An automated symbolic execution method and device based on weight comparison

Abstract

The application discloses an automatic guessing symbolic execution method and device based on weight comparison, which comprises the following steps: symbolic execution program, initialization program symbol state; path exploration is carried out on the program by using heuristic search; the direction of the branch statement node is selected according to the weight to continue searching; constraint solving is executed after reaching the maximum guessing depth; whether backtracking and adjusting the node weight are determined according to the constraint solving result; the maximum guessing depth is adjusted according to the guessing result under the current maximum guessing depth. Compared with the scheme of the ordinary heuristic search symbolic execution method, the number of constraint solving is reduced, and then the constraint solving and symbolic execution running time are greatly reduced; compared with the scheme of the ordinary guessing search symbolic execution method, the guessing success rate of the guessing symbolic execution is improved, the number of backtracking is reduced, and the adaptability of the method to different programs is improved by automatically determining the maximum guessing depth, so that the application has good accuracy and practicability.

Description

Technical Field

[0001] This invention belongs to the field of software testing technology, and relates to symbolic execution technology, and in particular to an automated guessing symbolic execution method and apparatus based on weight comparison. Background Technology

[0002] After discovering a vulnerability, test cases need to be constructed to verify it. However, the scale of current software and hardware programs is quite large, making manual construction of test cases virtually impossible. Therefore, how to automatically generate test cases is a crucial issue after vulnerability discovery. Symbolic execution is an effective method to solve this problem. As an important formal method and software analysis technique, symbolic execution uses abstract symbols to replace program variables. The output of the program's computation is represented as a function of the input symbol values. It traverses the program's execution space according to the program's semantics, playing a vital role in the detection and verification of program vulnerabilities and weaknesses. Symbolic execution symbolizes the input, collects path conditions while executing the program, and determines the reachability of the path by solving the constraint after each path exploration. If the path conditions are satisfied, the result of the constraint solution is the test case. By continuously exploring program paths and solving path constraints, symbolic execution can eventually automatically generate a large number of effective test cases.

[0003] During the symbolic execution process of generating test cases, a large number of complex data operations are involved, requiring extensive constraint solving. Constraint solving is essentially a complex mathematical problem and is the most time-consuming part of symbolic execution. The efficiency of symbolic execution heavily depends on the efficiency of constraint solving; therefore, the time spent on constraint solving during symbolic execution significantly impacts the efficiency of test case generation. Consequently, constraint solving overhead is currently one of the factors restricting the large-scale application of symbolic execution.

[0004] Traditional symbolic execution performs constraint solving every time a branch condition is added to the path conditions. If a solution is found, the path exploration continues; otherwise, the branch is deleted and the opposite branch is explored. Speculative Symbolic Execution (SSE) builds upon traditional symbolic execution by introducing a guessing approach. When encountering a branch condition, it doesn't directly perform constraint solving. Instead, it assumes the path conditions are satisfied and skips constraint solving at that node. Constraint solving is only performed when the number of undetermined branches on the current path reaches a certain number or the path ends. If the current path conditions are satisfied, the path exploration continues; if not, a backtracking operation is performed, sequentially solving constraints on the skipped nodes until a new feasible branch node is found, and the path exploration continues. This approach eliminates a significant number of constraint solving operations, thus greatly improving the efficiency of symbolic execution.

[0005] Existing automated symbolic execution methods based on weighted comparisons primarily rely on conventional symbolic execution methods for improvement. However, these methods suffer from the same drawbacks: when guessing a branch, they rely on a simple decision-making method, leading to low accuracy. Furthermore, because the optimal guess depth determination method in conventional symbolic execution is relatively simple and immutable, it suffers from poor adaptability in practical applications. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides an automated guessing symbol execution method and apparatus based on weight comparison. By improving the success rate of guessing symbol execution, it alleviates the inefficiency caused by excessive constraint solving in traditional symbol execution. Furthermore, it automatically and dynamically adjusts the guessing symbol execution according to different programs, thereby efficiently exploring paths for the program.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] An automated sign guessing method based on weighted comparison includes the following steps:

