Patch detection method and device

Abstract

The invention relates to the technical field of software analysis, and provides a patch detection method and device. The method comprises the following steps: determining a reference patch path and a reference context path from a reference anchor point diagram, and determining each candidate patch path and each candidate context path from a target anchor point diagram; determining a target patch path from the candidate patch paths according to the distances between the candidate patch paths and the candidate context paths and the distances between the reference patch paths and the reference context paths, and determining a target context path according to the target patch path; and determining the existence state of the patch in the target function according to the patch type, the reference patch path, the reference context path, the target patch path and the target context path of the reference function. The patch detection method and device are used for solving the problems that an existing patch detection method is poor in adaptability and too large in calculation overhead in a complex compiling environment, and patch detection efficiency and universality are improved.

Description

Technical Field

[0001] This application relates to the field of software analysis technology, and in particular to a patch detection method and apparatus. Background Technology

[0002] Patching is an effective way to distinguish between vulnerable functions and patched functions. A vulnerable function is a version of a function that does not include a patch and retains its original logical flaws; while a patched function is a version of a vulnerable function that has been patched, including new corrective logic or the removal of faulty logic. Typically, patches contain only minor code changes, making vulnerable and patched functions very similar. Patch detection verifies the presence of the patch in the target function by selecting representative features from the patch, thus effectively distinguishing whether the target function is a vulnerable or patched function.

[0003] However, existing patch detection methods still have shortcomings in practical applications. On the one hand, existing syntax-based detection methods are highly efficient under the same compilation environment, but they are highly sensitive to changes in the environment such as compilation optimization options and compiler versions, and have poor robustness. On the other hand, although semantic-based detection methods can cope with environmental differences, the computational overhead of the symbolic execution or simulation process they rely on is huge, making it difficult to meet the timeliness requirements of large-scale detection.

[0004] Therefore, it is of great significance to address the problems of poor adaptability and excessive computational overhead of existing patch detection methods in complex compilation environments, and to improve the efficiency and versatility of patch detection. Summary of the Invention

[0005] This application provides a patch detection method and apparatus to solve the problems of poor adaptability and excessive computational overhead of existing patch detection methods in complex compilation environments, thereby improving the efficiency and versatility of patch detection.

[0006] Firstly, this application provides a patch detection method, the method comprising: Based on the control flow graph of the reference function, a reference anchor graph of the reference function is constructed, and a reference patch path and a reference context path are determined from the reference anchor graph; Based on the control flow graph of the objective function, construct the target anchor graph of the objective function; based on the reference patch path and the reference context path, determine each candidate patch path and each candidate context path from the target anchor graph; Based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, a target patch path is determined from each candidate patch path, and a target context path is determined based on the target patch path; The existence status of the patch in the target function is determined based on the patch type of the reference function, the reference patch path, the reference context path, the target patch path, and the target context path.

[0007] Optionally, according to the patch detection method of this application, constructing the reference anchor graph of the reference function based on the control flow graph of the reference function includes: Obtain the first key instruction in the control flow graph of the reference function, and determine the first anchor node based on the first key instruction; Based on the first anchor node, construct the reference anchor graph of the reference function; The step of constructing the target anchor graph of the objective function based on the control flow graph of the objective function includes: Obtain the second key instruction in the control flow graph of the objective function, and determine the second anchor node based on the second key instruction; Based on the second anchor node, construct the target anchor graph of the objective function; The first key instruction includes a first condition comparison instruction and a first function call instruction; The second key instruction includes a second condition comparison instruction and a second function call instruction.

[0008] Optionally, according to the patch detection method of this application, determining the first anchor node according to the first key instruction includes: The first reverse instruction slice is determined based on the operands in the first conditional comparison instruction and / or the parameter loading operation in the first function call instruction; The first anchor node is determined based on the first reverse instruction slice; The step of determining the second anchor node according to the second key instruction includes: The second reverse instruction slice is determined based on the operands in the second conditional comparison instruction and / or the parameter loading operation in the second function call instruction; The second anchor node is determined based on the second reverse instruction slice.

[0009] Optionally, according to the patch detection method of this application, the reference function includes a vulnerable function and a repair function; the reference anchor graph includes a reference anchor graph of the vulnerable function and a reference anchor graph of the repair function; the reference patch path includes a reference patch path of the vulnerable function and a reference patch path of the repair function. Determining the reference patch path from the reference anchor point graph includes at least one of the following: The path that exists in the reference anchor graph of the vulnerable function but not in the reference anchor graph of the repair function is used as the reference patch path of the vulnerable function; the path that does not exist in the reference anchor graph of the vulnerable function but exists in the reference anchor graph of the repair function is used as the reference patch path of the repair function. Based on the distribution frequency of each anchor node in the reference anchor graph of the vulnerable function, the path weight value of each path in the reference anchor graph of the vulnerable function is determined, and the path with the highest path weight value is used as the reference patch path of the vulnerable function; based on the distribution frequency of each anchor node in the reference anchor graph of the repair function, the path weight value of each path in the reference anchor graph of the repair function is determined, and the path with the highest path weight value is used as the reference patch path of the repair function.

[0010] Optionally, according to the patch detection method of this application, the reference function includes a vulnerable function and a repair function; the reference context path includes a reference predecessor context path of the vulnerable function, a reference successor context path of the vulnerable function, a reference predecessor context path of the repair function, and a reference successor context path of the repair function; each candidate context path includes each candidate predecessor context path and each candidate successor context path. The step of determining the target patch path from the candidate patch paths based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, includes: The reference predecessor context path of the vulnerable function and the reference predecessor context path of the repair function are used as the reference predecessor path; The reference successor context path of the vulnerable function and the reference successor context path of the repair function are used as reference successor paths; For any candidate patch path among the candidate patch paths, a first distance is determined based on the candidate successor context path and the candidate patch path; a second distance is determined based on the reference successor path and the reference patch path; a third distance is determined based on the candidate predecessor context path and the candidate patch path; and a fourth distance is determined based on the reference predecessor path and the reference patch path. The first distance being less than or equal to the second distance and the third distance being less than or equal to the fourth distance are set as preset conditions, and the path that satisfies the preset conditions is set as the target patch path.

