Skip to main content
Springer Nature Link
Log in

Algorithm Selection for Dynamic Symbolic Execution: A Preliminary Study

  • Conference paper
  • First Online:
Logic-Based Program Synthesis and Transformation (LOPSTR 2020)

Part of the book series: Lecture Notes in Computer Science ((LNTCS,volume 12561))

Abstract

Given a portfolio of algorithms, the goal of Algorithm Selection (AS) is to select the best algorithm(s) for a new, unseen problem instance. Dynamic Symbolic Execution (DSE) brings together concrete and symbolic execution to maximise the program coverage. DSE uses a constraint solver to solve the path conditions and generate new inputs to explore. In this paper we join these lines of research by introducing a model that combines DSE and AS approaches. The proposed AS/DSE model is a generic and flexible framework enabling the DSE engine to solve the path conditions it collects with a portfolio of different solvers, by exploiting and extending the well-known AS techniques that have been developed over the last decade. In this way, one can increase the coverage and sometimes even outperform the aggregate coverage achievable by running simultaneously all the solvers of the portfolio.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 64.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 84.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    In JavaScript, z.replace(x,y) returns a new string where x is replaced by y in z. Note that x may be a regular expression, but for simplicity Aratha only considers string values for x. In this case, the first occurrence of x in y is replaced.

References

  1. Amadini, R., Andrlon, M., Gange, G., Schachte, P.,  Søndergaard, H., Stuckey, P.J.: Constraint programming for dynamic symbolic execution of javascript. In: Rousseau, L.-M., Stergiou, K. (eds.) CPAIOR 2019. LNCS, vol. 11494, pp. 1–19. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-19212-9_1

    Chapter  MATH  Google Scholar 

  2. Amadini, R., Gabbrielli, M., Mauro, J.: An enhanced features extractor for a portfolio of constraint solvers. In: Proceedings 29th Annual ACM Symposium Applied Computing, pp. 1357–1359. ACM (2014)

    Google Scholar 

  3. Amadini, R., Gabbrielli, M., Mauro, J.: SUNNY: a lazy portfolio approach for constraint solving. Theory Pract. Logic Program. 14(4–5), 509–524 (2014)

    Article  Google Scholar 

  4. Amadini, R., Gabbrielli, M., Mauro, J.: Why CP portfolio solvers are (under)utilized? issues and challenges. In: Falaschi, M. (ed.) LOPSTR 2015. LNCS, vol. 9527, pp. 349–364. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-27436-2_21

    Chapter  MATH  Google Scholar 

  5. Amadini, R., Gange, G., Stuckey, P.J.: Sweep-based propagation for string constraint solving. In: Proceedings of 32nd AAAI Conference Artificial Intelligence, pp. 6557–6564. AAAI (2018)

    Google Scholar 

  6. Amadini, R., Stuckey, P.J.: Sequential time splitting and bounds communication for a portfolio of optimization solvers. In: O’Sullivan, B. (ed.) CP 2014. LNCS, vol. 8656, pp. 108–124. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-10428-7_11

    Chapter  Google Scholar 

  7. Artzi, S., et al.: Finding bugs in web applications using dynamic test generation and explicit-state model checking. IEEE Trans. Softw. Eng. 36(4), 474–494 (2010)

    Article  Google Scholar 

  8. Cadar, C., Dunbar, D., Engler, D.: KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In: Proceedings of 8th USENIX Conference Operating Systems Design and Implementation, OSDI, vol. 8, pp. 209–224 (2008)

    Google Scholar 

  9. Godefroid, P., Klarlund, N., Sen, K.: DART: directed automated random testing. In: Proceedings of ACM SIGPLAN Conference Programming Language Design and Implementation (PLDI 2005), pp. 213–223. ACM (2005)

