CN108021507A - The parallel route searching method and device of semiology analysis - Google Patents
The parallel route searching method and device of semiology analysis Download PDFInfo
- Publication number
- CN108021507A CN108021507A CN201711423532.6A CN201711423532A CN108021507A CN 108021507 A CN108021507 A CN 108021507A CN 201711423532 A CN201711423532 A CN 201711423532A CN 108021507 A CN108021507 A CN 108021507A
- Authority
- CN
- China
- Prior art keywords
- path
- prefix
- binary tree
- true value
- predicted
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/3668—Software testing
- G06F11/3672—Test management
- G06F11/3684—Test management for test design, e.g. generating new test cases
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The parallel route searching method and device of semiology analysis provided by the invention, carry out stipulations processing by using to the controlling stream graph for obtaining program, obtain the path binary tree of controlling stream graph；Any one path in path selection binary tree, and obtain the true value sequence of the corresponding constraints in path；Negated along to each constraint true value backward in true value sequence, obtain multiple path prefix；The corresponding multiple predicted paths of each path prefix are determined according to path binary tree, a thread is distributed for each path prefix, in a manner of making to be carried out at the same time route searching to multiple predicted paths, so as to fulfill the parallel search to multiple paths, so as to effectively increase search efficiency, search difficulty is reduced.
Description
Technical field
The present invention relates to the parallel route searching method and device of computer technology, more particularly to a kind of semiology analysis.
Background technology
Symbolic execution technique has important application in fields such as software test, software vulnerability, bug excavations.It is specific next
Say, by replacing actually entering with symbol input in program process, by program variable symbolism, and pass through in analysis
The continuous collecting path constraints of pitching pile, generates test case to improve the coverage rate of software test or hair by constraint solver
Fragility existing for existing software.
Existing symbolic execution technique is the serial path searching method of the depth-first used, i.e., is exploring one every time
After the complete Program path of bar, the constraint true value in last non-leaf nodes of current fullpath is negated, as under
Path desired by an iteration, until completing the search of All Paths.
But the branch data and cycle-index due to Program path are huge, the prior art is in the number in face of execution route
During the situation that magnitude will exponentially increase, the problem of will appear from path explosion.Structural complexity between i.e. each path is high,
Quantity is big, so that the search efficiency in path is low, search difficulty is big.
The content of the invention
Existing in the prior art since the structural complexity between path is high in order to solve, number of paths is big and causes road
The problem of path search efficiency is low, and search difficulty is big, the present invention provides the parallel route searching method and dress of a kind of semiology analysis
Put.
On the one hand, the parallel route searching method of semiology analysis provided by the invention, including：
Stipulations processing is carried out to the controlling stream graph for obtaining program, obtains the path binary tree of the controlling stream graph；
Any one path in the path binary tree is chosen, and obtains the true value sequence of the corresponding constraints in the path
Row；
Negated along to each constraint true value backward in the true value sequence, obtain multiple path prefix；
The corresponding multiple predicted paths of each path prefix are determined according to the path binary tree, for each path prefix point
With a thread, so as to be carried out at the same time route searching to the multiple predicted path.
In wherein a kind of optional embodiment, it is described the multiple predicted path is carried out at the same time route searching it
Afterwards, further include：
Judge whether the quantity of the predicted path of whole is more than predetermined threshold value；
If it is not, then using whole predicted path as path prefix, and return described according to the path binary tree
The step of determining each path prefix corresponding multiple predicted paths, until the quantity of whole predicted path be more than it is default
Threshold value.
It is described to determine that each path prefix corresponds to according to the path binary tree in wherein a kind of optional embodiment
Multiple predicted paths, including：
According to each path prefix and the path binary tree, the corresponding complete road of each path prefix is obtained
Footpath；
The constraint true value in the corresponding fullpath of each path prefix is negated according to preset rules, described in acquisition
The corresponding multiple predicted paths of each path prefix.
In wherein a kind of optional embodiment, if either path prefix includes P node, the either path
The corresponding fullpath of prefix includes a nodes of P ', wherein the P is less than the P '；
Correspondingly, being negated according to preset rules to the constraint true value in the corresponding fullpath of either path prefix, obtain
The corresponding multiple predicted paths of the either path prefix, including：
To the P node in the corresponding fullpath of the either path prefix to the corresponding constraint of -1 node of P '
True value negates successively, obtains corresponding the P '-P predicted path of either path prefix.
In wherein a kind of optional embodiment, the controlling stream graph of described pair of acquisition program carries out stipulations processing, including：
According to the program structure of the controlling stream graph, determine the corresponding protocol type of described program structure, and according to institute
The corresponding reduction algorithm of protocol type is stated to handle described program structure；Wherein described protocol type including single choice select type,
More options type and circular form.
