用遗传编程自动生成符号执行的桩函数，提升测试覆盖率。
AutoStub: Genetic Programming-Based Stub Creation for Symbolic Execution
- 用遗传编程根据函数输入输出数据自动生成符号桩。
- 对55%函数实现超90%准确率，可发现语言特有边界情况。
- 适合需要自动化符号执行的软件测试人员使用。
符号执行是强大的软件测试技术，但在处理外部函数（如原生方法或第三方库）时存在局限。现有方法通常需额外上下文、昂贵的SMT求解器或人工干预，通过符号桩近似这些函数。本文提出一种新方法AutoStub，利用遗传编程在符号执行过程中自动创建符号桩。当符号执行遇到外部函数时，AutoStub通过随机输入执行函数并收集输出，生成训练数据；再由遗传编程推导出逼近函数行为的表达式作为符号桩。这些自动生成的桩使符号执行无需人工干预即可继续分析，探索此前难以触及的程序路径。实验表明，AutoStub能以超过90%的准确率自动近似55%的被测函数，并推断出语言特有行为，揭示对软件测试至关重要的边缘情况。
原文摘要 · Abstract (English)
Symbolic execution is a powerful technique for software testing, but suffers from limitations when encountering external functions, such as native methods or third-party libraries. Existing solutions often require additional context, expensive SMT solvers, or manual intervention to approximate these functions through symbolic stubs. In this work, we propose a novel approach to automatically generate symbolic stubs for external functions during symbolic execution that leverages Genetic Programming. When the symbolic executor encounters an external function, AutoStub generates training data by executing the function on randomly generated inputs and collecting the outputs. Genetic Programming then derives expressions that approximate the behavior of the function, serving as symbolic stubs. These automatically generated stubs allow the symbolic executor to continue the analysis without manual intervention, enabling the exploration of program paths that were previously intractable. We demonstrate that AutoStub can automatically approximate external functions with over 90% accuracy for 55% of the functions evaluated, and can infer language-specific behaviors that reveal edge cases crucial for software testing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。