owi
owi copied to clipboard
implement various exploration strategies and heuristics
- [ ] Depth-First Search (DFS): Traverses states in depth-first order.
- [ ] Breadth-First Search (BFS): Traverses states in breadth-first order.
- [ ] Random State Search: Randomly selects a state to explore. See how it is implemented in KLEE.
- [ ] Random Path Selection: Described in KLEE OSDI’08 paper.
- [ ] Non Uniform Random Search (NURS): Selects a state randomly according to a given distribution. The distribution can be based on the minimum distance to an uncovered instruction (MD2U), the query cost, etc. See how it is implemented in KLEE.
- [ ] Guiding Symbolic Execution with A* (see pre-publication).
- [ ] Compatible Branch Coverage Driven Symbolic Execution for Efficient Bug Finding;
- [ ] FeatMaker: Automated Feature Engineering for Search Strategy of Symbolic Execution;
- [ ] Symbolic execution search strategy based on Katz centrality analysis;
- [ ] Parameterized Search Heuristic Prediction for Concolic Execution.
This one also seems very promising: Empc: Effective Path Prioritization for Symbolic Execution with Path Cover
Hahaha, indeed, I had it in my mails this morning and was planning to add it there too :D