Apparatus and method of tuning of parameter for symbolic executer

Abstract

The present invention relates to a parameter tuning device and method for symbolic execution, wherein the parameter tuning device for symbolic execution may include a parameter determination unit for determining at least one parameter to be adjusted for the program and a parameter value determination unit for determining at least one cluster by performing clustering on the parameter to be adjusted and selecting an arbitrary parameter value from at least one cluster.

Description

Technology Field

[0001] This relates to a parameter tuning device and a parameter tuning method for symbolic execution. Background Technology

[0002] Symbolic execution is a technique for testing software (which may be referred to as a program, application, or app, etc.) that generates test input by receiving software input and executing the received software by replacing it with a symbolic variable. A tool for such symbolic execution, that is, a symbolic execution tool, is typically configured to check whether the true or false nature of the conditional statement can be satisfied simultaneously with the path traversed so far when a conditional statement for a substituted symbol is reached during the execution of a test, and if both cases are satisfied, to fork the path to generate a path (referred to as a State), and when at least one state reaches the end of the program, to use an SMT Solver to generate a test case that can reach that state.

[0003] However, as branches are repeated, the number of states inevitably increases. As this repetition of growth continues, the State-Explosion Problem occurs, where the generated states increase exponentially. Furthermore, the increase in states leads to an increase in the cost of generating test cases for the solution, causing the Solving Cost Problem. To address this, various features such as state pruning and effective solution methods are being introduced. With the introduction of these various features, the number of external parameters added to symbolic execution tools is also increasing. As a result, practical symbolic execution tools these days sometimes exceed 100 external parameters, causing users lacking specialized knowledge in symbolic execution to experience significant difficulties in optimizing parameters for the execution. Prior art literature

[0004] [Patent Document 0001] Republic of Korea Published Patent Application No. 10-1989802 (Title of Invention: Method and apparatus for performing a test using a test case, Registration Date: June 11, 2019) [Patent Document 0002] Republic of Korea Registered Patent Application No. 10-2273135 (Title of Invention: Parameter tuning apparatus and method for software test input generation symbol execution using symbol execution, Registration Date: June 29, 2021) The problem to be solved

[0005] The problem is to provide a parameter tuning device and method for symbolic execution that can generate an optimal combination of parameters for symbolic execution based on a score calculation function, a parameter selection algorithm, and a parameter value generation algorithm, without prior knowledge. means of solving the problem

[0006] To solve the above-mentioned problem, a parameter tuning device for symbolic execution and a parameter tuning method for symbolic execution are provided.

[0007] A parameter tuning device for symbolic execution may include a parameter determination unit for determining a target parameter for determining at least one target parameter for determining a program and a parameter value determination unit for determining at least one cluster by performing clustering on the target parameter for determining the program and selecting an arbitrary parameter value from at least one cluster.

[0008] The parameter value determination unit may calculate a selection probability for the at least one cluster based on a score for the at least one cluster, select a cluster according to the selection probability, select an arbitrary parameter value from the selected cluster, and update the score of the selected cluster using a score of symbolic execution based on the arbitrary parameter value.

[0009] The adjustment parameter determination unit may set a different parameter value for at least one parameter, and if the branch coverage resulting from symbolic execution based on the different parameter value corresponds to a predetermined value, the different parameter value may be excluded to obtain a set of normal operation parameters.

[0010] The adjustment parameter determination unit may generate one or more sets by performing aggregation for the at least one parameter based on similarity between the at least one parameter, and may determine a key parameter for the one or more sets.

[0011] The adjustment parameter determination unit may adjust the parameter value of the main parameter differently from the default value, obtain a score based on a symbol execution performed based on the adjusted parameter value, compare the score based on the symbol execution performed based on the adjusted parameter value with the score based on the default value, and if the score based on the symbol execution performed based on the adjusted parameter value is lower than the score based on the symbol execution performed based on the default value, the adjusted parameter value may be excluded to generate the adjustment target parameter.

[0012] The parameter value determination unit may be configured to expand the parameter value of the parameter to be adjusted, obtain a score based on symbolic execution for each of the value smaller than the reference value and the value larger than the reference value, determine one of the value smaller than the reference value and the value larger than the reference value as a new reference value based on each of the obtained scores, and use at least one of the value smaller than the reference value and the value larger than the reference value as the parameter value of the parameter to be adjusted.

[0013] A method for tuning parameters for symbolic execution may include the steps of acquiring a program, determining at least one parameter to be tuned for the program, performing clustering on the parameter to be tuned to obtain at least one cluster, and selecting an arbitrary parameter value from at least one cluster.

[0014] A parameter tuning method for symbolic execution further includes the step of updating the score of the selected cluster using a score of symbolic execution based on an arbitrary parameter value, wherein the arbitrary parameter may be obtained through the steps of calculating a selection probability for the at least one cluster based on the score for the at least one cluster, selecting a cluster according to the selection probability, and selecting an arbitrary parameter value from the selected cluster.

[0015] The step of determining at least one adjustment target parameter for the above program may include the step of setting a different parameter value for at least one parameter, and the step of obtaining a set of normal operation parameters by excluding the different parameter value when the branch coverage resulting from symbolic execution based on the different parameter value corresponds to a predetermined value.

[0016] The step of determining at least one adjustment target parameter for the above program may include the step of generating one or more sets by performing aggregation of the at least one parameter based on similarity between the at least one parameter and the step of determining a key parameter for the one or more sets.

[0017] The step of determining at least one parameter to be adjusted for the above program may include: adjusting the parameter value of the main parameter differently from the default value; obtaining a score based on a symbol execution performed based on the adjusted parameter value; comparing the score based on the symbol execution performed based on the adjusted parameter value with the score based on the default value; and, if the score based on the symbol execution performed based on the adjusted parameter value is lower than the score based on the symbol execution performed based on the default value, excluding the adjusted parameter value to generate the parameter to be adjusted.

[0018] A parameter tuning method for symbolic execution may further include a step of expanding the parameter value of the parameter to be adjusted, and the step of expanding the parameter value of the parameter to be adjusted may include a step of obtaining a score according to symbolic execution for each of a value smaller than a reference value and a value larger than a reference value, a step of determining one of the value smaller than a reference value and the value larger than a reference value as a new reference value based on each of the obtained scores, and a step of using at least one of the value smaller than a reference value and the value larger than a reference value as the parameter value of the parameter to be adjusted. Effects of the invention

[0019] According to the parameter tuning device and method for symbolic execution described above, it is possible to generate an optimal combination of parameters for symbolic execution based on a score calculation function, a parameter selection algorithm, and a parameter value generation algorithm without prior knowledge.