[0009] (1) Symbolically execute the program, initialize the symbolic state of the program as a six-tuple (pc,π,σ,d,tp,fp), and set the maximum guessing depth D; where pc points to the next program statement to be processed, π refers to the path constraint information, σ represents the set of symbolic values ​​related to the program variables, d represents the guessing depth of the current state, tp represents the probability of selecting the true branch when the current node is a conditional branch statement, and fp represents the probability of selecting the false branch when the current node is a conditional branch statement;

[0010] (2) After adding the initial values ​​of the program symbol state (pc0,true,σ0,0,tp0,fp0) to the open list, start the heuristic search to explore the path. The open list is a sorted list in which the nodes are sorted according to the heuristic values ​​attached to them by the heuristic search algorithm.

[0011] (3) Solve the constraint conditions of the current node. If the constraint solution is successful, the guess is successful. Adjust the maximum guess depth D and go to step (2.1) to continue exploring. If the constraint solution fails, the guess fails. Go to step (4).

[0012] (4) Backtrack the node and sequentially retrieve the nodes whose constraints have not yet been solved from the state stack until a feasible state node is found.

[0013] (5) Adjust the true branch weight value tp and false branch weight value fp of the nodes that failed to solve the constraints in the backtracking nodes in step (4), delete the node status of these nodes in the open list, adjust the maximum guess depth D, and go to step (2.1) to continue exploring the path.

[0014] (6) Complete the program path exploration.

[0015] Furthermore, the program statement includes any one of assignment statements, conditional branch statements, and jump statements; the path constraint information represents the conditional branches that need to be traversed to reach a specific program statement and the expressions for symbolic values ​​at each branch; the symbolic value set includes expressions containing both specific values ​​and symbolic values.

[0016] Furthermore, in step (2), the specific process of the heuristic search algorithm for sorting is as follows:

[0017] (2.1) Determine if the openlist is empty. If it is not empty, select unexplored nodes from the openlist for exploration. If it is empty, proceed to step (6).

[0018] (2.2) Explore based on the current node's pc;

[0019] (2.3) For each exploration, determine whether the statement is a conditional branch statement by using the pc. If it is not a branch statement, continue the path exploration according to the pc. If it is a branch statement, proceed to step (2.4).

[0020] (2.4) Compare the true branch weight value tp and the false branch weight value fp of the branch statement node, select the branch with the larger weight, save the symbol state of the node in the stack state used to save the current guess segment node state, increase the guess depth d by 1 and compare it with D to determine whether the maximum guess depth has been reached. If the maximum guess depth has not been reached, proceed to step (2.2) to continue exploration. If the maximum guess depth has been reached, proceed to step (3). At the same time, set the guess depth d of the other branch to 0 and add it to the open list as an unexplored node state.

[0021] Furthermore, the maximum guessing depth D in steps (3) and (5) is dynamically adjusted according to the following strategy:

[0022]

[0023] Where n represents the number of constraint solutions performed during the backtracking process.

[0024] Furthermore, the branch weights of nodes that fail to solve the constraints in step (5) are adjusted according to the following strategy:

[0025]

[0026] Where D represents the current maximum guess depth, and n represents the number of constraint solutions performed during the backtracking process when the node is backtracked.

[0027] The present invention also provides an automated symbol guessing execution device based on weight comparison, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements the above-described automated symbol guessing execution method based on weight comparison.

[0028] Furthermore, the computer program includes:

[0029] The symbolic execution module is used to analyze the program under test and generate test cases by guessing symbolic execution based on weight values;

[0030] The weight update module is used to adjust the weight of the corresponding node after a guess fails;

[0031] The program adaptive module is used to automatically and dynamically adjust different programs based on the guess results.

[0032] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0033] This invention determines the selection path for symbolic execution based on weight comparison, thereby reducing the number of constraint solutions that consume a lot of time in symbolic execution path exploration while improving the guessing success rate and further reducing the problem of excessive time consumption in symbolic execution path exploration. Secondly, this invention dynamically adjusts the maximum guessing depth automatically according to the program when performing symbolic execution, so it can be applied to path exploration of different programs and can perform path exploration more accurately and effectively according to different programs. Attached Figure Description

[0034] Figure 1 This is a flowchart of the automated symbol guessing execution method based on weight comparison according to the present invention. Detailed Implementation

[0035] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0036] The automated symbol guessing execution method based on weight comparison provided by this invention has the following process: Figure 1 As shown, the steps are as follows:

[0037] (1) The program is executed symbolically, and its symbolic state is initialized as a six-tuple (pc, π, σ, d, tp, fp). The program execution point pc, path condition π, and variable value σ are the same as in ordinary symbolic execution. pc points to the next program statement to be processed, which can be an assignment statement, a conditional branch statement, or a jump statement. π represents path constraint information, indicating the conditional branches that must be traversed to reach a specific program statement and the expressions related to symbolic values ​​at each branch. σ represents the set of symbolic values ​​related to program variables, including expressions containing both concrete and symbolic values. d represents the guessing depth of the current state. tp represents the probability of selecting a true branch when the current node is a conditional branch statement, and fp represents the probability of selecting a false branch when the current node is a conditional branch statement. Simultaneously, the maximum guessing depth D is set.

[0038] (2) After adding the initial values ​​of the program symbol state (pc0, true, σ0, 0, tp0, fp0) to the open list, heuristic search is started to explore the path. The open list is a sorted list in which the nodes are sorted according to the heuristic values ​​attached by the heuristic search algorithm. The specific process is as follows:

[0039] (2.1) Determine if the openlist is empty. If it is not empty, select unexplored nodes from the openlist for exploration. If it is empty, proceed to step (6).

[0040] (2.2) Explore based on the current node's pc;

[0041] (2.3) For each exploration, determine whether the statement is a conditional branch statement by using the pc. If it is not a branch statement, continue the path exploration according to the pc. If it is a branch statement, proceed to step (2.4).

[0042] (2.4) Compare the true branch weight value tp and the false branch weight value fp of the branch statement node, select the branch with the larger weight, save the symbol state of the node in the stack state used to save the current guessed segment node state, increase the guess depth d by 1 and compare it with D to determine whether the maximum guess depth has been reached. If the maximum guess depth has not been reached, proceed to step (2.2) to continue exploration. If the maximum guess depth has been reached, proceed to step (3). At the same time, set the guess depth d of the other branch to 0 and add it to the open list as an unexplored node state.

[0043] (3) Solve the constraints of the current node. If the constraint solution is successful, the guess is successful. Adjust the maximum guess depth D and proceed to step (2.1) to continue exploring. If the constraint solution fails, the guess fails. Proceed to step (4). In this step, the maximum guess depth D is dynamically adjusted according to the following strategy:

[0044]

[0045] Where n represents the number of constraint solutions performed during the backtracking process.

[0046] (4) Backtrack the node and sequentially retrieve the nodes whose constraints have not been solved from the state stack until a feasible state node is found.

[0047] (5) Adjust the true branch weight value tp and false branch weight value fp of the nodes that failed to solve the constraints in the backtracking nodes in step (4), delete the node status of these nodes in the open list, adjust the maximum guess depth D, and go to step (2.1) to continue exploring the path.

[0048] Specifically, the branch weights in the states of nodes that fail to solve are adjusted according to the following strategy:

[0049]

[0050] Where D represents the current maximum guess depth, and n represents the number of constraint solutions performed during the backtracking process when the node is backtracked to. The branch weight tp and the false branch weight fp are both adjusted according to this strategy.

[0051] The method for adjusting the maximum guess depth in this step is the same as in step (3).

[0052] (6) Complete the program path exploration.

[0053] Example:

[0054] like Figure 1 As shown in this embodiment, an automated guessing symbol execution method based on weight comparison is used to execute the program to be processed in a symbolic manner, and the symbol state of the program is initialized as a six-tuple (pc,π,σ,d,tp,fp).

[0055] The processing steps are as follows:

[0056] 1. The symbolic state six-tuple (pc, π, σ, d, tp, fp) of the initialization program is initialized to the value (pc0, true, σ0, 0, 0.45, 0.55). The guessing depth d of the current state can only be set to 0 during initialization. The probability tp of selecting a true branch when the current node is a conditional branch statement, and the probability fp of selecting a false branch when the current node is a conditional branch statement, can be initialized according to actual conditions. In this embodiment, based on relevant experiments, the probability of selecting a false branch is set to 0.55, slightly higher than the probability of selecting a true branch (0.45). Simultaneously, this embodiment initializes the maximum guessing depth D to 1. This parameter's initialization setting can be adjusted according to different situations.

[0057] 2. After adding the initial values ​​of the program symbol state (pc0, true, σ0, 0, 0.45, 0.55) to the open list, a heuristic search is initiated to explore the path. The open list is a sorted list where nodes are ordered according to heuristic values ​​assigned by the heuristic search algorithm. Path exploration continues until a conditional branch statement node is encountered. Upon encountering a conditional branch statement node, the weight values ​​of the true branch (tp) and false branch (fp) are compared. Since the false branch weight (0.55) is greater than the true branch weight, the false branch with the larger weight is selected. The symbol state of this node is saved in the stack `state`, which stores the current guessed segment node states. The guess depth `d` is increased by 1 and compared with the maximum guess depth `D`. Since the maximum guess depth of 1 has been reached, the guess depth `d` of the other branch is set to 0 and added to the open list as an unexplored node state before constraint solving.

[0058] 3. Solve the constraints. If the constraints are solved successfully, increase the maximum guess depth D to 2 and continue exploring the path based on the unexplored nodes in the open list. If the constraints are solved unsuccessfully, backtracking is required to find feasible nodes.

[0059] 4. In this embodiment, the initial maximum guess depth is 1, so only one node is put into the stack state. Since the false branch has been judged to be infeasible, the false branch state is deleted from the stack state.

[0060] 5. Adjust the weight tp of the true branch to 0.55 and the weight fp of the false branch to 0.45 according to the weight adjustment rules. Set the maximum guess depth D to 1 according to the maximum guess depth adjustment rules. At the same time, set the guess depth d to 0 and add it back to the open list as an unexplored node. Continue to explore the path until the program path exploration is completed.

[0061] Compared to the scheme using the ordinary heuristic search symbolic execution method, this embodiment reduces the number of constraint solving operations, thereby significantly reducing the constraint solving and symbolic execution runtime. Compared to the scheme using the ordinary guessing search symbolic execution method, this embodiment improves the guessing success rate of guessing symbolic execution, reduces the number of backtracking operations, and improves the adaptability of the method to different programs by automatically determining the maximum guessing depth, thus exhibiting better accuracy and practicality.

[0062] Based on the aforementioned weighted comparison-based automated symbol guessing execution method, this embodiment also provides a weighted comparison-based automated symbol guessing execution apparatus, including: a processor and a memory, the memory for storing a computer program, and the processor for executing the computer program to perform the aforementioned method. When the computer program is loaded into the processor, it implements the aforementioned weighted comparison-based automated symbol guessing execution method. Specifically, the apparatus includes:

[0063] The symbolic execution module is used to analyze the program under test by using symbolic execution based on weight values ​​to generate test cases; that is, to implement the parts of the above method steps (1)-(6) except for the specific content of weight update and adjustment of maximum guess depth.

[0064] The weight update module is used to adjust the weight of the corresponding node after a guessing failure; that is, to implement the specific adjustment strategy of the branch weight in the above method steps.

