Veritesting Hybrid Symbolic Execution for Software Testing

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Prior approaches to symbolic execution for software testing face limitations, including path explosion in dynamic symbolic execution (DSE) and solver blowup in static symbolic execution (SSE), which hinder effective test case generation and bug finding.

Innovation Solution

A method that dynamically alternates between DSE and SSE, leveraging the strengths of each approach to mitigate path explosion and solver blowup, by starting with DSE and opportunistically switching to SSE for specific conditions, thereby improving test case generation and bug detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If dynamic symbolic execution (DSE) is used to explore software code and generate test cases, then path coverage and bug detection capability are improved, but path explosion occurs leading to exponential growth in the number of execution paths to be analyzed

Engineering Contradiction:
Improvepath coverageVSAvoidnumber of execution paths
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the symbolic execution process into two distinct modes: Dynamic Symbolic Execution (DSE) for initial exploration and Static Symbolic Execution (SSE) for systematic analysis. This segmentation allows each mode to handle specific aspects of test case generation, preventing the path explosion problem by switching to SSE when path complexity increases

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements a dynamic switching mechanism between DSE and SSE modes based on runtime conditions. The system monitors execution state and automatically transitions between modes to optimize performance, making the testing system adaptable to different code structures and complexity levels

Inventive Principle:
Principle #15Dynamics

2Device complexity

If static symbolic execution (SSE) is used to translate executable statements into formulas, then solver blowup is avoided and handling of non-statically interpretable statements is improved, but node coverage and test case generation effectiveness deteriorate

Engineering Contradiction:
Improvesolver complexityVSAvoidnode coverage
Core Design Contradiction:
Device complexityVSMeasurement precision

Solution Approach 1:

The patent merges the strengths of both DSE and SSE into a unified hybrid framework. The system combines DSE's ability to achieve high node coverage with SSE's ability to handle complex control flow and avoid solver blowup, creating a synergistic effect that exceeds the capabilities of either approach alone

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The hybrid system serves multiple functions: it performs initial dynamic exploration for coverage, switches to static analysis for complex paths, and integrates both approaches to handle diverse software structures. This multi-functionality allows the system to adapt to different testing scenarios and code characteristics

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Reliability

If DSE is used for test case generation, then real inputs are produced and crashing bugs are found, but the overhead of exploring all execution paths increases testing time and computational resources

Engineering Contradiction:
Improvebug detection capabilityVSAvoidtesting time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary dynamic exploration to identify high-value test paths and bug-prone areas before committing to exhaustive static analysis. This preliminary action allows the system to focus subsequent SSE efforts on critical paths, reducing overall testing time while maintaining high bug detection capability

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS9619375B2Methods and systems for automatically testing software
Publication Date: 2017.04.11 CARNEGIE MELLON UNIV
  • US9619375B2 patent drawing
  • US9619375B2 patent drawing
  • US9619375B2 patent drawing

AI summary

An automatic software testing machine may be configured to provide an advanced symbolic execution approach to software testing that combines dynamic symbolic execution and static symbolic execution, leveraging the strengths of each and avoiding the vulnerabilities of each. One or more software testing machines within a software testing system may be configured to automatically and dynamically alternate between dynamic symbolic execution and static symbolic execution, based on partial control flow graphs of portions of the software code to be tested. In some example embodiments, a software testing machine begins with dynamic symbolic execution, but switches to static symbolic execution opportunistically. In static mode, instead of checking entire programs for verification, the software testing machine may only check one or more program fragments for testing purposes. Thus, the software testing machine may benefit from the strengths of both dynamic and static symbolic execution.