execution on the test program. When the symbolic execution finds valid input, it uses the tag sequence of the input to synthesize online and update the input grammar. Then, it uses the updated grammar to generate new candidate inputs and feeds them back to the symbolic execution engine. This allows the exploration of this part of the input to cover the functional code first, and the use of search strategies to explore the uncovered branches, forming a collaborative iterative closed loop of symbolic execution and grammar synthesis. The grammar is synthesized online using the valid input generated during the symbolic execution process. It can efficiently generate test cases that can pass complex parsing checks without relying on the pre-provided formal grammar, and deeply test the functional logic of the test program, increasing the probability of symbolic execution passing the format check stage, thereby improving the effectiveness and efficiency of symbolic execution. Attached Figure Description

[0019] Figure 1 This is a schematic diagram illustrating the implementation process of the symbolic execution method for online grammar synthesis assistance in this embodiment.

[0020] Figure 2 This is a schematic diagram of the system architecture for symbolic execution that enables online grammar synthesis assistance in this embodiment, where the sequence numbers represent steps.

[0021] Figure 3 This is a code snippet of the tested program (a simplified Java parser) used in a specific application embodiment of the present invention.

[0022] Figure 4 This is a schematic diagram of the program grammar (CFG) corresponding to the tested program obtained in a specific application embodiment of the present invention and the token digest extracted from the lexical analysis code.

[0023] Figure 5 This is a schematic diagram of the grammar learned for the first time by the grammar synthesis module in a specific embodiment of the present invention.

[0024] Figure 6This is a schematic diagram of the path constraint tree collected based on the initial input during the syntactic and lexical symbolic execution of the prefix expression language in a specific embodiment of the present invention.

[0025] Figure 7 This is a schematic diagram of the path constraint tree obtained by the symbolic execution of the prefix expression language parser after exploring two inputs in a specific application embodiment of the present invention. Detailed Implementation

[0026] The present invention will be further described below with reference to the accompanying drawings and specific preferred embodiments, but this does not limit the scope of protection of the present invention.

[0027] Symbolic execution systematically explores the program space by computing symbolic inputs during program execution, collecting path constraints in real time, and using constraint solvers to solve the constraints corresponding to the branches to be explored. However, when symbolic execution is applied to analyze programs with complex input formats (such as compilers and interpreters), the inputs generated by symbolic execution are usually rejected during the parsing phase, preventing execution from reaching the subsequent core functional code. Furthermore, existing symbolic execution techniques generate a large number of inputs that do not conform to the program's input grammar, making it difficult to penetrate the lexical and syntax analysis stages. Even using tagged summary information is difficult to penetrate the syntax analysis stage, and methods that directly generate input from the grammar rely on manually provided grammars, but high-quality formal grammars are often difficult to obtain.

[0028] The core idea of ​​this invention is to establish a collaborative feedback loop mechanism between symbolic execution and online grammar synthesis. By leveraging the powerful constraint-solving capabilities of symbolic execution, a small number of uniquely structured valid seed inputs are discovered. These valid inputs are then used to learn and derive the program's input grammar online through online grammar synthesis. Conversely, the learned grammar is used to generate a large number of diverse valid inputs and feed them back to the symbolic execution engine. This mechanism allows symbolic execution to pass parsing checks and reach deeper logic using the inputs generated from the grammar, while grammar synthesis continuously improves the grammar's integrity with the help of symbolic execution. This enables the efficient generation of test cases that pass complex parsing checks without relying on pre-provided formal grammars, and allows for in-depth testing of the program's functional logic, improving the efficiency, coverage, and effectiveness of symbolic execution.

[0029] like Figure 1 As shown, the steps of the symbolic execution method with online grammar synthesis assistance in this embodiment include: Step S1. Tag Information Acquisition: Extract a tag digest from the lexical analysis code of the program under test using existing character-level symbolic execution techniques. The tag digest includes tag examples and the mapping relationship between tag values ​​and character constraints.

