一句话:提出 PPT4J,用于判断 Java 二进制是否已应用指定补丁,并指出从补丁提取准确语义信息是关键挑战。
开源软件漏洞与安全补丁数量持续增长,安全补丁是保护软件免受攻击和漏洞影响的重要手段。实践中常难以判断补丁是否已集成到软件中,尤其当仅有二进制文件时。因此,补丁存在性测试对从业者至关重要。然而,从补丁中获取准确的语义信息具有挑战性,可能导致错误结果。论文提出 PPT4J,面向 Java 二进制开展补丁存在性测试,目标是在缺乏源码的情况下判断目标二进制是否已应用给定补丁。摘要未给出具体技术细节与实验结论。
The number of vulnerabilities reported in open source software has increased substantially in recent years. Security patches provide the necessary measures to protect software from attacks and vulnerabilities. In practice, it is difficult to identify whether patches have been integrated into software, especially if we only have binary files. Therefore, the ability to test whether a patch is applied to the target binary, a.k.a. patch presence test, is crucial for practitioners. However, it is challenging to obtain accurate semantic information from patches, which could lead to incorrect results.