    Google Scholar 

  10. Godefroid, P., Levin, M.Y., Molnar, D.: SAGE: whitebox fuzzing for security testing. Commun. ACM 55(3), 40–44 (2012)

    Article  Google Scholar 

  11. Hoos, H., Lindauer, M.T., Schaub, T.: Claspfolio 2: advances in algorithm selection for answer set programming. TPLP 14(4–5), 569–585 (2014)

    MATH  Google Scholar 

  12. Hurley, B., Kotthoff, L., Malitsky, Y., O’Sullivan, B.: Proteus: a hierarchical portfolio of solvers and transformations. In: Simonis, H. (ed.) CPAIOR 2014. LNCS, vol. 8451, pp. 301–317. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-07046-9_22

    Chapter  Google Scholar 

  13. Hutter, F., Xu, L., Hoos, H.H., Leyton-Brown, K.: Algorithm runtime prediction: methods and evaluation. Artif. Intell. 206, 79–111 (2014)

    Article  MathSciNet  Google Scholar 

  14. Istanbul Team: Istanbul website (2020). https://istanbul.js.org

  15. Kadioglu, S., Malitsky, Y., Sabharwal, A., Samulowitz, H., Sellmann, M.: Algorithm selection and scheduling. In: Lee, J. (ed.) CP 2011. LNCS, vol. 6876, pp. 454–469. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-23786-7_35

    Chapter  Google Scholar 

  16. Kerschke, P., Hoos, H.H., Neumann, F., Trautmann, H.: Automated algorithm selection: survey and perspectives. Evol. Comput. 27(1), 3–45 (2019)

    Article  Google Scholar 

  17. King, J.C.: Symbolic execution and program testing. Commun. ACM 19(7), 385–394 (1976)

    Article  MathSciNet  Google Scholar 

  18. Kotthoff, L.: Algorithm selection for combinatorial search problems: A survey. AI Mag. 35(3), 48–60 (2014)

    Article  Google Scholar 

  19. Liang, T., Reynolds, A., Tinelli, C., Barrett, C., Deters, M.: A DPLL(T) theory solver for a theory of strings and regular expressions. In: Biere, A., Bloem, R. (eds.) CAV 2014. LNCS, vol. 8559, pp. 646–662. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-08867-9_43

    Chapter  Google Scholar 

  20. Lindauer, M., Bergdoll, R.-D., Hutter, F.: An empirical study of per-instance algorithm scheduling. In: Festa, P., Sellmann, M., Vanschoren, J. (eds.) LION 2016. LNCS, vol. 10079, pp. 253–259. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-50349-3_20

    Chapter  Google Scholar 

  21. Loring, B., Mitchell, D., Kinder, J.: ExpoSE: practical symbolic execution of standalone JavaScript. In: Proceedings of 24th ACM SIGSOFT International SPIN Symposium Model Checking of Software, pp. 196–199. ACM (2017)

    Google Scholar 

  22. Majumdar, R., Sen, K.: Hybrid concolic testing. In: Proceedings of 29th International Conference Software Engineering (ICSE 2007), pp. 416–426. IEEE (2007)

    Google Scholar 

  23. Majumdar, R., Xu, R.-G.: Reducing test inputs using information partitions. In: Bouajjani, A., Maler, O. (eds.) CAV 2009. LNCS, vol. 5643, pp. 555–569. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-02658-4_41

    Chapter  Google Scholar 

  24. Malitsky, Y., Sabharwal, A., Samulowitz, H., Sellmann, M.: Algorithm portfolios based on cost-sensitive hierarchical clustering. In: Proceedings of 23rd International Joint Conference Artificial Intelligence. IJCAI/AAAI (2013)

    Google Scholar 

  25. de Moura, L., Bjørner, N.: Z3: an efficient SMT solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-78800-3_24

    Chapter  Google Scholar 

  26. Palikareva, H., Cadar, C.: Multi-solver support in symbolic execution. In: Sharygina, N., Veith, H. (eds.) CAV 2013. LNCS, vol. 8044, pp. 53–68. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-39799-8_3