[0020] According to the parameter tuning device and method for symbolic execution described above, the selection of parameters to be adjusted and the determination of the values ​​of the selected parameters are automatically performed solely by inputting the entire parameters of the program to be tested and the symbolic execution device. Consequently, the number of values ​​or variables that the user must additionally manually input, such as the determination of candidate values ​​for multiple parameters, is reduced, thereby reducing the burden on the user and improving user convenience.

[0021] According to the parameter tuning device and method for symbolic execution described above, since the value of each parameter is automatically generated, even users lacking specialized knowledge of symbolic execution can easily and efficiently perform symbolic execution.

[0022] According to the parameter tuning device and method for symbolic execution described above, as the improvement of the software branch detection capability increases, not only is branch coverage expanded, but the error detection capability within the software can also be enhanced, thereby enabling the effect of improving software test performance. Brief explanation of the drawing

[0023] FIG. 1 is a block diagram of a parameter tuning device according to one embodiment. FIG. 2 is a pseudo code for explaining the operation of a parameter tuning device according to one embodiment. FIG. 3 is a diagram illustrating parameter filtering according to one embodiment. FIG. 4 is a pseudocode for explaining the parameter comparison determination process according to one embodiment. FIG. 5 is a diagram illustrating a parameter comparison determination according to one embodiment. FIG. 6 is a diagram illustrating the sampling of parameter values ​​according to one embodiment. FIG. 7 is a diagram illustrating the clustering of parameter values ​​according to one embodiment. FIG. 8 is a graph showing branch coverage and system error detection results by a symbol execution tool employing a parameter tuning device according to one embodiment and a conventional symbol execution tool, respectively. FIG. 9 is a graph showing the system error detection results of a symbol execution tool employing a parameter tuning device according to one embodiment and a conventional symbol execution tool. FIG. 10 is a graph showing the branch coverage of a symbol execution tool employing a parameter tuning device according to an embodiment and a conventional symbol execution tool. FIG. 11 is a graph showing the branch coverage of a symbol execution tool employing a parameter tuning device according to an embodiment and another conventional symbol execution tool. FIG. 12 is a flowchart of a parameter tuning method for symbol execution according to one embodiment. Specific details for implementing the invention

[0024] The advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below but may be implemented in various different forms. These embodiments are provided merely to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention, and the present invention is defined only by the scope of the claims.

[0025] The terms used in this specification will be briefly explained, and the present invention will be described in detail. The terms used in this invention have been selected to be as widely used as possible, taking into account their functions in the invention; however, these terms may vary depending on the intent of those skilled in the art, case law, the emergence of new technologies, etc. Additionally, in specific cases, terms may be arbitrarily selected by the applicant, and in such cases, their meanings will be described in detail in the relevant description of the invention. Therefore, terms used in this invention should be defined not merely by their names, but based on the meanings they possess and the content of the invention as a whole. Throughout the specification, when it is stated that a part is connected to another part, this may mean that the part and the other part are physically connected to each other, and / or electrically connected. Furthermore, when it is stated that a part includes another part, unless specifically stated otherwise, this does not mean that another part other than the one mentioned is excluded, but rather that additional parts may be included depending on the embodiment, etc. Terms such as “part,” “module,” and “unit” as used in the specification refer to a unit corresponding to all or part of at least one device, system, method, structure, and material, etc., and may perform a specified function or operation depending on the circumstances. The “part,” “module,” and “unit,” etc. may be implemented in software, in hardware such as an FPGA or ASIC, or as a combination of software and hardware, depending on the designer, manager, or user. However, the “part,” “module,” and “unit,” etc. are not limited solely to software or hardware. The “part,” “module,” and “unit,” etc. may be configured to reside in an addressable storage medium or configured to operate one or more processors.Accordingly, as an example, terms such as "part," "module," and "unit" may include components such as software components, object-oriented software components, class components, and task components, as well as processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. According to an embodiment, a single "part," "module," "unit," etc. may be implemented as a single physical or logical configuration, or as a plurality of physical or logical configurations. Additionally, it is possible for a plurality of "parts," "modules," "units," etc., to be implemented as a single physical or logical configuration. Expressions such as the first to N (where N is a natural number greater than or equal to 1) are used to distinguish at least one part(s) from other part(s) for convenience of explanation, and may be arbitrarily selected and added to the components. For example, a component named as the first component may be otherwise named as the second component, and the second A component named as a component may also be otherwise named as the first component. Furthermore, expressions such as "first to Nth," unless otherwise specified, do not imply that these components are sequential. The term "and / or" may include a combination of multiple related items or any one of the multiple related items, but does not exclude a combination of two or more of the multiple related items. A singular expression may include a plural expression unless there is an obvious exception in the context. Additionally, an underscore (_) typically indicates that a character added after the underscore is a subscript of the character located before the underscore, and a caret (^) indicates that a character added after the caret is a superscript of the character located before the caret; however, depending on the situation, they may be used with a different meaning.

[0026] Hereinafter, with reference to FIGS. 1 to 11, an embodiment of a parameter tuning device (100, hereinafter referred to as the parameter tuning device) for symbol execution will be described. For clarity and conciseness of the description, the description will be based on an embodiment in which the parameter tuning device (100) and the symbol executer (190) are separated from each other. However, even if the parameter tuning device (100) and the symbol executer (190) are separated from each other, they are not necessarily physically separated. They may be logically separated. For example, the parameter tuning device (100) and the symbol executer (190) may each be implemented using separate processors (e.g., a Central Processing Unit (CPU) and / or a Graphics Processing Unit (GPU), etc.), or both may be implemented using only a single processor. That is, it is possible for a single processor to perform the operation of both the parameter tuning device (100) and the symbol executer (190).

[0027] FIG. 1 is a block diagram of a parameter tuning device according to one embodiment.

[0028] Referring to the illustration in FIG. 1, the parameter tuning device (100) is configured such that, in one embodiment, it acquires at least one program (10), selects one or more parameters to be adjusted (i.e., parameters to be adjusted (40)) through the operation (i.e., symbol execution) of at least one symbol execution device (190), determines one or more parameter values ​​(50) for each of the one or more parameters to be adjusted (40) at least once, and transmits the determined parameter values ​​(50) to the symbol execution device (190) so that the symbol execution device (190) performs symbol execution, thereby finally obtaining optimal parameter values. Depending on the embodiment, the parameters may include external parameters of the symbol execution device (190), and the external parameters may include all factors that affect the performance of the symbol execution (code coverage or bug detection).

[0029] The parameter tuning device (100) and the symbol implementer (190) may be configured to transmit data or commands, etc., from at least one side to the other side through a data input / output terminal, a circuit line, a cable and / or a wireless communication network (which may include a local area network or a mobile communication network, etc.). Accordingly, parameter values ​​(20, 50) are transmitted from the parameter tuning device (100) to the symbol implementer (190), and processing results (30, 60) of the symbol implementer (190) based thereon, such as a test case, can be transmitted to the parameter tuning device (100).