Another invention, present invention also offers a kind of parallel route searcher of semiology analysis, including：
Stipulations processing module, for carrying out stipulations processing to the controlling stream graph for obtaining program, obtains the controlling stream graph
Path binary tree；
Parallel route search module, for choosing any one path in the path binary tree, and obtains the path
The true value sequence of corresponding constraints；Negated along to each constraint true value backward in the true value sequence, obtain multiple paths
Prefix；The corresponding multiple predicted paths of each path prefix are determined according to the path binary tree, are distributed for each path prefix
One thread, so as to be carried out at the same time route searching to the multiple predicted path.
In wherein a kind of optional embodiment, the parallel route search module, is specifically used for：
Judge whether the quantity of the predicted path of whole is more than predetermined threshold value；
If it is not, then using whole predicted path as path prefix, and return described according to the path binary tree
The step of determining each path prefix corresponding multiple predicted paths, until the quantity of whole predicted path be more than it is default
Threshold value.
In wherein a kind of optional embodiment, the parallel route search module, is specifically used for：
According to each path prefix and the path binary tree, the corresponding complete road of each path prefix is obtained
Footpath；
The constraint true value in the corresponding fullpath of each path prefix is negated according to preset rules, described in acquisition
The corresponding multiple predicted paths of each path prefix.
In wherein a kind of optional embodiment, either path prefix includes P node, then before the either path
Sewing corresponding fullpath includes a nodes of P ', wherein the P is less than the P '；
Correspondingly, the parallel route search module, is specifically used for：
To the P node in the corresponding fullpath of the either path prefix to the corresponding constraint of -1 node of P '
True value negates successively, obtains corresponding the P '-P predicted path of either path prefix.
In wherein a kind of optional embodiment, the stipulations processing module, is specifically used for：
According to the program structure of the controlling stream graph, determine the corresponding protocol type of described program structure, and according to institute
The corresponding reduction algorithm of protocol type is stated to handle described program structure；Wherein described protocol type including single choice select type,
More options type and circular form.
The parallel route searching method and device of semiology analysis provided by the invention, by using the control to obtaining program
Flow graph carries out stipulations processing, obtains the path binary tree of the controlling stream graph；Choose in the path binary tree it is any all the way
Footpath, and obtain the true value sequence of the corresponding constraints in the path；Along to each constraint true value backward in the true value sequence
Negate, obtain multiple path prefix；The corresponding multiple predicted paths of each path prefix are determined according to the path binary tree, are
Each path prefix distributes a thread, in a manner of making to be carried out at the same time route searching to the multiple predicted path, so that real
Now to the parallel search in multiple paths, so as to effectively increase search efficiency, search difficulty is reduced.
Brief description of the drawings
Attached drawing herein is merged in specification and forms the part of this specification, shows the implementation for meeting the disclosure
Example, and be used to together with specification to explain the principle of the disclosure.
A kind of flow diagram of the parallel route searching method for semiology analysis that Fig. 1 embodiment of the present invention one provides；
A kind of flow diagram of the parallel route searching method of Fig. 2 semiology analysis provided by Embodiment 2 of the present invention；
A kind of structure diagram of the parallel route searcher for semiology analysis that Fig. 3 embodiment of the present invention three provides.
Pass through above-mentioned attached drawing, it has been shown that the clear and definite embodiment of the disclosure, will hereinafter be described in more detail.These attached drawings
It is not intended to limit the scope of disclosure design by any mode with word description, but is by reference to specific embodiment
Those skilled in the art illustrate the concept of the disclosure.
Embodiment
To make the purpose, technical scheme and advantage of the embodiment of the present invention clearer, below in conjunction with the embodiment of the present invention
In attached drawing, the technical solution in the embodiment of the present invention is clearly and completely described.
Symbolic execution technique has important application in fields such as software test, software vulnerability, bug excavations, wherein
Replace actually entering with symbol input in program process, it is continuous by pitching pile by program variable symbolism, and in analysis
Collecting path constraints, generates test case to improve the coverage rate of software test or find that software is deposited by constraint solver
Fragility.Mutually there is larger advantage to the profound analysis of program to be detected progress than traditional fuzz testing.
Wherein, the application first will sketch the related notion of symbolic execution technique：
Symbolic Execution based on principle can be expressed as building controlling stream graph to single Procedure Codes object to be analyzed,
Then since the entrance of controlling stream graph, by involved variable symbol, the sentence in analysis program and instruction successively,
It is translated as character expression.If running into control flow statement in Symbolic Execution, by condition judgment sentence to variate-value
It is required that being attached in path condition, judge which bar branch is feasible using constraint solver afterwards, and according to the path being pre-designed
Scheduling strategy, which is realized, analyzes the traversal in all paths of the process, finally exports the analysis result in every executable path.
The interprocedual of symbolic execution technique further includes：To whole program code constructor calling figure, in function call graph
In, the call relation between node and side difference representative function and function.According to default global analysis's scheduling strategy, function call
Analysis in each node (a corresponding function) implementation procedure in figure, finally obtains the every kind of feasible calling sequence of function call graph
The analysis result of row.
In existing symbolic execution technique, the serial path searching method of the depth-first generally used, i.e., each
After having explored a complete Program path, the constraint true value in last non-leaf nodes of current fullpath is taken
Instead, as the path desired by next iteration, until completing the search of All Paths.Iteration can only produce one each time for it
For follow-up expectation path as next task, whole track search process is serial, orderly.
