Symbol execution search method and device based on large language model

Abstract

The invention provides a symbolic execution search method and device based on a large language model, and the method comprises the steps: constructing a state evaluation cue word based on global information and the state information of each candidate state under the condition that the increment of an exploration coverage rate is lower than a preset increment threshold value; inputting a state evaluation cue word into the large language model, and performing comprehensive evaluation to obtain a preferred state, namely a candidate state with more potential for improving the exploration coverage rate; and performing subsequent symbolic execution search based on the optimal state until symbolic execution exploration of the to-be-tested program is completed. According to the method provided by the invention, by monitoring the exploration coverage rate of symbolic execution in real time, when it is detected that the coverage rate is increased and stagnated, the cue word containing the global information and the state information is utilized to guide the large language model to recognize the preferred state with high potential value, and the symbolic execution engine is guided to break through the constraint of complex logic; the coverage rate bottleneck is effectively broken through in the face of complex program logic, and the exploration efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a symbolic execution search method and apparatus based on a large language model. Background Technology

[0002] Symbolic execution, as an automated software testing and analysis technique, faces the core challenge of path explosion. Therefore, an efficient search strategy is crucial for guiding the engine to effectively explore the vast state space. Existing technologies primarily rely on heuristic search strategies. For example, the symbolic execution engine KLEE integrates common methods such as depth-first search, breadth-first search, and random search. Among these, the coverage-guided strategy CovNew is the most typical, prioritizing states that immediately cover unexecuted lines of code or branches, quickly improving coverage in the early stages of analysis. In recent years, machine learning-based state selection methods have also emerged, such as FeatureMaker, which automatically generates features and trains scoring functions based on historical path conditions. However, these methods rely on large amounts of historical execution data, feature representation is limited to the syntactic level, and model update latency is high, making it difficult to adapt to complex logical changes in real time during testing.

[0003] However, traditional coverage-driven strategies suffer from short-sightedness and localization in decision-making, which makes coverage growth prone to stagnation when faced with deep code that requires satisfying complex condition chains. Summary of the Invention

[0004] This invention provides a symbolic execution search method and apparatus based on a large language model, which solves the shortcomings of traditional search strategies in the prior art that are prone to getting stuck in local optima and have weak coverage growth when facing complex program logic, and ultimately achieves more efficient symbolic execution exploration.

[0005] This invention provides a symbolic execution search method based on a large language model, comprising: Obtain the exploration coverage of the symbol execution search within a preset time window; If the increment of the exploration coverage is less than a preset increment threshold, a state evaluation prompt word is constructed based on global information and the state information of each candidate state in the current candidate state set. The state evaluation prompts are input into a large language model, and the preferred state in the current candidate state set is obtained through evaluation by the large language model. Symbolic execution search is performed based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within a preset time window until the symbolic execution exploration of the program under test is completed.

[0006] According to the symbolic execution search method based on a large language model provided by the present invention, the step of determining the current candidate state set includes: Get the current initial state set; Based on the initial score of each initial state in the current initial state set, a filter state set is selected from the current initial state set; The current candidate state set is determined based on the clustering of the filtered state set.

[0007] According to the symbolic execution search method based on a large language model provided by the present invention, determining the current candidate state set based on the clustering of the filtered state set includes: Based on the state information of each filtering state in the filtering state set, the filtering states in the filtering state set are clustered to obtain the clusters. The current candidate state set is obtained by selecting a flag state from each cluster.

[0008] According to the symbolic execution search method based on a large language model provided by the present invention, the global information includes the program structure, exploration coverage and stall status information of the program under test; The status information includes status identifier code, code execution location, call stack information, and path constraint information.

[0009] According to the symbolic execution search method based on a large language model provided by the present invention, the step of determining the window size of the preset time window includes: Get the historical exploration coverage of symbolic execution search; The window size of the preset time window is determined based on the historical growth trend of the historical exploration coverage.

[0010] According to the symbolic execution search method based on a large language model provided by the present invention, the step of determining the preset incremental threshold includes: Based on the historical growth trend, the preset incremental threshold is determined.

