Symbolic Execution and Quantitative Reasoning: Applications to Software Safety and Security

Software failures often hide in the space between what a developer expected and what the code actually allows. Symbolic Execution and Quantitative Reasoning: Applications to Software Safety and Security takes that observation seriously and shows how systematic program analysis can expose behavior that conventional testing may miss.

Corina S. Păsăreanu presents symbolic execution as a technique for exploring many program behaviors simultaneously by collecting and solving symbolic constraints from branching conditions. The result is a set of inputs that exercise feasible paths through the program, giving developers a way to reason about possible execution states rather than relying only on handcrafted test cases.

Why Symbolic Execution Matters 💻

Rather than running one input at a time, symbolic execution builds a logical model of what the program could do. Every branch becomes a constraint, and solving those constraints reveals which inputs will drive execution down a particular path. This can uncover subtle errors in security-sensitive code, mobile applications, operating systems, databases, and even deep neural networks.

The book also extends the technique in a practical direction: algorithmic complexity and resource consumption. By analyzing how execution paths relate to input structure, the approach can help reason about performance as well as correctness.

From Symbolic Paths to Probabilities

A central contribution of the lecture is the move from “can this path happen?” to “how likely is it?” Probabilistic symbolic execution uses model counting to compute the fraction of the input domain that reaches target events. That turns the technique into a tool for quantitative reasoning.

For example, the book illustrates reliability analysis for an aircraft controller under varying wind conditions modeled probabilistically. The same machinery supports quantitative information flow analysis, where leakage of sensitive data can be measured using information theory metrics such as Shannon entropy.

Applications in Safety and Security

• Reliability analysis: estimate the probability of reaching critical states under uncertain or probabilistic conditions.
• Side-channel analysis: quantify information leakage and synthesize attacks that exploit observable behavior.
• Complexity analysis: connect symbolic execution to resource consumption and algorithmic performance.
• Model counting for data structures: reason about the space of possible data values and configurations.

Who This Book Helps

The material is designed for students and software engineers interested in advanced testing and verification techniques. Some familiarity with programming and basic logic will make the ideas more accessible, but the lecture format keeps the discussion focused and self-contained.

Inside the Lecture

The book begins with the basics of symbolic execution, including handling loops, dynamic symbolic execution, and structured input. It then introduces symbolic complexity analysis before moving into probabilistic reasoning, software reliability, grey paths, reliability analysis for the onboard abort executive, and model counting for data structures. Later chapters cover side-channel analysis, quantitative information flow, attack synthesis, multi-run analysis, and the effect of multi-threading, concluding with directions for future work.

This is a research-focused lecture that goes beyond introductory testing material and gives readers a clear view of how symbolic and probabilistic techniques can strengthen software safety and security.