Apparatus and method for software testing based on symbolic execution

Abstract

A software testing device according to one embodiment of the present invention relates to a symbolic execution-based software testing device utilizing state features, and may include an information collection module that generates a path by repeatedly performing symbolic execution and collects branch condition statements and path condition expressions searched for path generation, a grouping module that generates clusters by grouping path condition expressions based on branch condition statements included in path condition expressions, and a state feature selection module that selects branch condition statements to be used as state features from clusters according to preset criteria and converts the path into a feature vector using the state features.

Description

Technology Field

[0001] The present invention relates to a software testing device and method. Background Technology

[0002] Symbolic execution is a representative software testing technique that performs tests by replacing software inputs with symbolic variables.

[0003] Symbolic execution manages the paths explored during software execution in the form of states, and the total number of states increases as it branches (forks) whenever a conditional statement is encountered. Consequently, symbolic execution methods can suffer from the state-explosion problem, where the total number of states grows exponentially as execution continues. For this reason, an appropriate state selection strategy is required for effective symbolic execution.

[0004] Key components of a state selection strategy include state features, which represent specific information possessed by a state, and a ranking function, which determines the priority between states. Previous studies have proposed methods to define both elements based on expert intuition or to automatically generate ranking functions using machine learning techniques. However, despite these studies, the problem of having to generate a large number of state features at a high cost by relying on expert intuition or knowledge still persisted. Prior art literature

[0005] Korean Published Patent Application No. 10-2022-0046467 ("Method for automatically reducing the search space of symbolic executions through machine learning", Publication Date: April 14, 2022) The problem to be solved

[0006] The present invention aims to provide a software testing device and method for determining a state selection strategy in symbolic execution by determining state features and ranking functions based on branch condition statements and path condition expressions. means of solving the problem

[0007] A software testing device according to one embodiment of the present invention relates to a symbolic execution-based software testing device utilizing state features, and may include an information collection module that generates a path by repeatedly performing symbolic execution and collects branch condition statements and path condition expressions searched for path generation, a grouping module that generates clusters by grouping path condition expressions based on branch condition statements included in path condition expressions, and a state feature selection module that selects branch condition statements to be used as state features from clusters according to preset criteria and converts the path into a feature vector using the state features.

[0008] According to one embodiment, the state feature selection module may be characterized by selecting at least one cluster among the clusters and selecting the branch condition statement that formed the basis of the selected cluster as the branch condition statement to be used as the state feature.

[0009] According to one embodiment, the state feature selection module may be characterized by selecting at least one cluster such that all branch condition statements found in the entire path condition expression included in the selected cluster can be included.

[0010] According to one embodiment, the state feature selection module may be characterized by selecting the minimum possible number of clusters when selecting at least one cluster.

[0011] According to one embodiment, the state feature selection module may be characterized by selecting the minimum number of clusters using a greedy method in the set cover problem.

[0012] According to one embodiment, a ranking function generation module may be further included that uses a value obtained by operating a weight vector on a feature vector as a ranking function.

[0013] According to one embodiment, the ranking function generation module may be characterized by using a value calculated by inputting a value pre-set as a weight value within a weight vector as a ranking function, dividing the weight values ​​into a plurality of groups based on the software testing results, and determining the weight values ​​based on the similarity of the weight distribution between the plurality of groups.

[0014] According to one embodiment, the ranking function generation module may be characterized by calculating the weight distribution similarity between the group with the highest average of testing results and the group with the lowest average among the groups divided by weight values, and determining the weight value from the group with the highest average when the similarity is below a preset standard.

[0015] According to one embodiment, the weight distribution similarity may be characterized by being calculated based on the mean and standard deviation of the weights within the group.

[0016] A software testing method according to another embodiment of the present invention relates to a symbolic execution-based software testing method utilizing state features, and may include an information collection step of generating a path by repeatedly performing symbolic execution and collecting branch condition statements and path condition expressions searched for path generation, a grouping step of creating clusters by grouping path condition expressions based on branch condition statements included in path condition expressions, and a state feature selection step of selecting branch condition statements to be used as state features from the clusters according to a preset criterion and converting the path into a feature vector using the state features.