[0011] The present invention also provides a symbolic execution search device based on a large language model, comprising: The acquisition unit retrieves the exploration coverage of the symbolic search within a preset time window; The prompt word construction unit constructs state evaluation prompt words based on global information and the state information of each candidate state in the current candidate state set when the increment of the exploration coverage is lower than a preset increment threshold. The large model evaluation unit inputs the state evaluation prompts into the large language model and evaluates them to obtain the preferred state in the current candidate state set. The state execution unit performs symbolic execution search based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within a preset time window until the symbolic execution exploration of the program under test is completed.

[0012] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the symbolic execution search method based on a large language model as described above.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the symbolic execution search method based on a large language model as described above.

[0014] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the symbolic execution search method based on a large language model as described above.

[0015] The symbolic execution search method and apparatus based on a large language model provided by this invention monitors the exploration coverage of symbolic execution in real time. When the coverage growth stagnates, it activates the large language model for auxiliary decision-making using prompt words containing global and state information. By leveraging the semantic reasoning capabilities of the large language model, it identifies preferred states with high potential value, guiding the symbolic execution engine to overcome the constraints of complex logic. By utilizing the semantic understanding capabilities of the large language model, it effectively breaks through the coverage bottleneck when facing complex program logic, improves search efficiency, and thus enhances the code coverage of the program under test. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the symbolic execution search method based on a large language model provided by the present invention; Figure 2 This is a schematic diagram of the structure of the symbolic execution search tool based on a large language model provided by the present invention; Figure 3 This is a schematic diagram of the symbolic execution search device based on a large language model provided by the present invention; Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0019] It's worth noting that coverage-guided search strategies, such as the CovNew strategy, work on the principle that during symbolic execution, the system maintains a set of states to be explored. When it's time to select the next state to execute, the CovNew strategy prioritizes states that can immediately cover lines of code or branches that have never been executed before. This search strategy is very effective in the early stages of analysis, quickly covering the main parts of the program. Other commonly used heuristic strategies include: depth-first search (exploring deeply along a single path), breadth-first search (exploring all paths of the same depth), and random search (randomly selecting states from the set of states to be explored).

[0020] While the aforementioned search strategies are effective in certain scenarios, they suffer from inherent and insurmountable limitations, primarily manifested in short-sightedness and locality in decision-making. Taking the coverage-driven strategy CovNew as an example, in the later stages of analysis, when uncovered code requires a series of complex and interrelated conditions to reach, this strategy fails. This is because the search strategy only focuses on whether new code can be covered immediately, failing to determine which state is more likely to create the conditions for ultimately covering that code. During the search process, it repeatedly tries states that seem promising but are actually insurmountable bottlenecks, leading to stagnation in coverage growth. Therefore, the decision-making basis of existing search strategies is local, syntactic features, such as line numbers and branch distances, failing to understand the overall logic, semantic intent, and long-term relationships between states. Consequently, when faced with deep code requiring complex condition chains, coverage growth often stagnates.

[0021] To address the aforementioned problems, this invention provides a symbolic execution search method based on a large language model, which effectively overcomes the coverage bottleneck and improves exploration efficiency. Figure 1 This is a flowchart illustrating the symbolic execution search method based on a large language model provided by the present invention, as shown below. Figure 1 As shown, the method includes: Step 110: Obtain the exploration coverage of symbolic execution search within a preset time window.

[0022] Here, the preset time window refers to the sliding time interval used for observation and statistical data collection during symbolic execution. It can be either the length of physical time or the length of execution steps of the symbolic execution engine. Additionally, the exploration coverage here refers to the proportion of code regions successfully executed by the symbolic execution engine during the analysis of the program under test, including but not limited to line coverage and branch coverage.

[0023] Specifically, firstly, the execution status of the symbolic execution engine can be continuously monitored and recorded after it starts. As symbolic execution progresses, a queue of historical data can be maintained to record the history of coverage growth. More specifically, current exploration coverage data can be collected in real time within a preset time window. For example, the global code coverage value can be recorded at regular intervals or after executing a certain number of instructions, forming a record of coverage growth. It's understandable that by setting a preset time window, the focus can be on recent execution efficiency, providing a quantitative basis for determining whether the search process has stalled.