[0030] A symbol implementer (190) is an algorithm, device, or system configured to test software by performing symbol execution on all or part of the input of the software, and may be configured to, for example, generate test cases, analyze vulnerabilities of the software, or perform reverse engineering. Such a symbol implementer (190) may include software such as KLEE, SAGE, Angr, Mayhem, or Driller, or a device configured for processing such software, but these are exemplary and the symbol implementer (190) that can be adopted is not limited thereto.

[0031] The parameter tuning device (100) may include a parameter determination unit (110) and a parameter value determination unit (120). The parameter determination unit (110) and the parameter value determination unit (120) may be logically separated or physically separated. If logically separated, the parameter determination unit (110) and the parameter value determination unit (120) may be implemented by a single processor. If physically separated, the parameter determination unit (110) and the parameter value determination unit (120) may be implemented using two or more processors. Here, the processor may include, for example, a central processing unit, a graphics processing unit (GPU), a microcontroller unit (MCU), an application processor (AP), and / or an electronic control unit (ECU). These processing or control devices may be implemented, for example, by using one or more semiconductor chips, circuits, or related components alone or in combination.

[0032] The adjustment target parameter determination unit (110) can select an adjustment target parameter (40) for the acquired program (10). That is, the adjustment target parameter determination unit (110) can select which parameter to adjust among all parameters. The adjustment target parameter determination unit (110) can transmit one or more parameters (20) to the symbol execution unit (190), receive the symbol execution result (30) of the symbol execution unit (190) using one or more parameters (20), and select an adjustment target parameter (40) based on this. The selected adjustment target parameter (40) is transmitted to the parameter value determination unit (120). The parameter value determination unit (120) can determine the parameter value for the adjustment target parameter (40) selected by the adjustment target parameter determination unit (110) so that symbol execution can be performed. The parameter value determination unit (120) determines one or more parameter values ​​(50) corresponding to each of the parameters to be adjusted (40) and transmits them to the symbol implementer (190), and obtains a symbol execution result (60) corresponding to one or more parameter values ​​(50) to update the parameter values ​​(50). Subsequently, the updated parameter values ​​(50) may be transmitted back to the symbol implementer (190). Accordingly, it becomes possible to obtain optimal parameter values.

[0033] The adjustment target parameter determination unit (110) is described in more detail below.

[0034] FIG. 2 is pseudo code for explaining the operation of a parameter tuning device according to one embodiment, and FIG. 3 is a diagram for explaining parameter filtering according to one embodiment. In FIG. 3, iteration is a parameter for the number of iterations, max-memory is a parameter indicating the size of the maximum available memory, posix-runtime is a parameter for whether to enable the POSIX runtime environment (given as true or false), -write-cov is a parameter for whether to write a code coverage file (given as true or false), and -max-stack-frames is a parameter indicating the number of maximum stack frames. Coverage is a value indicating the code coverage corresponding to the setting. Here, the default values ​​for max-memory, posix-runtime, -write-cov, and -max-stack-frames may be given as 1000, false, true, and 4096, respectively. However, this is exemplary, and the default values ​​of these variables may be defined differently depending on the designer or user.

[0035] As described in FIG. 2, the adjustment target parameter determination unit (110) can first obtain a program (pgm) (10) to be analyzed, and, if necessary, may obtain certain information such as a set processing time (budget) (time), initial parameter value(s) (PV) and / or at least one parameter (which may be an external parameter) (all P), etc. (input). All or part of these may be received directly from a user, or may be received from another device (such as a memory device or a terminal device) via a data transmission / reception terminal or a wired / wireless communication network.

[0036] At least one variable, such as a parameter to be adjusted (D), a symbolic execution time (time_s, which may be set to, for example, 120 seconds (η_time=120)), and / or a set of parameters (P), may be initialized as necessary, as illustrated in FIG. 2 (lines 1 and 2). Here, the set of parameters (P) may be constructed through initialization for all parameters (all P) and, depending on the embodiment, may further include a value (V) for the parameter (p) (line 2).

[0037] As illustrated in FIG. 1, the adjustment target parameter determination unit (110) may include a parameter filtering unit (111), a parameter aggregation unit (114), and a parameter selection unit (117).

[0038] The parameter filtering unit (111) can obtain one or more sets of parameter values ​​(PV_min, hereinafter referred to as normal operation parameter sets) in which symbol execution operates normally from a set of initially set parameter values ​​(PV) (lines 4 and 5). That is, the amount of computation is reduced by removing setting values ​​that make normal operation of symbol execution impossible from among the values ​​that can be set for the parameters.

[0039] For example, referring to the illustration in FIG. 3, at least one of all parameters is set to a value different from the default value (max-memory=4000, posix-runtime=True, -write-cov=False, -max-stack-frames=8192). For example, at least one of all parameters may be set to a value different from the default value by setting max-memory to 1000, setting posix-runtime to False, setting -write-cov to True, and / or setting -max-stack-frames to 4096 (iterations 2 through 5). This setting of parameter values ​​may be performed for only one parameter or for all parameters. In each case where the parameter value is set differently (iterations 2 through 5), a symbolic execution is performed, and for each symbolic execution, a corresponding branch coverage value may be obtained. For example, whenever each parameter is set differently from its default value, symbolic execution is performed for that case and the corresponding branch coverage is calculated. In this case, if the branch coverage is 0 (the third and fifth iterations), this indicates that symbolic execution cannot be performed normally with the given parameter value. Specifically, according to the example illustrated in FIG. 3, when posix-runtime is set to False and -max-stack-frames is set to 4096, the branch coverage has a value of 0, which means that symbolic execution does not operate normally when posix-runtime is set to False and / or stack-frames is set to 4096.Therefore, to reduce unnecessary computation, the case where the corresponding parameters (posix-runtime, -max-stack-frames) have parameter values ​​where branch coverage becomes zero (False and 4096, respectively) is excluded, and only parameter values ​​for normal operation (i.e., parameter values ​​where branch coverage is not zero, e.g. True and 8192, respectively) are included, thereby obtaining a normal operation parameter set (PV_min), which is a minimal set of normal operation parameter values. For example, the normal operation parameter set (PV_min) is prepared by setting posix-runtime to True and max-stack-frames to 8192. The above-described parameter set (P) may be updated by the obtained normal operation parameter set (PV_min) as needed. Thus, the parameter set (P) can be prepared by excluding parameter value(s) that are not suitable for processing with respect to all parameters (all p) and including only the set of appropriate parameter values ​​(PV_min). These normal operation parameters (PV_min) or the parameter set (P) updated through them can be transmitted to the parameter set unit (114).

