一句话：提出静态漏洞检测与热补丁框架，在源码与二进制层面用签名匹配漏洞函数并自动生成热补丁。
本文提出一个同时面向源代码与二进制层面的静态漏洞检测与修补框架。其核心问题是如何自动识别目标程序中与已知漏洞相似的函数，并避免对已修复函数产生误报。方法上，框架首先自动收集已知漏洞信息并构建签名，随后利用相似签名匹配脆弱函数，并通过比对过滤掉目标程序中已被修补的函数。对于最终判定为脆弱的函数，框架进一步从源代码中学习，尝试自动生成热补丁。该工作将漏洞检测与补丁生成整合在统一的静态分析流程中，覆盖源码与二进制两种场景，但摘要未报告具体的实验设置与量化结果。
This paper presents a static vulnerability detection and patching framework at both source code and binary level. It automatically identifies and collects known vulnerability information to build the signature. It matches vulnerable functions with similar signatures and filters out the ones that have been patched in the target program. For the vulnerable functions, the framework tries to generate hot patches by learning from the source code.
DOI 原文 ·
@inproceedings{paperbot5875,
title = {Source code and binary level vulnerability detection and hot patching},
author = {Zhengzi Xu},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3418914}
}