[0030] Specifically, by symbolizing each character of the input, symbolic computation is performed along the program's execution path at the current input. Path constraints are maintained at program branches using a path tree, where the left and right subtrees of the path tree store the true / false branch constraints of the current branch. By continuously solving the constraints of the branches to be explored, new inputs can be derived, thereby exploring and refining the path tree. Through these steps, token examples and the mapping relationship between token values ​​and character constraints can be obtained, and a token summary can be extracted.

[0031] In this embodiment, the program under test can be a compiler, interpreter, document parser, or network protocol processing software, etc., with various complex input formats. Such complex input formats usually need to go through lexical analysis and syntax analysis stages.

[0032] In this embodiment, symbolic execution is performed on the lexical analysis code of the program under test to extract the mapping relationship between various tokens defined in the program and the specific character-level constraints that generate the tokens. The token digest establishes an abstract mapping relationship between token values ​​and character constraints, specifically including the token values ​​defined by the program under test and the underlying character-level path constraints required to generate the tokens. This is used to subsequently instantiate the abstract token sequence into specific string inputs. It also saves the specific instances of the token values, enabling subsequent steps to perform efficient operations at the token level, and finally restore them to specific strings.

[0033] In this embodiment, the extracted tag digest can be used in subsequent steps to convert the tag sequence generated by tag-level symbolic execution into string input and to provide information for grammar synthesis.

[0034] Specifically, such as Figure 2 As shown, a digest extractor is configured to perform character-level symbolic execution on the tested program to extract a tokenized digest.

[0035] Step S2. Tag-based symbolic execution: The symbolic execution engine receives a given input or a feedback candidate input as the current input, and performs tag-level symbolic execution on the program under test according to the extracted tag digest. During the symbolic execution process, the input is symbolized into a tag sequence, and the tag-level path constraints are collected. The symbolic execution engine is configured to prioritize exploring the path corresponding to the feedback candidate input, so as to use grammatically correct input to pass through the parsing phase and cover the functional logic code of the program. After the exploration of the given input is completed, the symbolic execution engine continues to explore the uncovered path branches in the path constraint tree, solves and generates new test cases, and continues to explore and maintain the path tree. It exits if the path constraint tree coverage is completed or resources are exhausted.

[0036] In this embodiment, a tag-based symbolic execution engine is activated to perform tag-based symbolic execution. This engine receives a given input or candidate inputs fed back from step S4, and performs online collaborative iterative closed-loop symbolic execution on the program under test based on the extracted tag digest. Specifically, initially, a given input is received for symbolic execution. After the given input exploration is completed, the symbolic execution continues to select path branches to be explored. When the symbolic execution finds a valid input that can be successfully parsed by the program, it proceeds to step S3 to obtain the tag sequence corresponding to the valid input, learns online, updates the input grammar of the program under test, and then proceeds to step S4 to sample and generate several new candidate inputs from the updated input grammar before feeding them back to the symbolic execution engine. The symbolic execution engine receives the candidate inputs and performs symbolic execution on the program under test based on the extracted tag digest. After all candidate inputs have been explored, the symbolic execution engine continues to explore branches not covered in the path constraint tree. When a new valid input is found again, it jumps back to step S3 for online grammar synthesis, forming an online collaborative iterative closed loop.

[0037] In this embodiment, during symbolic execution, the tokenized values ​​returned by the lexical analysis code are symbolized, transforming the input into a tokenized sequence. Symbolic calculations at the token level are performed along the program's execution path at the current input, and path constraints at the token level are collected at program branches. The true / false branch constraints at each branch are maintained as left and right subtrees of a constraint tree, used for subsequent solving of branches to be explored and generating new inputs to be explored. The symbolic execution engine is configured to prioritize exploring paths corresponding to candidate inputs, utilizing grammatically correct input to traverse the parsing stage and cover the program's functional logic code. Unlike traditional character-level symbolic execution, this embodiment treats the input as a tokenized sequence, symbolizing it during execution and collecting path constraints at the token level. This allows the structural requirements of the program for the input to be extracted from complex details and transformed into a structured logical description, enabling symbolic execution to understand and utilize the input's grammatical rules, achieving deep collaboration with grammatical synthesis.

