paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Difuzer

Difuzer：面向逻辑炸弹排查的可疑隐藏敏感操作检测
ICSE Proceedings of the 44th International Conference on Software Engineering2022匹配度 4/10 · 该论文属于静态分析与机器学习（One-Class SVM）结合的程序分析工作，与“AI→PL”有广义交集，但目标场景是安全领域的逻辑炸弹检测，未涉及 LLM/Agent、浮点程序分析或贝叶斯程序分析等核心方向。引用 31 inbox
Jordan Samhi, Li Li, Tegawendé F. Bissyandé, Jacques Klein
安全与隐私程序分析与抽象解释
crossref: 2026-09-12

AI 速览

一句话：提出 Difuzer，结合静态分析与 One-Class SVM 异常检测，识别可疑隐藏敏感操作以辅助逻辑炸弹排查。

逻辑炸弹通过特定条件触发恶意行为，使动态测试难以发现，如何拆解仍是未解问题。本文将可疑隐藏敏感操作（SHSO）视为逻辑炸弹排查的中间步骤，提出混合方法 Difuzer：先用插桩引擎与过程间数据流分析定位 SHSO 入口点，再提取触发条件相关特征，并利用 One-Class SVM 构建无监督学习模型，检测异常触发模式。摘要未报告具体实验数据，但方法目标是在动态测试前预测可能实现逻辑炸弹的 SHSO。

问题
动态测试中，逻辑炸弹只有在满足特定条件时才触发，导致恶意行为难以被检测和拆解，现有文献尚未解决该问题。
方法
Difuzer 结合插桩引擎与过程间数据流分析定位 SHSO 入口点，提取触发条件特征，并用 One-Class SVM 无监督检测异常触发。
评估
摘要仅说明采用无监督 One-Class SVM 检测异常触发，未给出实验设置或量化评估结果。
原文摘要（Abstract）

One prominent tactic used to keep malicious behavior from being detected during dynamic test campaigns is logic bombs, where malicious operations are triggered only when specific conditions are satisfied. Defusing logic bombs remains an unsolved problem in the literature. In this work, we propose to investigate Suspicious Hidden Sensitive Operations (SHSOs) as a step towards triaging logic bombs. To that end, we develop a novel hybrid approach that combines static analysis and anomaly detection techniques to uncover SHSOs, which we predict as likely implementations of logic bombs. Concretely, Difuzer identifies SHSO entry-points using an instrumentation engine and an inter-procedural data-flow analysis. Then, it extracts trigger-specific features to characterize SHSOs and leverages One-Class SVM to implement an unsupervised learning model for detecting abnormal triggers.

链接与引用

DOI 原文 · PDF（开放获取） ·

BibTeX 
@inproceedings{paperbot6949,
  title = {Difuzer},
  author = {Jordan Samhi and Li Li and Tegawendé F. Bissyandé and Jacques Klein},
  booktitle = {ICSE},
  year = {2022},
  doi = {10.1145/3510003.3510135}
}