[0040] The parameter aggregation unit (114) can perform aggregation for parameters (P), for example, can perform aggregation for mutually similar parameters (line 7).

[0041] According to one embodiment, the parameter aggregation unit (114) may measure the similarity between each parameter and perform aggregation by grouping parameters whose similarity is greater than a predetermined threshold. Here, the similarity between parameters may be calculated using Manhattan Distance (L1 distance), but is not limited thereto. Additionally, the parameter aggregation unit (114) may perform aggregation by further utilizing whether options are classified into the same category by the symbol implementer (190) and / or whether antonyms (e.g., Max and Min, On and Off, etc.) are used. That is, the parameter aggregation unit (114) may calculate a score between each parameter based on the result of calculating Manhattan distance, whether they are classified into the same category and / or whether antonyms are used, and if the calculated score is greater than a predetermined threshold (which can be defined by a designer or user, etc.), group the corresponding parameters into the same set to create one or more sets. As a result, one or more sets of parameters (for example, a set consisting of max-memory, batch-time, sym-files, -use merge, -write-cov and -max-stack-frames, etc. of FIG. 4) are obtained.

[0042] Additionally, the parameter aggregation unit (114) may measure the similarity between multiple parameters within a generated parameter set and, among all or some of the parameter(s) within the same set, determine at least one parameter with high similarity to other parameter(s) as the main parameter. For example, the parameter aggregation unit (114) may calculate the similarity with all other parameters within a predetermined set for each parameter within a predetermined set, calculate the average of one or more similarity(s) obtained according to the calculation, and select the parameter with the largest calculated average to determine it as the main parameter. The parameter set and the main parameter may be transmitted to the parameter selection unit (117).

[0043] FIG. 4 is a pseudocode for explaining a parameter comparison determination process according to one embodiment, and FIG. 5 is a diagram for explaining a parameter comparison determination according to one embodiment.

[0044] The parameter selection unit (117) is configured to select a parameter to be adjusted (40) using a set of parameters and a main parameter (line 8 of FIG. 2 and line 1 of FIG. 4). According to one embodiment, the parameter selection unit (117) may also obtain a parameter to be adjusted (40) based on trial and error.

[0045] More specifically, the parameter selection unit (117), referring to the illustration in FIG. 3, first initializes the score (S_base) of the default value or the total branch coverage (TotalB) (e.g., both may be initialized to an empty set) (line 2), and then transmits the normal operation parameter set (PV_min) to the symbol executer (190) so that the symbol execution is performed one or more times for the normal operation parameter set (PV_min) (lines 4 and 5). For example, the symbol execution for the normal operation parameter set (PV_min) may be performed three times (η_iter=3). According to the embodiment, each symbol execution for the normal operation parameter set (PV_min) may be defined to be performed within a given time, but may also be arranged to be performed for a relatively short time (e.g., 1 second). Here, the value of the main parameter may be given as a default value (the first to third iterations (iter 1 to 3) in FIG. 5).

[0046] According to the result of one or more symbolic executions for the normal operation parameter set (PV_min), at least one coverable branch (B) is obtained. In this case, the branch (B) may be added to the existing total branch (TotalB), as shown in FIGS. 4 and 5 (Line 6). Additionally, the score related to the branch (B) may be added in the same way to the score for the normal operation parameter set (PV_min), i.e., the score for the default value (S_base) (Line 7). Thus, the score for the default value (S_base) can be updated. Here, the score related to the branch (B) may include the score for the obtained branch (B) and the total branch (TotalB).

[0047] According to one embodiment, the value of a key parameter within a parameter set may be modified as shown in FIG. 5, and the symbol executer (190) may perform one or more additional symbol executions for each parameter set in which the value of the key parameter is modified (lines 9 to 20, iters 4 to 6, iters 7 to 9, and iters 10 to 12 in FIG. 5). For example, at least one key parameter may be set differently from the corresponding default value (the first to third iterations (iters 1 to 3) in FIG. 5), and symbol execution may be performed based on a set containing the key parameter that is set differently. Here, symbol execution for a parameter set in which the value of the key parameter has been changed may be performed at least three times, in the same way as symbol execution based on a normal operation parameter set (PV_min) (η_iter=3). If necessary, some parameters (default setting in FIG. 5) may not be modified.

[0048] To explain more specifically, the value of a key parameter is set to a value different from the default value of the corresponding key parameter, and a symbolic execution is performed one or more times using the set in which the key parameter is set to a different value (hereinafter referred to as the set of first parameter values) (iter 4 to 6 of FIG. 5), and a score corresponding to the result of the symbolic execution is obtained. Subsequently, whether to retain or exclude the set of parameters is determined based on the score for the symbolic execution on the set of first parameter values. For example, the score for the set of first parameter values ​​and the score when the key parameter is at its default value are compared with each other, and the exclusion of the set of first parameter values ​​may be determined based on the comparison result. Subsequently, another key parameter is set to a value different from the default value, and a set of parameter values ​​corresponding thereto (hereinafter referred to as the set of second parameter values) is obtained, and a symbolic execution is performed one or more times on the set of second parameter values. Likewise, a score is obtained for the result of the corresponding symbol execution, and based on the obtained score, it is determined whether to maintain the set of second parameter values ​​(iter 7 to 9 of FIG. 5). Another key parameter is also set to a value different from the default value of another key parameter, and based on the set of parameter values ​​(hereinafter the set of third parameter values), one or more symbol executions, determination of the score, and determination of whether to maintain are performed sequentially (iter 10 to 12 of FIG. 5). Here, the number of symbol executions performed for each parameter set (i.e., the parameter set where the key parameter has a default value, the set of first parameter values ​​to the set of third parameter values) may all be the same, only some may be the same, or all may be different, depending on the design.

[0049] According to one embodiment, the process of obtaining or determining the score of the set of parameter values ​​described above may be performed as illustrated in FIG. 4.

[0050] In detail, first, a candidate value (V) for at least one major parameter (p_id) among all or some parameters (GP) is obtained by the parameter selection unit (117) or the symbol implementer (190), and by adjusting the value of the major parameter using the candidate value (V), a set(s) of a predetermined parameter value (e.g., a set of first parameter values, a set of second parameter values, and / or a set of third parameter values, etc.) is obtained (Line 9 of FIG. 4). That is, the major parameter (p_id) is adjusted to have a value (v) different from the default value. If necessary, a score (S) corresponding to each set of parameter values ​​(p_id) is initialized (Line 11), and a set of parameters in which the major parameter (p_id) has a value (v) different from the default value may be further added to the parameter value (PV) (Line 13). Subsequently, symbolic execution is performed based on the set of parameter values ​​in which the value of the main parameter (p_id) has been modified, and accordingly, a coverable branch (B) is obtained (Line 14), and an update of the entire branch (TotalB) can be performed based on the coverable branch (B) (Line 15). In addition, a score corresponding to the branch (B) is obtained sequentially, and a previously initialized score (S) is updated using the obtained score (Line 16). Such a process of updating the parameter value (PV) or the score (S) may be repeated one or more times, for example, three times, as given (Line 12).