But the branch data and cycle-index due to Program path are huge, the prior art is in the number in face of execution route
During the situation that magnitude will exponentially increase, the problem of will appear from path explosion.Then, serial path search in theory may be used
With each reachable path in traversal program and test case is generated, but this target is often difficult to reach in practical implementation
Arrive.In addition, when the path number of required exploration in program is very much, or program to be measured includes circulation etc. may include unlimited perform
The structure in path, the time-consuming of serial heuristic process can become very significantly, and execution efficiency may be because of potential unlimited road
Footpath situation and reduce.
Therefore, based on existing in the prior art since the structural complexity between path is high, number of paths is big and causes
Route searching efficiency is low, search difficulty it is big the problem of, the present invention provides a kind of semiology analysis parallel route searching method and
Device.
It should be noted that will be illustrated in detail to exemplary embodiment here, its example is illustrated in the accompanying drawings.Under
When the description in face is related to attached drawing, unless otherwise indicated, the same numbers in different attached drawings represent the same or similar key element.Below
Embodiment described in exemplary embodiment does not represent all embodiments consistent with the disclosure.On the contrary, they
Only it is the example of the apparatus and method consistent with some aspects being described in detail in such as the appended claims, the disclosure.
How the technical solution of technical scheme and the application is solved with specifically embodiment below above-mentioned
Technical problem is described in detail.These specific embodiments can be combined with each other below, for the same or similar concept
Or process may repeat no more in certain embodiments.Below in conjunction with attached drawing, the embodiment of the present invention is described.
A kind of flow diagram of the parallel route searching method for semiology analysis that Fig. 1 embodiment of the present invention one provides.
As shown in Figure 1, the parallel route searching method of the semiology analysis, including：
Step 101, carry out stipulations processing to the controlling stream graph for obtaining program, obtains the path binary tree of controlling stream graph.
It should be noted that the executive agent of the embodiment of the present invention one concretely search by a kind of parallel route of semiology analysis
Rope device, it can specifically be made of the program run in logic circuit, integrated chip, memory, processor and memory.
Specifically, the controlling stream graph of program is that single Procedure Codes object structure to be analyzed is obtained, it is one
The abstraction of a process or program, represents all paths that can be traversed in a program process.In general, its
The possibility flow direction that all branch confluences perform in a process is represented in graph form, can also reflect that the real-time of process is held
Row process.In above-mentioned steps, after the controlling stream graph of program is obtained, stipulations processing can be carried out to the controlling stream graph, to obtain
It must can be used for the path binary tree for representing controlling stream graph Zhong Ge branches confluence and path relation.
Preferably, in a step 101, the corresponding Regularia of program structure can be determined according to the program structure of controlling stream graph
Type, and being handled according to reduction algorithm corresponding with protocol type program structure, wherein protocol type including single choice select type,
More options type and circular form.
Specifically, the controlling stream graph of program is carried out stipulations processing by parallel route searcher, is mainly shown as to control
Several complex situations carry out stipulations processing in flow graph processed, obtain path binary tree, with for subsequently to path binary tree reality
Parallel search is applied to be ready.
Single choice therein selects type and refers to the branch confluence on controlling stream graph carrying out replication processes, so as to be by in-degree
2 confluence is transformed to the confluence that two in-degrees are 1, and the branch confluence that in-degree is 1 can transform to his father confluence
Left child or right child confluence (being defaulted as left child's node)；More options type is referred to for out-degree present on controlling stream graph
Confluence more than 2, is converted to the confluence that multiple out-degree are equal to 2.The left child of two out-degree sides difference directive confluence
Confluence and right child confluence；More options type refers to circulation carrying out decyclization stipulations, removes the back edge of circulation, be converted to only
There is the situation of two injection arcs of true exit and false exit.
In addition, the path binary tree obtained in the present embodiment can specifically exist in the form of one-dimension array, such as the array
Can be using the confluence to path binary tree from top to bottom, order from left to right is stored in array：Tree root confluence
Numbering be 0, its left child confluence numbering is 1, and right child confluence numbering is 2, the left child's confluence in the confluence that numbering is 1
Point numbering is 3, and right child confluence numbering is 4, i.e. the numbering of the left child confluence for the confluence that numbering is i is 2i+1, right
The numbering of child confluence is 2i+2.At the same time can be stored in the array each confluence whether be leaf confluence mark letter
Breath, wherein leaf confluence correspond to and are in a last confluence in all confluences on a paths, it is used to represent this
The end of paths.
Any one path in step 102, path selection binary tree, and obtain the true value sequence of the corresponding constraints in path
Row.
Step 103, each constraint true value backward along in true value sequence negate, and obtain multiple path prefix.
Specifically, in step 102 and 103, due to including each confluence and path structure in the binary tree of path, from
Any one paths are chosen in the binary tree of path, and constraints analysis is carried out to the path to obtain the constraints in the path
True value sequence.Wherein, true value sequence is made of the one-dimension array of 0 and 1, and the constraint that each of which numeral represents is true
Value, i.e., true and false branch trend of the confluence under constraints on path.For example, any one fullpath is chosen,
Analyze it to obtain the true value sequence in the path<0,0,0>.
Then, each constraint true value backward along in true value sequence negates, and obtains multiple path prefix.With above-mentioned true value
Exemplified by sequence, the multiple path prefix obtained after negating are<0,0,1>,<0,1>,<1>.Wherein,<0,0,1>To be right<0,0,0>
Last constraint true value negate,<0,1>To be right<0,0,0>Constraint true value second from the bottom negate,<1>To be right<0,0,0>'s
Constraint true value third from the bottom negates.It is appreciated that these path prefix are not analyzed through overconstrained condition, i.e., before these paths
Sew not produce the prefix in path.
Step 104, determine the corresponding multiple predicted paths of each path prefix according to path binary tree, for before each path
Sew one thread of distribution, so as to be carried out at the same time route searching to multiple predicted paths.
Specifically, after multiple path prefix are obtained, each path prefix is directed to, it is corresponding multiple that its can be obtained
Predicted path, i.e., do not produce path.With path prefix<0,1>Exemplified by, according to the path structure in the binary tree of path, it can be obtained
Corresponding predicted path<0,1,0>,<0,1,1>.Similar, while can also obtain the predicted path of other path prefix.Then,
Path searching apparatus will be that each path prefix distributes a thread, be searched so as to path can be carried out at the same time to multiple predicted paths
Rope, that is, be directed to<0,0,1>,<0,1>,<1>These three path prefix, are respectively that each path prefix distributes a thread, with
Per thread is set to handle the track search task of the corresponding predicted path of a path prefix.
, can be in the unit interval by using the mode that parallel processing is carried out to the corresponding predicted path of multiple path prefix
It is interior it is as much as possible predicted path is handled, further, since path prefix is to the free routing in the binary tree of path
Each true value sequence negates acquisition respectively, is not in predicted path weight between the corresponding predicted path of each path prefix therefore
Folded situation, i.e. thread are that the first time that the path carries out is searched for the search that each predicted path carries out, and then into one
Step ensures the search efficiency and search coverage rate in path.
The present embodiment one provides the parallel route searching method of semiology analysis, by using the controlling stream graph to obtaining program
Stipulations processing is carried out, obtains the path binary tree of controlling stream graph；Any one path in path selection binary tree, and obtain path
The true value sequence of corresponding constraints；Negated along to each constraint true value backward in true value sequence, obtain multiple path prefix；
The corresponding multiple predicted paths of each path prefix are determined according to path binary tree, a thread is distributed for each path prefix,
In a manner of making to be carried out at the same time route searching to multiple predicted paths, so as to fulfill the parallel search to multiple paths, so as to have
Effect improves search efficiency, reduces search difficulty.
On the basis of above-described embodiment one, in order to further improve search efficiency, Fig. 2 is provided by Embodiment 2 of the present invention
A kind of flow diagram of the parallel route searching method of semiology analysis.
As shown in Fig. 2, the parallel route searching method of the semiology analysis includes：
Step 201, carry out stipulations processing to the controlling stream graph for obtaining program, obtains the path binary tree of controlling stream graph.
Any one path in step 202, path selection binary tree, and obtain the true value sequence of the corresponding constraints in path
Row.
Step 203, each constraint true value backward along in true value sequence negate, and obtain multiple path prefix.
Step 204, determine the corresponding multiple predicted paths of each path prefix according to path binary tree, for before each path
Sew one thread of distribution, so as to be carried out at the same time route searching to multiple predicted paths.
Step 205, judge whether the quantity of whole predicted paths is more than predetermined threshold value.
If so, then terminate to search for.If it is not, then perform step 206.
Step 206, using whole predicted paths as path prefix, and return to step 204.
It should be noted that with embodiment one similarly, the executive agent of the embodiment of the present invention two is concretely a kind of
The parallel route searcher of semiology analysis, it specifically can be by logic circuit, integrated chip, memory, processor and storage
The program composition run in device.
Specifically, the controlling stream graph of program is that single Procedure Codes object structure to be analyzed is obtained, it is one
The abstraction of a process or program, represents all paths that can be traversed in a program process.In general, its
The possibility flow direction that all branch confluences perform in a process is represented in graph form, can also reflect that the real-time of process is held
Row process.In above-mentioned steps, after the controlling stream graph of program is obtained, stipulations processing can be carried out to the controlling stream graph, to obtain
It must can be used for the path binary tree for representing controlling stream graph Zhong Ge branches confluence and path relation.
Preferably, in step 201, the corresponding Regularia of program structure can be determined according to the program structure of controlling stream graph
Type, and being handled according to reduction algorithm corresponding with protocol type program structure, wherein protocol type including single choice select type,
More options type and circular form.
