Symbolic execution search strategy based on Katz centrality analysis

When there are a large number of branch structures in the program, the path explosion problem will occur in symbolic execution. Because the path space is too large, all paths cannot be executed one by one, resulting in low coverage. The path with higher priority execution coverage can improve the symbolic execution coverage. Therefore, this paper proposes a path search strategy based on graph centrality analysis. By constructing a code coverage-oriented Katz path graph, and using Katz centrality score to calculate the node's centrality score, path priority is determined according to the node's centrality score. This strategy can prioritize the exploration of important paths and improve the efficiency of path selection, thus alleviating the problem of path explosion and improving code coverage. The experimental results show that compared with the existing search strategy, this strategy can explore more paths, and the coverage rate is improved by 15.7% on average.