[0024] Step 120: If the increment of the exploration coverage is lower than a preset increment threshold, construct a state evaluation prompt word based on global information and the state information of each candidate state in the current candidate state set.

[0025] Here, the preset incremental threshold refers to the critical value used to determine whether the current symbol execution search efficiency meets expectations. This value can be a fixed value or a value dynamically adjusted based on historical trends. Here, the current candidate state set refers to the set of program states that have been generated but not yet fully executed or explored during the current symbol execution process. Here, a candidate state refers to a single program state in the set, representing the specific context of the program under test at a certain point in its execution.

[0026] Additionally, the global information here refers to data reflecting the overall exploration status of the program under test, such as the current total coverage and the distribution of uncovered code regions. The state information here refers to data describing the detailed characteristics of specific candidate states, including code source code location, call stack depth, path constraints, etc.

[0027] Specifically, firstly, the incremental changes in coverage can be calculated within a preset time window. For example, an exponential moving average algorithm can be used to calculate the smoothed increment of coverage. When this increment is lower than a preset increment threshold, it indicates that the current search strategy may have fallen into a local optimum or a bottleneck that is difficult to overcome, i.e., it has entered a stagnant state. At this point, the intelligent decision-making process is triggered. In detail, current global information and candidate states to be processed can be obtained.

[0028] To improve search efficiency, a current candidate state set can be filtered from all pending states. For each candidate state in this set, its corresponding state information is extracted. Then, the global information and the state information of each candidate state are combined according to a pre-designed structured template to construct a state evaluation prompt word that includes the program context, the characteristics of the state to be evaluated, and the requirements of the evaluation task.

[0029] Understandably, by constructing prompts rich in semantic information, it is possible to transform the numerical features in symbolic execution into natural language or code context that large language models can understand, thereby leveraging the reasoning capabilities of large language models to analyze the potential value of states.

[0030] Step 130: Input the state evaluation prompt words into the large language model, and evaluate the preferred state in the current candidate state set through the large language model.

[0031] The preferred state here refers to the candidate state that, after evaluation by a large language model, is considered most likely to trigger new code paths, improve coverage, or achieve specific test goals in subsequent execution.

[0032] Specifically, the constructed state evaluation prompts can be input into a pre-trained large language model. Based on the global and state information in the prompts, the large language model analyzes the logical connections and semantic distances between each candidate state and the uncovered regions. Here, the large language model acts as a code analysis expert, scoring or ranking the exploration potential of candidate states and returning the evaluation results in a structured format. Then, by parsing the returned results, each or more states with the highest ranking or score are extracted as the preferred states.

[0033] Understandably, by leveraging a deep understanding of code logic through large language models, it is possible to identify states that seem to have low priority in traditional heuristics but are actually crucial for overcoming complex constraints, thus overcoming the shortsightedness of traditional strategies.

[0034] Step 140: Perform symbolic execution search based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within a preset time window until the symbolic execution exploration of the program under test is completed.

[0035] Specifically, the determined preferred state can be returned to the symbolic execution engine, so that the symbolic execution engine can prioritize scheduling and executing the preferred state, and continue to solve constraints and explore code along the path corresponding to the state, generating new sub-states and test cases.

[0036] During and after the execution of the preferred state, the exploration coverage is continuously monitored, and the above acquisition and judgment process is repeated. If the coverage increment is detected to be lower than the threshold again, the evaluation based on the large language model is triggered again; if the coverage growth is normal, the regular search strategy can be maintained. This cyclical process continues until the stopping conditions are met, such as reaching 100% coverage, reaching the maximum time limit, or the set of states to be searched is empty, thus completing the symbolic execution exploration of the program under test. It can be understood that this on-demand intervention mechanism ensures execution efficiency in the regular stage and can break the deadlock at critical moments by using the large model, achieving a balance between search efficiency and depth.

[0037] The method provided in this invention monitors the exploration coverage of symbolic execution in real time. When the coverage growth stagnates, it activates a large language model to assist in decision-making using prompts containing global and state information. By leveraging the semantic reasoning capabilities of the large language model, it identifies preferred states with high potential value, guiding the symbolic execution engine to overcome the constraints of complex logic. By utilizing the semantic understanding capabilities of the large language model, it effectively breaks through the coverage bottleneck when facing complex program logic, improves search efficiency, and ultimately enhances the code coverage of the program under test.

[0038] Based on any of the above embodiments, the steps for determining the current candidate state set include: Get the current initial state set; Based on the initial score of each initial state in the current initial state set, a filter state set is selected from the current initial state set; The current candidate state set is determined based on the clustering of the filtered state set.

[0039] Here, the current initial state set refers to the set of all active program states maintained by the symbolic execution engine at the current moment, awaiting scheduling. The initial score for any initial state refers to a numerical value obtained by quickly evaluating the state using traditional heuristic algorithms, used to initially measure the state's exploration value. For example, a score calculated based on code depth or distance from uncovered code.

[0040] Furthermore, the "filtered state set" here refers to the subset of states that are considered to have high potential value after the first round of coarse filtering. Here, "clustering" refers to dividing the filtered states into several groups based on the similarity between them; states within the same group have a high degree of similarity in execution paths or logical characteristics.

[0041] Specifically, firstly, the scheduler queue of the symbolic execution engine can be directly accessed to obtain all currently pending states, which serve as the current initial state set. Next, to reduce the computational burden on subsequent large language models, a two-level filtering strategy can be used to filter the current initial state set.

[0042] The first-level filtering strategy can be based on the initial score of each initial state in the current initial state set, selecting a set of states to filter from the current initial state set; this is a heuristic fast filtering. Specifically, for each initial state in the current initial state set, its initial score can be calculated using a preset heuristic function. This heuristic function could be the shortest distance to the nearest uncovered instruction in the control flow graph, or the current execution depth of the state, etc. After obtaining the initial scores of all states, the states are sorted according to their initial scores, and a certain percentage of the top-ranked states are selected, such as the top 10%, or states with initial scores higher than a specific threshold are selected, thereby constructing the set of states to filter.

[0043] It should be noted that by adding a fast filtering stage based on heuristic algorithms before calling the large language model, states that are obviously lacking in exploration value can be quickly eliminated from the massive number of states to be searched. This effectively utilizes the advantages of traditional algorithms in terms of fast computation speed and low overhead, serving as a pre-filter for large model evaluation. This effectively reduces the number of states that need to be subjected to deep semantic analysis, thereby significantly reducing the overall computational overhead and runtime latency of the system while ensuring that the exploration direction is roughly correct.

[0044] The second-level screening strategy involves clustering the selected state sets to determine the current candidate state set. Specifically, the states in the selected state set are further clustered, and based on the clustering results, the final candidate state set submitted to the large language model for evaluation is determined. For example, a flag state is selected from each cluster to obtain the current candidate state set.

[0045] The method provided in this invention provides an efficient two-stage pre-screening process. The first stage uses traditional heuristics for rapid coarse screening, and the second stage performs clustering and deduplication based on state features. This significantly reduces the computational burden of large models while ensuring the diversity of candidate states.

[0046] Based on any of the above embodiments, determining the current candidate state set based on the clustering of the filtered state set includes: Based on the state information of each filtering state in the filtering state set, the filtering states in the filtering state set are clustered to obtain the clusters. The current candidate state set is obtained by selecting a flag state from each cluster.

[0047] Here, the marker state refers to the specific state selected as the representative of each cluster, which carries the key features common to the states in that cluster.

[0048] Specifically, firstly, deep features of each selected state in the selection state set can be extracted as state information, such as function call stack summaries, key branch selection history, and path constraints. Then, a fast clustering algorithm can be used to divide the states in the selection state set into several clusters based on the similarity of the state information. For example, states in the selection state set can be clustered based on path constraint similarity and call stack overlap. For instance, states with the same call stack and similar path constraint structures can be grouped into one category.

[0049] Next, each generated cluster can be traversed, and the most representative state from each cluster can be selected as the flag state. Here, the selection strategy can be to choose the state with the highest initial score in the cluster, or the most recently generated state in the cluster. Finally, the flag states selected from all clusters are aggregated to form the final set of current candidate states.