The controlling stream graph of program is carried out stipulations processing by path searching apparatus, be mainly shown as in controlling stream graph it is several compared with
Stipulations processing is carried out for complicated situation, obtains path binary tree, to be carried out subsequently to implement parallel search to path binary tree
Prepare.
Single choice therein selects type and refers to the branch confluence on controlling stream graph carrying out replication processes, so as to be by in-degree
2 confluence is transformed to the confluence that two in-degrees are 1, and the branch confluence that in-degree is 1 can transform to his father confluence
Left child or right child confluence (being defaulted as left child's node)；More options type is referred to for out-degree present on controlling stream graph
Confluence more than 2, is converted to the confluence that multiple out-degree are equal to 2.The left child of two out-degree sides difference directive confluence
Confluence and right child confluence；More options type refers to circulation carrying out decyclization stipulations, removes the back edge of circulation, be converted to only
There is the situation of two injection arcs of true exit and false exit.
In addition, the path binary tree obtained in the present embodiment can specifically exist in the form of one-dimension array, such as the array
Can be using the confluence to path binary tree from top to bottom, order from left to right is stored in array：Tree root confluence
Numbering be 0, its left child confluence numbering is 1, and right child confluence numbering is 2, the left child's confluence in the confluence that numbering is 1
Point numbering is 3, and right child confluence numbering is 4, i.e. the numbering of the left child confluence for the confluence that numbering is i is 2i+1, right
The numbering of child confluence is 2i+2.At the same time can be stored in the array each confluence whether be leaf confluence mark letter
Breath, wherein leaf confluence correspond to and are in a last confluence in all confluences on a paths, it is used to represent this
The end of paths.
Due to including each confluence and path structure in the binary tree of path, any one road is chosen from the binary tree of path
Footpath, and constraints analysis is carried out to the path to obtain the true value sequence of the constraints in the path.Wherein, true value sequence by
0 and 1 one-dimension array composition, the constraint true value that each of which numeral represents, i.e., the confluence on path is in constraint bar
True and false branch trend under part.For example, any one fullpath is chosen, is analyzed it to obtain the true of the path
Value sequence<0,0,0>.
Then, each constraint true value backward along in true value sequence negates, and obtains multiple path prefix.With above-mentioned true value
Exemplified by sequence, the multiple path prefix obtained after negating are<0,0,1>,<0,1>,<1>.Wherein,<0,0,1>To be right<0,0,0>
Last constraint true value negate,<0,1>To be right<0,0,0>Constraint true value second from the bottom negate,<1>To be right<0,0,0>'s
Constraint true value third from the bottom negates.It is appreciated that these path prefix are not analyzed through overconstrained condition, i.e., before these paths
Sew not produce the prefix in path.
After multiple path prefix are obtained, each path prefix is directed to, its corresponding multiple predicted path can be obtained,
Do not produce path.With path prefix<0,1>Exemplified by, according to the path structure in the binary tree of path, it is corresponding pre- that its can be obtained
Survey path<0,1,0>,<0,1,1>.Similar, while can also obtain the predicted path of other path prefix.Then, route searching
Device will be that each path prefix distributes a thread, so as to route searching can be carried out at the same time to multiple predicted paths, that is, be directed to<
0,0,1>,<0,1>,<1>These three path prefix, are respectively that each path prefix distributes a thread, so that per thread
Handle the track search task of the corresponding predicted path of a path prefix.
What is different from the first embodiment is that the embodiment of the present invention two is further included to whether the quantity of whole predicted paths is more than
The judgement of predetermined threshold value, when the quantity of whole predicted paths is not more than predetermined threshold value, using whole predicted paths as road
Footpath prefix, and return to the step of corresponding multiple predicted paths of each path prefix are determined according to path binary tree.By using
The cycle criterion and circulation obtain the mode of path prefix, as far as possible more predicted paths can be obtained, so as to increase effectively road
Path search coverage rate.
Preferably, the corresponding multiple prediction roads of each path prefix can be determined in the following way in the present embodiment two
Footpath, to obtain different predicted path as much as possible：According to each path prefix and path binary tree, before obtaining each path
Sew corresponding fullpath；The constraint true value in the corresponding fullpath of each path prefix is negated according to preset rules, is obtained
Obtain the corresponding multiple predicted paths of each path prefix.
For example, if either path prefix includes P node, the corresponding fullpath of either path prefix includes
A nodes of P ', wherein P are less than P '；Correspondingly, according to preset rules to the constraint in the corresponding fullpath of either path prefix
True value negates, and obtains the corresponding multiple predicted paths of either path prefix, including：Fullpath corresponding to either path prefix
In the P node to the corresponding constraint true value of -1 node of P ' negate successively, obtain corresponding the P '-P of either path prefix
A predicted path.
In further example, in the present embodiment two, due to needing that the quantity of whole predicted paths is judged, because
This, can establish a task list Q, need the predicted path that scans for and according to the prediction in task list Q for storage
Path carries out thread distribution.Wherein, the nodal point number of path prefix 2, it is represented by<0,1>, obtained according to path binary tree
Any one nodal point number of the path prefix is the fullpath of 4, then, to the true value sequence of fullpath<0,1,1,1>
For, since the 2nd node, until the 3rd node carries out inversion operation respectively, and obtain 2 predicted paths<0,0>And
<0,1,0>, store into task list Q.
