implement various exploration strategies and heuristics

[redianthus]

• [ ] Depth-First Search (DFS): Traverses states in depth-first order.
• [ ] Breadth-First Search (BFS): Traverses states in breadth-first order.
• [ ] Random State Search: Randomly selects a state to explore. See how it is implemented in KLEE.
• [ ] Random Path Selection: Described in KLEE OSDI’08 paper.
• [ ] Non Uniform Random Search (NURS): Selects a state randomly according to a given distribution. The distribution can be based on the minimum distance to an uncovered instruction (MD2U), the query cost, etc. See how it is implemented in KLEE.
• [ ] Guiding Symbolic Execution with A* (see pre-publication).
• [ ] Compatible Branch Coverage Driven Symbolic Execution for Efficient Bug Finding;
• [ ] FeatMaker: Automated Feature Engineering for Search Strategy of Symbolic Execution;
• [ ] Symbolic execution search strategy based on Katz centrality analysis;
• [ ] Parameterized Search Heuristic Prediction for Concolic Execution.

[filipeom]

This one also seems very promising: Empc: Effective Path Prioritization for Symbolic Execution with Path Cover

[redianthus]

Hahaha, indeed, I had it in my mails this morning and was planning to add it there too :D