Symbolic Execution State Feature Selection for Software Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software testing techniques using symbolic execution face a state-explosion problem due to the exponential increase in the number of states, requiring an effective state selection strategy that is often costly and reliant on expert intuition.
Innovation Solution
A software testing apparatus and method that determines a state selection strategy by generating a path through symbolic execution, collecting branch conditional statements and path conditional expressions, grouping these expressions, selecting branch conditional statements as state features, and converting paths into feature vectors, thereby reducing costs and improving error detection capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symbolic execution is performed to achieve comprehensive software testing, then error detection capability is improved, but the number of states increases exponentially causing state-explosion problem
Solution Approach 1:
The patent extracts and selects only the most relevant state features from the complete state space using a selection strategy based on branch conditional statements and path conditional expressions. This extraction approach reduces the exponential state space to a manageable subset of critical features that maintain error detection capability while avoiding state explosion.
Solution Approach 2:
The patent transforms the state representation by changing parameters from complete state traces to condensed feature vectors derived from branch and path conditional expressions. This parameter transformation reduces dimensionality while preserving the essential information needed for effective software testing and error detection.
2Reliability
If expert intuition is used to define state features and ranking functions, then state selection strategy effectiveness is improved, but development cost increases
Solution Approach 1:
The patent enables the system to automatically generate and optimize state features and ranking functions using machine learning techniques, eliminating the need for expensive expert intervention. The system self-services by learning from execution data and automatically determining which branch conditional statements and path conditional expressions are most relevant for state selection.
Solution Approach 2:
The patent replaces the mechanical process of expert intuition and manual feature definition with automated machine learning algorithms. This substitution uses computational models to learn optimal state features from data, replacing human expert knowledge with an automated system that reduces development costs while maintaining or improving effectiveness.
3Reliability
If all branch conditional statements are considered as state features, then testing coverage is improved, but feature vector dimensionality increases
Solution Approach 1:
The patent applies local quality by assigning different importance weights to different branch conditional statements based on their relevance to error detection. Instead of treating all features equally, the system identifies and emphasizes locally critical features (those most relevant to specific error conditions) while downweighting or eliminating less important features, thereby reducing dimensionality while maintaining coverage.
Solution Approach 2:
The patent implements partial action by selecting only the necessary subset of branch conditional statements that provide sufficient testing coverage. Rather than using all possible features, the system identifies the minimal adequate set of features needed to detect errors, reducing feature vector dimensionality while maintaining effective coverage through selective feature inclusion.
Data Source
AI summary
The present invention relates to a symbolic execution-based software testing apparatus, according to one embodiment, the software testing apparatus comprises an information collector configured to generate a path by repeatedly performing symbolic execution, and collect branch conditional statements and path conditional expressions searched for generating the path, a group generator configured to group the path conditional expression based on the branch conditional statement included in the path conditional expression to generate a cluster and a state feature selector configured to select the branch conditional statement to be used as the state feature from the cluster according to a preset criterion, and convert the path into a feature vector using the state feature.