[0051] After symbol execution is repeatedly performed using key parameters adjusted to predetermined values ​​different from the default values, a corresponding score is obtained for each iteration, and the total sum or average of the scores resulting from the repeated symbol executions is calculated. In other words, the average of the scores resulting from the adjustment of the key parameters is obtained.

[0052] The average of the obtained scores can be compared with the default value score (S_base) (Line 17). According to the embodiment, if the average of the scores corresponding to the symbolic execution is smaller than the default value score (S_base), the value of the key parameter used in that symbolic execution may be excluded from adjustment (Line 18). In other words, if the value of the key parameter is adjusted differently from the default value but performance is not improved compared to the default setting, the case where the key parameter has that value may be excluded from adjustment. For example, if the score resulting from the symbolic execution is smaller than the score in the default situation, such as when -usemerge is set to True (iter 4–6 in FIG. 5), the parameter value modified to -usemerge True is excluded.

[0053] Conversely, if the sum or average of the scores resulting from symbolic execution is greater than the score (S_base) corresponding to the default value, the principal parameter whose value was adjusted is treated as a target for adjustment. In other words, since the performance of symbolic execution has improved as a result of adjusting the principal parameter, that principal parameter is treated as a target for adjustment to further enhance performance. In this case, if necessary, all parameters in the set containing that principal parameter may also be designated as targets for adjustment.

[0054] When the score operation described above is performed on all or some of the set of parameter values ​​(p_id) and whether to exclude or retain them is determined, the parameters to be adjusted (40) are determined based on the set of parameters that are retained (lines 19 and 20). In this case, the parameters to be adjusted (40) may include not only the main parameters that can be set to other values, but also the remaining parameters that are not to be excluded. If the value of a specific main parameter is excluded from the adjustment target, the value of that main parameter may be fixed to a default value. For example, in the case where -use-merge is True and / or -max-stack-frames is 4096, if the score corresponding to each is smaller than the score (S_base) corresponding to the default value, -use-merge is determined and fixed to the default value, i.e., false, and -max-stack-frames is determined and fixed to 8192 and is not treated as an adjustment target, and the remaining parameters (-write-cov, etc.) are treated as adjustment target parameters (40) so that they can be adjusted. Accordingly, the adjustment target parameter (40) is obtained.

[0055] The parameter value determination unit (120) can obtain at least one adjustment target parameter (40) from the adjustment target parameter determination unit (110) and obtain an optimal parameter value based thereon.

[0056] According to one embodiment, the parameter value determination unit (120) may include a parameter value expansion unit (121) and a parameter value design unit (123), as shown in FIG. 1.

[0057] The parameter value expansion unit (121) further increases the value that can be used as a parameter. If there is insufficient data, clustering by the parameter value design unit (123) described later may not be possible. Accordingly, the parameter value expansion unit (121) can collect value(s) by repeating the collection step until enough values ​​are accumulated to enable clustering.

[0058] FIG. 6 is a diagram illustrating the sampling of parameter values ​​according to one embodiment.

[0059] According to one embodiment, the parameter value expansion unit (121) may expand the value by substituting similar values ​​with the default value of each parameter as the initial reference value. According to an embodiment, the parameter value expansion unit (121) may be omitted.

[0060] The parameter value expansion section (121) may be implemented by employing greedy value sampling, as shown in FIG. 6.

[0061] Specifically, referring to FIGS. 2 and FIGS. 6, the parameter value expansion unit (121) first sets a value smaller than the first reference value (hereinafter the first reference value (1st)) (e.g., 100) among values ​​between a predetermined range (PV) (e.g., a value 0.5 times the first reference value (50) to a value 1.5 times the first reference value (150)) and a value larger than the first reference value (e.g., 70, hereinafter the first parameter value) (e.g., 120, hereinafter the second parameter value) as values ​​for the predetermined parameter (line 12), and can perform symbolic execution for both the smaller first parameter value and the larger second parameter value (lines 13 and 14).

[0062] Branch coverage (B_l, B_h) corresponding to each of the first and second parameter values ​​is obtained by the result of symbolic execution (lines 13 to 15), and in addition, a score (0.75) for the first parameter value and a score (0.25) for the second parameter value may be obtained (line 16). Based on the obtained scores, either of the first or second parameter values ​​may be determined as a new reference value (hereinafter referred to as the second reference value) (s3, line 17). Which of the first and second parameter values ​​is selected as the new reference value may be determined probabilistically based on the score (0.75 or 0.25) of the reference value. For example, if the score obtained using the first parameter value is 75 and the score obtained using the second parameter value is 25, the smaller first parameter value may be selected as the second reference value with a probability of 75%, and the larger second parameter value may be selected as the second reference value with a probability of 25%. Of course, depending on the embodiment, it is also possible to select a parameter value as the second reference value such that the score is calculated to be larger without using probability.

[0063] When a second reference value is selected, a value smaller than the second reference value (e.g., a value having 40, hereinafter referred to as the third parameter value) and a value larger than the second reference value (e.g., a value having 90, hereinafter referred to as the fourth parameter value) are each set as the values ​​of a predetermined parameter among values ​​within a predetermined range (e.g., a value having 0.5 times the second reference value (35) to a value having 1.5 times the second reference value (015)) as described above, and a symbolic execution is performed for both values, and a corresponding score can be obtained (s3, lines 11 and 20). Based on these scores, either the smaller third parameter value or the larger fourth parameter value is determined as another new reference value (hereinafter referred to as the third reference value). As described above, the determination of the third reference value may be based on probability, but the probability (0.33 and 0.67) may be determined according to the scores (e.g., 10 and 15) corresponding to each of the third and fourth parameter values ​​(e.g., proportionally). According to an embodiment, it is also possible for the parameter value having the higher score among the third and fourth parameter values ​​to be selected as the third reference value.

[0064] The aforementioned first to fourth parameter values ​​may be further utilized to determine the optimal parameter values ​​(line 17). In other words, in addition to the first reference value, new parameter values, namely the first to fourth parameter values, are obtained and added to the parameter (D) to be adjusted, thereby performing an expansion of the parameter values.

[0065] FIG. 7 is a diagram illustrating the clustering of parameter values ​​according to one embodiment.

[0066] The parameter value design unit (123) can obtain a plurality of clusters (C1 to C5) by performing clustering based on one or more parameter values ​​(C_T, which may be prepared in a set format) as illustrated in FIGS. 2 and 7, and determine the selection probability of each cluster (C1 to C5). Here, the one or more parameter values ​​may include parameter values ​​transmitted from the existing adjustment target parameter determination unit (110), and may additionally include data (i.e., parameter values) obtained by the parameter value expansion unit (121) as needed (line 19).

