Fitnex: Fitness-Guided Path Exploration

Dynamic symbolic execution combines static analysis and runtime monitoring to compute test inputs by exploring paths of the code under test. When the coverage of a test target (such as the coverage of a branch and the violation of an assertion) requires a relatively long, specific path, existing path exploration strategies often need to explore many other alternative, unhelpful paths before being able to explore this desirable path. This issue becomes more substantial when generating method sequences, where paths in possible combinations of method calls in sequences can easily explode even for relatively small programs.

To address the issues, Fitnex uses fitness values computed through a fitness function (traditionally used in genetic algorithms) to guide path exploration in dynamic symbolic execution. The fitness function measures how close an explored path or branch is in achieving test target coverage.

For details, please read the following DSN 2009 paper:

Fitness-Guided Path Exploration in Dynamic Symbolic Execution PDF
Tao Xie, Nikolai Tillmann, Peli de Halleux and Wolfram Schulte

Sources of Fitnex V1.0 can be downloaded from here

Contact Tao Xie

Last edited Jul 29, 2009 at 6:33 AM by sthumma, version 4


No comments yet.