## 5 Evaluation
### Path Exploration Capability Improvement  
After analyzing the performance overhead and the effectiveness of state space explosion mitigation by EtWExplorer's abstract syntax tree analysis technique. The core goal of EtWExplorer is to explore more paths during the symbolic execution. If EtWExplorer's multi-priority scheduling technique based on abstract syntax tree analysis causes a loss of path exploration capability. Then the previous performance tests and state space explosion mitigation will become meaningless. Therefore, whether EtWExplorer does not lose the accuracy of path exploration with multi-priority scheduling and pruning of states in symbolic execution is the third question we want to test. Here, we use the same test program as in Section 5.2.  
In Figures 5 and 6, the x-axis represents the explore technology execution time in minutes, and the y-axis represents the number of basic blocks found (Figure 5) and edges found (Figure 6). The meaning represented by the lines of each color in the figure is the same as in Figure 3. We will make one note here. Since Veritesting requires the construction of a local control flow graph, the precise local control flow graph is difficult to be constructed. Therefore, the path exploration performance of Veritesting performs weakly in the experiments.  
Figure 5: Improvements in path exploration capability (block coverage) when exploring programs that cause state space explosions.  
As we can see from the graphs, many exploration techniques exit just at the beginning of the test due to the state space explosion which we tested in Section 5.2. When there is a state space explosion, the symbolic execution engine needs to perform symbolic execution for each state, which severely affects the efficiency of symbolic execution and thus makes it difficult to discover new paths. At the same time, the large amount of state space leads to an increase in memory usage. Then the memory usage reaches the 20 GB we set, the symbolic execution will exit directly. Therefore, in this experiment, not all path exploration techniques end at the same time. Path exploration is also constrained by memory usage.  
Finally, we calculated a mean value by adding up the results obtained from the six procedures. The path exploration capability (number of unique basic blocks found) ratio is the EtWExplorer technique: Coverage-based technique: Angr's Explorer technique: Length-limiter technique: Veritesting technique = 2489: 1246: 921: 921: 253. The path exploration capability (Number of unique edges found) ratio is EtWExplorer technique:Coverage-based technique:Angr's Explorer technique:Lengthlimiter technique:Veritesting technique = 2984:1643:1111:1111:285. EtWExplorer has a 199% to 983% improvement in the path exploration capability of block coverage and a 181% to 1047% improvement in path exploration capability of edge coverage. We can find a significant improvement in EtWExplorer's path exploration capability in programs that would cause a state space explosion.  
In summary, EtWExplorer can significantly improve the path exploration capability of symbolic execution techniques in programs that cause path explosion while introducing an acceptable range of performance overhead. This has an important meaning in vulnerability discovery.