一句话：提出约束引导的补丁存在性测试，利用方法约束消除混淆 Java 二进制中模糊摘要匹配的歧义。
补丁存在性测试（PPT）对缓解 Java 程序因第三方库（TPL）引入的漏洞至关重要，但混淆会改变与补丁相关的特征，显著降低现有方法的准确性。已有研究用若干代表性模糊特征构造补丁摘要，以在混淆前后保持特征一致性；这类摘要适合 TPL 检测，却难以直接用于需要更细粒度特征的 PPT：由于覆写、继承等因素，TPL 中语义结构相似的方法常具有相同摘要，仅依赖特征相似度而不考虑方法约束会导致误判。为此，论文提出约束引导的 PPT 方法，在模糊匹配之外引入方法约束来消解摘要匹配歧义，面向混淆 Java 二进制实现更可靠的补丁存在性判定。摘要未报告具体实验数据。
Patch presence testing (PPT) is critical for mitigating vulnerabilities introduced by the use of third-party libraries (TPLs) in Java programs. However, the widespread use of obfuscation significantly undermines its accuracy by altering patch-relevant features. To preserve feature consistency before and after obfuscation for reliable comparison, existing studies summarize patch digests using several representative fuzzy features. These fuzzy features, designed to generalize obfuscation-prone details, have proven effective in TPL detection. Nevertheless, this approach faces limitations when directly applied to PPT, where finer features are needed to capture subtle patch changes. Although patch digests facilitate feature matching under obfuscation-induced code changes with high efficiency, methods with similar semantic structures—common in TPLs due to factors such as overriding and inheritance—often exhibit identical digests. Relying solely on feature similarity without considering method constraints often results in inaccurate outcomes.
@inproceedings{paperbot11732,
title = {Beyond Fuzzy Matching: Constraint-Guided Patch Presence Testing for Obfuscated Java Binaries},
author = {Lige Zhan and Jiang Ming and Chenke Luo and Letian Sha and Guojun Peng and Jianming Fu},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3787802}
}