Accelerating Symbolic Analysis for Android Apps

In the context of test data generation, symbolic execution gets more attention as computing power increases continuously. Experiments show that test generation tools based on symbolic execution can get high coverage and find bugs on real applications. However, symbolic execution still has limitations in handling some complex program structures such as pointers, arrays and library functions. To address the problem, this study proposes a technique called lazy symbolic execution, which combines symbolic execution with a lazy evaluation strategy. The authors approach is motivated by the observation that some program structures can be reasoned about symbolically and the others have to be evaluated concretely. Traditional symbolic execution can cope with the former well, whereas lazy symbolic evaluation is used to handle the latter. However, lazy symbolic evaluation introduces intermediate variables into path constraints. To eliminate those variables, concrete values for some input variables are first obtained by constraint solving or searching processes. Then, the given path is executed again using inputs consisting of concrete and symbolic values. The procedure is repeated until all intermediate variables are wiped out. The authors have implemented a prototype tool and performed some experiments. The empirical results show the effectiveness of their approach.

Recently, symbolic execution has been witnessed great success in applying symbolic execution to automatically generate high coverage test inputs for programs testing. While path explosion still a primary challenge in scaling concolic testing to large programs, meanwhile constraint solving is fundamental to concolic testing as a constraint solver is continuously invoked during analysis, while the main roadblock to performance of concolic testing engines is the time spent in constraint solving. To address this issue and achieve the purpose of selecting the path with simplest constraints to solve, this paper presents a new heuristic search strategy which determines the path priority based on the complexity of path constraints. We have implemented the strategy in angr, a binary-oriented concolic testing tools implemented by Shellphish, and evaluated this strategy on CTF binaries provided by famous institution. The results show that our strategy achieves significantly greater testing efficiency in larger programs while no apparent effect in minor programs.

Symbolic execution is emerging as a powerful technique for generating test inputs systematically to achieve exhaustive path coverage of a bounded depth. However, its practical use is often limited by path explosion because the number of paths of a program can be exponential in the number of branch conditions encountered during the execution. To mitigate the path explosion problem, we propose a new redundancy removal method called postconditioned symbolic execution. At each branching location, in addition to determine whether a particular branch is feasible as in traditional symbolic execution, our approach checks whether the branch is subsumed by previous explorations. This is enabled by summarizing previously explored paths by weakest precondition computations. Postconditioned symbolic execution can identify path suffixes shared by multiple runs and eliminate them during test generation when they are redundant. Pruning away such redundant paths can lead to a potentially exponential reduction in the number of explored paths. Since the new approach is computationally expensive, we also propose several heuristics to reduce its cost. We have implemented our method in the symbolic execution engine KLEE [1] and conducted experiments on a large set of programs from the GNU Coreutils suite. Our results confirm that redundancy due to common path suffix is both abundant and widespread in real-world applications.

In software security testing, fuzz testing and symbolic execution are two main testing techniques. Fuzz testing finds program bugs by executing the target program with random inputs it generates while monitoring the execution for abnormal behaviors. Though fuzz testing is able to explore deep into a program's state space efficiently, it usually cannot guarantee the code coverage ratio in many situations. Symbolic execution treats a program's input as symbols and executes the program with such symbolic input. Symbolic execution tries to explore the whole state space of a program by analyzing all of the program's paths. Symbolic execution always guarantees the code coverage ratio in theory, but for real programs it has many problems such as path explosion. Our new method, hybrid fuzz testing, combines the benefits of fuzz testing and symbolic execution. Symbolic execution will start to work and to generate new program input when fuzz testing cannot increase the code coverage ratio. The experiment result implies that our hybrid fuzz testing method can obviously increase the code coverage ratio efficiently in reasonable resources using.

Dynamic symbolic execution (DSE) has been proposed to effectively generate test inputs for real-world programs. Unfortunately, DSE techniques do not scale well for large realistic programs, because often the number of feasible execution paths of a program increases exponentially with the increase in the length of an execution path. In this paper, we propose MultiSE, a new technique for merging states incrementally during symbolic execution, without using auxiliary variables. The key idea of MultiSE is based on an alternative representation of the state, where we map each variable, including the program counter, to a set of guarded symbolic expressions called a value summary. MultiSE has several advantages over conventional DSE and conventional state merging techniques: value summaries enable sharing of symbolic expressions and path constraints along multiple paths and thus avoid redundant execution. MultiSE does not introduce auxiliary symbolic variables, which enables it to 1) make progress even when merging values not supported by the constraint solver, 2) avoid expensive constraint solver calls when resolving function calls and jumps, and 3) carry out most operations concretely. Moreover, MultiSE updates value summaries incrementally at every assignment instruction, which makes it unnecessary to identify the join points and to keep track of variables to merge at join points. We have implemented MultiSE for JavaScript programs in a publicly available open-source tool. Our evaluation of MultiSE on several programs shows that 1) value summaries are an eective technique to take advantage of the sharing of value along multiple execution path, that 2) MultiSE can run significantly faster than traditional dynamic symbolic execution and, 3) MultiSE saves a substantial number of state merges compared to conventional state-merging techniques.