[0067] According to one embodiment, clustering may be performed based on the value used for each parameter and the result of symbolic execution based on the value of the parameter, i.e., the score. Clustering may be performed by employing, for example, MeanShift Clustering, or by further utilizing online learning. The number of times clustering is performed may correspond to the number of parameters (40) to be adjusted. For example, if K parameters are to be adjusted, K clustering may be performed accordingly.

[0068] When clustering is completed, one or more clusters (C1 to C5) are obtained, and a score for each of the one or more clusters (C1 to C5) is obtained (T1). The score for each cluster (C1 to C5) can be given as the average of the score(s) belonging to the corresponding cluster (C1 to C5). Specifically, for example, in the case of the first cluster (C1), the range of the first cluster (C1) can be set using the minimum value (min_1) and the maximum value (max_1) of the parameter values, and the score of the first cluster (C1) can be obtained by calculating the average of the score(s) derived according to symbolic execution based on the parameters belonging to the set range. This can be performed identically for each cluster (C1 to C5).

[0069] The scores of each specific cluster (C1 to C5) described above may also be calculated using the following mathematical formula 1.

[0070] [Mathematical Formula 1]

[0071]

[0072] In Equation 1, lv and hv represent the maximum and minimum values ​​of the parameter, respectively, and v represents the parameter value. s is the score. In Equation 1, the numerator is the average of the scores derived from specific clusters (C1 to C5), and the denominator is the average of the scores derived from all clusters (C1 to C5). For example, if the first cluster (C1) is given as {(2GB, 28), (3GB, 26)} and the second cluster (C2) is given as {(0.5GB, 8), (0.1GB, 6)} according to the clustering results, the score of the first cluster (C1) (Score(C1)) and the score of the second cluster (C2) (Score(C2)) can be calculated as shown in Equations 2 and 3 below, respectively.

[0073] [Mathematical Formula 2]

[0074]

[0075] [Mathematical Formula 3]

[0076]

[0077] According to one embodiment, the selection probability of each cluster (C1 to C5) may be calculated using the average of the scores belonging to each cluster (C1 to C5) (T2). Specifically, the selection probability of each cluster (C1 to C5) is differentially added in proportion to the average score. Here, the selection probability of each cluster (C1 to C5) may be defined in proportion to the average score of each cluster (C1 to C5).

[0078] Subsequently, one of the clusters (C1 to C5) is selected according to the selection probability, and a random value is selected within the selected cluster (C1 to C5) (Line 21). For example, if the minimum value of -max-memory within the selected cluster is given as 8000 and the maximum value as 10000, 8200, which is a value between the minimum and maximum values, can be newly selected as the value of -max-memory. Based on the selected random value, a symbol execution is performed by the symbol executer (190), and branch coverage and a score are obtained (Lines 22 and 23). The score obtained according to the result of the symbol execution is reflected in the existing score for the corresponding cluster (C1 to C5) (T_3, Line 24). For example, the result of the symbol execution (i.e., score) obtained through the newly selected parameter value (8200) is reflected in the calculation of the average score of the corresponding clusters (C1 to C5), and accordingly, the average score of the corresponding clusters (C1 to C5) increases or decreases. Thus, a change occurs in the score corresponding to at least one cluster (C1 to C5), and the selection probability of each cluster (C1 to C5) is updated in accordance with such change in score (T4, line 25). Of course, depending on the situation, the average score of the corresponding clusters (C1 to C5) may be maintained, in which case the selection probability of each cluster (C1 to C5) may remain approximately the same as before.

[0079] If necessary, at least one cluster (C1 to C5) among all clusters (C1 to C5) is selected again, and a random value within the selected cluster (C1 to C5) may be selected again. Then, symbolic execution is performed based on the selected random value, and the newly acquired score is added to the existing score to update the selection probability. Based on the updated selection probability, at least one cluster (C1 to C5) among all clusters (C1 to C5) is selected again. The process described above may be repeated, for example, until a predefined condition (e.g., a certain number of processing times or a predefined processing time) is reached (Line 26).

[0080] Branch coverage can also be accumulated through the repetition described above (Lines 22 and 27). The accumulated branch coverage can be combined (Line 27). The combined branch coverage may be output externally and provided to a user or other information processing device.

[0081] The parameter tuning device (100) described above may be implemented using a device specifically designed to perform processing such as the aforementioned calculation or control, or it may be implemented by using one or more information processing devices alone or in combination. Here, one or more information processing devices may include, for example, a desktop computer, a laptop computer, a server hardware device, a smartphone, a tablet PC, a smart watch, a head-mounted display (HMD) device, a portable game console, a navigation device, a digital television, a set-top box, a digital media player device, a media streaming device, an audio playback device (such as an artificial intelligence speaker), a home appliance, a manned or unmanned mobile vehicle (e.g., a vehicle, a mobile robot, a wireless model vehicle or a robot vacuum cleaner), a manned or unmanned aerial vehicle (e.g., an aircraft, a helicopter, a drone, a model airplane or a model helicopter), a household / industrial / military robot, an industrial / military machine or a medical device, but are not limited thereto. Depending on the situation or conditions, the designer or user, etc., may consider and adopt at least one of the various devices for processing and controlling information in addition to the device described above as the parameter tuning device (100) described above.

[0082] FIG. 8 is a diagram showing branch coverage and system error detection results by a symbolic execution tool employing a parameter tuning device according to one embodiment and a conventional symbolic execution tool, respectively, where "Our" in FIG. 8 refers to the parameter tuning device (100) described above. Bayesian Optimization, Genetic Algorithm, TPE, Successive Halving, and CMA-ES are conventionally known parameter tuning algorithms that utilize machine learning. Additionally, xorriso (1.5.2), gcal (4.1), grep (3.4), gawk (5.1.0), and combine (0.4.0) each refer to software that is the subject of analysis.

[0083] Referring to the illustration in FIG. 8, the parameter tuning device (100) described above has a larger branch coverage value and a larger number of detected bugs compared to a conventionally known parameter tuning algorithm. In other words, the parameter tuning device (100) described above exhibits superior performance compared to other technologies. In particular, as illustrated in FIG. 8, it can be seen that the number of parameters tuned by existing algorithms is significantly smaller than the number of parameters for symbolic execution.

[0084] FIG. 9 is a graph showing the system error detection results of a symbol execution tool employing a parameter tuning device according to one embodiment and a conventional symbol execution tool.

[0085] Regarding the error detection results, that is, the number of bugs obtained, the error was detected based on the parameter tuning device (100) described above, the conventionally known Symtuner, and the conventionally known KLEE, and as shown in FIG. 9, more errors were detected than with the existing parameter tuning technology. In particular, the parameter tuning device (100) detected 16 bugs in a total of three software programs (i.e., gawk (5.1.0), gcal (4.1), and combine (0.4.0)), eight of which were bugs that were not detected by Symtuner and KLEE.

[0086] FIGS. 10 and 11 are graphs showing the branch coverage of a symbol execution tool employing a parameter tuning device according to an embodiment and a conventional symbol execution tool, respectively. In FIGS. 10 and 11, the x-axis represents time and the y-axis represents the number of branches. FIG. 10 illustrates the total number of branches obtained by the parameter tuning device (100), the total number of branches obtained by semi-automatic parameter adjustment, and the total number of branches obtained by manual parameter adjustment when the input program (10) is xorriso-1.5.2, a C-language-based program running on Linux. FIG. 11 illustrates the number of branches when the input program (10) is trueprint-5.4, a C-language-based program running on Linux. Here, KLEE is employed as the symbol executer (190). For both programs, parameter adjustment was performed five times over a period of 24 hours.

[0087] Referring to FIGS. 10 and 11, it can be seen that, compared to existing parameter tuning techniques, parameter tuning by the parameter tuning device (100) can achieve higher branch coverage than manual or semi-automatic parameter determination for a given input program (10), xorriso-1.5.2 and trueprint-5.4. In particular, this branch coverage shows a difference that increases over time. For example, in the case of the manual method, the number of branches covered hardly changes over time, and in the case of the semi-automatic method, it generally increases slowly after a certain period, whereas parameter tuning by the above-described parameter tuning device (100) shows a rapid increase in the number of branches covered after approximately a certain point in time (e.g., after 10 hours have elapsed). In other words, when using parameter combinations by the parameter tuning device (100), it becomes possible to achieve higher branch coverage than existing methods in most software.

[0088] As described above, the parameter tuning device (100) can significantly reduce the burden on a user who intends to perform symbol execution. That is, since the values ​​of each parameter are automatically generated by simply providing the entire parameters of the program (10) to be tested and the symbol execution tool to be performed as input, even a user lacking specialized knowledge of symbol execution can efficiently perform symbol execution.

[0089] Hereinafter, an embodiment of a parameter tuning method for symbol execution will be described with reference to FIG. 12.

[0090] FIG. 12 is a flowchart of a parameter tuning method for symbol execution according to one embodiment.

[0091] According to one embodiment of the parameter tuning method illustrated in FIG. 12, a target program is obtained by at least one device provided to perform parameter tuning, and various information for other symbol execution is obtained (400). Here, the various information may include, for example, processing time, initial parameter value, or parameters. Additionally, if necessary, the initialization of at least one variable(s) for processing these may also be performed sequentially or in conjunction therewith.

[0092] Among the given parameter value(s), parameter value(s) for which symbolic execution operates normally are selected and obtained, and accordingly, a set of normal operation parameters is constructed (402). Here, the given parameter value may include an initial parameter value. The selection of normal operation parameter values ​​may be performed, for example, by setting at least one parameter among all parameters to a value different from the default value, and performing symbolic execution based on the parameter value different from the default value to obtain branch coverage, excluding cases where the branch coverage corresponds to a predetermined value (e.g., cases where the branch coverage is 0), and including only cases where the branch coverage is not a predetermined value (i.e., cases where the branch coverage is not 0). Accordingly, among all parameter values, parameter values ​​that are not suitable for processing are excluded, and a set of normal operation parameters based only on normal operation parameter values ​​is obtained.

[0093] Aggregation of parameters can be performed (404). Aggregation of parameters can be performed based on the similarity between each parameter, for example, through the calculation of Manhattan distance. If necessary, aggregation can also be performed using additional methods such as whether options are classified into the same category and / or whether antonyms are used.

[0094] When one or more sets of parameters are generated, the principal parameters for those sets can be determined. The principal parameters may be determined by calculating the similarity between each parameter belonging to the set of parameters and all other parameters within the same set, calculating the average of these similarities, and obtaining the parameter with the largest calculated average.

[0095] The values ​​of the key parameters may be adjusted sequentially or simultaneously, and further symbolic executions may be performed based on the key parameters whose values ​​have been adjusted (406). More specifically, a set of parameter values ​​is obtained by setting the values ​​of the key parameters to values ​​different from the default values, and at least one symbolic execution (e.g., three times) is performed based on the set of parameter values ​​to obtain a score for the symbolic execution. The score for the symbolic execution is compared with the score obtained by the symbolic execution when the value of the key parameters is the default value, and based on this, it is determined whether to maintain or exclude the value of the key parameters.

[0096] If the score obtained by adjusting the value of a key parameter is lower than the score obtained with the default value, that key parameter is excluded from adjustment. Otherwise, that key parameter is treated as a target for adjustment. In the latter case, the remaining parameters, excluding the key parameter excluded from adjustment, may also be determined as targets for adjustment along with the key parameter. Accordingly, the parameters subject to adjustment are obtained.

[0097] If the parameter to be adjusted is not obtained in sufficient quantities for subsequent processing, further expansion of the parameter value may be performed based on the parameter to be adjusted (408). This may be performed, for example, through greedy value sampling. This may be performed by performing symbolic execution on values ​​smaller than and larger than the reference value, respectively, to calculate a corresponding score for each, determining either the smaller value or the larger value as a new reference value based on the score, and repeating the process described above using the new reference value. In this case, the determination of the new reference value may be processed based on the selection probability given corresponding to the score. Meanwhile, at least one of the smaller value and the larger value is used as the parameter value of the parameter to be adjusted. Accordingly, expansion of the parameter value of the parameter to be adjusted becomes possible.

[0098] Clustering is performed on the parameters to be adjusted to obtain one or more clusters, and a selection probability is calculated for each of the one or more clusters (410). Clustering may be performed, for example, through mean moving clustering. The calculation of the selection probability is performed based on the scores of the clusters, and the scores of the clusters may be obtained based on the average of the scores belonging to the clusters.

[0099] Subsequently, a predetermined cluster is selected from one or more clusters according to the selection probability, and after an arbitrary value is selected within the selected cluster, a symbolic execution is performed for the selected arbitrary value (412). A corresponding score is obtained according to the symbolic execution, and the obtained score is reflected in the score of the selected cluster. Accordingly, the score of the cluster is updated, and the selection probability is also updated according to the update of the cluster score. The process of selecting a cluster, selecting an arbitrary parameter from the selected cluster, performing a symbolic execution, and updating the score and selection probability (412) may be repeated according to the embodiment. In this case, the repetition may be performed until a predetermined number of times is reached or a predetermined processing time has elapsed.

[0100] The parameter tuning method for symbolic execution according to the above-described embodiment may be implemented in the form of a program that can be executed by a computer device. The program may include instructions, libraries, data files and / or data structures, etc., either individually or in combination, and may be designed and created using machine code or high-level language code. The program may be specially designed to implement the above-described method, or it may be implemented using various functions or definitions that are known and available to a person skilled in the art of computer software. Furthermore, the computer device may be implemented to include a processor or memory, etc., that enable the realization of the program's functions, and may further include a communication device as needed.

[0101] A program for implementing the parameter tuning method for symbolic execution described above may be recorded on a recording medium readable by a device such as a computer. A recording medium readable by a computer may include at least one type of physical storage medium capable of temporarily or non-temporarily storing one or more programs executed upon a call by a device such as a computer, such as a semiconductor storage medium such as ROM, RAM, SD card, or flash memory (e.g., a solid-state drive (SSD)), a magnetic disk storage medium such as a hard disk or floppy disk, an optical recording medium such as a compact disk or DVD, or a magneto-optical recording medium such as a floptical disk.

[0102] Although various embodiments of a parameter tuning device for symbol execution and a parameter tuning method for symbol execution have been described above, at least one of the parameter tuning device for symbol execution and the parameter tuning method for symbol execution is not limited only to the embodiments described above. Various other devices or methods that can be implemented by a person skilled in the art by modifying and varying the embodiments described above may also be at least one embodiment of the parameter tuning device for symbol execution and the parameter tuning method for symbol execution described above. For example, even if the described method(s) are performed in a different order than described, and / or the component(s) of the described system, structure, device, circuit, etc. are combined, connected, or combined in a form different from described, or replaced or substituted by other components or equivalents, etc., they may still be at least one embodiment of the parameter tuning device for symbol execution and the parameter tuning method for symbol execution described above.

[0103] Those skilled in the art related to the embodiments of the present invention will understand that they may be implemented in modified forms without departing from the essential nature of the description. Therefore, the disclosed methods should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the claims, not by the detailed description of the invention, and all variations within the scope of the claims should be interpreted as being included within the scope of the present invention. Explanation of the symbols

[0104] 100: Parameter Tuning Device 110: Adjustment target parameter determination unit 120: Parameter value determination unit 190: Symbol Launcher

Claims

Claim 1 A parameter tuning device for symbolic execution comprising: a parameter determination unit for determining a target parameter for determining a program and determining at least one target parameter for determining a program; and a parameter value determination unit for determining a parameter for determining a target parameter for determining a program, determining at least one cluster and selecting an arbitrary parameter value from at least one cluster. Claim 2 A parameter tuning device for symbolic execution according to claim 1, wherein the parameter value determining unit calculates a selection probability for the at least one cluster based on a score for the at least one cluster, selects a cluster according to the selection probability, selects an arbitrary parameter value from the selected cluster, and updates the score of the selected cluster using a score of symbolic execution based on the arbitrary parameter value. Claim 3 A parameter tuning device for symbol execution according to claim 1, wherein the adjustment parameter determination unit sets a different parameter value for at least one parameter, and when the branch coverage according to symbol execution based on the different parameter value corresponds to a predetermined value, the different parameter value is excluded to obtain a set of normal operation parameters. Claim 4 In claim 1, the adjustment parameter determination unit performs aggregation for the at least one parameter based on similarity between the at least one parameter to generate one or more sets, and is a parameter tuning device for symbolic execution that determines a key parameter for the one or more sets. Claim 5 In claim 4, the adjustment parameter determination unit adjusts the parameter value of the main parameter differently from the default value, obtains a score based on a symbol execution performed based on the adjusted parameter value, compares the score based on the symbol execution performed based on the adjusted parameter value with the score based on the default value, and if the score based on the symbol execution performed based on the adjusted parameter value is lower than the score based on the symbol execution performed based on the default value, excludes the adjusted parameter value to generate the parameter to be adjusted. Claim 6 A parameter tuning device for symbolic execution according to claim 1, wherein the parameter value determining unit expands the parameter value of the parameter to be adjusted, obtains a score according to symbolic execution for each of a value smaller than a reference value and a value larger than a reference value, determines one of the value smaller than a reference value and the value larger than a reference value as a new reference value based on each of the obtained scores, and uses at least one of the value smaller than a reference value and the value larger than a reference value as the parameter value of the parameter to be adjusted. Claim 7 A method for tuning parameters for symbolic execution comprising: a step of acquiring a program; a step of determining at least one parameter to be tuned for the program; a step of performing clustering on the parameter to be tuned to acquire at least one cluster; and a step of selecting an arbitrary parameter value from at least one cluster. Claim 8 A method for tuning parameters for symbolic execution according to claim 7, further comprising the step of updating the score of at least one cluster using a score of symbolic execution based on an arbitrary parameter value; wherein the arbitrary parameter is obtained through the steps of: calculating a selection probability for at least one cluster based on the score for at least one cluster; selecting a cluster according to the selection probability; and selecting an arbitrary parameter value from the selected cluster. Claim 9 A method for tuning parameters for symbolic execution according to claim 7, wherein the step of determining at least one parameter to be adjusted for the program comprises: a step of setting a different parameter value for at least one parameter; and a step of obtaining a set of normal operation parameters by excluding the different parameter value when the branch coverage according to symbolic execution based on the different parameter value corresponds to a predetermined value. Claim 10 A method for tuning parameters for symbolic execution according to claim 7, wherein the step of determining at least one parameter to be adjusted for the program comprises: a step of generating one or more sets by performing aggregation of the at least one parameter based on similarity between the at least one parameter; and a step of determining a key parameter for the one or more sets. Claim 11 A method for tuning parameters for symbol execution according to claim 10, wherein the step of determining at least one parameter to be adjusted for the program comprises: a step of adjusting the parameter value of the main parameter to be different from the default value; a step of obtaining a score based on a symbol execution performed based on the adjusted parameter value; a step of comparing the score based on a symbol execution performed based on the adjusted parameter value with the score based on a symbol execution performed based on the default value; and a step of excluding the adjusted parameter value to generate the parameter to be adjusted if the score based on the symbol execution performed based on the adjusted parameter value is lower than the score based on the default value. Claim 12 A method for tuning parameters for symbolic execution according to claim 7, further comprising the step of expanding the parameter value of the parameter to be adjusted; wherein the step of expanding the parameter value of the parameter to be adjusted comprises: the step of obtaining a score according to symbolic execution for each of a value smaller than a reference value and a value larger than a reference value; the step of determining one of the value smaller than a reference value and the value larger than a reference value as a new reference value based on each of the obtained scores; and the step of using at least one of the value smaller than a reference value and the value larger than a reference value as the parameter value of the parameter to be adjusted.

Images