# An Approach for Detecting Feasible Paths Based on Minimal SSA Representation and Symbolic Execution
## 4 Detection Methodology
### Avoid Duplicated Feasible Paths
It should be noted that the 10 programs consist of a number of strings or pure numerical comparison branches, which belong to data types that can be solved by a constraint solver. Therefore, it is possible to detect a good number of feasible paths using the proposed approach. With regard to the program, i.e., Gallery (a web application allowing users to publish and organize photos in albums), although it contains a large number of branches, the proportion of the constraints that could be solved was not high, owing to the limitations of the constraint solver. Therefore, the proposed approach only detected 2116 paths among the 3093 branches in the Gallery program. In addition, among the analyses of the 10 programs, it was noted that the proposed approach failed to analyze the built-in WordPress functions, i.e., add_action (\"list_menu\", function_name), which is \begin{table}
\begin{tabular}{l c c c c} \hline \hline \multirow{2}{*}{**Program**} & \multicolumn{2}{c}{**KLEE**} & \multicolumn{2}{c}{**Our Approach**} \\ \cline{2-5}  & **\#I** & **T(s)** & **\#I** & **T(s)** \\ \hline eR1985 & 66 & 0.014 & 53 & 0.007 \\ fcB2002 & 70 & 0.007 & 55 & 0.006 \\ gA2008 & 52 & 0.009 & 41 & 0.004 \\ rA2008 & 52 & 0.005 & 39 & 0.004 \\ tA2008 & 92 & 0.016 & 73 & 0.012 \\ tM2004 & 53 & 0.004 & 49 & 0.003 \\ ttB2002 & 190 & 0.433 & 155 & 0.293 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of KLEE (using SSA) and the proposed approach’s (using minimal SSA) times for generating paths among the test programs. quite challenging when it comes to our approach, since it requires an understanding of the built structure of that function in WordPress that can be traversed and analyzed. On the other hand, if a path is found to possess the same weight as a previous path that has been detected as a feasible path, it is considered a duplicated path. The proposed approach avoided 67,790 duplicated feasible paths (#DFD) among the 10 programs, all which were detected previously as feasible paths. The time required to analyze the instructions and to generate the paths was different in each program based on the number of instructions and conditions that were analyzed. Since no study has thus far been conducted to detect the feasible paths in PHP, we followed the methods of various studies [17; 63; 64; 65; 66] to validate the large-scale results by randomly selecting 50 feasible paths from each plugin (detected by the proposed approach) and checking manually whether any of them were duplicated. Table 7 shows the results when checking for duplications in the detected feasible paths out of the 50 paths that were chosen randomly from each plugin. The first column (program) shows the plugin name, the second column (#FP) shows the number of paths that were chosen randomly for testing, and the third column (#DFP) shows the number of duplicated paths out of the 50 chosen paths. The chosen feasible paths in Table 7 were analyzed and we checked whether any duplication existed with the detected feasible paths (i.e., the validation of these paths was implemented by utilizing inputs from Z3 Solver to ensure the feasibility of the path). It can be noted that our work successfully accomplished our objective of to producing no duplications in each presented program. This indicates that the proposed work was evaluated accordingly. A sample of the results is shown in Appendix A (test case of Peruggia). ## 6 Threats to Validity

While this research demonstrates the effects of minimal SSA representation and avoids duplicated paths in the generation of feasible paths, threats to the validity of certain results