Demonstration venue · read-only. Every page can be browsed; the buttons that would change it are switched off. Create an account to run TaxoReview on your own data. A simulation from public publication records: the people listed were not invited and did not agree to review.
? Tutorial for this page

Shuangjie Yao

dblp:407/7514 · DBLP profile ↗
← Back
2ranked-venue papers
1as first author
2since 2021 · last 2026
—ORCID · none

Domains — the database's venue-derived domains; a paper can count in several

Systems, architecture and hardware · 1 · 1 since 2021Security and privacy · 1 · 1 first-author · 1 since 2021

Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.

Software engineering, system software, and programming languages
1 paper
Program analysis · 67% Software testing · 33%

Topics — the 3 heaviest of 3, each with the papers that count most for it

TopicWeightPapersLastEvidence papers
Program analysis › symbolic execution
path explosion
0.912025
Empc: Effective Path Prioritization for Symbolic Execution with Path Cover · SP 2025
Software testing › test optimization
path prioritization
0.912025
Empc: Effective Path Prioritization for Symbolic Execution with Path Cover · SP 2025
Program analysis
symbolic execution
0.912025
Empc: Effective Path Prioritization for Symbolic Execution with Path Cover · SP 2025

Methods — techniques the papers use, named apart from their topics

path cover · 0.9minimum path cover · 0.9
YearPublicationVenuePosition
2026 TArCS: Trusted and Attack-Resilient Clock Source with TEE and RDMA
Yunpeng Xu, Yu Jin 0010, Shuangjie Yao, Teng Ma 0006, Shuwen Deng
APPT4
2025 Empc: Effective Path Prioritization for Symbolic Execution with Path Cover
abstract
Symbolic execution is a powerful program analysis technique that can formally reason the correctness of program behaviors and detect software bugs. It can systematically explore the execution paths of the tested program. But it suffers from an inherent limitation: path explosion. Path explosion occurs when symbolic execution encounters an overwhelming number (exponential to the program size) of paths that need to be symbolically reasoned. It severely impacts the scalability and performance of symbolic execution. To tackle this problem, previous works leverage various heuristics to prioritize paths for symbolic execution. They rank the exponential number of paths using static rules or heuristics and explore the paths with the highest rank. However, in practice, these works often fail to generalize to diverse programs. In this work, we propose a novel and effective path prioritization technique with path cover, named Empc. Our key insight is that not all paths need to be symbolically reasoned. Unlike traditional path prioritization, our approach leverages a small subset of paths as a minimum path cover (MPC) that can cover all code regions of the tested programs. To encourage diversity in path prioritization, we compute multiple MPCs. We then guide the search for symbolic execution on the small number of paths inside multiple MPCs rather than the exponential number of paths. We implement our technique Empc based on KLEE. We conduct a comprehensive evaluation of Empc to investigate its performance in code coverage, bug findings, and runtime overhead. The evaluation shows that Empc can cover 19.6% more basic blocks than KLEE's best search strategy and 24.4% more lines compared to the state-of-the-art work cgs. Empc also finds 24 more security violations than KLEE's best search strategy. Meanwhile, Empc can significantly reduce the memory usage of KLEE by up to 93.5% and reduce the number of symbolic states by up to 88.6%.
Shuangjie Yao, Dongdong She
SP1