[0017] According to one embodiment, the state feature selection step may be characterized by selecting at least one cluster among the clusters and selecting the branch condition statement that forms the basis of the selected cluster as the branch condition statement to be used as the state feature.

[0018] According to one embodiment, the state feature selection step may be characterized by selecting at least one cluster so that all branch condition statements found in the entire path condition expression included in the selected cluster can be included.

[0019] According to one embodiment, the state feature selection step may be characterized by selecting at least one cluster, wherein the minimum possible number of clusters is selected.

[0020] According to one embodiment, the state feature selection step may be characterized by selecting the minimum number of clusters using a greedy method in the set cover problem.

[0021] According to one embodiment, a ranking function generation step may be further included, in which a value obtained by operating a weight vector on a feature vector is used as a ranking function.

[0022] According to one embodiment, the ranking function generation step may be characterized by using a value calculated by inputting a value previously set as a weight value within a weight vector as a ranking function, dividing the weight values ​​into a plurality of groups based on the software testing results, and determining the weight values ​​based on the similarity of the weight distribution between the plurality of groups.

[0023] According to one embodiment, the ranking function generation step may be characterized by calculating the weight distribution similarity between the group with the highest average of testing results and the group with the lowest average among the groups divided by weight values, and determining the weight value from the group with the highest average when the similarity is below a preset standard.

[0024] According to one embodiment, the weight distribution similarity may be characterized by being calculated based on the mean and standard deviation of the weights within the group. Effects of the invention

[0025] According to the above-described symbolic execution-based software testing device and method, by determining state features and ranking functions based on branch condition statements and path condition expressions, the cost of devising a state selection strategy can be drastically reduced and the software error detection capability can be improved. Brief explanation of the drawing

[0026] FIG. 1 is a block diagram of a software testing device according to one embodiment. FIG. 2 is a schematic diagram of a symbol execution process according to one embodiment. FIG. 3 is a schematic diagram of a path condition expression grouping process according to one embodiment. FIG. 4 is a schematic diagram of a state feature selection process according to one embodiment. FIG. 5 is a schematic diagram of a feature vector transformation process according to one embodiment. FIG. 6 is an example of a vector operation result according to one embodiment. FIG. 7 is a diagram showing weight values ​​according to one embodiment based on testing results. FIG. 8 is a schematic diagram of a software testing device and a symbol execution device according to one embodiment. FIG. 9 is a flowchart of a software testing method according to one embodiment. Specific details for implementing the invention

[0027] The advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below but may be implemented in various different forms. These embodiments are provided merely to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention, and the present invention is defined only by the scope of the claims.

[0028] The terms used in this specification will be briefly explained, and the invention will be described in detail.

[0029] The terms used in this invention have been selected based on currently widely used general terms, taking into account their functions within the invention; however, these terms may vary depending on the intent of those skilled in the art, case law, the emergence of new technologies, etc. Additionally, in specific cases, terms have been arbitrarily selected by the applicant, and in such cases, their meanings will be described in detail in the relevant description of the invention. Therefore, the terms used in this invention should be defined not merely by their names, but based on their meanings and the overall content of the invention.

[0030] Throughout the specification, when a part is described as "comprising" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components. Furthermore, terms such as "part," "module," and "unit" used in the specification refer to a unit that processes at least one function or operation and may be implemented as software, hardware components such as FPGAs or ASICs, or a combination of software and hardware. However, the terms "part," "module," and "unit" are not limited to software or hardware. "Part," "module," and "unit" may be configured to reside in an addressable storage medium or configured to run one or more processors. Accordingly, as an example, terms such as "part," "module," and "unit" include components such as software components, object-oriented software components, class components, and task components, as well as processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables.