Constraint solving is one of the main challenges for symbolic execution. Caching is an effective mechanism to reduce the number of the solver invocations in symbolic execution and is adopted by many mainstream symbolic execution engines. However, caching can not perform well on all programs. How to improve caching’s effectiveness is challenging in general. In this work, we propose a partial solution-based caching method for improving caching’s effectiveness. Our key idea is to utilize the partial solutions inside the constraint solving to generate more cache entries. A partial solution may satisfy other constraints of symbolic execution. Hence, our partial solution-based caching method naturally improves the rate of cache hits. We have implemented our method on two mainstream symbolic executors (KLEE and Symbolic PathFinder) and two SMT solvers (STP and Z3). The results of extensive experiments on real-world benchmarks demonstrate that our method effectively increases the number of the explored paths in symbolic execution. Our caching method achieves 1.07x to 2.3x speedups for exploring the same amount of paths on different benchmarks.

Background and aimsThe birth weight of a newborn is a crucial factor that affects their overall health and future well-being. Low birth weight (LBW) is a widespread global issue, which the World Health Organization defines as weighing less than 2,500 g. LBW can have severe negative consequences on an individual’s health, including neonatal mortality and various health concerns throughout their life. To address this problem, this study has been conducted using BDHS 2017–2018 data to uncover important aspects of LBW using a variety of machine learning (ML) approaches and to determine the best feature selection technique and best predictive ML model.MethodsTo pick out the key features, the Boruta algorithm and wrapper method were used. Logistic Regression (LR) used as traditional method and several machine learning classifiers were then used, including, DT (Decision Tree), SVM (Support Vector Machine), NB (Naïve Bayes), RF (Random Forest), XGBoost (eXtreme Gradient Boosting), and AdaBoost (Adaptive Boosting), to determine the best model for predicting LBW. The model’s performance was evaluated based on the specificity, sensitivity, accuracy, F1 score and AUC value.ResultsResult shows, Boruta algorithm identifies eleven significant features including respondent’s age, highest education level, educational attainment, wealth index, age at first birth, weight, height, BMI, age at first sexual intercourse, birth order number, and whether the child is a twin. Incorporating Boruta algorithm’s significant features, the performance of traditional LR and ML methods including DT, SVM, NB, RF, XGBoost, and AB were evaluated where LR, had a specificity, sensitivity, accuracy and F1 score of 0.85, 0.5, 85.15% and 0.915. While the ML methods DT, SVM, NB, RF, XGBoost, and AB model’s respective accuracy values were 85.35%, 85.15%, 84.54%, 81.18%, and 84.41%. Based on the specificity, sensitivity, accuracy, F1 score and AUC, RF (specificity = 0.99, sensitivity = 0.58, accuracy = 85.86%, F1 score = 0.9243, AUC = 0.549) outperformed the other methods. Both the classical (LR) and machine learning (ML) models’ performance has improved dramatically when important characteristics are extracted using the wrapper method. The LR method identified five significant features with a specificity, sensitivity, accuracy and F1 score of 0.87, 0.33, 87.12% and 0.9309. The region, whether the infant is a twin, and cesarean delivery were the three key features discovered by the DT and RF models, which were implemented using the wrapper technique. All three models had the identical F1 score of 0.9318. However, “child is twin” was recognized as a significant feature by the SVM, NB, and AB models, with an F1 score of 0.9315. Ultimately, with an F1 score of 0.9315, the XGBoost model recognized “child is twin” and “age at first sex” as relevant features. Random Forest again beat the other approaches in this instance.ConclusionsThe study reveals Wrapper method as the optimal feature selection technique. The ML method outperforms traditional methods, with Random Forest (RF) being the most effective predictive model for Low-Birth-Weight prediction. The study suggests that policymakers in Bangladesh can mitigate low birth weight newborns by considering identified risk factors.