    Chapter  Google Scholar 

  27. Rice, J.R.: The algorithm selection problem. Adv. Comput. 15, 65–118 (1976)

    Article  Google Scholar 

  28. Saxena, P., Akhawe, D., Hanna, S., Mao, F., McCamant, S., Song, D.: A symbolic execution framework for JavaScript. In: Proceedings of 2010 IEEE Symposium Security and Privacy, pp. 513–528. IEEE Computer Society (2010)

    Google Scholar 

  29. Schwartz, E.J., Avgerinos, T., Brumley, D.: All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask). In: Proceedings of 31st IEEE Symposium on Security and Privacy, pp. 317–331 (2010)

    Google Scholar 

  30. Sen, K., Agha, G.: CUTE and jCUTE: concolic unit testing and explicit path model-checking tools. In: Ball, T., Jones, R.B. (eds.) CAV 2006. LNCS, vol. 4144, pp. 419–423. Springer, Heidelberg (2006). https://doi.org/10.1007/11817963_38

    Chapter  Google Scholar 

  31. Sen, K., Kalasapur, S., Brutch, T.G., Gibbs, S.: Jalangi: a selective record-replay and dynamic analysis framework for JavaScript. In: Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium Foundations of Software Engineering, pp. 488–498 (2013)

    Google Scholar 

  32. Sen, K., Marinov, D., Agha, G.: CUTE: A concolic unit testing engine for C. In: Proceedings of 10th European Software Engineering Conference, pp. 263–272. ACM (2005)

    Google Scholar 

  33. Smith-Miles, K.: Cross-disciplinary perspectives on meta-learning for algorithm selection. ACM Comput. Surv. 41(1), 1–25 (2008)

    Article  Google Scholar 

  34. Tillmann, N., de Halleux, J.: Pex–white box test generation for.NET. In: Beckert, B., Hähnle, R. (eds.) TAP 2008. LNCS, vol. 4966, pp. 134–153. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-79124-9_10

    Chapter  Google Scholar 

  35. Valenzano, R.A., Nakhost, H., Müller, M., Schaeffer, J., Sturtevant, N.R.: ArvandHerd: parallel planning with a portfolio. In: European Conference Artificial Intelligence, Frontiers in Artificial Intelligence and Applications, vol. 242, pp. 786–791. IOS Press (2012)

    Google Scholar 

  36. Xu, L., Hutter, F., Hoos, H., Leyton-Brown, K.: Evaluating component solver contributions to portfolio-based algorithm selectors. In: Cimatti, A., Sebastiani, R. (eds.) SAT 2012. LNCS, vol. 7317, pp. 228–241. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-31612-8_18

    Chapter  Google Scholar 

  37. Xu, L., Hutter, F., Hoos, H.H., Leyton-Brown, K.: SATzilla: Portfolio-based algorithm selection for SAT. J. Artif. Intell. Res. 32, 565–606 (2008)

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. University of Bologna, Bologna, Italy

    Roberto Amadini

  2. University of Melbourne, Parkville, VIC, Australia

    Peter Schachte & Harald Søndergaard

  3. Monash University, Clayton, VIC, Australia

    Graeme Gange & Peter J. Stuckey

Authors
  1. Roberto Amadini
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Graeme Gange
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Peter Schachte
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Harald Søndergaard
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Peter J. Stuckey
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Roberto Amadini .

Editor information

Editors and Affiliations

  1. King’s College London, London, UK

    Maribel Fernández

Rights and permissions

Reprints and permissions

Copyright information

© 2021 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Amadini, R., Gange, G., Schachte, P., Søndergaard, H., Stuckey, P.J. (2021). Algorithm Selection for Dynamic Symbolic Execution: A Preliminary Study. In: Fernández, M. (eds) Logic-Based Program Synthesis and Transformation. LOPSTR 2020. Lecture Notes in Computer Science(), vol 12561. Springer, Cham. https://doi.org/10.1007/978-3-030-68446-4_10

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-68446-4_10

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-68445-7

  • Online ISBN: 978-3-030-68446-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation