BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support

Autores
Rosner, Nicolas Leandro; Geldenhuys, Jaco; Aguirre, Nazareno Matias; Visser, Willem; Frias, Marcelo Fabian
Año de publicación
2015
Idioma
inglés
Tipo de recurso
artículo
Estado
versión publicada
Descripción
Lazy Initialization (LI) allows symbolic execution to effectively deal with heap-allocated data structures, thanks to a significant reduction in spurious and redundant symbolic structures. Bounded lazy initialization (BLI) improves on LI by taking advantage of precomputed relational bounds on the interpretation of class fields in order to reduce the number of spurious structures even further. In this paper we present bounded lazy initialization with SAT support (BLISS), a novel technique that refines the search for valid structures during the symbolic execution process. BLISS builds upon BLI, extending it with field bound refinement and satisfiability checks. Field bounds are refined while a symbolic structure is concretized, avoiding cases that, due to the concrete part of the heap and the field bounds, can be deemed redundant. Satisfiability checks on refined symbolic heaps allow us to prune these heaps as soon as they are identified as infeasible, i.e., as soon as it can be confirmed that they cannot be extended to any valid concrete heap. Compared to LI and BLI, BLISS reduces the time required by LI by up to four orders of magnitude for the most complex data structures. Moreover, the number of partially symbolic structures obtained by exploring program paths is reduced by BLISS by over 50 percent, with reductions of over 90 percent in some cases (compared to LI). BLISS uses less memory than LI and BLI, which enables the exploration of states unreachable by previous techniques.
Fil: Rosner, Nicolas Leandro. Universidad de Buenos Aires. Facultad de Ciencias Exactas y Naturales. Departamento de Computación; Argentina
Fil: Geldenhuys, Jaco. University of Stellenbosch; Sudáfrica
Fil: Aguirre, Nazareno Matias. Consejo Nacional de Investigaciones Científicas y Técnicas; Argentina. Universidad Nacional de Río Cuarto. Facultad de Ciencias Exactas Fisicoquímicas y Naturales. Departamento de Computación; Argentina
Fil: Visser, Willem. University of Stellenbosch; Sudáfrica
Fil: Frias, Marcelo Fabian. Instituto Tecnológico de Buenos Aires; Argentina. Consejo Nacional de Investigaciones Científicas y Técnicas; Argentina
Materia
Symbolic Execution
Lazy Initialization
Tight Field Bounds
Symbolic Pathfinder
Nivel de accesibilidad
acceso abierto
Condiciones de uso
https://creativecommons.org/licenses/by-nc-sa/2.5/ar/
Repositorio
CONICET Digital (CONICET)
Institución
Consejo Nacional de Investigaciones Científicas y Técnicas
OAI Identificador
oai:ri.conicet.gov.ar:11336/42805
Acceder
id CONICETDig_a5d1d94cc1360a39c7ef74a9b03d1c24
oai_identifier_str oai:ri.conicet.gov.ar:11336/42805
network_acronym_str CONICETDig
repository_id_str 3498
network_name_str CONICET Digital (CONICET)
spelling BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT SupportRosner, Nicolas LeandroGeldenhuys, JacoAguirre, Nazareno MatiasVisser, WillemFrias, Marcelo FabianSymbolic ExecutionLazy InitializationTight Field BoundsSymbolic Pathfinderhttps://purl.org/becyt/ford/1.2https://purl.org/becyt/ford/1Lazy Initialization (LI) allows symbolic execution to effectively deal with heap-allocated data structures, thanks to a significant reduction in spurious and redundant symbolic structures. Bounded lazy initialization (BLI) improves on LI by taking advantage of precomputed relational bounds on the interpretation of class fields in order to reduce the number of spurious structures even further. In this paper we present bounded lazy initialization with SAT support (BLISS), a novel technique that refines the search for valid structures during the symbolic execution process. BLISS builds upon BLI, extending it with field bound refinement and satisfiability checks. Field bounds are refined while a symbolic structure is concretized, avoiding cases that, due to the concrete part of the heap and the field bounds, can be deemed redundant. Satisfiability checks on refined symbolic heaps allow us to prune these heaps as soon as they are identified as infeasible, i.e., as soon as it can be confirmed that they cannot be extended to any valid concrete heap. Compared to LI and BLI, BLISS reduces the time required by LI by up to four orders of magnitude for the most complex data structures. Moreover, the number of partially symbolic structures obtained by exploring program paths is reduced by BLISS by over 50 percent, with reductions of over 90 percent in some cases (compared to LI). BLISS uses less memory than LI and BLI, which enables the exploration of states unreachable by previous techniques.Fil: Rosner, Nicolas