# An Approach for Detecting Feasible Paths Based on Minimal SSA Representation and Symbolic Execution
## 4 Detection Methodology
### Avoid Duplicated Feasible Paths
\begin{table}
\begin{tabular}{l l l l l l l l l} \hline \hline
**Program** & **Version** & **Files** & **LoC** & **\#I** & **\#B** & **\#FD** & **\#DFD** & **T(s)** \\ \hline Peruggia & 1.1 & 10 & 659 & 3664 & 59 & 235 & 462 & 1.86 \\ Measureit & 1.14 & 2 & 826 & 3939 & 34 & 158 & 79 & 0.97 \\ Zipec & 0.32 & 10 & 1160 & 2458 & 126 & 424 & 319 & 2.58 \\ PHPLib & 7.4 & 75 & 13,053 & 42,192 & 324 & 694 & 706 & 4.94 \\ Getboo & 1.04 & 160 & 21,318 & 119,526 & 1776 & 2977 & 1223 & 9.28 \\ WordPress & 2.0 & 215 & 30,147 & 205,816 & 3198 & 7345 & 4383 & 17.49 \\ Gallery & 2 & 586 & 83,787 & 184,533 & 3093 & 2116 & 1744 & 12.41 \\ NeoBill & 0.9 & 620 & 100,139 & 249,820 & 3365 & 11,740 & 9583 & 31.75 \\ Phpmyadmin & 2.6.3 & 287 & 143,171 & 625,406 & 2229 & 29,815 & 11,462 & 59.92 \\ TikiWiki & 21.4 & 1563 & 499,315 & 2,211,879 & 30,243 & 97,165 & 37,829 & 504.86 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Summary of running the proposed approach with open source applications. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Program** & **\#FP** & **\#DFP** \\ \hline Peruggia & 50 & No duplication \\ Measureit & 50 & No duplication \\ Zipec & 50 & No duplication \\ PHPLib & 50 & No duplication \\ Getboo & 50 & No duplication \\ WordPress & 50 & No duplication \\ Gallery & 50 & No duplication \\ NeoBill & 50 & No duplication \\ Phpmyadmin & 50 & No duplication \\ TikiWiki & 50 & No duplication \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Manually validation of 50 detected feasible paths. remain that the reader should account for when interpreting any outcomes. These threats comprise internal, external, and construct validities, and this section clarifies such problems regarding valid study results. ### Internal Validity

Internal validity threats concern mostly uncontrolled factors that can influence experimental results. The key internal validity threat here lies in probable faults arising in the execution of our strategy. To mitigate this problem, we reviewed our experimental scripts for different feasible path scenarios and cases to ensure correctness before carrying out all experiments. ### Construct Validity

Threats to construct validity mainly involve the relationship between observation and theory, which arise mostly in regard to how performance is measured for the proposed method of generating feasible paths. Test programs were chosen for the evaluation. Moreover, the performance for each feasible path generation strategy was compared via objective metrics such as the amounts of feasible and duplicated paths detected and the time needed for generation. ### External Validity

External validity involves the generalizability of the research findings. Could our approach be implemented with alternative languages effectively? The results indicate that reducing the number of instructions in the SSA form helps decrease the time required to generate the paths. In addition, the proposed method for avoiding duplicated paths has proven its efficiency in avoiding the detection of duplicated paths. In the future, we intend to experiment with various applications written in different languages, which entails creating a minimal SSA form in such languages. Then, the approach could be generalized to several other languages. The proposed approach in PHP was compared with C-based approaches, where the number of feasible paths and duplicate paths are the same in both languages. The programming language used to write the 7 test programs does not affect the results of the programs because the target paths are based on the control flow graph; thus, the program does not have a specific statement related to one programming language [43]. However, it would have been better to test the time spent on implementing the paths in each language using the same programming language. The algorithm created by [PERSON] et al. [11] was previously compared with that of [PERSON] et al. [32], and the results indicated that a non-optimized implementation of the algorithm of [PERSON] et al. [11] is somewhat faster than [PERSON] et al.