Symbolic execution for software testing in practice: preliminary assessment

Authors:
Cristian Cadar;Patrice Godefroid;Sarfraz Khurshid;Corina S. Păsăreanu;Koushik Sen;Nikolai Tillmann;Willem Visser
Affiliations:
Imperial College London, London, United Kingdom;Microsoft Research, Redmond, WA, USA;University of Texas at Austin, Austin, TX, USA;Carnegie Melon University & NASA Ames, Pittsburgh, PA, USA;University of California at Berkeley, Berkeley, CA, USA;Microsoft Research, Redmond, WA, USA;Stellenbosch University, Matieland, South Africa
Venue:
Proceedings of the 33rd International Conference on Software Engineering
Year:
2011

Citing 54
Cited 23

Applications of symbolic evaluation

Journal of Systems and Software
Symbolic execution systems—a review

Software Engineering Journal
Using symbolic execution for verification of Ada tasking programs

ACM Transactions on Programming Languages and Systems (TOPLAS)
A static analyzer for finding dynamic programming errors

Software—Practice & Experience
Symbolic execution and program testing

Communications of the ACM
Using symbolic execution for verifying safety-critical systems

Proceedings of the 8th European software engineering conference held jointly with 9th ACM SIGSOFT international symposium on Foundations of software engineering
Program Flow Analysis: Theory and Application

Program Flow Analysis: Theory and Application
A program testing system

ACM '76 Proceedings of the 1976 annual conference
SELECT—a formal system for testing and debugging programs by symbolic execution

Proceedings of the international conference on Reliable software
LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation

Proceedings of the international symposium on Code generation and optimization: feedback-directed and runtime optimization
DART: directed automated random testing

Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation
Parameterized unit tests

Proceedings of the 10th European software engineering conference held jointly with 13th ACM SIGSOFT international symposium on Foundations of software engineering
CUTE: a concolic unit testing engine for C

Proceedings of the 10th European software engineering conference held jointly with 13th ACM SIGSOFT international symposium on Foundations of software engineering
Automatically Generating Malicious Disks using Symbolic Execution

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Test input generation for java containers using state matching

Proceedings of the 2006 international symposium on Software testing and analysis
Bogor/Kiasan: A k-bounded Symbolic Execution for Checking Strong Heap Properties of Open Systems

ASE '06 Proceedings of the 21st IEEE/ACM International Conference on Automated Software Engineering
EXE: automatically generating inputs of death

Proceedings of the 13th ACM conference on Computer and communications security
Compositional dynamic test generation

Proceedings of the 34th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Hybrid Concolic Testing

ICSE '07 Proceedings of the 29th international conference on Software Engineering
Scalable automated methods for dynamic program analysis

Scalable automated methods for dynamic program analysis
On the Automated Generation of Program Test Data

IEEE Transactions on Software Engineering
Symbolic Testing and the DISSECT Symbolic Evaluation System

IEEE Transactions on Software Engineering
Combining symbolic execution with model checking to verify parallel numerical programs

ACM Transactions on Software Engineering and Methodology (TOSEM)
Combining unit-level symbolic execution and system-level concrete execution for testing nasa software

ISSTA '08 Proceedings of the 2008 international symposium on Software testing and analysis
Finding bugs in dynamic web applications

ISSTA '08 Proceedings of the 2008 international symposium on Software testing and analysis
Path Feasibility Analysis for String-Manipulating Programs

TACAS '09 Proceedings of the 15th International Conference on Tools and Algorithms for the Construction and Analysis of Systems: Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2009,
Reducing Test Inputs Using Information Partitions

CAV '09 Proceedings of the 21st International Conference on Computer Aided Verification
Software Model Checking Improving Security of a Billion Computers

Proceedings of the 16th International SPIN Workshop on Model Checking Software
Heuristics for Scalable Dynamic Test Generation

ASE '08 Proceedings of the 2008 23rd IEEE/ACM International Conference on Automated Software Engineering
A survey of new trends in symbolic execution for software testing and analysis

International Journal on Software Tools for Technology Transfer (STTT) - Special Section on HVC 07
Reverse engineering of binary device drivers with RevNIC

Proceedings of the 5th European conference on Computer systems
Execution synthesis: a technique for automated software debugging

Proceedings of the 5th European conference on Computer systems
JPF-SE: a symbolic execution extension to Java PathFinder

TACAS'07 Proceedings of the 13th international conference on Tools and algorithms for the construction and analysis of systems
Generalized symbolic execution for model checking and testing

TACAS'03 Proceedings of the 9th international conference on Tools and algorithms for the construction and analysis of systems
A decision procedure for bit-vectors and arrays

CAV'07 Proceedings of the 19th international conference on Computer aided verification
Z3: an efficient SMT solver

TACAS'08/ETAPS'08 Proceedings of the Theory and practice of software, 14th international conference on Tools and algorithms for the construction and analysis of systems
RWset: attacking path explosion in constraint-based test generation

TACAS'08/ETAPS'08 Proceedings of the Theory and practice of software, 14th international conference on Tools and algorithms for the construction and analysis of systems
Pex: white box test generation for .NET

TAP'08 Proceedings of the 2nd international conference on Tests and proofs
Structural coverage of feasible code

Proceedings of the 5th Workshop on Automation of Software Test
Parallel symbolic execution for structural test generation

Proceedings of the 19th international symposium on Software testing and analysis
All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)

SP '10 Proceedings of the 2010 IEEE Symposium on Security and Privacy
KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs

OSDI'08 Proceedings of the 8th USENIX conference on Operating systems design and implementation
Dynamic test generation to find integer bugs in x86 binary linux programs

SSYM'09 Proceedings of the 18th conference on USENIX security symposium
Testing closed-source binary device drivers with DDT

USENIXATC'10 Proceedings of the 2010 USENIX conference on USENIX annual technical conference
Scalable distributed concolic testing: a case study on a flash storage platform

ICTAC'10 Proceedings of the 7th International colloquium conference on Theoretical aspects of computing
Directed test suite augmentation: techniques and tradeoffs

Proceedings of the eighteenth ACM SIGSOFT international symposium on Foundations of software engineering
Moles: tool-assisted environment isolation with closures

TOOLS'10 Proceedings of the 48th international conference on Objects, models, components, patterns
Analysis & Detection of SQL Injection Vulnerabilities via Automatic Test Case Generation of Programs

SAINT '10 Proceedings of the 2010 10th IEEE/IPSJ International Symposium on Applications and the Internet
Stable deterministic multithreading through schedule memoization

OSDI'10 Proceedings of the 9th USENIX conference on Operating systems design and implementation
FloPSy: search-based floating point constraint solving for symbolic execution

ICTSS'10 Proceedings of the 22nd IFIP WG 6.1 international conference on Testing software and systems
CORAL: solving complex constraints for symbolic pathfinder

NFM'11 Proceedings of the Third international conference on NASA Formal methods
Directed incremental symbolic execution

Proceedings of the 32nd ACM SIGPLAN conference on Programming language design and implementation
CUTE and jCUTE: concolic unit testing and explicit path model-checking tools

CAV'06 Proceedings of the 18th international conference on Computer Aided Verification
Execution generated test cases: how to make systems code crash itself

SPIN'05 Proceedings of the 12th international conference on Model Checking Software

Higher-order test generation

Proceedings of the 32nd ACM SIGPLAN conference on Programming language design and implementation
Symbolic execution of alloy models

ICFEM'11 Proceedings of the 13th international conference on Formal methods and software engineering
Verifying GPU kernels by test amplification

Proceedings of the 33rd ACM SIGPLAN conference on Programming Language Design and Implementation
Mutation based test case generation via a path selection strategy

Information and Software Technology
make test-zesti: a symbolic execution solution for improving regression testing

Proceedings of the 34th International Conference on Software Engineering
Predicting concurrency failures in the generalized execution traces of x86 executables

RV'11 Proceedings of the Second international conference on Runtime verification
The GISMOE challenge: constructing the pareto program surface using genetic programming to find better programs (keynote paper)

Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering
Practical isolation of failure-inducing changes for debugging regression faults

Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering
Augmented dynamic symbolic execution

Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering
Dynamic adaptive search based software engineering

Proceedings of the ACM-IEEE international symposium on Empirical software engineering and measurement
Toward variability-aware testing

FOSD '12 Proceedings of the 4th International Workshop on Feature-Oriented Software Development
Testing android apps through symbolic execution

ACM SIGSOFT Software Engineering Notes
Ranged Model Checking

ACM SIGSOFT Software Engineering Notes
Billions and billions of constraints: whitebox fuzz testing in production

Proceedings of the 2013 International Conference on Software Engineering
aPET: a test case generation tool for concurrent objects

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering
Testing noninterference, quickly

Proceedings of the 18th ACM SIGPLAN international conference on Functional programming
An orchestrated survey of methodologies for automated software test case generation

Journal of Systems and Software
Steering symbolic execution to less traveled paths

Proceedings of the 2013 ACM SIGPLAN international conference on Object oriented programming systems languages & applications
Cloud engineering is Search Based Software Engineering too

Journal of Systems and Software
Multi-solver support in symbolic execution

CAV'13 Proceedings of the 25th international conference on Computer Aided Verification
Simulating software behavior based on UML activity diagram

Proceedings of the 5th Asia-Pacific Symposium on Internetware
Redundant state detection for dynamic symbolic execution

USENIX ATC'13 Proceedings of the 2013 USENIX conference on Annual Technical Conference
Automated testing of chef automation scripts

Proceedings Demo & Poster Track of ACM/IFIP/USENIX International Middleware Conference

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present results for the "Impact Project Focus Area" on the topic of symbolic execution as used in software testing. Symbolic execution is a program analysis technique introduced in the 70s that has received renewed interest in recent years, due to algorithmic advances and increased availability of computational power and constraint solving technology. We review classical symbolic execution and some modern extensions such as generalized symbolic execution and dynamic test generation. We also give a preliminary assessment of the use in academia, research labs, and industry.