Precise and timely leaf area index (LAI) estimation for winter wheat is crucial for precision agriculture. The emergence of high-resolution unmanned aerial vehicle (UAV) data and machine learning techniques offers a revolutionary approach for fine-scale estimation of wheat LAI at the low cost. While machine learning has proven valuable for LAI estimation, there are still model limitations and variations that impede accurate and efficient LAI inversion. This study explores the potential of classical machine learning models and deep learning model for estimating winter wheat LAI using multispectral images acquired by drones. Initially, the texture features and vegetation indices served as inputs for the partial least squares regression (PLSR) model and random forest (RF) model. Then, the ground-measured LAI data were combined to invert winter wheat LAI. In contrast, this study also employed a convolutional neural network (CNN) model that solely utilizes the cropped original image for LAI estimation. The results show that vegetation indices outperform the texture features in terms of correlation analysis with LAI and estimation accuracy. However, the highest accuracy is achieved by combining both vegetation indices and texture features to invert LAI in both conventional machine learning methods. Among the three models, the CNN approach yielded the highest LAI estimation accuracy (R 2 = 0.83), followed by the RF model (R 2 = 0.82), with the PLSR model exhibited the lowest accuracy (R 2 = 0.78). The spatial distribution and values of the estimated results for the RF and CNN models are similar, whereas the PLSR model differs significantly from the first two models. This study achieves rapid and accurate winter wheat LAI estimation using classical machine learning and deep learning methods. The findings can serve as a reference for real-time wheat growth monitoring and field management practices.

To determine whether texture analysis for magnetic resonance imaging (MRI) can predict recurrence in patients with breast cancer treated with neoadjuvant chemotherapy (NAC). This retrospective study included 130 women who received NAC and underwent subsequent surgery for breast cancer between January 2012 and August 2017. We assessed common features, including standard morphologic MRI features and clinicopathologic features. We used a commercial software and analyzed texture features from pretreatment and midtreatment MRI. A random forest (RF) method was performed to build a model for predicting recurrence. The diagnostic performance of this model for predicting recurrence was assessed and compared with those of five other machine learning classifiers using the Wald test. Of the 130 women, 21 (16.2%) developed recurrence at a median follow-up of 35.4 months. The RF classifier with common features including clinicopathologic and morphologic MRI features showed the lowest diagnostic performance (area under the receiver operating characteristic curve [AUC], 0.83). The texture analysis with the RF method showed the highest diagnostic performances for pretreatment T2-weighted images and midtreatment DWI and ADC maps showed better diagnostic performance than that of an analysis of common features (AUC, 0.94 vs. 0.83, p < 0.05). The RF model based on all sequences showed a better diagnostic performance for predicting recurrence than did the five other machine learning classifiers. Texture analysis using an RF model for pretreatment and midtreatment MRI may provide valuable prognostic information for predicting recurrence in patients with breast cancer treated with NAC and surgery. • RF model-based texture analysis showed a superior diagnostic performance than traditional MRI and clinicopathologic features (AUC, 0.94 vs.0.83, p < 0.05) for predicting recurrence in breast cancer after NAC. • Texture analysis using RF classifier showed the highest diagnostic performances (AUC, 0.94) for pretreatment T2-weighted images and midtreatment DWI and ADC maps. • RF model showed a better diagnostic performance for predicting recurrence than did the five other machine learning classifiers.

The classification model in machine learning has been employed to address different problems. Machine Learning classification is an effective method to realize customer churn prediction. This article provides a comparative study of machine learning from the perspective of predicting customer churn. Customer churn is one of the obstacles hindering the development of companies. Through classification approaches based on machine learning, customer churn can be predicted precisely, thus providing decision-making capabilities to these companies. Customer churn prediction is a typical classification problem and can be addressed by the use of a decision tree or random forest model. In this paper, decision tree and random forest models are employed to predict customer churn, using sales data provided by a chemical company from 2012 to 2020. We analyze the underlying risk of customer churn and the customer churn factors, including the low-priced count (LC), total amount of money (TM), and creation time (CT). The prediction results of the two models are evaluated by calculating various metrics. The experimental results indicate that the low-priced count (LC) is the most essential factor for customer churn. The results of the comparison, considering the training error and generalization error including: confusion matrix, ROC curve, AUC, precision, recall, and F1 score, reveal that the random forest model has better prediction accuracy than the decision tree model.

