Binary-level Directed Symbolic Execution Through Pattern Learning

Directed symbolic execution is an effective technique that tests specific parts of programs. It is widely used in various security tasks, for instance, patch testing, bug reproduction, and static report verification. However, existing works perform at the source level, while few works focus on the binary level as source codes of the security-critical program are not always available. In addition, current techniques at the source level migrating to the binary level introduce excessive overhead, thus exacerbating the scalability issues inherent in symbolic execution. In this paper, we propose a data-driven approach to enhance the efficiency of state selection strategies in binary-level directed symbolic execution, named DSyML. We leverage the supervised machine learning technique to learn how to approach target sites from the analysis of vulnerable paths to targets. Given a target site, we utilize the machine learning model to guide symbolic execution toward the specific target, generating an input that exercises the target. We evaluated DSyML on the Cyber Grand Challenge (CGC) dataset, which is a famous dataset containing abundant vulnerable programs. The experimental results demonstrate that DSyML outperforms both directed heuristic strategy(Director) and undirected data-driven strategy(SyML) in the majority of cases. DSyML triggered 6 more vulnerabilities than Director, 4 faster out of 5 vulnerabilities triggered together. In addition, out of 11 vulnerabilities for a given target, DSyML triggered 9 of them faster than SyML.