[0050] The method provided in this invention achieves deduplication and diversity preservation of candidate states by clustering the filtered states and selecting marker states. It should be noted that since symbolic execution often generates a large number of intermediate states with similar paths and repetitive logic, inputting all of these states into a large model would not only waste computational resources but also potentially lead to overly simplistic model output suggestions. Therefore, by extracting marker states through clustering, the method ensures that the state set input to the large language model is both high-quality and maintains sufficient sample diversity. This allows the large language model to make decisions based on a broader perspective of program logic, further improving the breadth and efficiency of the exploration.

[0051] Based on any of the above embodiments, the global information includes the program structure, exploration coverage, and stall status information of the program under test; The status information includes status identifier code, code execution location, call stack information, and path constraint information.

[0052] Here, global information includes the program structure, exploration coverage, and stall status information of the program under test. The program structure refers to the static organization of the program under test, such as function call graphs, control flow graphs, or the directory hierarchy of the source code. It can be understood that the program structure of the program under test can be used to assist the large language model in building an understanding of the overall program architecture.

[0053] Here, exploration coverage is specifically represented in the global information as a list of currently covered lines of code or a summary of uncovered key code regions, which clarifies the search target. Stagnation information refers to data describing the specific degree to which the current search has stalled, such as the duration of no coverage increase or the number of iterations.

[0054] In addition, the state information includes a state identifier, code execution location, call stack information, and path constraint information. The state identifier can be an ID used to uniquely identify a state within the symbolic execution engine. Here, the code execution location refers to the source code file, line number, and function name corresponding to the program counter in the current state. The call stack information records the sequence of function calls from the program entry point to the current execution location, reflecting the historical context of execution. The path constraint information is a summary of all logical constraints collected along the current path, reflecting the feasibility of the state and potential data dependencies.

[0055] Specifically, during the construction of state evaluation prompts, program structure, current exploration coverage, and stall information can be extracted from the global statistics module of the symbolic execution engine. Simultaneously, for each state entering the candidate state set, its internal data structure is accessed in depth to read its state identifier, the source code location corresponding to the current instruction, the complete function call stack, and the logical expression or simplified summary of the path constraints.

[0056] Then, this multi-dimensional information is assembled according to a preset prompt template. For example, the global background can be described at the beginning of the prompt: "The current program structure is as follows, X% has been covered, stuck at step Y"; then the details of the candidate state are listed: "State ID is Z, located at line B of function A, call stack is [Main->...->A], current constraint involves variable C"; finally, a prompt is given to guide the large model to play the role of a code analysis expert in evaluation.

[0057] Furthermore, it should be noted that in existing technologies, FeatMaker is a method for automatically generating state features in symbolic execution search strategies. Its core principle is to utilize the inherent path conditions of symbolic execution as a feature base. Through an iterative algorithm encompassing collection, clustering, extraction, and learning phases, it dynamically filters and refines effective path condition features and their corresponding scoring function weights from data accumulated during testing, thereby guiding state selection in subsequent explorations. However, the FeatMaker method suffers from a single feature source and limited semantic understanding. Its state features strictly rely on branch conditions within the path conditions, essentially representing syntactic Boolean judgments, lacking the extraction and utilization of program semantic information, thus limiting its potential for understanding complex program logic. In addition, FeatMaker incurs greater runtime overhead and latency. Because its method relies on iterative running and terminating during symbolic execution to collect data and update features and weights, it introduces significant startup delays.

[0058] Therefore, the method provided by this invention provides a large language model with global information including program structure, coverage, and stagnation status, enabling the model to have a macro-level decision-making perspective and understand the target and the current search dilemma. Simultaneously, by providing state information including code location, call stack, and path constraints, the large language model gains micro-level code analysis capabilities, understanding the current position and how to reach it. This fully activates the large language model's code reasoning ability, allowing it to accurately determine which states are most likely to help the system overcome the current coverage stagnation dilemma, not only based on syntactic features but also on deep semantic logic and data flow dependencies. This overcomes the short-sightedness of traditional strategies, achieves a paradigm shift from local optima to global optima, and improves symbolic execution efficiency.