Leandro. Universidad de Buenos Aires. Facultad de Ciencias Exactas y Naturales. Departamento de Computación; ArgentinaFil: Geldenhuys, Jaco. University of Stellenbosch; SudáfricaFil: Aguirre, Nazareno Matias. Consejo Nacional de Investigaciones Científicas y Técnicas; Argentina. Universidad Nacional de Río Cuarto. Facultad de Ciencias Exactas Fisicoquímicas y Naturales. Departamento de Computación; ArgentinaFil: Visser, Willem. University of Stellenbosch; SudáfricaFil: Frias, Marcelo Fabian. Instituto Tecnológico de Buenos Aires; Argentina. Consejo Nacional de Investigaciones Científicas y Técnicas; ArgentinaIEEE Computer Society2015-07info:eu-repo/semantics/articleinfo:eu-repo/semantics/publishedVersionhttp://purl.org/coar/resource_type/c_6501info:ar-repo/semantics/articuloapplication/pdfapplication/pdfhttp://hdl.handle.net/11336/42805Rosner, Nicolas Leandro; Geldenhuys, Jaco; Aguirre, Nazareno Matias; Visser, Willem; Frias, Marcelo Fabian; BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support; IEEE Computer Society; IEEE Transactions On Software Engineering; 41; 7; 7-2015; 639-6600098-5589CONICET DigitalCONICETenginfo:eu-repo/semantics/altIdentifier/doi/10.1109/TSE.2015.2389225info:eu-repo/semantics/altIdentifier/url/https://ieeexplore.ieee.org/document/7004061/info:eu-repo/semantics/openAccesshttps://creativecommons.org/licenses/by-nc-sa/2.5/ar/reponame:CONICET Digital (CONICET)instname:Consejo Nacional de Investigaciones Científicas y Técnicas2025-09-29T10:43:44Zoai:ri.conicet.gov.ar:11336/42805instacron:CONICETInstitucionalhttp://ri.conicet.gov.ar/Organismo científico-tecnológicoNo correspondehttp://ri.conicet.gov.ar/oai/requestdasensio@conicet.gov.ar; lcarlino@conicet.gov.arArgentinaNo correspondeNo correspondeNo correspondeopendoar:34982025-09-29 10:43:45.18CONICET Digital (CONICET) - Consejo Nacional de Investigaciones Científicas y Técnicasfalse
dc.title.none.fl_str_mv BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support
title BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support
spellingShingle BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support
Rosner, Nicolas Leandro
Symbolic Execution
Lazy Initialization
Tight Field Bounds
Symbolic Pathfinder
title_short BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support
title_full BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support
title_fullStr BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support
title_full_unstemmed BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support
title_sort BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support
dc.creator.none.fl_str_mv Rosner, Nicolas Leandro
Geldenhuys, Jaco
Aguirre, Nazareno Matias
Visser, Willem
Frias, Marcelo Fabian
author Rosner, Nicolas Leandro
author_facet Rosner, Nicolas Leandro
Geldenhuys, Jaco
Aguirre, Nazareno Matias
Visser, Willem
Frias, Marcelo Fabian
author_role author
author2 Geldenhuys, Jaco
Aguirre, Nazareno Matias
Visser, Willem
Frias, Marcelo Fabian
author2_role author
author
author
author
dc.subject.none.fl_str_mv Symbolic Execution
Lazy Initialization
Tight Field Bounds
Symbolic Pathfinder
topic Symbolic Execution
Lazy Initialization
Tight Field Bounds
Symbolic Pathfinder
purl_subject.fl_str_mv https://purl.org/becyt/ford/1.2
https://purl.org/becyt/ford/1
dc.description.none.fl_txt_mv Lazy Initialization (LI) allows symbolic execution to effectively deal with heap-allocated data structures, thanks to a significant reduction in spurious and redundant symbolic structures. Bounded lazy initialization (BLI) improves on LI by taking advantage of precomputed relational bounds on the interpretation of class fields in order to reduce the number of spurious structures even further. In this paper we present bounded lazy initialization with SAT support (BLISS), a novel technique that refines the search for valid structures during the symbolic execution process. BLISS builds upon BLI, extending it with field bound refinement and satisfiability checks. Field bounds are refined while a symbolic structure is concretized, avoiding cases that, due to the concrete part of the heap and the field bounds, can be deemed redundant. Satisfiability checks on refined symbolic heaps allow us to prune these heaps as soon as they are identified as infeasible, i.e., as soon as it can be confirmed that they cannot be extended to any valid concrete heap. Compared to LI and BLI, BLISS reduces the time required by LI by up to four orders of magnitude for the most complex data structures. Moreover, the number of partially symbolic structures obtained by exploring program paths is reduced by BLISS by over 50 percent, with reductions of over 90 percent in some cases (compared to LI). BLISS uses less memory than LI and BLI, which enables the exploration of states unreachable by previous techniques.
Fil: Rosner, Nicolas Leandro. Universidad de Buenos Aires. Facultad de Ciencias Exactas y Naturales. Departamento de Computación; Argentina
Fil: Geldenhuys, Jaco. University of Stellenbosch; Sudáfrica
Fil: Aguirre, Nazareno Matias. Consejo Nacional de Investigaciones Científicas y Técnicas; Argentina. Universidad Nacional de Río Cuarto. Facultad de Ciencias Exactas Fisicoquímicas y Naturales. Departamento de Computación; Argentina
Fil: Visser, Willem. University of Stellenbosch; Sudáfrica
Fil: Frias, Marcelo Fabian. Instituto Tecnológico de Buenos Aires; Argentina. Consejo Nacional de Investigaciones Científicas y Técnicas; Argentina
description Lazy Initialization (LI) allows symbolic execution to effectively deal with heap-allocated data structures, thanks to a significant reduction in spurious and redundant symbolic structures. Bounded lazy initialization (BLI) improves on LI by taking advantage of precomputed relational bounds on the interpretation of class fields in order to reduce the number of spurious structures even further. In this paper we present bounded lazy initialization with SAT support (BLISS), a novel technique that refines the search for valid structures during the symbolic execution process. BLISS builds upon BLI, extending it with field bound refinement and satisfiability checks. Field bounds are refined while a symbolic structure is concretized, avoiding cases that, due to the concrete part of the heap and the field bounds, can be deemed redundant. Satisfiability checks on refined symbolic heaps allow us to prune these heaps as soon as they are identified as infeasible, i.e., as soon as it can be confirmed that they cannot be extended to any valid concrete heap. Compared to LI and BLI, BLISS reduces the time required by LI by up to four orders of magnitude for the most complex data structures. Moreover, the number of partially symbolic structures obtained by exploring program paths is reduced by BLISS by over 50 percent, with reductions of over 90 percent in some cases (compared to LI). BLISS uses less memory than LI and BLI, which enables the exploration of states unreachable by previous techniques.
publishDate 2015
dc.date.none.fl_str_mv 2015-07
dc.type.none.fl_str_mv info:eu-repo/semantics/article
info:eu-repo/semantics/publishedVersion
http://purl.org/coar/resource_type/c_6501
info:ar-repo/semantics/articulo
format article
status_str publishedVersion
dc.identifier.none.fl_str_mv http://hdl.handle.net/11336/42805
Rosner, Nicolas Leandro; Geldenhuys, Jaco; Aguirre, Nazareno Matias; Visser, Willem; Frias, Marcelo Fabian; BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support; IEEE Computer Society; IEEE Transactions On Software Engineering; 41; 7; 7-2015; 639-660
0098-5589
CONICET Digital
CONICET
url http://hdl.handle.net/11336/42805
identifier_str_mv Rosner, Nicolas Leandro; Geldenhuys, Jaco; Aguirre, Nazareno Matias; Visser, Willem; Frias, Marcelo Fabian; BLISS: Improved Symbolic Execution by Bounded Lazy Initialization with SAT Support; IEEE Computer Society; IEEE Transactions On Software Engineering; 41; 7; 7-2015; 639-660
0098-5589
CONICET Digital
CONICET
dc.language.none.fl_str_mv eng
language eng
dc.relation.none.fl_str_mv info:eu-repo/semantics/altIdentifier/doi/10.1109/TSE.2015.2389225
info:eu-repo/semantics/altIdentifier/url/https://ieeexplore.ieee.org/document/7004061/
dc.rights.none.fl_str_mv info:eu-repo/semantics/openAccess
https://creativecommons.org/licenses/by-nc-sa/2.5/ar/
eu_rights_str_mv openAccess
rights_invalid_str_mv https://creativecommons.org/licenses/by-nc-sa/2.5/ar/
dc.format.none.fl_str_mv application/pdf
application/pdf
dc.publisher.none.fl_str_mv IEEE Computer Society
publisher.none.fl_str_mv IEEE Computer Society
dc.source.none.fl_str_mv reponame:CONICET Digital (CONICET)
instname:Consejo Nacional de Investigaciones Científicas y Técnicas
reponame_str CONICET Digital (CONICET)
collection CONICET Digital (CONICET)
instname_str Consejo Nacional de Investigaciones Científicas y Técnicas
repository.name.fl_str_mv CONICET Digital (CONICET) - Consejo Nacional de Investigaciones Científicas y Técnicas
repository.mail.fl_str_mv dasensio@conicet.gov.ar; lcarlino@conicet.gov.ar
_version_ 1844614473397043200
score 13.069144

Publicaciones similares