[0011] Optionally, according to the patch detection method of this application, the reference function includes a vulnerable function and a repair function; the reference patch path includes a reference patch path for the vulnerable function and a reference patch path for the repair function; the reference context path includes a reference context path for the vulnerable function and a reference context path for the repair function. Determining the existence status of the patch in the target function based on the patch type of the reference function, the reference patch path, the reference context path, and the target patch path includes any one of the following: If the patch type includes deletion type and addition type, the target patch path matches the reference patch path of the vulnerable function successfully, the target context path matches the reference context path of the vulnerable function successfully, the target patch path fails to match the reference patch path of the repair function, and the target context path fails to match the reference context path of the repair function, then it is determined that the target function does not have a patch. If the patch type is deletion type, the target patch path matches the reference patch path of the vulnerable function, and the target context path matches the reference context path of the vulnerable function, then it is determined that the target function does not have a patch. If the patch type is new, the target patch path fails to match the reference patch path of the repair function, and the target context path successfully matches the reference context path of the repair function, then it is determined that the target function does not have a patch.

[0012] Secondly, this application also provides a patch detection device, the device comprising: The reference module is used to construct a reference anchor graph of the reference function based on the control flow graph of the reference function, and to determine the reference patch path and reference context path from the reference anchor graph; The candidate module is used to construct a target anchor graph of the objective function based on the control flow graph of the objective function; and to determine each candidate patch path and each candidate context path from the target anchor graph based on the reference patch path and the reference context path. The determination module is used to determine the target patch path from the candidate patch paths based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, and to determine the target context path based on the target patch path; The detection module is used to determine the existence status of the patch in the target function based on the patch type of the reference function, the reference patch path, the reference context path, the target patch path, and the target context path.

[0013] Thirdly, this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the patch detection method as described in the first aspect above.

[0014] Fourthly, this application provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the patch detection method as described in the first aspect above.

[0015] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the patch detection method as described in the first aspect above.

[0016] The patch detection method and apparatus provided in this application determine reference patch paths and reference context paths from a reference anchor point graph, and then determine candidate patch paths and candidate context paths from a target anchor point graph based on the reference patch paths and reference context paths. This allows the method and apparatus to effectively utilize the environmental features of the reference context paths, thereby ensuring improved positioning accuracy of candidate patch paths and candidate context paths in complex compilation environments. By determining the target patch path from each candidate patch path and determining the existence state of the patch in the target function, the method and apparatus can solve the problem of excessive computational overhead, thereby significantly improving the efficiency and versatility of patch detection. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the patch detection method provided in this application.

[0019] Figure 2 This is a schematic diagram of the patch detection device provided in this application.

[0020] Figure 3 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0021] In the embodiments of this application, the terms "first," "second," etc., are used to distinguish similar objects, and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, and the number of objects is not limited; for example, the first object can be one or more.

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] Figure 1 This is a flowchart illustrating the patch detection method provided in this application, as follows: Figure 1 As shown, the method may include the following steps: Step 110: Based on the control flow graph of the reference function, construct the reference anchor graph of the reference function, and determine the reference patch path and reference context path from the reference anchor graph; Step 120: Based on the control flow graph of the objective function, construct the target anchor graph of the objective function; based on the reference patch path and reference context path, determine each candidate patch path and each candidate context path from the target anchor graph; Step 130: Determine the target patch path from each candidate patch path based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path; and determine the target context path based on the target patch path. Step 140: Determine the existence status of the patch in the target function based on the patch type, reference patch path, reference context path, target patch path, and target context path of the reference function.

[0024] It should be noted that the above-mentioned patch detection method is executed by a computer device. This computer device can be a general-purpose desktop computer, personal computer, high-performance server, code analysis platform, or a distributed computing cluster containing local computing resources; this application does not specifically limit it in this regard.

[0025] Unless otherwise specified, the following embodiments use a computer device as the execution subject to illustrate the patch detection method of this application.

[0026] Specifically, a reference function is a piece of binary code used to extract patch characteristics. For example, a reference function may include vulnerability functions and fix functions.

[0027] A control flow graph is a directed graph used to describe the execution flow of a function. For example, nodes in a control flow graph represent basic blocks, and edges represent transitions within the control flow.

[0028] A reference anchor graph refers to a directed graph structure that performs semantic abstraction on binary reference functions. For example, a reference anchor graph can include reference anchor graphs for vulnerable functions and reference anchor graphs for fix functions.

[0029] A reference patch path refers to a specific path in a reference anchor graph that characterizes the behavior of a patch. For example, a reference patch path may include the reference patch path for a vulnerable function and the reference patch path for a fix function.

[0030] The reference context path describes the environmental characteristics of the reference patch path within the control flow. The reference context path can include the reference context path of the vulnerable function and the reference context path of the patch function. Specifically, the reference context path of the vulnerable function can include both a reference predecessor context path and a reference successor context path; similarly, the reference context path of the patch function can also include both a reference predecessor context path and a reference successor context path.

[0031] It is understandable that the path before the reference patch path is the reference predecessor patch path; the path after the reference patch path is the reference successor patch path.

[0032] The target function refers to the binary function to be tested, that is, the function whose patch is to be determined. For example, the target function can be generated by different compiler versions, different optimization options, or different operating system environments.

[0033] The target anchor graph refers to the directed graph structure after semantic abstraction of the binary objective function.

[0034] Candidate patch paths refer to paths in the target anchor graph of the objective function that are semantically highly similar to the reference patch path. Due to compilation differences, there may be multiple candidate paths with similar structures in the objective function.

[0035] Candidate context paths are used to describe the environmental characteristics of candidate patch paths within the control flow. Candidate context paths can include candidate predecessor context paths and candidate successor context paths.

[0036] The distance between each candidate patch path and each candidate context path is used to describe the topological interval of the path in the control flow. For example, the distance can be the shortest path length between the end node of the candidate successor context path and the beginning node of the candidate patch path; or it can be the shortest path length between the end node of the candidate patch path and the beginning node of the candidate predecessor context path.

[0037] The distance between the reference patch path and the reference context path is used to describe the topological spacing of the paths in the control flow. For example, the distance can be the shortest path length between the end node of the reference successor context path and the beginning node of the reference patch path; or it can be the shortest path length between the end node of the reference patch path and the beginning node of the reference predecessor context path.

