Formal methods and testing are two important approaches that assist in the development of
high-quality software. While traditionally these approaches have been seen as rivals, in …

During the last 10 years, code inspection for standard programming errors has largely been
automated with static code analysis. During the next 10 years, we expect to see similar …

We present a new symbolic execution tool, KLEE, capable of automatically generating tests
that achieve high coverage on a diverse set of complex and environmentally-intensive …

This paper describes GenProg, an automated method for repairing defects in off-the-shelf,
legacy programs without formal specifications, program annotations, or special coding …

A few billion lines of code later Page 1 66 communicAtions of the Acm | FeBrUAry 2010 | vOl.
53 | nO. 2 contributed articles In 2002, COVErITY commercialized3 a research static bug-finding …

This article presents EXE, an effective bug-finding tool that automatically generates inputs
that crash real code. Instead of running code on manually or randomly constructed input …

Software bugs are a well-known source of security vulnerabilities. One technique for finding
bugs, symbolic execution, considers all possible inputs to a program but suffers from …

Software development and maintenance are costly endeavors. The cost can be reduced if
more software defects are detected earlier in the development cycle. This paper introduces …

A malware detector is a system that attempts to determine whether a program has malicious
intent. In order to evade detection, malware writers (hackers) frequently use obfuscation to …

A decision procedure is an algorithm that, given a decision problem, terminates with a
correct yes/no answer. In this book, we focus on decision procedures for decidable first …