Intelligent Constraint Classification for Symbolic Execution

Abstract

Forward symbolic execution is a powerful systematic software analysis technique, but suffers from the high cost of constraint solving. During symbolic execution, off-the-shelf constraint solvers are used to check the satisfiability of path conditions whenever they are updated. However, the satisfiability information is sufficient for path exploration, while the concrete solutions are needed only for special cases, e.g., when a property violation is detected. Thus, symbolic execution can be made more efficient by leveraging rapid constraint classification instead of time-consuming constraint solving when the concrete solutions are not necessary. This paper introduces ICON, a novel approach to scaling symbolic execution with intelligent constraint classification, where neural networks are utilized to classify path conditions for satisfiability. Experimental evaluation shows ICON is highly accurate in classifying path conditions, is faster than state-of-the-art techniques for conventional constraint solving, learning based constraint solving, and constraint solution reuse, and enables more efficient symbolic execution.