[0038] Specifically, in step 110, the binary code of the reference function is preprocessed to obtain the control flow graph of the reference function. Subsequently, based on the control flow graph of the reference function, a reference anchor graph of the reference function is constructed, and the reference patch path and reference context path are determined from the reference anchor graph.

[0039] Understandably, to avoid the problem of infinite path expansion caused by loop structures, the control flow graph needs to be flattened. Specifically, a natural cycle detection algorithm is used to identify edges with loop structures in the control flow graph. For example, a loop path is "A→B→C→A", and a back edge is "C→A". By removing all back edges, the control flow graph is transformed into a directed acyclic graph, thus limiting the path search space.

[0040] Alternatively, in order to preserve the reachability semantics of the original control flow graph as much as possible, a transition edge is added to the tail node of the loop structure (i.e., the source node of the back edge) so that it can be connected to a legal successor node outside the loop structure.

[0041] In step 120, the binary code of the objective function is preprocessed to obtain the control flow graph of the objective function. Subsequently, based on the control flow graph of the objective function, a target anchor graph of the objective function is constructed, and each candidate patch path and each candidate context path is determined from the target anchor graph.

[0042] It should be noted that the specific method for determining the target anchor point plot of the objective function is the same as the method for determining the reference anchor point plot of the reference function described above, and the repetition will not be repeated.

[0043] In step 130, for any candidate patch path among all candidate patch paths, the shortest path length between the candidate patch path and each candidate context path is obtained, and the shortest path length is used as the distance. For example, the shortest path length between the end node of the candidate successor context path and the beginning node of the candidate patch path can be obtained; alternatively, the shortest path length between the end node of the candidate patch path and the beginning node of the candidate predecessor context path can also be obtained.

[0044] Subsequently, the shortest path length between the reference patch path and the reference context path is obtained, and this shortest path length is used as the distance. For example, the shortest path length between the end node of the reference successor context path and the beginning node of the reference patch path can be obtained; alternatively, the shortest path length between the end node of the reference patch path and the beginning node of the reference predecessor context path can also be obtained.

[0045] Next, based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, the path that meets the distance constraint and has the highest matching degree is selected from each candidate patch path and used as the target patch path. The target context path is then determined based on the target patch path.

[0046] In step 140, since different patch types exhibit different characteristics in the anchor graph, it is necessary to combine the patch type to determine the existence state of the patch in the objective function. Based on the patch type, reference patch path, reference context path, target patch path, and target context path of the reference function, it is verified whether the objective function possesses semantic features consistent with the patch type and a complete context environment, thereby determining the existence state of the patch in the objective function.

[0047] The patch detection method provided in this application determines the reference patch path and reference context path from the reference anchor graph, and then determines each candidate patch path and each candidate context path from the target anchor graph based on the reference patch path and reference context path. This allows the method to effectively utilize the environmental features of the reference context path, thereby ensuring improved positioning accuracy of each candidate patch path and each candidate context path in complex compilation environments. By determining the target patch path from each candidate patch path and determining the existence status of the patch in the target function, the method can solve the problem of excessive computational overhead, thereby significantly improving the efficiency and versatility of patch detection.

[0048] In one embodiment, constructing a reference anchor graph of the reference function based on the control flow graph of the reference function may include: Obtain the first key instruction in the control flow graph of the reference function, and determine the first anchor node based on the first key instruction; Based on the first anchor node, construct the reference anchor graph of the reference function; Based on the control flow graph of the objective function, constructing the objective anchor graph of the objective function can include: Obtain the second key instruction in the control flow graph of the objective function, and determine the second anchor node based on the second key instruction; Based on the second anchor node, construct the target anchor graph of the objective function; The first key instruction includes a first condition comparison instruction and a first function call instruction; The second key instructions include the second conditional comparison instruction and the second function call instruction.

[0049] Specifically, the first conditional comparison instruction and the second conditional comparison instruction refer to instructions used to compare two operands and set flag bits according to the comparison result. For example, conditional comparison instructions may include the cmp (Compare) and test instructions under the x86 architecture, or the CMP and TST instructions under the ARM architecture; as another example, to enhance versatility, certain special forms of instructions can be standardized and converted, such as test eax, eax, etc., into the logically equivalent cmp eax, 0, thereby uniformly extracting the anchor value as 0. This application does not make specific limitations in this regard.

[0050] The first function call instruction and the second function call instruction refer to the instructions used to implement subroutine calls. Examples include the `call` instruction in the x86 architecture and the `BL` (Branch with Link) instruction in the ARM architecture. Another example is a jump instruction without a return value; if its semantic behavior is equivalent to a function call (the jump address is the function's starting address), it is abstracted as a `call` instruction. This application does not specifically limit this.

[0051] The first and second anchor nodes refer to graph nodes containing semantic attributes. Each anchor node includes an anchor type and an anchor value. The anchor type indicates the semantic role of the anchor node in the binary program, such as a conditional comparison or function call; the anchor value indicates the key constant or call target involved by the anchor node. For example, for the instruction "cmp eax, 0", its anchor type is CMP and its anchor value is the constant 0; for the instruction "call foobar", its anchor type is CALL and its anchor value is foobar. This application does not impose specific limitations on this.

[0052] Specifically, when constructing the reference anchor graph, each basic block in the control flow graph of the reference function is traversed to obtain the assembly instruction sequence, and the first key instruction is identified from the assembly instruction sequence. Subsequently, the first anchor node is determined based on the first key instruction. The first key instruction includes a first conditional comparison instruction and a first function call instruction. The first anchor node can be determined in at least one of the following ways: Optionally, for the first conditional comparison instruction, the identifier representing the conditional comparison semantics is used as the anchor type, and the key constant is used as the anchor value. In this process, to eliminate instruction differences caused by different compilers or coding habits, instruction standardization can be performed to convert comparison instructions of different forms but with the same semantics into a unified standard form, and extract the normalized operands.

[0053] Subsequently, based on the determined anchor point type and anchor point value, the corresponding first anchor point node is generated.