The present embodiment two, can by using the mode that parallel processing is carried out to the corresponding predicted path of multiple path prefix
It is as much as possible within the unit interval that predicted path is handled, further, since path prefix is in the binary tree of path
Each true value sequence of free routing negates acquisition respectively, therefore, is not between the corresponding predicted path of each path prefix
The overlapping situation of predicted path, i.e. thread are to search the first time carried out to the path to the search that each predicted path carries out
Rope, and then it is further ensured that the search efficiency and search coverage rate in path.
A kind of structure diagram of the parallel route searcher for semiology analysis that Fig. 3 embodiment of the present invention three provides.
As shown in figure 3, the parallel route searcher of the semiology analysis, including：
Stipulations processing module 10, for carrying out stipulations processing to the controlling stream graph for obtaining program, obtains the road of controlling stream graph
Footpath binary tree；
Parallel route search module 20, for any one path in path selection binary tree, and it is corresponding to obtain path
The true value sequence of constraints；Negated along to each constraint true value backward in true value sequence, obtain multiple path prefix；According to road
Footpath binary tree determines the corresponding multiple predicted paths of each path prefix, a thread is distributed for each path prefix, so that right
Multiple predicted paths are carried out at the same time route searching.
Optionally, parallel route search module 20, is specifically used for：Judge whether the quantity of the predicted path of whole is more than in advance
If threshold value；If it is not, then regard whole predicted paths as path prefix, and before return determines each path according to path binary tree
The step of sewing corresponding multiple predicted paths, until the quantity of whole predicted paths is more than predetermined threshold value.
Optionally, parallel route search module 20, is specifically used for：According to each path prefix and path binary tree, obtain
The corresponding fullpath of each path prefix；It is true to the constraint in the corresponding fullpath of each path prefix according to preset rules
Value negates, and obtains the corresponding multiple predicted paths of each path prefix.
Optionally, either path prefix includes P node, then it is a to include P ' for the corresponding fullpath of either path prefix
Node, wherein P are less than P '；
Correspondingly, parallel route search module 20, is specifically used for：To in the corresponding fullpath of either path prefix
P node to the corresponding constraint true value of -1 node of P ' negates successively, obtains corresponding the P '-P prediction of either path prefix
Path.
Optionally, stipulations processing module 10, are specifically used for：According to the program structure of controlling stream graph, program structure pair is determined
The protocol type answered, and program structure is handled according to reduction algorithm corresponding with protocol type；Wherein protocol type bag
Include single choice and select type, more options type and circular form.
It is apparent to those skilled in the art that for convenience and simplicity of description, the system of foregoing description
Specific work process and corresponding beneficial effect, may be referred to the corresponding process in preceding method embodiment, herein no longer
Repeat.
The parallel route searcher of semiology analysis provided by the invention, by using to obtain program controlling stream graph into
Professional etiquette is about handled, and obtains the path binary tree of controlling stream graph；Any one path in path selection binary tree, and obtain path pair
The true value sequence for the constraints answered；Negated along to each constraint true value backward in true value sequence, obtain multiple path prefix；Root
The corresponding multiple predicted paths of each path prefix are determined according to path binary tree, and a thread is distributed for each path prefix, with
Make the mode that multiple predicted paths are carried out at the same time with route searching, so as to fulfill the parallel search to multiple paths, so that effectively
Search efficiency is improved, reduces search difficulty.
One of ordinary skill in the art will appreciate that：Realizing all or part of step of above-mentioned each method embodiment can lead to
The relevant hardware of programmed instruction is crossed to complete.Foregoing program can be stored in a computer read/write memory medium.The journey
Sequence upon execution, execution the step of including above-mentioned each method embodiment；And foregoing storage medium includes：ROM, RAM, magnetic disc or
Person's CD etc. is various can be with the medium of store program codes.
Finally it should be noted that：The above embodiments are only used to illustrate the technical solution of the present invention., rather than its limitations；To the greatest extent
Pipe is described in detail the present invention with reference to foregoing embodiments, it will be understood by those of ordinary skill in the art that：Its according to
Can so modify to the technical solution described in foregoing embodiments, either to which part or all technical characteristic into
Row equivalent substitution；And these modifications or replacement, the essence of appropriate technical solution is departed from various embodiments of the present invention technology
The scope of scheme.
Claims (10)
- A kind of 1. parallel route searching method of semiology analysis, it is characterised in that including：Stipulations processing is carried out to the controlling stream graph for obtaining program, obtains the path binary tree of the controlling stream graph；Any one path in the path binary tree is chosen, and obtains the true value sequence of the corresponding constraints in the path；Negated along to each constraint true value backward in the true value sequence, obtain multiple path prefix；The corresponding multiple predicted paths of each path prefix are determined according to the path binary tree, for each path prefix distribution one A thread, so as to be carried out at the same time route searching to the multiple predicted path.
