Evaluation and analysis of concolic execution optimizations in hybrid fuzzing

Aiming at the problem that the traditional hybrid fuzzy test promotion technology focuses more on the use of multiple dynamic and static analysis methods to assist and ignores the performance of concolic execution, a hybrid fuzzing balance-point model was proposed. Based on the model, the popular concolic execution tools were analyzed, including taint-assist fuzzing, hybrid fuzzing and concolic execution, and 6 symbol execution schemes were summarized. Based on the hybrid symbol execution engine Triton, 6 symbol execution schemes were reproduced, and tested and evaluated through 10 typical real programs. Performance comparison and impact factor analysis of each scheme were conducted from three dimensions of efficiency, memory consumption and coverage. Experiment results show that all of the optimization patterns can basically reduce the unnecessary constraints and thus reduce time and space consumption. However, the reduction of constraints can cause information loss and lead to coverage decrease. Based on the analysis of experimental data, the performance sequence of an optimization scheme was proposed, and three optimization schemes for different test requirements were proposed.