[0054] Optionally, for the first function call instruction, the identifier representing the semantics of the function call is used as the anchor type, and the call target is used as the anchor value. During this process, if the target address of a no-return jump instruction is the function's starting address, then this no-return jump instruction is also treated as a function call instruction. Subsequently, based on the determined anchor type and anchor value, the corresponding first anchor node is generated.

[0055] Subsequently, based on the anchor node and anchor value, the corresponding first anchor node is determined.

[0056] After identifying all the first anchor nodes, the reference anchor graph of the reference function is constructed according to the execution order of each instruction in the control flow graph of the reference function.

[0057] It should be noted that the specific method for determining the target anchor point plot of the objective function is the same as the method for determining the reference anchor point plot of the reference function described above, and the repetition will not be repeated.

[0058] The patch detection method provided in this application determines the first anchor node through the first key instruction in the control flow graph of the reference function, and constructs the reference anchor graph of the reference function based on the first anchor node; then, it determines the second anchor node through the second key instruction in the control flow graph of the target function, and constructs the target anchor graph of the target function based on the second anchor node. This method filters out non-key instructions, achieves lightweight and efficient computation, and thus significantly improves the efficiency of patch detection.

[0059] In one embodiment, determining the first anchor node according to the first key instruction may include: The first reverse instruction slice is determined based on the operands in the first conditional comparison instruction and / or the parameter loading operation in the first function call instruction; The first anchor node is determined based on the first reverse instruction slice; Determining the second anchor node based on the second key instruction may include: The second reverse instruction slice is determined based on the operands in the second conditional comparison instruction and / or the parameter loading operation in the second function call instruction; The second anchor node is determined based on the second reverse instruction slice.

[0060] Specifically, the operands in the first and second conditional comparison instructions refer to the data objects that participate in the logical operations within the conditional comparison instructions. For example, in the x86 instruction `cmp eax, 0`, both `eax` and `0` are operands; in `test eax, eax`, both `eax` values ​​are operands.

[0061] The parameter loading operations in both the first and second function call instructions refer to a series of instruction actions performed before the function call instruction is executed, in order to pass parameters to the called function. For example, in the x86 32-bit architecture, parameters are usually passed through the stack, so the parameter loading operation is manifested as a push instruction or a mov instruction; in the x86 64-bit or ARM architecture, parameters are usually passed through registers, so the parameter loading operation is manifested as an assignment instruction to a specific parameter register.

[0062] The first and second reverse instruction slices refer to all preceding instructions that influence the key instruction, and can be extracted using reverse data flow analysis techniques. For example, by using the first and second reverse instruction slices, the source of the key instruction can be traced, thereby obtaining richer semantic context information.

[0063] Specifically, in determining the first anchor node, to enhance its discriminative capability, a first reverse instruction slice is extracted using reverse data flow analysis technology. The first reverse instruction slice can be determined through at least one of the following methods: Optionally, for a first conditional comparison instruction, using the operand in the first conditional comparison instruction as a slice variable, the data dependency path is traced forward along the control flow to collect all instructions involved in the calculation of that operand, thereby forming a first reverse instruction slice. Subsequently, constant values ​​and their corresponding operation types are extracted from the first reverse instruction slice as auxiliary information for the first anchor node. This auxiliary information helps distinguish anchors with the same type and principal value but different semantic origins. For example, if there are two identical instructions "test eax, eax", both normalized to "cmp eax, 0", they cannot be distinguished by the instructions themselves alone. In this case, the first reverse instruction slice reveals that the former's eax originates from "and eax, 0Eh", and the latter's eax originates from "and eax, 3".

[0064] Finally, the first anchor node is generated based on the anchor type, anchor value, and auxiliary information.

[0065] Optionally, for the first function call instruction, using the parameter loading operation as a slice variable, its data dependency path is traced backward to collect all instructions for parameter loading operations, thus forming a first reverse instruction slice. Subsequently, constant values ​​from the function parameters are extracted from the first reverse instruction slice as auxiliary information for the first anchor node. This auxiliary information can supplement the semantic information of the function call behavior, thereby improving the accuracy of anchor matching. For example, for the instruction sequence "mov [esp+4], 3" or "push eax", the source of eax is further traced through the first reverse instruction slice, and the immediate value contained therein is extracted as an auxiliary constant.

[0066] Finally, based on the anchor point type, anchor point value, and auxiliary information, the first anchor point node is generated. It should be noted that the specific method for determining the second anchor node is the same as the method for determining the first anchor node, and the repetitions will not be repeated.

[0067] The patch detection method provided in this application determines a first anchor node by comparing operands in a first conditional instruction and / or loading parameters in a first function call instruction; and determines a second anchor node by comparing operands in a second conditional instruction and / or loading parameters in a second function call instruction. This method can extract key variables from instruction slices as auxiliary information, effectively distinguishing anchor nodes with the same instruction type and principal value but different semantic origins, avoiding detection errors caused by local similarity of instructions, and thus significantly improving the accuracy and robustness of patch detection.

[0068] In one embodiment, the reference function includes a vulnerable function and a repair function; the reference anchor graph includes a reference anchor graph of the vulnerable function and a reference anchor graph of the repair function; the reference patch path includes a reference patch path of the vulnerable function and a reference patch path of the repair function. Determining the reference patch path from the reference anchor point diagram may include at least one of the following: Paths that exist in the reference anchor graph of the vulnerable function but not in the reference anchor graph of the repair function are used as reference patch paths for the vulnerable function; paths that do not exist in the reference anchor graph of the vulnerable function but exist in the reference anchor graph of the repair function are used as reference patch paths for the repair function. Based on the distribution frequency of each anchor node in the reference anchor graph of the vulnerable function, determine the path weight value of each path in the reference anchor graph of the vulnerable function, and take the path with the highest path weight value as the reference patch path of the vulnerable function; based on the distribution frequency of each anchor node in the reference anchor graph of the repair function, determine the path weight value of each path in the reference anchor graph of the repair function, and take the path with the highest path weight value as the reference patch path of the repair function.

[0069] Understandably, one path can be extracted from both the vulnerable function and the patching function as a reference patch path. Retaining dual reference paths can handle situations where patch modifications are minor or only involve boundary conditions. In such cases, relying solely on a single version's reference path may be insufficient to accurately distinguish the version status of the target function. By bidirectionally matching the target function with both the reference patch paths of the vulnerable function and the patching function, the behavioral characteristics of the target function can be more comprehensively characterized, thereby significantly improving the accuracy and robustness of patch detection results.

