一句话：提出 PHunter，利用抗混淆的语义特征精确高效检测 Android 应用中第三方库补丁是否存在。
第三方库广泛用于 Android 应用，但其漏洞使补丁存在性测试至关重要；然而现有方法难以应对普遍存在的代码混淆。本文提出 PHunter，通过捕获与补丁相关方法的抗混淆语义特征来判断目标应用中补丁是否存在：先用粗粒度特征定位补丁相关方法，再比较细粒度语义相似度确定代码是否已被打补丁。在 94 个 CVE 与 200 个应用上的评估表明，PHunter 优于现有工具，平均准确率 97.1%，效率高、误报率低，并对不同混淆策略具有鲁棒性；它还能消除现有第三方库检测工具产生的误报，最多减少 25.2% 的误报且准确率达 95.3%。
Third-party libraries (TPLs) are widely utilized by Android developers to implement new apps. Unfortunately, TPLs are often suffering from various vulnerabilities, which could be exploited by attackers to cause catastrophic consequences for app users. Therefore, testing whether a vulnerability has been patched in target apps is crucial. However, existing techniques are unable to effectively test patch presence for obfuscated apps while obfuscation is pervasive in practice. To address the new challenges introduced by code obfuscation, this study presents PHunter, which is a system that captures obfuscation-resilient semantic features of patch-related methods to identify the presence of the patch in target apps. Specifically, PHunter utilizes coarse-grained features to locate patch-related methods, and compares the fine-grained semantic similarity to determine whether the code has been patched. Extensive evaluations on 94 CVEs and 200 apps show that PHunter can outperform state-of-the-art tools, achieving an average accuracy of 97.1% with high efficiency and low false positive rates. Besides, PHunter is able to be resilient to different obfuscation strategies. More importantly, PHunter is useful in eliminating the false alarms generated by existing TPL detection tools. In particular, it can help reduce up to 25.2% of the false alarms with an accuracy of 95.3%.
@inproceedings{Xie0JGHZ023,
title = {Precise and Efficient Patch Presence Test for Android Applications against Code Obfuscation},
author = {Zifan Xie and Ming Wen and Haoxiang Jia and Xiaochen Guo and Xiaotong Huang and Deqing Zou and Hai Jin},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598061}
}