A Survey of Search Strategies in the Dynamic Symbolic Execution

Abstract

Dynamic symbolic execution (DSE) is an important way to discover software vulnerabilities. One key challenge in DSE is to find proper paths in the huge program execution space to generate effective inputs. Currently, the main search strategies used for DSE include classical search strategy, heuristic search strategy, and pruning redundance strategy. This paper reviews and compares the main search strategies of DSE in recent years, including the Generational strategy, CarFast, Control-Flow Directed Search, Fitness-Guided Search strategy, Context-Guided Search strategy, RWset technique and Veritesting.