[0070] The distribution frequency of anchor nodes refers to the total number of times a single anchor node appears in its associated reference anchor graph. For example, the lower the distribution frequency of an anchor node, the rarer the corresponding path, and the stronger its ability to distinguish between vulnerable functions and repair functions.

[0071] Optionally, for vulnerable functions, paths that exist in the reference anchor graph of the vulnerable function but not in the reference anchor graph of the patching function can be filtered out. These paths represent control flow logic that was removed during the patching process. For example, by using these paths as reference patch paths for vulnerable functions, if such a path is successfully matched in the target function, it indicates that the target function retains the code characteristics of the old version, thus determining that the target function is an unpatched vulnerable function.

[0072] Optionally, for the fix function, paths that do not exist in the reference anchor graph of the vulnerable function but do exist in the reference anchor graph of the fix function can be filtered out. These paths represent the new control flow logic introduced by the patch. For example, by using these paths as reference patch paths for the fix function, if the path is successfully matched in the target function, it indicates that the target function contains the key fix features introduced by the patch, thus determining that the target function is a fixed fix function.

[0073] Optionally, for the vulnerability function, the distribution frequency of each anchor node in the reference anchor graph of the vulnerability function is statistically analyzed. Based on the distribution frequency of each anchor node, the inverse word frequency of each anchor node is calculated, and this inverse word frequency is used as the weight value of the anchor node. Among them, the lower the distribution frequency, the higher the inverse word frequency. The higher the inverse word frequency, the higher the weight value of the anchor node, which in turn represents that the corresponding path is more distinctive. For example, for anchor node A, its inverse word frequency can be shown in formula (1): Formula (1) in, Indicates the inverse word frequency of anchor node A. This indicates the number of times anchor node A appears in the entire anchor point graph.

[0074] For example, for a path consisting of n anchor points Its path weight can be defined as a binary tuple, which can be expressed by formula (2): Formula (2) in, This represents the anchor node with the highest distinguishability in the path. This indicates the length of the path, which is the number of anchor nodes in the path. Indicates the first in the path Inverse word frequency of each anchor node.

[0075] Subsequently, path weights can be compared and sorted lexicographically, prioritizing rarer anchor paths with higher distinctiveness. If the distinctiveness is the same, longer paths are selected to enhance the constraint during matching, thus using the path with the highest weight value as the reference patch path for the vulnerability function. For example, for path... and path The process of comparing and sorting the path weights can be shown in formula (3): Formula (3) in, Representing a path Path weights, Representing a path Path weights, Representing a path The anchor node with the highest differentiation. Representing a path The anchor node with the highest differentiation. Representing a path Length, Representing a path The length.

[0076] Optionally, for the repair function, the distribution frequency of each anchor node in the reference anchor graph of the repair function is statistically analyzed. Based on the distribution frequency of each anchor node, the inverse word frequency of each anchor node is calculated. Thus, based on the inverse word frequency of each anchor node, the path weight value of each path in the reference anchor graph of the repair function is determined, and the path with the highest path weight value is taken as the reference patch path of the repair function.

[0077] It should be noted that the specific method for determining the reference patch path of the repair function is the same as the method for determining the reference patch path of the vulnerable function described above, and the repetition will not be repeated.

[0078] Optionally, to further improve the accuracy and robustness of reference patch path selection, a tiered filtering strategy can be adopted. First, filtering can be based on the differences in the paths. For example, paths that exist in the reference anchor graph of the vulnerable function but not in the reference anchor graph of the repair function can be used as reference patch paths for the vulnerable function; paths that do not exist in the reference anchor graph of the vulnerable function but exist in the reference anchor graph of the repair function can be used as reference patch paths for the repair function.

[0079] Subsequently, if multiple candidate paths are selected, or if no path meeting the criteria is found, further filtering is performed based on the distribution frequency of anchor nodes. For example, the reference patch path for the vulnerable function is determined based on the distribution frequency of each anchor node in the reference anchor graph of the vulnerable function; the reference patch path for the repair function is determined based on the distribution frequency of each anchor node in the reference anchor graph of the repair function.

[0080] The patch detection method provided in this application extracts reference patch paths from the reference anchor graphs of the vulnerability function and the fix function respectively, and selects the path that appears only in a single function, or selects the path with the highest weight based on the frequency of anchor distribution. This allows the method to more comprehensively match the target function through bidirectional matching when facing patches that only introduce minor changes or involve boundary cases, avoiding misjudgments caused by relying on a single reference path, thereby significantly improving the accuracy and robustness of patch detection.

[0081] In one embodiment, the reference function includes a vulnerable function and a repair function; the reference context path includes the reference predecessor context path of the vulnerable function, the reference successor context path of the vulnerable function, the reference predecessor context path of the repair function, and the reference successor context path of the repair function; each candidate context path includes each candidate predecessor context path and each candidate successor context path. The target patch path is determined from the candidate patch paths based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path. This can include: The reference predecessor context path of the vulnerable function and the reference predecessor context path of the repair function are used as the reference predecessor path; The reference successor context path of the vulnerable function and the reference successor context path of the fix function are used as the reference successor path; For any candidate patch path among all candidate patch paths, determine the first distance based on the candidate successor context path and the candidate patch path; determine the second distance based on the reference successor path and the reference patch path; determine the third distance based on the candidate predecessor context path and the candidate patch path; and determine the fourth distance based on the reference predecessor path and the reference patch path. The first distance is less than or equal to the second distance, and the third distance is less than or equal to the fourth distance, which are set as preset conditions. The path that meets the preset conditions is set as the target patch path.

[0082] Specifically, the first distance represents the shortest path length between the end node of the candidate successor context path and the beginning node of the candidate patch path.

[0083] The second distance represents the shortest path length between the end node of the reference successor path and the beginning node of the reference patch path.

[0084] The third distance represents the shortest path length between the end node of the candidate patch path and the beginning node of the candidate predecessor context path.

[0085] The fourth distance represents the shortest path length between the end node of the reference patch path and the beginning node of the reference predecessor context path.

