Automatically discover vulnerability through similar functions

In this paper a new vulnerability discovery method based on symbolic execution and machine learning is proposed. Given a vulnerable function, similar function set can be located efficiently based on machine learning technique. Function call graphs of each function from the similar function set are obtained by dataflow analysis of the whole program. At last, the symbolic execution engine KLEE is used to travel certain paths of the tested program according to the function call graphs obtained. With the help of the function call graphs, KLEE has no need to travel all of the program paths that can absolutely increase the efficiency of symbolic execution. Upon the dual effect of machine learning and symbolic execution, the method proposed is more efficient than solely using symbolic execution and is more precise than solely using machine learning.