A method, apparatus and medium for detecting vulnerabilities caused by imperfect patches

Abstract

The present application relates to the technical field of software security, and particularly relates to a method and device for detecting vulnerabilities caused by imperfect patches and a medium. The method comprises the following steps: classifying submitted information by combining a rule-based and / or ChatGPT-based method to identify security patches; extracting JavaScript files with PoCs from the security patches to generate executable PoCs files; collecting all patch files and arranging them according to frequency information, taking frequently patched code as hot code to construct a hot code file list; comparing the current file name to be instrumented with the hot code file list to selectively instrument the hot code; performing mutation operations on the PoCs JavaScript files to generate new samples; replacing the generated new sample code into the hot code area for fuzz testing; and if a new vulnerability is found during the fuzz testing process, taking it as input. Through the method, the accuracy and efficiency of identifying security patches and discovering new vulnerabilities are significantly improved.

Images