[0031] Below, embodiments of the present invention are described in detail with reference to the attached drawings so that those skilled in the art can easily implement the invention. Additionally, parts of the drawings that are irrelevant to the description are omitted to clearly explain the invention.

[0032] Terms including ordinal numbers, such as "first," "second," etc., may be used to describe various components, but the components are not limited by the terms. The terms are used solely for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be named the second component, and similarly, the second component may be named the first component. The term "and / or" includes a combination of multiple related items or any one of the multiple related items.

[0034] Hereinafter, the software testing device (1) and method of the present invention will be described with reference to the drawings.

[0035] The software testing device (1) and method of the present invention are testing devices and methods based on symbolic execution. Symbolic execution manages the searched path in the form of a state and branches whenever a conditional statement is encountered, and since the total number of states increases, an appropriate state selection strategy is required. The state selection strategy consists of a state feature that expresses specific information possessed by candidate states and a ranking function for determining the priority among candidate states. The present invention is for an appropriate state selection strategy in symbolic execution and is characterized by determining the state selection strategy by determining the state feature and ranking function based on branching conditional statements and path conditional expressions.

[0036] The software testing device (1) and method of the present invention relate to a symbolic execution-based software testing device (1) that utilizes state features, and can generate a path by repeatedly performing symbolic execution and collect branch condition statements and path condition expressions searched for path generation. In addition, the software testing device (1) and method can generate clusters by grouping path condition expressions based on branch condition statements included in the path condition expressions. In addition, the software testing device (1) and method can select branch condition statements to be used as state features from the clusters according to pre-set criteria and convert the path into a feature vector using the state features.

[0037] FIG. 1 is a block diagram of a software testing device (1) of the present invention according to one embodiment.

[0038] The software testing device (1) of the present invention may be provided in a form that is additionally included in existing commercial software testing tools (e.g., Microsoft SAGE, etc.), or may be provided as a separate device.

[0039] The software testing device (1) of the present invention is provided as a processor device, through which software testing can be performed. That is, each component (module, etc.) included in the software testing device (1) can perform the function of the corresponding component through the processor device. The processor may include one or more electronic devices capable of performing various computation and control processing, such as a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a Micro Controller Unit (MCU), an Application Processor (AP), an Electronic Controlling Unit (ECU), a Micro Processor (Micom), or others. These processing or control devices may be implemented, for example, by using one or more semiconductor chips, circuits, or related components alone or in combination. However, they are not limited thereto and may be implemented by various devices capable of processing information.

[0040] Additionally, the software testing device (1) may be implemented by separately providing a collection device for collecting information, a storage device for storing the collected information and the output (result value, etc.) derived by processing by the processor, and an output device for outputting the information.

[0041] For example, the software testing device (1) may be equipped with an input device, such as a keyboard, mouse, or touchpad, capable of receiving user input as a collection device, and a communication device capable of communicating with other devices or configurations, and may collect user input, communication signals, etc. received through these. Additionally, for example, the software testing device (1) may include at least one of a main memory and an auxiliary memory as a storage device. The main memory may be implemented using a semiconductor storage medium such as ROM and / or RAM, for example, and the auxiliary memory may be implemented based on a device capable of storing data permanently or semi-permanently, such as a flash memory device (Solid State Drive (SSD), etc.), an SD (Secure Digital) card, a hard disk drive (HDD), a compact disc, a DVD, or a laser disc. Additionally, for example, the software testing device (1) may include output devices such as a display, printer device, speaker device, video output terminal, and data input / output terminal, so as to output intermediate outputs or results resulting from the software testing process to a user or transmit them to another device or configuration. However, the collection device, storage device, and output device of the software testing device (1) are not limited to the examples described above, and any device suitable for performing the corresponding function may be utilized without limitation.

[0042] Referring to FIG. 1, a software testing device (1) according to one embodiment of the present invention may include an information collection module (10), a grouping module (30), a state feature selection module (50), and a ranking function generation module (70).

[0043] Referring to FIG. 2, the information collection module (10) will be described.

