Abstract:Concolic testing is a powerful technique for vulnerability detection. Current concolic testing tools usually randomly select one well-formed concrete input to start their workflow, then employ different path selection methods to explore the execution space. However, experiments have shown that concolic testing tools have different vulnerability detection performance when starting with different well-formed concrete inputs. In this paper, we present an evaluation method to help concolic testing tools select better initial inputs. The key idea is that: if the concolic execution triggered by one candidate initial input covers more error-prone operations with different execution contexts, it is likely to detect more bugs. Specifically, we firstly identify error-prone operations using fine-grained dynamic taint analysis. Then we propose a scoring algorithm to evaluate the vulnerability detection ability of different candidate initial inputs. We implemented this method in a new tool called CrashFinderHB, and applied it to four applications in Linux: readelf, convert, cjpeg, swftool. Experimental results show that using our evaluation method to select starting points can improve the effectiveness of concolic testing. Moreover, starting with carefully selected initial inputs, we found 4 previously unknown errors in readelf and convert.

Towards Optimal Concolic Testing

Towards Concolic Testing for Hybrid Systems

Engineering Seminar ( WiSe 2020 / 21 ) Search Strategies in Concolic Testing Description

A Search Strategy Guided by Uncovered Branches for Concolic Testing

Effective Test Case Generation via Concolic Execution

A Parallel Approach to Concolic Testing with Low-cost Synchronization

Evaluating Initial Inputs for Concolic Testing

Directed Concolic testing method for source code

Concolic Testing in Logic Programming

Testing concolic execution through consistency checks

Abstraction-driven Concolic Testing

Test Generation for Embedded Executables Via Concolic Execution in a Real Environment

Scaling Concolic Testing for the Environment-Intensive Program.

BATON: Symphony of Random Testing and Concolic Testing Through Machine Learning and Taint Analysis

Convergence Depth Control for Process System Optimization

Concolic Metamorphic Debugging

Constructing Multi-constrained Cognitive Diagnostic Tests: An Improved Ant Colony Optimization Algorithm.

Incremental Concolic Testing of Register-Transfer Level Designs

Comparative Analysis of Constraint Handling Techniques for Constrained Combinatorial Testing.

Applications of Function Summary in Concolic Testing

A Novel Method Makes Concolic System More Effective