- 2. the parallel route searching method of semiology analysis according to claim 1, it is characterised in that described to the multiple Predicted path is carried out at the same time after route searching, is further included：Judge whether the quantity of the predicted path of whole is more than predetermined threshold value；If it is not, then using whole predicted path as path prefix, and return and described determined according to the path binary tree The step of each path prefix corresponding multiple predicted paths, until the quantity of whole predicted path is more than default threshold Value.
- 3. the parallel route searching method of semiology analysis according to claim 1, it is characterised in that described according to the road Footpath binary tree determines the corresponding multiple predicted paths of each path prefix, including：According to each path prefix and the path binary tree, the corresponding fullpath of each path prefix is obtained；The constraint true value in the corresponding fullpath of each path prefix is negated according to preset rules, is obtained described each The corresponding multiple predicted paths of path prefix.
- 4. the parallel route searching method of semiology analysis according to claim 3, it is characterised in that if either path prefix Include P node, then the corresponding fullpath of the either path prefix includes a nodes of P ', wherein the P is less than described P’；Correspondingly, the constraint true value in the corresponding fullpath of either path prefix is negated according to preset rules, described in acquisition The corresponding multiple predicted paths of either path prefix, including：To the P node in the corresponding fullpath of the either path prefix to the corresponding constraint true value of -1 node of P ' Negate successively, obtain corresponding the P '-P predicted path of either path prefix.
- 5. according to the parallel route searching method of claim 1-4 any one of them semiology analysis, it is characterised in that described right The controlling stream graph for obtaining program carries out stipulations processing, including：According to the program structure of the controlling stream graph, determine the corresponding protocol type of described program structure, and according to the rule The about corresponding reduction algorithm of type handles described program structure；Wherein described protocol type selects type, multiselect including single choice Select type and circular form.
- A kind of 6. parallel route searcher of semiology analysis, it is characterised in that including：Stipulations processing module, for carrying out stipulations processing to the controlling stream graph for obtaining program, obtains the path of the controlling stream graph Binary tree；Parallel route search module, for choosing any one path in the path binary tree, and obtains the path and corresponds to Constraints true value sequence；Negated along to each constraint true value backward in the true value sequence, obtain multiple path prefix； The corresponding multiple predicted paths of each path prefix are determined according to the path binary tree, a line is distributed for each path prefix Journey, so as to be carried out at the same time route searching to the multiple predicted path.
- 7. the parallel route searcher of semiology analysis according to claim 6, it is characterised in that the parallel route is searched Rope module, is specifically used for：Judge whether the quantity of the predicted path of whole is more than predetermined threshold value；If it is not, then using whole predicted path as path prefix, and return and described determined according to the path binary tree The step of each path prefix corresponding multiple predicted paths, until the quantity of whole predicted path is more than default threshold Value.
- 8. the parallel route searcher of semiology analysis according to claim 6, it is characterised in that the parallel route is searched Rope module, is specifically used for：According to each path prefix and the path binary tree, the corresponding fullpath of each path prefix is obtained；The constraint true value in the corresponding fullpath of each path prefix is negated according to preset rules, is obtained described each The corresponding multiple predicted paths of path prefix.
- 9. the parallel route searcher of semiology analysis according to claim 8, it is characterised in that in either path prefix Including P node, then the corresponding fullpath of the either path prefix includes a nodes of P ', wherein the P is less than the P '；Correspondingly, the parallel route search module, is specifically used for：To the P node in the corresponding fullpath of the either path prefix to the corresponding constraint true value of -1 node of P ' Negate successively, obtain corresponding the P '-P predicted path of either path prefix.