[0044] The information collection module (10) can generate a path (state) by repeatedly performing symbol execution and can collect branch condition statements and path condition expressions searched for path generation.

[0045] The information collection module (10) can generate paths by repeatedly performing symbolic execution. According to one embodiment, the information collection module (10) can generate paths by repeatedly performing symbolic execution. Here, the path may be a test case generated through a branch conditional statement. That is, the information collection module (10) can generate various paths as test cases by repeatedly performing symbolic execution for a certain period of time and passing through a pre-set branch conditional statement. For example, the information collection module (10) can generate multiple paths as test cases by repeating symbolic execution 20 times for a short period of 120 seconds. FIG. 2 is a schematic diagram showing the process of performing symbolic execution according to one embodiment. Referring to FIG. 2, it can be seen that the information collection module (10) can generate multiple paths through each branch conditional statement via symbolic execution.

[0046] The information collection module (10) can collect branch condition statements and path condition expressions searched for path generation. The information collection module (10) passes through branch condition statements in generating each path, and each path may have previous branch condition statement information as a path condition expression for the creation of the path. Referring again to FIG. 2, the previous branch condition statement for generating a path is ( and ), ( and ) and each path to the previous branch statement to generate the corresponding path , , It can have a path condition expression. The information collection module (10) can therefore generate test cases and collect the entire branch condition statement and the path condition expression of each test case.

[0047] According to one embodiment, the information collection module (10) can perform symbol execution through a separate device. In this case, the information collection module (10) can repeatedly perform symbol execution through a command to a separate device for symbol execution and collect branch condition statements and path condition expressions generated therefrom.

[0048] Referring to FIG. 3, the grouping module (30) will be described.

[0049] The grouping module (30) can create clusters by grouping path condition expressions based on branch condition statements included in the path condition expressions.

[0050] The grouping module (30) can receive path condition expressions collected by the information collection module (10) from the previous step, and information on each branch condition statement included therein.

[0051] The grouping module (30) can create clusters by grouping path condition expressions based on branch condition statements included in the path condition expressions. That is, the grouping module (30) can group each state (path) based on the branch condition statement passed through to pass through the path.

[0052] According to one embodiment, the grouping module (30) can group path condition expressions based on the last branch condition statement included in the path among the branch condition statements included in the path condition expression. Since each path condition expression passes through a plurality of branch condition statements in order, there may be an order in which each branch condition statement is passed. For example, referring to FIG. 2, path 2 is next Because it went through, the branch conditional statement included at the end of the path is am.

[0053] According to one embodiment, the grouping module (30) may group path condition expressions based on a set of covered branches reached by the path condition expression. According to another embodiment, the grouping module (30) may group path condition expressions based on a set of covered paths reached.

[0054] The criteria used to group path condition expressions in the grouping module (30) are not limited to the aforementioned embodiments, and each path condition expression can be grouped according to various criteria.

[0055] Figure 3 is a schematic diagram showing that each path condition expression is grouped based on a branch condition statement in the grouping module (30).

[0056] Referring to Fig. 3, it can be seen that each path condition expression is grouped based on a branch condition statement included in the path condition expression to create a cluster. For example, path condition expression PC1 can be grouped based on the branch condition statement BS1 included in path condition expression PC1, and path condition expressions PC2 and PC4 can be grouped based on the branch condition statement BS2 included in path condition expressions PC2 and PC4. Each grouped set of path condition expressions can be created as a cluster (e.g., BS1, BS2).

[0057] Referring to FIGS. 4 and FIGS. 5, the state feature selection module (50) will be described.

[0058] The state feature selection module (50) can select a branch condition statement to be used as a state feature from the cluster according to a preset standard, and convert the path into a feature vector using the state feature.

[0059] The state feature selection module (50) can select branch condition statements to be used as state features from each cluster grouped in the aforementioned grouping module (30) according to preset criteria. That is, the software testing device (1) of the present invention can use branch condition statements as state features.

[0060] According to one embodiment, the state feature selection module (50) can select at least one cluster among the clusters and select the branch condition statement that formed the basis of the selected cluster as the branch condition statement to be used as the state feature.

[0061] Additionally, according to one embodiment, the state feature selection module (50) may select at least one cluster so that all branch condition statements discovered in the entire path condition expression included in the selected cluster can be included. The state feature selection module (50) selects at least one partial cluster from among the previously grouped multiple clusters, and may select a partial cluster in which the branch condition statements included in the path condition expression belonging to the partial cluster can cover all branch condition statements discovered. That is, the state feature selection module (50) may select at least one cluster so that all all branch condition statements discovered previously can be included in at least one path condition expression included in the selected partial cluster. Referring again to the example of FIG. 2, when the state feature selection module (50) selects a partial cluster, , , , A subset of clusters can be selected such that each branch condition statement is included in at least one path condition expression included within the selected subset of clusters. Additionally, the branch condition statement that forms the basis of the selected clusters can be selected as the branch condition statement to be used as the state feature. Figure 4 is a schematic diagram illustrating the process of selecting the state feature. To explain using the example in Figure 4, if the branch condition statements included in the path condition expressions PC1, PC3, PC5, and PC7 can cover all the branch condition statements discovered (i.e., when viewed as a whole path condition expression, at least one of the previously discovered branch condition statements is included), then the BS1 and BS3 clusters can be selected, and the branch condition statements BS1 and BS3 that form the basis of these clusters can be selected as the branch condition statements to be used as the state feature.

[0062] Additionally, according to one embodiment, the state feature selection module (50) can select at least one cluster, and select the minimum number of clusters possible to cover all the searched branch condition statements. As described above, when the state feature selection module (50) selects at least one cluster capable of covering all the searched path condition expressions, various cases of selecting clusters may occur. According to one embodiment, in such cases, the state feature selection module (50) can select clusters such that the number of selected clusters among these various cases is minimized. Referring again to the example of FIG. 4, there may be various cases of selecting clusters capable of covering all the searched path condition expressions, such as (BS1, BS2, BS3), (BS1, BS3, BS4), and (BS1, BS3). At this time, the state feature selection module (50) can select (BS1, BS3) so that the number of clusters is minimized.

[0063] According to one embodiment, the state feature selection module (50) may use a greedy method in the set cover problem when selecting the minimum number of clusters that can cover all the searched branch conditions. Since the process of selecting the minimum number of clusters that cover all the branch conditions is the set cover problem, which is well known as an NP-complete problem, a solution close to the correct answer (minimum number of clusters) can be obtained through a greedy method. For example, if the cluster set to be obtained (minimum number of clusters that can cover all branch conditions) is defined as RC, the minimum number of cluster sets RC can be obtained by repeating the process of adding one by one the clusters that RC does not cover until the clusters included in RC cover all branch conditions, until the path condition expressions within the clusters included in RC cover all branch conditions.

[0064] The state feature selection module (50) can convert paths into feature vectors using state features. The state feature selection module (50) can select branch condition statements to be used as state features through the aforementioned process, and can convert previously generated paths into feature vectors using the selected branch condition statements as state features.

[0065] FIG. 5 is a schematic diagram representing a selected branch conditional statement according to one embodiment and the state (path) accordingly as a state feature. Referring to the embodiment of FIG. 5, through the aforementioned process , , , A branch conditional statement to be used as a state feature has been selected, and the state feature selection module (50) can convert each path into a 4-dimensional feature vector through this. In the case of path 0, Since it only includes, it can be represented as <1,0,0,0>, and in the case of path 1, Therefore, it can be represented as <0,1,1,0>, and in the case of path 2, Therefore, it can be represented as <0,1,0,1>.

[0066] Referring to FIGS. 6 and FIGS. 7, the ranking function generation module (70) will be described.

[0067] The ranking function generation module (70) can use the value obtained by operating a weight vector on a feature vector as a ranking function.