[0065] The program adaptive module is used to automatically and dynamically adjust different programs based on the guessing results; that is, to implement the specific adjustment strategy for the maximum guessing depth in the above method steps.

[0066] The technical means disclosed in this invention are not limited to those disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered within the scope of protection of this invention.

Claims

1. An automated symbol guessing execution method based on weighted comparison, characterized in that, Includes the following steps: (1) Symbolically execute the program and initialize the symbolic state of the program to a six-tuple. At the same time, set the maximum guess depth. ;in, Points to the next program statement that needs to be processed. Refers to path constraint information. Represents the set of symbolic values ​​associated with program variables. This indicates the depth of the guess for the current state. This indicates the probability of selecting the true branch when the current node is a conditional branch statement. This indicates the probability of selecting a false branch when the current node is a conditional branch statement; (2) Initialize the program symbol state Add to open list Then, heuristic search is used to explore paths, including open lists. It is a sorted list, in which the nodes are sorted according to heuristic values ​​assigned by a heuristic search algorithm; the specific process of the heuristic search algorithm for sorting is as follows: (2.1) Determine if the list is open Is it empty? If not empty, then start from the open list. Select unexplored nodes for exploration; if the node is empty, proceed to step (6). (2.2) Based on the current node To explore; (2.3) For each exploration through Determine if the statement is a conditional branch statement; if not, then... Continue exploring the path; if it is a branching statement, proceed to step (2.4). (2.4) True branch weight values ​​for branch statement nodes and the weight of the false branch Compare the branches, select the one with the larger weight, and save the symbolic state of that branch in the stack used to save the current guessed segment node state. In the middle, the depth will be guessed Add 1 and Compare the results to determine if the maximum guess depth has been reached. If not, proceed to step (2.2) to continue exploration. If the maximum guess depth has been reached, proceed to step (3). Simultaneously, change the guess depth of the other branch. Set to 0 and add to the open list as an unexplored node. ; (3) Solve the constraints of the current node. If the constraint solution is successful, the guess is successful, then adjust the maximum guess depth. Then proceed to step (2.1) to continue exploring. If the constraint solution fails, i.e. the guess fails, proceed to step (4). (4) Backtrack the node from the state stack. The nodes that have not yet been constrained are sequentially extracted and constrained until a feasible state node is found. (5) Adjust the true branch weights of the nodes that failed to solve the constraints in the backtracking nodes in step (4). and the weight of the false branch And remove these nodes from the open list. Adjust the maximum guess depth based on the node state. Then proceed to step (2.1) to continue exploring the path; The maximum guess depth in steps (3) and (5) Dynamic adjustments will be made based on the following strategies: in, Indicates the number of constraint solutions performed during the backtracking process; (6) Complete the program path exploration.

2. The automated symbol guessing execution method based on weighted comparison according to claim 1, characterized in that, The program statements include any one of assignment statements, conditional branch statements, and jump statements; the path constraint information represents the conditional branches that need to be passed to execute a specific statement in the program, as well as the expressions for symbolic values ​​at each branch; the symbolic value set includes expressions containing both specific values ​​and symbolic values.

3. The automated symbol guessing execution method based on weighted comparison according to claim 1, characterized in that, In step (5), the branch weights of nodes where constraint solving fails are adjusted according to the following strategy: in, This indicates the current maximum guess depth. This indicates the number of constraint solutions performed during the backtracking process when the node is currently being backtracked to.

4. An automated symbol guessing execution device based on weighted comparison, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is loaded into the processor, it implements the automated symbol guessing execution method based on weight comparison as described in any one of claims 1-3.

5. The automated symbol guessing execution device based on weight comparison according to claim 4, characterized in that, The computer program includes: The symbolic execution module is used to analyze the program under test and generate test cases by guessing symbolic execution based on weight values; The weight update module is used to adjust the weight of the corresponding node after a guess fails; The program adaptive module is used to automatically and dynamically adjust different programs based on the guess results.

Images