Leveraging Large Language Models and Expert Techniques for Path Selection

Abstract

Although symbolic execution is a powerful tool for vulnerability analysis, it is frequently hampered by the path explosion issue. Previous attempts to reduce the search space caused by path explosion have focused on pruning infeasible paths and comparing states. Machine learning has also been used to train a model to prune the search space of states. The rise of generalized Large Language Models (LLMs) provides an opportunity to avoid this cumbersome training process. LLMs have been shown to be very effective in the field of code analysis. This paper demonstrates a technique to use LLMs, paired with techniques derived from observing human experts, in order to perform effective symbolic execution by using path selection. This paper creates a framework to integrate an LLM with a symbolic execution process and measures its effects compared to an existing symbolic execution engine, angr. The results show that the LLM performs equivalent to or better compared to existing methods when comparing the number of logical branches taken. By demonstrating this approach’s effectiveness, this paper opens an opportunity for further expansion of the usage of LLMs within symbolic execution.