Previous studies have investigated predictive factors for parenting stress in caregivers of autism spectrum disorder (ASD) patients using traditional statistical approaches, but their study settings and results were inconsistent. Herein, this study aimed to identify major predictors for parenting stress in this population by developing explainable machine learning models. Study participants were collected from the Department of Child and Adolescent Psychiatry, Severance Hospital, Yonsei University College of Medicine, Seoul, the Republic of Korea between March 2016 and October 2020. A total of 36 model features were used, which include subscales of the Minnesota Multiphasic Personality Inventory-2 (MMPI-2) for caregivers' psychopathology, Social Responsiveness Scale-2 for core symptoms, and Child Behavior Checklist (CBCL) for behavioral problems. Machine learning classifiers [eXtreme Gradient Boosting (XGBoost), random forest (RF), logistic regression, and support vector machine (SVM) classifier] were generated to predict severe total parenting stress and its subscales (parental distress, parent-child dysfunctional interaction, and difficult child). Model performance was assessed by area under the receiver operating curve (AUC), sensitivity, specificity, accuracy, positive predictive value, and negative predictive value. We utilized the SHapley Additive exPlanations tree explainer to investigate major predictors. A total of 496 participants were included [mean age of ASD patients 6.39 (SD 2.24); 413 men (83.3%)]. The best-performing models achieved an AUC of 0.831 (RF model; 95% CI 0.740-0.910) for parental distress, 0.814 (SVM model; 95% CI 0.720-0.896) for parent-child dysfunctional interaction, 0.813 (RF model; 95% CI 0.724-0.891) for difficult child, and 0.862 (RF model; 95% CI 0.783-0.930) for total parenting stress on the test set. For the total parenting stress, ASD patients' aggressive behavior and anxious/depressed, and caregivers' depression, social introversion, and psychasthenia were the top 5 leading predictors. By using explainable machine learning models (XGBoost and RF), we investigated major predictors for each subscale of the parenting stress index in caregivers of ASD patients. Identified predictors for parenting stress in this population might help alert clinicians whether a caregiver is at a high risk of experiencing severe parenting stress and if so, providing timely interventions, which could eventually improve the treatment outcome for ASD patients.

aSymbolic execution is an important software analysis technique, but it faces challenges such as path explosion, which leads to a reduction in efficiency. Existing path exploration strategies, such as Random State Search, typically exhibit poor adaptability to real-world programs and lack effective path selection strategies. To address these challenges, this paper proposes a Transfer Learning-based Symbolic Execution Path Exploration Strategy, TLS (Transfer Learning Search). We adopt a transfer learning method based on functional classification to optimize existing symbolic execution strategies. Specifically, real-world programs are classified according to their functional characteristics, and transfer learning is applied by freezing partial layers of existing neural networks with training sets from each program family that better reflect its features. Multiple models are trained based on different training sets to adapt to various program families. Experimental results show that this strategy solves the problem of insufficient training data for real-world programs. Compared to traditional heuristic methods such as random-path (rps) and random-state (rss) strategies, this approach significantly improves instruction coverage and branch coverage on specific program families. For example, in the Grep program test, branch coverage increased by approximately fifteen percentage points, generating more test cases. This approach provides a new and effective solution to the adaptability problem of symbolic execution for complex programs.

In recent years, COVID-19 has been regarded as the most dangerous pandemic for several countries. On various social media platforms, such as Twitter, Facebook, and Instagram, a variety of rumours, hypes, and news are published. This might have a detrimental impact on people’s life. As a result, social media platforms have always had a difficult time authenticating this fake information. Different machine learning (ML) and deep learning (DL) classifiers were used in this work to categorize the continuing impacts of tweets and forecast their after-effects. Support vector machine (SVM), random forest (RF), decision tree (DT), and k-nearest neighbor (KNN) were used for classification, while AdaBoost and convolutional neural network (CNN) were utilized for future effects. The tweets dataset from Kaggle was used to train the SVM, RF, KNN, and DT models, which were then assessed on multiple evaluation criteria such as accuracy, precision, recall, and F1-score, using a 70 : 30 ratio. The CNN and AdaBoost, on the other hand, have been taught to detect the mean square error, root mean square error, and mean absolute error. With 0.74 and 0.73 percent score out of 1, respectively, RF and SVM exhibit the best accuracy in impact when classifying the outcomes on the obtained dataset. In terms of a regression problem, CNN beat the ADA Regressor across the board.

Three machine learning classifiers: random forest, decision tree and support vector machine were used to build predictive models of an anti-mycobacterial ChEMBL database and evaluated for their predictive capability. Before the development of predictive models, data pre-processing was carried out to fix the class imbalance problem by applying cost-sensitive classifier, and filtration of data instance by supervised synthetic minority oversampling technique (SMOTE), spread subsample and resample method. The statistical evaluation indicated that random forest model was the best model as it showed the best accuracy 93.83%, specificity 90.5%, receiver operating characteristic (ROC) 0.984, MCC 0.772 and kappa statistics 0.768 in comparison to other models whereas LibSVM showed the highest sensitivity 94.4% compared with others. Additionally, toxicity predictive models based on SingleCellcall DSSTox carcinogenicity database (AID1189) was developed which resulted in random forest model as the best model. The deployment of both RF predictive models on two unknown datasets resulted in 1317 compounds out of 1554 approved drugs and 2234 compounds out of 18,746 ChEMBL anti-malarial dataset as non-toxic and anti-mycobacterial compounds. Thus machine learning models present highly efficient methods to find out novel hit anti-mycobacterial compounds. We suggest that such machine learning techniques could be very useful to screen drug candidates not only for tuberculosis but also for other diseases.

Development of prediction model to estimate future risk of ovarian lesions: A multi-center retrospective study