[0068] The ranking function generation module (70) can use the value obtained by performing a weight vector operation on the feature vector generated by the aforementioned state feature selection module (50) as a ranking function. Specifically, the ranking function generation module (70) can use the result value obtained by performing a weight vector operation on the value obtained by converting each path into a feature vector through the state feature as a ranking function for each path.

[0069] FIG. 6 is a schematic diagram illustrating the process of calculating the result of an operation in a ranking function generation module (70). Referring to the example in FIG. 6, it can be seen that a result is calculated for each path by performing a weight vector operation on the feature vector transformed through the state feature for each path. The operation of the feature vector and the weight vector can be performed by multiplying the state feature included in each vector by the corresponding weight value and then adding them. According to the example, for path 0, 0.5 was produced by applying the weight vector (0.5, 2.1, -1.7, 3) to the feature vector <1,0,0,0>, for path 1, 0.4 was produced by applying the weight vector (0.5, 2.1, -1.7, 3) to the feature vector <0,1,1,0>, and for path 2, 5.1 was produced by applying the weight vector (0.5, 2.1, -1.7, 3) to the feature vector <0,1,0,1>.

[0070] According to one embodiment, the ranking function generation module (70) uses a value calculated by inputting a pre-set value as a weight value within a weight vector as a ranking function, divides the weight values ​​into multiple groups based on the software testing results, and determines weights based on the similarity of the weight distribution between the multiple groups. Here, the software testing result value may refer to a score calculated using information obtained by testing the software. For example, the software testing result value may be a score based on the testing result calculated using branching coverage obtained through the testing result.

[0071] According to one embodiment, the preset value entered as a weight value may be any random number within a range preset by the user.

[0072] The ranking function generation module (70) can perform software testing by inputting a pre-set value into each weight value within the weight vector, operating it with the feature vector, and using the resulting value as a ranking function.

[0073] Additionally, the ranking function generation module (70) can divide the weight values ​​corresponding to each state feature into multiple groups based on the score evaluated according to the software testing results. For example, the ranking function generation module (70) can separate the groups into groups where the software testing result score is greater than or equal to a first criterion, groups where it is greater than or equal to a second criterion but less than the first criterion, and groups where it is less than the second criterion. FIG. 7 is a result showing the weight values ​​corresponding to the state features according to the testing results according to one embodiment. Referring to the example in FIG. 7, it can be seen that each weight value is divided into three groups based on the score according to the software testing results.

[0074] Additionally, the ranking function generation module (70) can determine weights based on the similarity of weight distributions between multiple divided groups. The ranking function generation module (70) can analyze the weight distribution within multiple divided groups and determine weights based on the similarity of distributions between each group.

[0075] According to one embodiment, the weight distribution similarity may be calculated based on the mean and standard deviation of the weights within a group. That is, the mean and standard deviation of the weights within a group are calculated, and the weight distribution similarity between groups can be calculated based on the degree of similarity of these values.

[0076] According to one embodiment, the ranking function generation module (70) can determine the weight value from the group with the highest average of testing results and the group with the lowest average of weight values ​​by comparing the similarity of the weight distributions among the groups into which the weight values ​​are divided, if the similarity of the distributions is below a preset standard. For example, as shown in the example of FIG. 7, when the ranking function generation module (70) divides the weight values ​​into three groups based on the scores of the software testing results, it can calculate the similarity of the weight distribution between the group with the highest average score and the group with the lowest average score. Additionally, if the calculated similarity is below a preset standard, the ranking function generation module (70) can determine the weight value from the group with the highest average score. That is, the ranking function generation module (70) can determine one of the weight values ​​included in the group with the highest average of software testing results as the weight value of the corresponding state feature. According to one embodiment, the ranking function generation module (70) can determine the value closest to the average among the weight values ​​included in the group with the highest average score as the weight value of the corresponding state feature.

[0077] According to one embodiment, the ranking function generation module (70) can determine the weight values ​​randomly by comparing the weight distribution similarity of the group with the highest average of testing results and the group with the lowest average among the groups divided by weight values, and if the distribution similarity is greater than or equal to a preset standard.

[0078] The software testing device (1) of the present invention can determine state features and ranking functions through the above process.

[0079] The software testing device (1) can apply a state selection strategy having a state feature and a ranking function determined by a branch condition statement and a path condition expression, and can perform software testing by performing symbolic execution accordingly.

[0080] Additionally, according to another embodiment, the software testing device (1) of the present invention may be provided in a form that is added to another software testing device (1) based on symbolic execution, and may be provided in a form that additionally performs a state selection strategy on the symbolic execution of the other device. In this case, the symbolic execution performed in the present invention may be carried out by utilizing the execution performed on behalf of the other device.

[0081] FIG. 8 is a schematic diagram showing a software testing device (1) and a symbol execution device (2) of the present invention. Referring to FIG. 8, a software testing device according to another embodiment may provide a separate symbol execution device (2) that performs symbol execution, so that symbol execution is performed in the device. Referring to FIG. 8, the symbol execution device (2) receives a program and performs symbol execution to search for a path, and accordingly, can search for path condition expressions and branch condition statements. The software testing device (1) receives the searched path condition expressions and branch condition statements, determines state features and ranking functions through the aforementioned processes, and can transmit the determined state features and ranking functions back to the symbol execution device (2). Software testing can be performed by performing symbol execution through a state selection strategy based on the state features and ranking functions received by the symbol execution device (2).

[0082] Hereinafter, the symbolic execution-based software testing method of the present invention will be described with reference to FIG. 9.

[0083] FIG. 9 is a flowchart of the software testing method of the present invention.

[0084] Referring to FIG. 9, the software testing method of the present invention relates to a symbolic execution-based software testing method utilizing state features and a ranking function. It may include an information collection step (S910) for generating a path by repeatedly performing symbolic execution and collecting branch condition statements and path condition expressions searched for path generation. Additionally, the software testing method may include a grouping step (S920) for creating clusters by grouping path condition expressions based on branch condition statements included in the path condition expressions. Furthermore, the software testing method may include a state feature selection step (S930) for selecting branch condition statements to be used as state features from the clusters according to pre-set criteria and converting the path into a feature vector using the state features.

[0085] According to one embodiment, the state feature selection step may be characterized by selecting at least one cluster among the clusters and selecting the branch condition statement that forms the basis of the selected cluster as the branch condition statement to be used as the state feature.

[0086] According to one embodiment, the state feature selection step may be characterized by selecting at least one cluster so that all branch condition statements found in the entire path condition expression included in the selected cluster can be included.

[0087] According to one embodiment, the state feature selection step may be characterized by selecting at least one cluster, wherein the minimum possible number of clusters is selected.

[0088] According to one embodiment, the state feature selection step may be characterized by selecting the minimum number of clusters using a greedy method in the set cover problem.

[0089] According to one embodiment, a ranking function generation step may be further included, in which a value obtained by operating a weight vector on a feature vector is used as a ranking function.

[0090] According to one embodiment, the ranking function generation step may be characterized by using a value calculated by inputting a value previously set as a weight value within a weight vector as a ranking function, dividing the weight values ​​into a plurality of groups based on the software testing results, and determining the weight values ​​based on the similarity of the weight distribution between the plurality of groups.

[0091] According to one embodiment, the ranking function generation step may be characterized by calculating the weight distribution similarity between the group with the highest average of testing results and the group with the lowest average among the groups divided by weight values, and determining the weight value from the group with the highest average when the similarity is below a preset standard.

[0092] According to one embodiment, the weight distribution similarity may be characterized by being calculated based on the mean and standard deviation of the weights within the group.