[0059] Based on any of the above embodiments, the step of determining the window size of the preset time window includes: Get the historical exploration coverage of symbolic execution search; The window size of the preset time window is determined based on the historical growth trend of the historical exploration coverage.

[0060] Here, the window size of the preset time window refers to the specific length of the observation interval, which directly determines the sensitivity and smoothness of stagnation detection. Historical exploration coverage refers to the set of all coverage values ​​recorded sequentially by the system from the start of symbolic execution to the current moment. Furthermore, the historical growth trend refers to the macroscopic characteristics reflecting the change in coverage growth rate over time, obtained through analysis of historical exploration coverage; for example, whether it is in the early stage of rapid growth or in a slow plateau phase.

[0061] Specifically, firstly, historical exploration coverage data can be continuously recorded during symbol execution. Then, trend analysis can be performed on this data periodically or in real-time, such as calculating the slope or derivative of the coverage curve. Based on the historical growth trends obtained from the analysis, the window size of the preset time window can be dynamically adjusted.

[0062] It should be noted that in the early stages of symbolic execution, since coverage typically grows rapidly, the window size can be set to a smaller value to quickly capture changes. However, in the later stages of symbolic execution, as uncovered code becomes harder to access, coverage growth naturally slows down, at which point the window size can be increased. For example, a base window size can be set, and the current window size can be calculated by weighting it with the reciprocal of the current coverage growth rate.

[0063] The method provided in this invention introduces a parameter adaptive mechanism to dynamically adjust the window size based on historical growth trends, enabling it to adapt to the coverage growth characteristics at different analysis stages. Increasing the window size in later analysis stages allows the use of average data over a longer range to smooth short-term fluctuations in coverage, preventing normal, slow growth from being incorrectly identified as stagnation, thereby improving the robustness of stagnation detection.

[0064] Based on any of the above embodiments, the step of determining the preset incremental threshold includes: Based on the historical growth trend, the preset incremental threshold is determined.

[0065] Here, the preset incremental threshold refers to the minimum coverage increase required within a specific preset time window to determine whether symbolic execution is progressing normally. It can be understood that this threshold is a quantitative standard for determining stagnation and non-stagnation, directly affecting whether the large language model intervenes in the decision-making process.

[0066] Specifically, a correlation mapping can be established between the preset incremental threshold and historical growth trends. After determining the historical growth trend, if the trend indicates that the current stage of program analysis is deep, i.e., coverage growth is generally slow, the preset incremental threshold can be automatically reduced; conversely, if it is in a shallow stage that is easy to explore, a higher threshold is maintained. For example, a decay function can be set to gradually reduce the preset incremental threshold as the total exploration coverage increases or the execution time increases.

[0067] The method provided in this invention achieves intelligent floating of the detection standard by dynamically adjusting the preset incremental threshold based on historical growth trends. This ensures that even in the later stages of program analysis where lower but still existing coverage growth is tolerated, the large language model is only triggered when coverage growth almost completely stops, i.e., when a true deadlock or bottleneck occurs. Therefore, this not only reduces unnecessary calls to the large language model, lowering computational costs and operational overhead, but also ensures timely response when the large language model is truly needed, achieving an optimal balance between resource utilization and search efficiency.

[0068] Based on any of the above embodiments Figure 2 This is a schematic diagram of the structure of the symbolic execution search tool based on a large language model provided by the present invention, as shown below. Figure 2 As shown, this structure consists of five core parts: the KLEE execution engine, the coverage stall detection module, the state pre-screening module, the large model state evaluation module, and the state selection execution module. These modules work together to form a closed-loop control system. The specific interaction flow includes: First, the KLEE execution engine initiates and is responsible for the actual symbolic execution of the program, path constraint solving, and test case generation. In the initial phase or in a non-stagnant state, the KLEE execution engine uses traditional heuristic search strategies such as CovNew to explore paths and outputs coverage data in real time.

[0069] Subsequently, the coverage stagnation detection module continuously monitors the coverage growth output by the KLEE execution engine. This module employs an adaptive sliding window-based algorithm to calculate the exponential moving average increment of coverage within a preset time window. When this increment is detected to be lower than a dynamically adjusted judgment threshold, the system is determined to be in a stagnant state, and the intelligent decision-making process is activated, transferring control to the next module.

[0070] Next, the state pre-screening module receives the set of states to be processed from the engine. To reduce the computational overhead of subsequent large models, this module performs a two-stage screening: First, it uses heuristic functions, such as calculating the distance to uncovered code, to quickly score and initially screen the states to be processed; second, it extracts deep features such as call stacks and path constraint structures from the initially screened states, performs clustering and deduplication, and selects the most representative flag states from each cluster, thereby constructing a high-quality and diverse set of candidate states.

[0071] Next, the large model state evaluation module, based on the state information of each state in the candidate state set and combined with current global information, such as the program structure of the program under test, the overall program coverage, and the distribution of uncovered areas, constructs structured prompt words. This module inputs the prompt words into a large language model, such as Qwen2.5, and utilizes the semantic understanding and reasoning capabilities of the large language model to perform in-depth evaluation and ranking of the exploration potential of each state, and parses the list of preferred states returned by the large model.

[0072] Finally, the state selection execution module selects the optimal-ranked state (i.e., the state with the greatest exploration potential) based on the evaluation results of the large model and returns it to the KLEE execution engine. Then, the KLEE execution engine resumes execution based on this preferred state, generating new sub-states and updating the global coverage, thus breaking the previous search deadlock. The system then enters a new monitoring cycle, and as the analysis phase deepens, the window size and threshold parameters in the above modules can be adaptively adjusted to adapt to the non-linear changing trend of coverage growth.

[0073] It should be noted that the execution search tool provided in this embodiment of the invention, as a new searcher implementation of the KLEE engine, does not require changes to the core principle of symbolic execution, nor does it require manual user intervention. The entire "detection-filtering-decision-execution" process is fully automated and easy to deploy and apply in existing program analysis workflows.

[0074] Based on any of the above embodiments Figure 3 This is a schematic diagram of the symbolic execution search device based on a large language model provided by the present invention, as shown below. Figure 3 As shown, the device includes: Acquire unit 310 to obtain the exploration coverage of symbol execution search within a preset time window; The prompt word construction unit 320 constructs state evaluation prompt words based on global information and the state information of each candidate state in the current candidate state set when the increment of the exploration coverage is lower than a preset increment threshold. The large model evaluation unit 330 inputs the state evaluation prompt words into the large language model, and obtains the preferred state in the current candidate state set through the evaluation of the large language model; The state execution unit 340 performs symbolic execution search based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within a preset time window until the symbolic execution exploration of the program under test is completed.

[0075] The apparatus provided in this invention monitors the exploration coverage of symbolic execution in real time. When it detects that the coverage growth has stagnated, it activates a large language model to assist in decision-making using prompts containing global and state information. By leveraging the semantic reasoning capabilities of the large language model, it identifies preferred states with high potential value, guiding the symbolic execution engine to break through the constraints of complex logic. By utilizing the semantic understanding capabilities of the large language model, it effectively overcomes the coverage bottleneck when facing complex program logic, improves search efficiency, and thus enhances the code coverage of the program under test.

[0076] Based on any of the above embodiments, the prompt word construction unit is specifically used for: Get the current initial state set; Based on the initial score of each initial state in the current initial state set, a filter state set is selected from the current initial state set; The current candidate state set is determined based on the clustering of the filtered state set.

[0077] Based on any of the above embodiments, the prompt word construction unit is further specifically used for: Based on the state information of each filtering state in the filtering state set, the filtering states in the filtering state set are clustered to obtain the clusters. The current candidate state set is obtained by selecting a flag state from each cluster.

[0078] Based on any of the above embodiments, the global information includes the program structure, exploration coverage, and stagnation status information of the program under test; The status information includes status identifier code, code execution location, call stack information, and path constraint information.

[0079] Based on any of the above embodiments, the acquisition unit is specifically used for: Get the historical exploration coverage of symbolic execution search; The window size of the preset time window is determined based on the historical growth trend of the historical exploration coverage.

[0080] Based on any of the above embodiments, the prompt word construction unit is further specifically used for: Based on the historical growth trend, the preset incremental threshold is determined.

[0081] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a symbolic execution search method based on a large language model. This method includes: obtaining the exploration coverage of symbolic execution search within a preset time window; if the increment of the exploration coverage is lower than a preset increment threshold, constructing a state evaluation prompt word based on global information and the state information of each candidate state in the current candidate state set; inputting the state evaluation prompt word into the large language model, and obtaining the preferred state in the current candidate state set through evaluation by the large language model; performing symbolic execution search based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within the preset time window until the symbolic execution exploration of the program under test is completed.

[0082] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0083] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the symbolic execution search method based on a large language model provided by the above methods. The method includes: obtaining the exploration coverage of symbolic execution search within a preset time window; when the increment of the exploration coverage is lower than a preset increment threshold, constructing a state evaluation prompt word based on global information and the state information of each candidate state in the current candidate state set; inputting the state evaluation prompt word into a large language model, and obtaining the preferred state in the current candidate state set through evaluation by the large language model; performing symbolic execution search based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within the preset time window until the symbolic execution exploration of the program under test is completed.

[0084] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the symbolic execution search method based on a large language model provided by the above methods. The method includes: obtaining the exploration coverage of symbolic execution search within a preset time window; when the increment of the exploration coverage is lower than a preset increment threshold, constructing a state evaluation prompt word based on global information and the state information of each candidate state in the current candidate state set; inputting the state evaluation prompt word into a large language model, and obtaining the preferred state in the current candidate state set through evaluation by the large language model; performing symbolic execution search based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within the preset time window until the symbolic execution exploration of the program under test is completed.

[0085] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0086] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A symbolic execution search method based on a large language model, characterized in that, include: Obtain the exploration coverage of the symbol execution search within a preset time window; If the increment of the exploration coverage is less than a preset increment threshold, a state evaluation prompt word is constructed based on global information and the state information of each candidate state in the current candidate state set. The state evaluation prompts are input into a large language model, and the preferred state in the current candidate state set is obtained through evaluation by the large language model. Symbolic execution search is performed based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within a preset time window until the symbolic execution exploration of the program under test is completed.

2. The symbolic execution search method based on a large language model according to claim 1, characterized in that, The steps for determining the current candidate state set include: Get the current initial state set; Based on the initial score of each initial state in the current initial state set, a filter state set is selected from the current initial state set; The current candidate state set is determined based on the clustering of the filtered state set.

3. The symbolic execution search method based on a large language model according to claim 2, characterized in that, The process of determining the current candidate state set based on the clustering of the filtered state set includes: Based on the state information of each filtering state in the filtering state set, the filtering states in the filtering state set are clustered to obtain the clusters. The current candidate state set is obtained by selecting a flag state from each cluster.

4. The symbolic execution search method based on a large language model according to any one of claims 1 to 3, characterized in that, The global information includes the program structure, exploration coverage, and stall status information of the program under test; The status information includes status identifier code, code execution location, call stack information, and path constraint information.

5. The symbolic execution search method based on a large language model according to any one of claims 1 to 3, characterized in that, The steps for determining the window size of the preset time window include: Get the historical exploration coverage of symbolic execution search; The window size of the preset time window is determined based on the historical growth trend of the historical exploration coverage.

6. The symbolic execution search method based on a large language model according to claim 5, characterized in that, The steps for determining the preset incremental threshold include: Based on the historical growth trend, the preset incremental threshold is determined.

7. A symbolic execution search device based on a large language model, characterized in that, include: The acquisition unit retrieves the exploration coverage of the symbolic search within a preset time window; The prompt word construction unit constructs state evaluation prompt words based on global information and the state information of each candidate state in the current candidate state set when the increment of the exploration coverage is lower than a preset increment threshold. The large model evaluation unit inputs the state evaluation prompts into the large language model and evaluates them to obtain the preferred state in the current candidate state set. The state execution unit performs symbolic execution search based on the preferred state to repeatedly obtain the exploration coverage of symbolic execution search within a preset time window until the symbolic execution exploration of the program under test is completed.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the symbolic execution search method based on a large language model as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the symbolic execution search method based on a large language model as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the symbolic execution search method based on a large language model as described in any one of claims 1 to 6.

Images