[0038] Valid input is input that can be successfully parsed by the test program, meaning it has passed the lexical and syntax analysis stages. The candidate inputs generated through sampling inherit all production rules of the grammar, possessing a correct syntactic structure. Therefore, the returned candidate inputs meet the program's input format requirements and will not be rejected during the parsing stage due to format errors. In this embodiment, by configuring the symbolic execution engine to prioritize exploring the paths corresponding to the returned candidate inputs, the symbolic execution can be guided to perform priority exploration. This allows these grammatically correct inputs to fully utilize the parsing stage and cover the program's functional logic code, avoiding rejection during the parsing stage due to violations of lexical or syntactic rules, greatly improving exploration efficiency and effectiveness.

[0039] In this embodiment, during symbolic execution, when exploring uncovered path branches in the path constraint tree, a grammar-oriented search strategy can be adopted. By calculating the index position of the symbolic tag on which each branch condition depends in the input sequence, the unexplored branch with the smallest tag index is selected first. The tag index represents the position subscript of the tag involved in the branch condition in the input tag sequence, that is, which tag in the input is a certain input substring.

[0040] Since the preceding words in a sentence are usually more important for determining the sentence structure, this embodiment employs a grammar-oriented search strategy in step S2 when exploring uncovered path branches in the path constraint tree. This strategy is based on the characteristic that "the prefix of the input usually determines the grammar rule used." By calculating the index position of the symbolic tag on which each branch condition depends in the input sequence, the unexplored branch with the smallest tag index is preferentially selected. That is, when selecting a path branch, the branch with the smaller tag index is preferentially explored, so that the system will prioritize trying to change the tag at the beginning of the input sequence, thereby quickly traversing different top-level grammar structures, rather than making small mutations within a fixed grammar structure.

[0041] Specifically, when exploring uncovered path branches in the path constraint tree using a grammar-oriented search strategy, a set of unexplored branches can be maintained. The index position of the symbolic tag on which each branch condition depends in the input sequence can be calculated. The branch with the smallest index is prioritized; if the indices are the same, the shallower branch in the path constraint tree is prioritized for solving and exploration. For example, the following steps can be used: In the path constraint tree constructed by symbolic execution, maintain the set of all unexplored branch nodes; Identify the tag index corresponding to each unexplored branch in the branch node set. The tag index represents the position subscript of the tag involved in the branch condition in the input tag sequence. When selecting the next path constraint to be solved to generate a new test case, the unexplored branch with the smallest tag index is selected first. If multiple branches have the same smallest tag index, the branch with the shallowest depth in the path constraint tree is selected first among the explored branches with the smallest tag index.

[0042] Specifically, such as Figure 2 As shown, during the execution of label-based symbolic execution, a path constraint tree can be maintained, and a path selector can be configured to select paths. The path selector is configured to execute the above-mentioned grammar-oriented search strategy, that is, when selecting a path branch to be explored to generate new input, the unexplored branch with the smaller corresponding label index is selected first for constraint solving. Different grammatical production rules can be quickly covered by prioritizing the change of the label of the prefix of the input sequence.

[0043] This embodiment, by employing the above-described grammar-oriented search strategy, can cover different grammar production rules more quickly and evenly, further improving the code coverage of the parsing part.

[0044] Step S3. Online Grammar Synthesis: When a valid input that can be successfully parsed by the program is found, the tag sequence corresponding to the current valid input is obtained, and the input grammar of the tested program is updated to obtain the updated input grammar, which is represented as a context-free grammar.

[0045] When symbolic execution in step S2 discovers a valid input that can be successfully parsed by the program (i.e., no parsing exception is thrown), the grammar is learned online using the input. This process is performed at the tag level to reduce the search space and improve accuracy.

[0046] In this embodiment, online grammar synthesis can be achieved through the following steps: Tag-level context-free grammar generation: The tag sequence of the current valid input is used as a sample, and the tag sequence is generalized to a tag-level context-free grammar to obtain a tag-level grammar; Specifically, by generalizing rules to substrings of the tag sequence, a generalized grammar is obtained. Input is sampled from the generalized grammar, and the input program is run to determine if the sampling is correct. If correct, it indicates that the generalization direction is correct. Substrings are selected from each correctly generalized grammar, and rule generalization is continuously performed until a context-free tag-level grammar is obtained.

[0047] Character-level grammar generation: Calculate the specific character value range corresponding to each tag based on the tag digest, so as to instantiate the tag-level grammar into a character-level input grammar and obtain the updated input grammar.

[0048] The generalization steps for character-level grammars are similar to those for tag-level grammars. By replacing each character at each position of the tag with a character from the range of possible values ​​and running the program to determine if the replacement is successful, all possible string values ​​for the tag are obtained, resulting in the tagged character-level grammar. The final grammar is then obtained by merging the tagged character-level grammar into the tagged context-free grammar.

[0049] Specifically, such as Figure 2As shown, by configuring an input grammar synthesis module, the input grammar synthesis module takes the valid input tag sequence generated in step S2 as a sample, uses the grammar inference algorithm to generalize the tag sequence into a tag-level context-free grammar, uses the tag digest extracted in step S1, and combines it with the satisfiability modulo theory (SMT) solver to calculate the specific character value range corresponding to each tag, instantiating the tag-level grammar into a character-level input grammar, and then providing it to the input generator, which samples and generates executable test input according to the subsequent step S4.

[0050] Furthermore, the process after step S2 and before step S3 includes determining whether a valid input brings new grammar information to trigger a grammar update. A grammar update is only triggered if the input contains a structure unknown to the current grammar. Incremental update mechanism: Maintaining a global grammar. That is, whenever a new valid input is found, it first checks whether the current grammar can cover that input. Only when the input contains a structure unknown to the current grammar is the grammar synthesis algorithm triggered to update and improve the grammar.

[0051] In this embodiment, the determination of whether a valid input brings new grammar information to trigger a grammar update can be achieved through the following steps: Maintain a global list of currently learned grammars; When a valid input is found, check whether the current valid input can be accepted or generated by the currently learned grammar. If not, it is determined that the current input contains a new grammar structure, triggering the update and expansion of the current grammar, and proceeding to step S3. If it can, it is determined that the current input does not bring new grammar information, and the symbolic execution of step S2 is continued without triggering the grammar update.

[0052] Specifically, the grammar synthesis module maintains a global list of currently learned grammars. When the symbolic execution in step S2 discovers a new valid input, it first checks whether the input can be accepted or generated by the currently learned grammar. If the input cannot be accepted by the currently learned grammar, it is determined that the input contains a new grammar structure, triggering the update and expansion of the current grammar, and then proceeding to step S4. If the input can be accepted by the currently learned grammar, it is determined that the input does not bring new grammar information, and the symbolic execution in step S2 continues without triggering the grammar synthesis update.

[0053] Step S4. Input Feedback and Iteration: Sample multiple new candidate inputs from the currently updated input grammar, feed each candidate input back to the symbolic execution engine, and return to step S2.

[0054] In this embodiment, samples are taken from the grammar updated in step S4 to generate a batch of new candidate token sequences that structurally conform to the grammar rules. These sequences are then transformed into test cases. These newly generated test cases are fed back to the symbolic execution engine in step S2 and marked as "high priority." This allows the symbolic execution engine to prioritize exploring these feedback inputs in step S2. Since these inputs originate from the learned grammar, they have a high probability of passing the parsing check, thus guiding the symbolic execution engine to directly bypass the parsing phase and explore and test the functional logic code of the program under test. Finally, after exploring these high-priority inputs, the symbolic execution engine resumes exploring uncovered branches in the path constraint tree. Once new valid inputs are found again, the process jumps back to step S3, forming a continuous iterative optimization.

[0055] In this embodiment, when feeding back the generated new candidate input to the symbolic execution engine, the method also includes prioritizing symbolic execution of the target legal input generated from the new grammar. The target legal input is the input that can directly reach the semantic analysis and functional code area of ​​the program under test without triggering a parsing error. When performing path search in step S2, the method is configured such that after the exploration of the target legal input is completed, the next path is selected from the path constraint tree for exploration.

[0056] This embodiment extracts a tokenized digest of the lexical analysis code of the program under test, and uses the tokenized digest to perform token-based symbolic execution on the program under test. When symbolic execution finds valid input, it uses the tokenized sequence of the input to synthesize online and update the input grammar. Then, it uses the updated grammar to generate new candidate inputs and feeds them back to the symbolic execution engine, allowing priority to explore these inputs to cover the functional code. Subsequently, it continues to explore uncovered branches using a search strategy, thus forming a collaborative iterative closed loop between symbolic execution and grammar synthesis. The legal inputs generated during symbolic execution are synthesized online to generate more legal inputs for symbolic execution. It can efficiently generate test cases that can pass complex parsing checks without relying on pre-provided formal grammars, and deeply test the functional logic of the program, increasing the probability of symbolic execution passing the format check stage, thereby improving the effectiveness and efficiency of symbolic execution.

[0057] The following uses the present invention to Figure 3 Taking the test program shown as an example, the invention will be further explained. The test program is a simplified Java language parser, and its corresponding grammar is as follows: Figure 4As shown in the left-hand side. This test program consists of lexical analysis code (getNextToken) and syntax analysis code (methods starting with parse). The lexical analysis code is responsible for identifying whether a string belongs to a certain token, and the syntax analysis code is responsible for determining whether the token sequence conforms to the syntax rules. For example, lexical analysis will identify "a1" as an ID (identifier token), while identifying "1a" as an invalid token. Syntax analysis will determine that CLS ID LB RB is a valid sequence, while CLS ID LB is not. Assume that the initial input of the given test program is "class A1{int A1(){}}". The complete steps for implementing symbolic execution using this invention are as follows: Step S1: Perform symbolic execution on the lexical analysis code of the program under test, and extract the token digest. The token digest includes the tokens and the mapping relationship between the token values ​​and character constraints.

[0058] First, symbolic execution is performed on the lexical analysis code within a given time to obtain the character constraints for each token value. For example, the character constraint for the identifier token T_ID might be that the first character is a letter, followed by letters or numbers. The extracted token constraints are saved as a path constraint tree, such as... Figure 4 As shown in the right-hand side. For example, the constraint of T_ID can be expressed as: ( [0]≠'('∧...∧ [0]='a')∨(...∧ [0]='b')∨...∨( [0]='a'∧ [1]='a'∧...)∨... Step S2: The symbolic execution engine receives a given initial input or a candidate input from feedback as the current input, and performs symbolic execution on the program under test according to the extracted label summary. During the symbolic execution process, the input is symbolized into a label sequence and path constraints at the label level are collected. The symbolic execution engine is configured to prioritize exploring the path corresponding to the candidate input from feedback.

[0059] After collecting the tag digest, the given initial input "class A1{int A1(){}}" is symbolized at the tag level, resulting in the following tag sequence. T_CLS, T_ID, T_LBR, T_INT, T_ID, T_LP, T_RP, T_LBR,T_RBR, T_RBR The following tag-level constraints were collected: ...∧T[0]=T_CLS∧T[1]=T_ID∧T[2]=T_LBR∧T[3]=T_INT∧T[4]=T_ID∧T[5]=T_LP∧T[6]=T_RP∧T[7]=T_LBR∧T[8]=T_RBR∧T[9]=T_RBR After the current input exploration is completed, the symbolic execution engine continues to explore the uncovered path branches in the path constraint tree and solves to generate new test cases. It exits if the path constraint tree coverage is completed or resources are exhausted.

[0060] Symbolic execution maintains the constraints on the path as a path tree and maintains branches to be explored for solving new inputs. Symbolic execution uses a grammar-oriented search strategy to explore these branches. In this embodiment, after exploring the path corresponding to a given input, symbolic execution finds that the input passes the grammar check and therefore passes the input to the grammar synthesis module for grammar learning.

[0061] Step S3: When a valid input that can be successfully parsed by the program is found, the tag sequence corresponding to the current valid input is obtained, and the input grammar of the tested program is updated to obtain the updated input grammar, which is represented as a context-free grammar.

[0062] When symbolic execution encounters a new valid input, it immediately invokes the syntax synthesis module to learn the syntax from the marked sequence. In this embodiment, the syntax that syntax synthesis can learn is as follows: Figure 5 As shown. Grammar synthesis stores the grammar as G, which includes grammar rules related to class and method.

[0063] Step S4: Sample and generate multiple new candidate inputs from the currently updated input grammar, feed each candidate input back to the symbolic execution engine, and return to execute step S2.

[0064] The synthesized grammar can sample more inputs that meet the grammar requirements, such as "class A1{} class A1{{}}", "class A1{{}} class A1{}", and "class A1{{}{}{}}". The grammar synthesis module returns these inputs to symbolic execution, which prioritizes exploring these inputs that are more likely to pass the parsing code. After exploring these inputs, symbolic execution continues to explore the program space by setting the grammar-oriented search strategy in step S2, and when it finds new valid inputs that cannot be accepted by G, it proceeds to step S4 for a new round of grammar synthesis.

[0065] Specifically, in step S2, this embodiment adopts Figure 6The test program using prefix expressions illustrates the grammar-oriented search strategy of this invention. Grammar rules are typically determined by the prefix symbols of the input, for example, in... Figure 6 In the prefix expression grammar on the left, whether the first symbol is +, *, or >> (right shift) directly determines whether the subsequent grammar rules for addition, multiplication, or right shift will be applied. Assuming the initial input for symbolic execution is ">>a 1", the generated path constraint tree will look like this: Figure 6 As shown on the right. A grammar-oriented search strategy will sort the branches to be explored into { 0 : T[0] = T_A, 1 : T[0] = T_M, 2 : T[0] ≠ T_RS, 3: T[1] ≠ T_ID}. Then symbolic execution preferentially chooses T[0]=T_A for constraint solving. Assuming the input after solving is "+ a 1", symbolic execution obtains a new path constraint tree as follows: Figure 7 As shown. At this point, the new branches to be explored are sorted as { 1 : T[0] = T_M, 2 : T[0] ≠ T_RS, 4 : T[1] ≠ T_ID, 3: T[1] ≠ T_ID}. It is worth noting that although the depth of node n2 is shallower than that of node n4, it still has a higher priority. This is because the tag index of node n2 is smaller, which means it is in a more recent prefix position.

[0066] Through the above steps, this embodiment can generate more valid inputs that can pass through the parsing stage code for symbolic execution, thereby improving the effectiveness of symbolic execution.

[0067] This embodiment also provides an online grammar synthesis-assisted symbolic execution device, including: The tag digest acquisition module is used to perform symbolic execution on the lexical analysis code of the program under test and extract the tag digest, which includes tags and the mapping relationship between tag values ​​and character constraints. The tag-based symbolic execution module is used by the symbolic execution engine to receive a given input or a feedback candidate input as the current input, and to perform symbolic execution on the program under test according to the extracted tag digest. During the symbolic execution process, the input is symbolized into a tag sequence and path constraints at the tag level are collected. The symbolic execution engine is configured to prioritize exploring the path corresponding to the feedback candidate input, so as to use grammatically correct input to traverse the parsing stage and cover the functional logic code of the program. After the exploration of the given input is completed, the symbolic execution engine continues to explore the uncovered path branches in the path constraint tree and solves to generate new test cases. If the path constraint tree coverage is completed or resources are exhausted, the module exits. The online grammar synthesis module is used to obtain the tag sequence corresponding to the current valid input when a valid input that can be successfully parsed by the program is found, and to update the input grammar of the tested program to obtain the updated input grammar, wherein the input grammar is represented as a context-free grammar; The input feedback and iteration module is used to sample and generate multiple new candidate inputs from the currently updated input grammar, feed each candidate input back to the symbolic execution engine, and return to execute the tag-based symbolic execution module.

[0068] In this embodiment, the summary extraction module uses a summary extractor, which is configured to perform character-level symbolic execution on the lexical analysis code of the program under test to extract the summary information of the lexical analysis. The summary information establishes a mapping relationship, which includes the tag values ​​defined by the program under test and the underlying character-level path constraints required to generate the tag, and is used to subsequently instantiate the abstract tag sequence into a specific string input.