[0094] Those skilled in the art related to the embodiments of the present invention will understand that they may be implemented in modified forms without departing from the essential nature of the description. Therefore, the disclosed methods should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the claims, not by the detailed description of the invention, and all variations within the scope of the claims should be interpreted as being included within the scope of the present invention. Explanation of the symbols

[0095] 1: Software testing device 2: Symbolic execution unit 10: Information Gathering Module 30: Grouping Module 50: State Feature Selection Module 70: Ranking function creation module

Claims

Claim 1 The software testing device for symbolic execution-based software testing utilizing state features comprises: an information collection module that generates a path by repeatedly performing symbolic execution and collects branch condition statements and path condition expressions searched for the generation of the path; a grouping module that generates clusters by grouping path condition expressions based on branch condition statements included in the path condition expressions; and a state feature selection module that selects branch condition statements to be used as state features from the clusters according to a preset criterion and converts the path into a feature vector using the state features; wherein the state feature generation module selects at least one cluster among the clusters and selects the branch condition statement that forms the basis of the selected cluster as the branch condition statement to be used as the state feature, and selects the at least one cluster such that all branch condition statements searched can be included in the entire path condition expression included in the selected cluster. Claim 2 delete Claim 3 delete Claim 4 A software testing device according to claim 1, wherein the state feature selection module selects the minimum possible number of clusters when selecting at least one cluster. Claim 5 A software testing device according to claim 4, wherein the state feature selection module selects the minimum number of clusters using a greedy method in the set cover problem. Claim 6 A software testing device further comprising: a ranking function generation module that uses a value obtained by operating a weight vector on the feature vector as a ranking function in claim 1. Claim 7 A software testing device according to claim 6, wherein the ranking function generation module uses a value calculated by inputting a value pre-set as a weight value within the weight vector as a ranking function, divides the weight values ​​into a plurality of groups based on the software testing results, and determines the weight values ​​based on the similarity of the weight distribution between the plurality of groups. Claim 8 A software testing device according to claim 7, wherein the ranking function generation module calculates the weight distribution similarity of the group with the highest average value of the software testing result and the group with the lowest average value among the plurality of groups, and when the weight distribution similarity is below a preset standard, determines the weight value from the group with the highest average value of the software testing result. Claim 9 A software testing device according to claim 7, characterized in that the weight distribution similarity is calculated based on the mean and standard deviation of the weight values ​​within the plurality of groups. Claim 10 A software testing method based on symbolic execution utilizing state features, comprising: an information collection step of generating a path by repeatedly performing symbolic execution and collecting branch condition statements and path condition expressions searched for generating the path; a grouping step of generating clusters by grouping path condition expressions based on branch condition statements included in the path condition expressions; and a state feature selection step of selecting branch condition statements to be used as state features from the clusters according to a pre-set criterion and converting the path into a feature vector using the state features; wherein the state feature selection step is characterized by selecting at least one cluster among the clusters and selecting the branch condition statement that formed the basis of the selected cluster as the branch condition statement to be used as the state feature, such that all branch condition statements searched can be included in the entire path condition expression included in the selected cluster. Claim 11 delete Claim 12 delete Claim 13 A software testing method according to claim 10, wherein the state feature selection step is characterized by selecting the minimum possible number of clusters when selecting at least one cluster. Claim 14 A software testing method according to claim 13, wherein the state feature selection step is characterized by selecting the minimum number of clusters using a greedy method in the set cover problem. Claim 15 A software testing method further comprising, in claim 10, a ranking function generation step of using a value obtained by operating a weight vector on the feature vector as a ranking function. Claim 16 A software testing method according to claim 15, wherein the ranking function generation step comprises using a value calculated by inputting a value previously set as a weight value within the weight vector as a ranking function, dividing the weight value into a plurality of groups based on the software testing results, and determining the weight value based on the similarity of the weight distribution between the plurality of groups. Claim 17 In claim 16, the ranking function generation step is characterized by calculating the weight distribution similarity between the group with the highest average value of the software testing result and the group with the lowest average value among the plurality of groups, and when the weight distribution similarity is below a preset standard, determining the weight value from the group with the highest average value of the software testing result. Claim 18 A software testing method according to claim 16, wherein the weight distribution similarity is calculated based on the mean and standard deviation of the weight values ​​within the plurality of groups.

Images