从一个漏洞定位修补程序点
Localizing Patch Points From One Exploit
摘要：
自动补丁生成可以显著减少漏洞暴露后的窗口。为了实现这一目标，一个长期存在的问题是补丁本地化：找到一个程序点，在该程序点可以合成补丁。我们提出PatchLoc，自动识别这样的位置在一个脆弱的二进制文件的第一个系统之一，只要一个漏洞，具有很高的准确性。PatchLoc不会对源代码、测试套件或漏洞的专业知识的可用性做出任何假设。PatchLoc在我们研究的43个CVE中，约有88%具有高精度，在大型现实应用中精确定位有效的补丁位置。这些结果源于一种新的方法来自动合成一个测试套件，使概率排名和有效地区分候选程序补丁的位置。
英文摘要：
Automatic patch generation can significantly reduce the window of exposure after a vulnerability is disclosed. Towards this goal, a long-standing problem has been that of patch localization: to find a program point at which a patch can be synthesized. We present PatchLoc, one of the first systems which automatically identifies such a location in a vulnerable binary, given just one exploit, with high accuracy. PatchLoc does not make any assumptions about the availability of source code, test suites, or specialized knowledge of the vulnerability. PatchLoc pinpoints valid patch locations in large real-world applications with high accuracy for about 88% of 43 CVEs we study. These results stem from a novel approach to automatically synthesizing a test-suite which enables probabilistically ranking and effectively differentiating between candidate program patch locations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
