## 5 Evaluation
### Performance Overhead  
EtWExplorer is essentially a time-efficiency trade-off technology. In order to improve the path exploration capability of EtWExplorer, we introduce the abstract syntax tree analysis technique to assist us. The abstract syntax tree analysis technique is used to record and analyze the expressions generated by each executed basic block and match them with the unsatisfiable constraints of the \"unsat\" basic blocks. This affects the execution efficiency of the path exploration technique to some degree. Therefore, we illustrate how much performance overhead is introduced by EtWExplorer, which is based on abstract syntax tree analysis techniques, through this experiment.  
In order to better test the performance overhead introduced by EtWExplorer, we needed to make some limitations on the test program. We set the test program that did not cause a state space explosion. This was due to the fact that, in this experiment, we were more concerned with the execution efficiency of the program rather than the path exploration capability. Without causing a state space explosion, the path exploration capabilities of several path exploration techniques were approximately the same, we only needed to compare the time length of path exploration to obtain the performance overhead introduced by EtWExplorer. Therefore, we chose \"ffmpeg\", \"ffprobe\" in the ffmpeg and \"nm\", \"objcopy\", \"objdump\", \"readelf\", \"size\", \"strings\" in the binutils as the test program.  
In Figure 3, the x-axis represents the explore technology execution time in minutes, and the y-axis represents the number of states executed per second. The blue line represents the number of states executed per second of EtWExplorer, the red line bar represents the number of states executed per second of our coverage technique, the green line represents the number of states executed per second of Angr's Explorer technique, the pink line represents the number of states executed per second of the Lengthlimiter technique, and the black line represents the number of states executed per second of the Veritesing technique. We will make two notes here. First, the end times of different exploration techniques are not necessarily the same because of their different execution efficiencies and methods of deciding the completion of execution. Second, in some test programs (especially \"ffmpeg\", \"ffprobe\" in the ffmpeg), there are encode/decode operations, and symbolic executions of such concentrated data operations will seriously affect efficiency. This results in a situation where the execution is sometimes fast and sometimes slow during symbolic execution. Therefore, the path exploration performance of Veritesing performs weakly in the experiments.  
As we can see from the graph, EtWExplorer did not introduce significant performance overhead. In most programs, EtWExplorer's exploration capability is similar to that of other techniques. We believe that this is mainly due to the fact that EtWExplorer does not introduce a lot of abstract syntax tree analysis when the program does not cause a state space explosion. Therefore, no significant performance overhead was introduced.  
Finally, we calculated a mean value by adding up the results obtained from the eight tests. The execution efficiency (average number of state symbolic executions per second) ratio was the EtWExplorer technique:Coverage-based technique:Angr's Explorer technique:Lengthlimiter technique:Veritesting technique = 215:156:754:759:73. (Angr's Explorer's global control flow graphs are generated offline, while Veritesting's local control flow graphs were generated online, so there was a big difference in performance between the two techniques.) EtWExplorer introduced a performance overhead of 72% in the worst case and could improve performance by 294% in the best case. We can conclude that the performance overhead introduced by EtWExplorer was within a moderate and reasonable range.