## 2 Background
### Path Exploration Technique  
Existing path exploration techniques are often a component of symbolic execution tools. On the one hand, more research has focused on improving the performance of symbolic execution tools and neglected the study of path exploration. The mainstream research directions of symbolic execution at this stage will be detailed in Section 7. On the other hand, the change in the positioning of symbolic execution in the vulnerability discovery domain has led to the fact that symbolic execution is no longer used as a single tool to perform vulnerability discovery. It often appears in the role of a fuzzing assistant tool in vulnerability discovery. As a result, the concolic execution [7], which focuses the analysis target on the concrete input (generated in the fuzzing phase) and does not generate a state space explosion, has become the dominant research direction for symbolic execution. This has led to a serious shortage of current research in the area of path exploration. However, the concolic execution can only fetch program paths around the path to which the concrete input is executed, which essentially limits the path exploration capability of the symbolic execution. The shortage of symbolic execution due to its ability to face the state space explosion has led to a change in its application positioning and the change in application positioning has led to a little study of path exploration techniques for symbolic execution at this stage.  
At this stage, a part of the commonly used path exploration techniques originates from the traditional tree search algorithm. This is due to the fact that the execution of the program is a process of searching from the root node (entry point) to the leaf node (exit point) of the binary tree. Each branch of the program is a node of the binary tree (except for the leaf nodes). Therefore, the traditional tree search algorithm is the most common type of path exploration technique.  
Another class of path exploration techniques oriented to symbolic execution often require the assistance of control flow graphs (CFG) to explore the paths in a program effectively. Angr [8] proposes a path exploration technique that enhances the path exploration ability with the help of control flow graphs generated by Angr. Veritesting [9] avoids state space explosion by constructing a local CFG, finding a specific node in the CFG, and directing the symbolic execution to the target location. These two path exploration techniques allow for more efficient discovery of paths in programs based on CFGs. However, both techniques require precise CFGs. Even the emulated CFG implemented in Angr is not sufficient to support its exploration technique. Veritesting generates a local CFG and is not able to analyze the CFG accurately in the face of some unknown nodes and system calls. Therefore, such CFG-based path exploration techniques are difficult to really solve the state space explosion problem in real-world programs.  
There is also a class of path exploration techniques that require manual assistance to enhance the path exploration capabilities of symbolic execution. Manual merge point technology is one of these. It is done by manually marking an address in the program as a merge point, so states that reach that address will be briefly held, and any other states that reach that same point before timeout will be merged. This requires researchers to have an extremely deep knowledge of the program in order to set the merge point accurately. This deep knowledge is difficult to achieve. Even if the merge point is set accurately, the excessive merging of programs during dynamic execution is likely to lead to a loss of symbolic execution path exploration capability.  
Therefore, this paper proposes a multi-priority scheduling method based on abstract syntax tree analysis to mitigate the state space explosion problem in path exploration of symbolic execution.