[0069] In this embodiment, the label-based symbolic execution module is configured to perform label-based symbolic execution and maintain a path constraint tree during execution. The module includes a path selector, which is programmed to perform a grammar-oriented search strategy. That is, when selecting a path branch to be explored to generate new input, it prioritizes the unexplored branch with a smaller corresponding label index for constraint solving. Different grammatical production rules can be quickly covered by prioritizing the change of the label of the prefix of the input sequence.

[0070] In this embodiment, the online grammar synthesis module is configured to perform online grammar synthesis. When the path exploration module finds a valid input that can be parsed and checked by the program under test, it receives the tag sequence of the valid input. The module uses a grammar learning algorithm to construct or update the input grammar of the program under test online in order to incrementally improve the description of the program input structure.

[0071] The symbolic execution device for online grammar synthesis assistance in this embodiment corresponds one-to-one with the symbolic execution method for online grammar synthesis assistance described above, and will not be described in detail here.

[0072] In summary, by employing a collaborative feedback closed-loop mechanism between symbolic execution and online grammar synthesis, this invention can achieve the following effects: 1. High degree of automation: It does not require users to provide any preset input grammar. Starting from scratch, it automatically derives the grammar through a "execution-learning-feedback" loop, solving the problem of missing input grammar in the program.

[0073] 2. Improve code coverage: Input generated by online grammar synthesis has a high probability of passing parsing checks, allowing tests to delve into the functional code behind the parser.

[0074] 3. Optimize search efficiency: By adopting a grammar-oriented search strategy, different grammar production rules can be covered more quickly and evenly, improving the coverage of the parsing code.

[0075] 4. Synergistic effect: Symbolic execution can provide effective and relatively evenly distributed input samples for grammar synthesis, while grammar synthesis can generate a large number of inputs that can pass the code parsing for symbolic execution, which can improve the coverage of deep code. Furthermore, the combination of symbolic execution and grammar synthesis can complement each other and achieve synergy between symbolic execution and grammar synthesis.

[0076] This embodiment also provides a computer device, including a processor and a memory, wherein the memory is used to store a computer program and the processor is used to execute the computer program to perform the method as described above.

[0077] This embodiment further provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described above.

[0078] Those skilled in the art will understand that the above embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce implementations of the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0079] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the invention. Therefore, any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention should fall within the protection scope of the present invention.

Claims

1. A symbolic execution method assisted by online grammar synthesis, characterized in that the steps include... include: Step S1. Tag digest acquisition: Perform character-level symbolic execution on the lexical analysis code of the program under test, and extract the tag digest, which includes tags and the mapping relationship between tag values ​​and character constraints; Step S2. Tag-based symbolic execution: The symbolic execution engine receives a given input or a feedback candidate input as the current input, and performs tag-level symbolic execution on the program under test according to the extracted tag digest. During the symbolic execution process, the input is symbolized into a tag sequence, and path constraints at the tag level are collected. The symbolic execution engine is configured to prioritize exploring the path corresponding to the feedback candidate input, so as to use grammatically correct input to traverse the parsing stage and cover the functional logic code of the program. After the exploration of the given input is completed, the symbolic execution engine continues to explore the uncovered path branches in the path constraint tree, solves and generates new test cases, and continues to explore and maintain the path tree. If the path constraint tree coverage is completed or resources are exhausted, the process exits. Step S3. Online Grammar Synthesis: When a valid input that can be successfully parsed by the program is found, the tag sequence corresponding to the current valid input is obtained, and the input grammar of the tested program is updated to obtain the updated input grammar, wherein the input grammar is represented as a context-free grammar; Step S4. Input Feedback and Iteration: Sample multiple new candidate inputs from the currently updated input grammar, feed each candidate input back to the symbolic execution engine, and return to step S2.

2. The symbolic execution method with online grammar synthesis assistance according to claim 1, characterized in that, In step S2, when exploring the uncovered path branches in the path constraint tree, a grammar-oriented search strategy is adopted. The index position of the symbolic tag on which each branch condition depends is calculated in the input sequence, and the unexplored branch with the smallest tag index is selected first.

3. The symbolic execution method with online grammar synthesis assistance according to claim 2, characterized in that, The steps for exploring uncovered path branches in the path constraint tree using a grammar-oriented search strategy include: In the path constraint tree constructed by symbolic execution, maintain the set of all unexplored branch nodes; Identify the tag index corresponding to each unexplored branch in the set of branch nodes, where the tag index represents the position subscript of the tag involved in the branch condition in the input tag sequence; When selecting the next path constraint to be solved to generate a new test case, the unexplored branch with the smallest tag index is selected first. If multiple branches have the same smallest tag index, the branch with the shallowest depth in the path constraint tree is selected first among the explored branches with the smallest tag index.

4. The symbolic execution method with online grammar synthesis assistance according to claim 1, characterized in that, Step S3 includes: The current valid input tag sequence is used as a sample, and the tag sequence is generalized to a tag-level context-free grammar to obtain a tag-level grammar; The specific character value range corresponding to each tag is calculated based on the tag digest, so as to instantiate the tag-level grammar into a character-level input grammar and obtain the updated input grammar.

5. The symbolic execution method with online grammar synthesis assistance according to claim 1, characterized in that, The process after S2 and before S3 also includes a step to determine whether a valid input brings new grammar information and trigger a grammar update. A grammar update is only triggered when the input contains a structure that is currently unknown to the grammar.

6. The symbolic execution method with online grammar synthesis assistance according to claim 5, characterized in that, The step of determining whether valid input brings new grammar information to trigger a grammar update includes: Maintain a global list of currently learned grammars; When a valid input is found, check whether the current valid input can be accepted or generated by the currently learned grammar. If not, it is determined that the current input contains a new grammar structure, triggering the update and expansion of the current grammar, and proceeding to step S3. If it can, it is determined that the current input does not bring new grammar information, and the symbolic execution of step S2 is continued without triggering the grammar update.

7. The online grammar synthesis-assisted symbolic execution method according to any one of claims 1 to 6, characterized in that, After step S4 feeds back the generated new candidate inputs to the symbolic execution engine, step S2 also includes prioritizing symbolic execution on the legal inputs generated from the new grammar. The target legal input is the input that can directly reach the semantic analysis and functional code region of the program under test without triggering parsing errors. When performing path search in step S2, the configuration is such that after the exploration of the target legal input is completed, the next path is selected from the path constraint tree for exploration.

8. A symbolic execution device with online grammar synthesis assistance, characterized in that, include: The tag digest acquisition module is used to perform symbolic execution on the lexical analysis code of the program under test and extract the tag digest, which includes tags and the mapping relationship between tag values ​​and character constraints. The tag-based symbolic execution module is used by the symbolic execution engine to receive a given input or a feedback candidate input as the current input, and to perform tag-level symbolic execution on the program under test according to the extracted tag digest. During the symbolic execution process, the input is symbolized into a tag sequence and the tag-level path constraints are collected. The symbolic execution engine is configured to prioritize exploring the path corresponding to the feedback candidate input, so as to use grammatically correct input to traverse the parsing stage and cover the functional logic code of the program. After the exploration of the given input is completed, the symbolic execution engine continues to explore the uncovered path branches in the path constraint tree and solves to generate new test cases. If the path constraint tree coverage is completed or resources are exhausted, the module exits. The online grammar synthesis module is used to obtain the tag sequence corresponding to the current valid input when a valid input that can be successfully parsed by the program is found, and to update the input grammar of the tested program to obtain the updated input grammar, wherein the input grammar is represented as a context-free grammar; The input feedback and iteration module is used to sample and generate multiple new candidate inputs from the currently updated input grammar, feed each candidate input back to the symbolic execution engine, and return to execute the tag-based symbolic execution module.

9. A computer device comprising a processor and a memory, the memory being used to store a computer program, characterized in that, The processor is used to execute the computer program to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the method as described in any one of claims 1 to 7.

Images