Fitnex: Fitness-Guided Path Exploration
Dynamic symbolic execution combines static analysis and runtime monitoring to compute test inputs by exploring paths of the code under test. When the coverage of a test target (such as the coverage of a branch and the violation of an assertion) requires a relatively long, specific path, existing path exploration strategies often need to explore many other alternative, unhelpful paths before being able to explore this desirable path. This issue becomes more substantial when generating method sequences, where paths in possible combinations of method calls in sequences can easily explode even for relatively small programs.
To address the issues, Fitnex uses fitness values computed through a fitness function (traditionally used in genetic algorithms) to guide path exploration in dynamic symbolic execution. The fitness function measures how close an explored path or branch is in achieving test target coverage.
For details, please read the following MSR tech report:
Fitness-Guided Path Exploration in Dynamic Symbolic Execution PDF
Tao Xie, Nikolai Tillmann, Peli de Halleux and Wolfram Schulte, Microsoft Research TechReport MSR-TR-2008-123.
Contact Tao Xie