- 10. according to the parallel route searcher of claim 6-9 any one of them semiology analysis, it is characterised in that described Stipulations processing module, is specifically used for：According to the program structure of the controlling stream graph, determine the corresponding protocol type of described program structure, and according to the rule The about corresponding reduction algorithm of type handles described program structure；Wherein described protocol type selects type, multiselect including single choice Select type and circular form.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711423532.6A CN108021507B (en) | 2017-12-25 | 2017-12-25 | Parallel path searching method and device for symbol execution |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711423532.6A CN108021507B (en) | 2017-12-25 | 2017-12-25 | Parallel path searching method and device for symbol execution |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108021507A true CN108021507A (en) | 2018-05-11 |
| CN108021507B CN108021507B (en) | 2020-07-28 |
Family
ID=62070934
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711423532.6A Active CN108021507B (en) | 2017-12-25 | 2017-12-25 | Parallel path searching method and device for symbol execution |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108021507B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109189758A (en) * | 2018-07-26 | 2019-01-11 | 新华三技术有限公司 | O&M flow designing method, device and equipment, operation method, device and host |
| CN110059010A (en) * | 2019-04-12 | 2019-07-26 | 西北工业大学 | The buffer overflow detection method with fuzz testing is executed based on dynamic symbol |
| CN112100071A (en) * | 2020-09-16 | 2020-12-18 | 腾讯科技（深圳）有限公司 | Test case generation method and device, computer equipment and storage medium |
| CN113656280A (en) * | 2021-07-09 | 2021-11-16 | 中国科学院信息工程研究所 | Vulnerability exploitation point searching method and device based on symbolic execution |
| CN113688403A (en) * | 2021-10-26 | 2021-11-23 | 江苏通付盾科技有限公司 | Intelligent contract vulnerability detection method and device based on symbolic execution verification |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011078812A1 (en) * | 2009-12-22 | 2011-06-30 | Bazlamacci Cuneyt F | Systolic array architecture for fast ip lookup |
-
2017
- 2017-12-25 CN CN201711423532.6A patent/CN108021507B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011078812A1 (en) * | 2009-12-22 | 2011-06-30 | Bazlamacci Cuneyt F | Systolic array architecture for fast ip lookup |
Non-Patent Citations (3)
| Title |
|---|
| ANKUR PACHAURI 等: "Towards a parallel approach for test data generation for branch coverage with genetic algorithm using the extended path prefix strategy", 《INTERNATIONAL CONFERENCE ON COMPUTING FOR SUSTAINABLE GLOBAL DEVELOPMENT》 * |
| 朱敬茹 等: "一种基于GPU的危险路径并行提取方法", 《小型微型计算机系统》 * |
| 胡正国: "路径前缀测试策略的研究与实现", 《西北工业大学学报》 * |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109189758A (en) * | 2018-07-26 | 2019-01-11 | 新华三技术有限公司 | O&M flow designing method, device and equipment, operation method, device and host |
| CN109189758B (en) * | 2018-07-26 | 2021-02-09 | 新华三技术有限公司 | Operation and maintenance flow design method, device and equipment, operation method, device and host |
| CN110059010A (en) * | 2019-04-12 | 2019-07-26 | 西北工业大学 | The buffer overflow detection method with fuzz testing is executed based on dynamic symbol |
| CN110059010B (en) * | 2019-04-12 | 2023-01-31 | 西北工业大学 | Buffer overflow detection method based on dynamic symbol execution and fuzzy test |
| CN112100071A (en) * | 2020-09-16 | 2020-12-18 | 腾讯科技（深圳）有限公司 | Test case generation method and device, computer equipment and storage medium |
| CN112100071B (en) * | 2020-09-16 | 2022-03-18 | 腾讯科技（深圳）有限公司 | Test case generation method and device, computer equipment and storage medium |
| CN113656280A (en) * | 2021-07-09 | 2021-11-16 | 中国科学院信息工程研究所 | Vulnerability exploitation point searching method and device based on symbolic execution |
| CN113656280B (en) * | 2021-07-09 | 2024-04-05 | 中国科学院信息工程研究所 | Vulnerability exploitation point searching method and device based on symbol execution |
| CN113688403A (en) * | 2021-10-26 | 2021-11-23 | 江苏通付盾科技有限公司 | Intelligent contract vulnerability detection method and device based on symbolic execution verification |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108021507B (en) | 2020-07-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108021507A (en) | The parallel route searching method and device of semiology analysis | |
| CN104375942B (en) | Binary oriented hybrid fuzzing method | |
| Nayak et al. | Automatic Test Data Synthesis using UML Sequence Diagrams. | |
| US8108826B2 (en) | Code-coverage guided prioritized test generation | |
| CN105138335B (en) | A kind of function call path extraction method and device based on controlling stream graph | |
| CN104503917B (en) | Change domain of influence analysis method and system based on data flow function call path | |
| CN103116540A (en) | Dynamic symbol execution method and device based on global superblock domination graph | |
| Wagner et al. | CAGEN: A fast combinatorial test generation tool with support for constraints and higher-index arrays | |
| CN109189469A (en) | Android application micro services method and system based on reflection | |
| CN104503901A (en) | Guiding symbol execution method based on static path analysis | |
| Greitschus et al. | Loop invariants from counterexamples | |
| CN100559347C (en) | A kind of recognition methods of nested loop structure | |
| CN106462432B (en) | The method simplified for data relevant control stream | |
| US20050137839A1 (en) | Methods, apparatus and programs for system development | |
| Do et al. | Planning for compilation of a quantum algorithm for graph coloring | |
| Saifan | Test Case Reduction Using Data Mining Classifier Techniques. | |
| Slaby et al. | Compact symbolic execution | |
| Andriushchenko et al. | Search and explore: symbiotic policy synthesis in POMDPs | |
| CN104809067B (en) | Towards the method for generating test case and device of equality constraint | |
| CN110347570A (en) | A kind of Code automatic build tool analysis method under IDE environment | |
| CN107247663B (en) | Redundancy variant identification method | |
| Fakhouri et al. | Improved Path Testing Using Multi-Verse Optimization Algorithm and the Integration of Test Path Distance. | |
| Saumya et al. | Xstressor: Automatic generation of large-scale worst-case test inputs by inferring path conditions | |
| CN107391124B (en) | Conditional slicing method based on golden section search and software execution track | |
| CN110399284A (en) | A kind of test case writes and executes method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |