A Survey of Search Strategies in the Dynamic Symbolic Execution
Yu Liu, Xu Zhou, Wei-Wei Gong · ITM Web of Conferences · 2017
Dynamic symbolic execution (DSE) is an important way to discover software vulnerabilities. One key challenge in DSE is to find proper paths in the huge program execution space to generate effective inputs. Currently, the main search strategies used for DSE include classical search strategy, heuristic search strategy, and pruning redundance strategy. This paper reviews and compares the main search strategies of DSE in recent years, including the Generational strategy, CarFast, Control-Flow Directed Search, Fitness-Guided Search strategy, Context-Guided Search strategy, RWset technique and Veritesting.