Veritesting Hybrid Symbolic Execution for Software Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Prior approaches to symbolic execution for software testing face limitations, including path explosion in dynamic symbolic execution (DSE) and solver blowup in static symbolic execution (SSE), which hinder effective test case generation and bug finding.
Innovation Solution
A method that dynamically alternates between DSE and SSE, leveraging the strengths of each approach to mitigate path explosion and solver blowup, by starting with DSE and opportunistically switching to SSE for specific conditions, thereby improving test case generation and bug detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic symbolic execution (DSE) is used to explore software code and generate test cases, then path coverage and bug detection capability are improved, but path explosion occurs leading to exponential growth in the number of execution paths to be analyzed
Solution Approach 1:
The patent segments the symbolic execution process into two distinct modes: Dynamic Symbolic Execution (DSE) for initial exploration and Static Symbolic Execution (SSE) for systematic analysis. This segmentation allows each mode to handle specific aspects of test case generation, preventing the path explosion problem by switching to SSE when path complexity increases
Solution Approach 2:
The patent implements a dynamic switching mechanism between DSE and SSE modes based on runtime conditions. The system monitors execution state and automatically transitions between modes to optimize performance, making the testing system adaptable to different code structures and complexity levels
2Device complexity
If static symbolic execution (SSE) is used to translate executable statements into formulas, then solver blowup is avoided and handling of non-statically interpretable statements is improved, but node coverage and test case generation effectiveness deteriorate
Solution Approach 1:
The patent merges the strengths of both DSE and SSE into a unified hybrid framework. The system combines DSE's ability to achieve high node coverage with SSE's ability to handle complex control flow and avoid solver blowup, creating a synergistic effect that exceeds the capabilities of either approach alone
Solution Approach 2:
The hybrid system serves multiple functions: it performs initial dynamic exploration for coverage, switches to static analysis for complex paths, and integrates both approaches to handle diverse software structures. This multi-functionality allows the system to adapt to different testing scenarios and code characteristics
3Reliability
If DSE is used for test case generation, then real inputs are produced and crashing bugs are found, but the overhead of exploring all execution paths increases testing time and computational resources
Solution Approach 1:
The patent performs preliminary dynamic exploration to identify high-value test paths and bug-prone areas before committing to exhaustive static analysis. This preliminary action allows the system to focus subsequent SSE efforts on critical paths, reducing overall testing time while maintaining high bug detection capability
Data Source
AI summary
An automatic software testing machine may be configured to provide an advanced symbolic execution approach to software testing that combines dynamic symbolic execution and static symbolic execution, leveraging the strengths of each and avoiding the vulnerabilities of each. One or more software testing machines within a software testing system may be configured to automatically and dynamically alternate between dynamic symbolic execution and static symbolic execution, based on partial control flow graphs of portions of the software code to be tested. In some example embodiments, a software testing machine begins with dynamic symbolic execution, but switches to static symbolic execution opportunistically. In static mode, instead of checking entire programs for verification, the software testing machine may only check one or more program fragments for testing purposes. Thus, the software testing machine may benefit from the strengths of both dynamic and static symbolic execution.