[0086] Specifically, firstly, the reference predecessor context path of the vulnerable function and the reference predecessor context path of the repair function are used as reference predecessor paths; and the reference successor context path of the vulnerable function and the reference successor context path of the repair function are used as reference successor paths.

[0087] Subsequently, for any candidate patch path among the candidate patch paths, the candidate successor context path corresponding to the candidate patch path is identified, and the shortest path length between the end node of the candidate successor context path and the beginning node of the candidate patch path is calculated and determined as the first distance; similarly, the shortest path length between the end node of the reference successor path and the beginning node of the reference patch path is taken as the second distance.

[0088] Next, the candidate predecessor context path corresponding to the candidate patch path is identified, and the shortest path length between the end node of the candidate patch path and the beginning node of the candidate predecessor context path is calculated and determined as the third distance; similarly, the shortest path length between the end node of the reference patch path and the beginning node of the reference predecessor context path is taken as the fourth distance.

[0089] Furthermore, the calculated first, second, third, and fourth distances are compared to verify whether the preset conditions are met. The preset conditions include that the first distance is less than or equal to the second distance, and the third distance is less than or equal to the fourth distance. The first distance being less than or equal to the second distance constrains the relative position of the patch path and the subsequent context; the third distance being less than or equal to the fourth distance constrains the relative position of the patch path and the predecessor context. The preset conditions can be shown in formula (4): Formula (4) in, Indicates the candidate successor context path, Indicates the path to the candidate patch. Indicates reference to the successor path, Indicates the reference patch path. Indicates the candidate predecessor context path, This indicates the referenced predecessor path.

[0090] Finally, if a candidate patch path meets the preset conditions, it indicates that the path is not only semantically similar to the patch, but also correctly embedded in the context in terms of control flow structure, and is thus identified as the target patch path.

[0091] Optionally, if multiple candidate paths simultaneously meet the above preset conditions, the number of anchor points that match each candidate path with the context path is further counted, and the path with the most anchor points that match the context path is selected as the final result.

[0092] The patch detection method provided in this application determines a first distance based on candidate successor context paths and candidate patch paths; a second distance based on reference successor paths and reference patch paths; a third distance based on candidate predecessor context paths and candidate patch paths; and a fourth distance based on reference predecessor paths and reference patch paths. This allows the method to effectively exclude paths that are semantically similar but deviate in control flow structure by utilizing context paths, avoiding false alarms caused by local similarity, thereby significantly improving the accuracy and robustness of patch detection.

[0093] In one embodiment, the reference function includes a vulnerable function and a fix function; the reference patch path includes the reference patch path of the vulnerable function and the reference patch path of the fix function; the reference context path includes the reference context path of the vulnerable function and the reference context path of the fix function. Based on the patch type, reference patch path, reference context path, and target patch path of the reference function, determine the existence status of the patch in the target function, which may include any of the following: If the patch type includes deletion and addition types, the target patch path matches the reference patch path of the vulnerable function successfully, the target context path matches the reference context path of the vulnerable function successfully, the target patch path fails to match the reference patch path of the repair function, and the target context path fails to match the reference context path of the repair function, it is determined that the target function does not have a patch. If the patch type is deletion type, the target patch path matches the reference patch path of the vulnerable function, and the target context path matches the reference context path of the vulnerable function, then it is determined that the target function does not have a patch. If the patch type is new, the target patch path fails to match the reference patch path of the repair function, or the target context path successfully matches the reference context path of the repair function, it is determined that the target function does not have a patch.

[0094] Specifically, a deletion type means that the patch contains the removed code statements without introducing new code. For example, removing an unsafe function call.

[0095] A "new addition" type means that the patch contains newly added code statements without removing any old code. For example, a boundary check if statement has been added.

[0096] The absence of a patch for the target function indicates that the target function is vulnerable, meaning it has not been fixed and poses a security risk.

[0097] Specifically, the diversity of patch code modification methods necessitates the adoption of corresponding judgment strategies for different types of patches.

[0098] Optionally, for patches that include both deletion and addition types, these patches possess characteristics of both the vulnerable function and the repair function. If the detection results show that the target function's characteristics completely match the vulnerable function's characteristics but do not match the repair function's characteristics, it indicates that the target function retains the old version's code characteristics and does not contain the new version's repair characteristics. For example, if the target patch path successfully matches the vulnerable function's reference patch path, the target context path successfully matches the vulnerable function's reference context path, the target patch path fails to match the repair function's reference patch path, and the target context path fails to match the repair function's reference context path, it is determined that the target function does not have a patch. In this case, the target function is a vulnerable function.

[0099] Optionally, for patches that only involve deletion, these patches only possess the characteristics of a vulnerable function because no new code is available for extraction. In this case, the identification of the vulnerable function depends on the existence of the deleted code. If the detection results show that the code logic that should have been deleted still exists in the target function, it indicates that the target function has not been patched. For example, if the target patch path matches the reference patch path of the vulnerable function, and the target context path matches the reference context path of the vulnerable function, it is determined that the target function does not have a patch. In this case, the target function is a vulnerable function.

[0100] Optionally, for patches that only contain new information, these patches only possess the characteristics of a fix function because the old code has not been removed. In this case, the vulnerability function is identified by "missing fix features." However, to prevent completely unrelated functions from being mistakenly identified as vulnerable functions, context verification needs to be introduced. If the detection results show that the target function retains the context structure of the fix function but lacks the newly added patch code, then the function is considered vulnerable. For example, if the target patch path fails to match the reference patch path of the fix function, but the target context path successfully matches the reference context path of the fix function, it is determined that the target function does not have a patch.

[0101] Optionally, to ensure the recall rate of anchor paths, it is not mandatory for the auxiliary information of anchors to be completely consistent, as this information may vary slightly under different compilation settings. Therefore, when both the reference patch path of the vulnerable function and the reference patch path of the fix function exist, and both the target patch path and the target context path are matched, the patch path score and the context path score can be compared sequentially to determine the final classification result of the target function.

[0102] Specifically, the score of the matching path is calculated based on the degree of matching of the auxiliary information. The higher the degree of matching, the stronger its consistency with the reference path, and the higher its score. The calculation process of the matching path is shown in formula (5): in, Indicates the matching score. Indicates the reference patch path or reference context path. This represents auxiliary information in the anchor node. Indicates the target patch path or target context path. Indicates the length of the reference patch path or reference context path. This represents the index of the anchor node in the path. The method for representing the longest common subsequence.

[0103] The patch detection method provided in this application establishes differentiated judgment logic for different types of patches, such as deletion types, addition types, and patches that contain both deletion and addition types, thereby determining that no patch exists in the target function. This method can utilize the integrity of the context to verify the existence of patches in the target function, thus accurately identifying the existence of patches in the target function even when the code before and after the patch modification is highly similar.

[0104] The patch detection device provided in this application will be described below. The patch detection device described below can be referred to in correspondence with the patch detection method described above, and can achieve the same technical effect. It will not be described again here.

[0105] Figure 2 This is a schematic diagram of the patch detection device provided in this application, as shown below. Figure 2 As shown, the device may include: Reference module 210 is used to construct a reference anchor graph of the reference function based on the control flow graph of the reference function, and to determine a reference patch path and a reference context path from the reference anchor graph; Candidate module 220 is used to construct a target anchor graph of the objective function based on the control flow graph of the objective function; and to determine each candidate patch path and each candidate context path from the target anchor graph based on the reference patch path and the reference context path. The determining module 230 is used to determine a target patch path from the candidate patch paths based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, and to determine a target context path based on the target patch path; The detection module 240 is used to determine the existence status of the patch in the target function based on the patch type of the reference function, the reference patch path, the reference context path, the target patch path, and the target context path.

[0106] In one embodiment, the reference module 210 is specifically used for: Obtain the first key instruction in the control flow graph of the reference function, and determine the first anchor node based on the first key instruction; Based on the first anchor node, construct the reference anchor graph of the reference function; The candidate module 220 is specifically used for: Obtain the second key instruction in the control flow graph of the objective function, and determine the second anchor node based on the second key instruction; Based on the second anchor node, construct the target anchor graph of the objective function; The first key instruction includes a first condition comparison instruction and a first function call instruction; The second key instruction includes a second condition comparison instruction and a second function call instruction.

[0107] In one embodiment, the reference module 210 is specifically used for: The first reverse instruction slice is determined based on the operands in the first conditional comparison instruction and / or the parameter loading operation in the first function call instruction; The first anchor node is determined based on the first reverse instruction slice; The candidate module 220 is specifically used for: The second reverse instruction slice is determined based on the operands in the second conditional comparison instruction and / or the parameter loading operation in the second function call instruction; The second anchor node is determined based on the second reverse instruction slice.

[0108] In one embodiment, the reference function includes a vulnerable function and a repair function; the reference anchor graph includes a reference anchor graph of the vulnerable function and a reference anchor graph of the repair function; the reference patch path includes a reference patch path of the vulnerable function and a reference patch path of the repair function. The reference module 210 is specifically used for at least one of the following: The path that exists in the reference anchor graph of the vulnerable function but not in the reference anchor graph of the repair function is used as the reference patch path of the vulnerable function; the path that does not exist in the reference anchor graph of the vulnerable function but exists in the reference anchor graph of the repair function is used as the reference patch path of the repair function. Based on the distribution frequency of each anchor node in the reference anchor graph of the vulnerable function, the path weight value of each path in the reference anchor graph of the vulnerable function is determined, and the path with the highest path weight value is used as the reference patch path of the vulnerable function; based on the distribution frequency of each anchor node in the reference anchor graph of the repair function, the path weight value of each path in the reference anchor graph of the repair function is determined, and the path with the highest path weight value is used as the reference patch path of the repair function.

[0109] In one embodiment, the reference function includes a vulnerable function and a repair function; the reference context path includes a reference predecessor context path of the vulnerable function, a reference successor context path of the vulnerable function, a reference predecessor context path of the repair function, and a reference successor context path of the repair function; each candidate context path includes each candidate predecessor context path and each candidate successor context path. The determining module 230 is specifically used for: The reference predecessor context path of the vulnerable function and the reference predecessor context path of the repair function are used as the reference predecessor path; The reference successor context path of the vulnerable function and the reference successor context path of the repair function are used as reference successor paths; For any candidate patch path among the candidate patch paths, a first distance is determined based on the candidate successor context path and the candidate patch path; a second distance is determined based on the reference successor path and the reference patch path; a third distance is determined based on the candidate predecessor context path and the candidate patch path; and a fourth distance is determined based on the reference predecessor path and the reference patch path. The first distance being less than or equal to the second distance and the third distance being less than or equal to the fourth distance are set as preset conditions, and the path that satisfies the preset conditions is set as the target patch path.

[0110] In one embodiment, the reference function includes a vulnerable function and a repair function; the reference patch path includes a reference patch path for the vulnerable function and a reference patch path for the repair function; the reference context path includes a reference context path for the vulnerable function and a reference context path for the repair function. The detection module 240 is specifically used for any of the following: If the patch type includes deletion type and addition type, the target patch path matches the reference patch path of the vulnerable function successfully, the target context path matches the reference context path of the vulnerable function successfully, the target patch path fails to match the reference patch path of the repair function, and the target context path fails to match the reference context path of the repair function, then it is determined that the target function does not have a patch. If the patch type is deletion type, the target patch path matches the reference patch path of the vulnerable function, and the target context path matches the reference context path of the vulnerable function, then it is determined that the target function does not have a patch. If the patch type is new, the target patch path fails to match the reference patch path of the repair function, and the target context path successfully matches the reference context path of the repair function, then it is determined that the target function does not have a patch.

[0111] Figure 3 This example illustrates one of the physical structural diagrams of an electronic device, such as... Figure 3 As shown, the electronic device may include: a processor 310, a communications interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communications interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute the patch detection method described in any of the above embodiments, for example including: Based on the control flow graph of the reference function, a reference anchor graph of the reference function is constructed, and a reference patch path and a reference context path are determined from the reference anchor graph; Based on the control flow graph of the objective function, construct the target anchor graph of the objective function; based on the reference patch path and the reference context path, determine each candidate patch path and each candidate context path from the target anchor graph; Based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, a target patch path is determined from each candidate patch path, and a target context path is determined based on the target patch path; The existence status of the patch in the target function is determined based on the patch type of the reference function, the reference patch path, the reference context path, the target patch path, and the target context path.

[0112] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to perform the patch detection method provided by the above methods, the method including: Based on the control flow graph of the reference function, a reference anchor graph of the reference function is constructed, and a reference patch path and a reference context path are determined from the reference anchor graph; Based on the control flow graph of the objective function, construct the target anchor graph of the objective function; based on the reference patch path and the reference context path, determine each candidate patch path and each candidate context path from the target anchor graph; Based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, a target patch path is determined from each candidate patch path, and a target context path is determined based on the target patch path; The existence status of the patch in the target function is determined based on the patch type of the reference function, the reference patch path, the reference context path, the target patch path, and the target context path.

[0114] In another aspect, this application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the patch detection methods provided by the methods described above, the method comprising: Based on the control flow graph of the reference function, a reference anchor graph of the reference function is constructed, and a reference patch path and a reference context path are determined from the reference anchor graph; Based on the control flow graph of the objective function, construct the target anchor graph of the objective function; based on the reference patch path and the reference context path, determine each candidate patch path and each candidate context path from the target anchor graph; Based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, a target patch path is determined from each candidate patch path, and a target context path is determined based on the target patch path; The existence status of the patch in the target function is determined based on the patch type of the reference function, the reference patch path, the reference context path, the target patch path, and the target context path.

[0115] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

Claims

1. A patch detection method, characterized in that, include: Based on the control flow graph of the reference function, a reference anchor graph of the reference function is constructed, and a reference patch path and a reference context path are determined from the reference anchor graph; Based on the control flow graph of the objective function, construct the target anchor graph of the objective function; based on the reference patch path and the reference context path, determine each candidate patch path and each candidate context path from the target anchor graph; Based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, a target patch path is determined from each candidate patch path, and a target context path is determined based on the target patch path; The existence status of the patch in the target function is determined based on the patch type of the reference function, the reference patch path, the reference context path, the target patch path, and the target context path.

2. The patch detection method according to claim 1, characterized in that, The step of constructing the reference anchor graph of the reference function based on the control flow graph of the reference function includes: Obtain the first key instruction in the control flow graph of the reference function, and determine the first anchor node based on the first key instruction; Based on the first anchor node, construct the reference anchor graph of the reference function; The step of constructing the target anchor graph of the objective function based on the control flow graph of the objective function includes: Obtain the second key instruction in the control flow graph of the objective function, and determine the second anchor node based on the second key instruction; Based on the second anchor node, construct the target anchor graph of the objective function; The first key instruction includes a first condition comparison instruction and a first function call instruction; The second key instruction includes a second condition comparison instruction and a second function call instruction.

3. The patch detection method according to claim 2, characterized in that, The step of determining the first anchor node according to the first key instruction includes: The first reverse instruction slice is determined based on the operands in the first conditional comparison instruction and / or the parameter loading operation in the first function call instruction; The first anchor node is determined based on the first reverse instruction slice; The step of determining the second anchor node according to the second key instruction includes: The second reverse instruction slice is determined based on the operands in the second conditional comparison instruction and / or the parameter loading operation in the second function call instruction; The second anchor node is determined based on the second reverse instruction slice.

4. The patch detection method according to claim 1, characterized in that, The reference function includes the vulnerable function and the repair function; the reference anchor graph includes the reference anchor graph of the vulnerable function and the reference anchor graph of the repair function; the reference patch path includes the reference patch path of the vulnerable function and the reference patch path of the repair function. Determining the reference patch path from the reference anchor point graph includes at least one of the following: The path that exists in the reference anchor graph of the vulnerable function but does not exist in the reference anchor graph of the repair function is used as the reference patch path of the vulnerable function; the path that does not exist in the reference anchor graph of the vulnerable function but exists in the reference anchor graph of the repair function is used as the reference patch path of the repair function. Based on the distribution frequency of each anchor node in the reference anchor graph of the vulnerable function, the path weight value of each path in the reference anchor graph of the vulnerable function is determined, and the path with the highest path weight value is used as the reference patch path of the vulnerable function; based on the distribution frequency of each anchor node in the reference anchor graph of the repair function, the path weight value of each path in the reference anchor graph of the repair function is determined, and the path with the highest path weight value is used as the reference patch path of the repair function.

5. The patch detection method according to claim 1, characterized in that, The reference function includes a vulnerable function and a repair function; the reference context path includes the reference predecessor context path of the vulnerable function, the reference successor context path of the vulnerable function, the reference predecessor context path of the repair function, and the reference successor context path of the repair function; each candidate context path includes each candidate predecessor context path and each candidate successor context path. The step of determining the target patch path from the candidate patch paths based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, includes: The reference predecessor context path of the vulnerable function and the reference predecessor context path of the repair function are used as the reference predecessor path; The reference successor context path of the vulnerable function and the reference successor context path of the repair function are used as reference successor paths; For any candidate patch path among the candidate patch paths, a first distance is determined based on the candidate successor context path and the candidate patch path; a second distance is determined based on the reference successor path and the reference patch path; a third distance is determined based on the candidate predecessor context path and the candidate patch path; and a fourth distance is determined based on the reference predecessor path and the reference patch path. The first distance being less than or equal to the second distance and the third distance being less than or equal to the fourth distance are set as preset conditions, and the path that satisfies the preset conditions is set as the target patch path.

6. The patch detection method according to claim 1, characterized in that, The reference functions include vulnerable functions and repair functions; the reference patch paths include reference patch paths for vulnerable functions and reference patch paths for repair functions. The reference context path includes the reference context path of the vulnerable function and the reference context path of the fix function; Determining the existence status of the patch in the target function based on the patch type of the reference function, the reference patch path, the reference context path, and the target patch path includes any one of the following: If the patch type includes deletion type and addition type, the target patch path matches the reference patch path of the vulnerable function successfully, the target context path matches the reference context path of the vulnerable function successfully, the target patch path fails to match the reference patch path of the repair function, and the target context path fails to match the reference context path of the repair function, then it is determined that the target function does not have a patch. If the patch type is deletion type, the target patch path matches the reference patch path of the vulnerable function, and the target context path matches the reference context path of the vulnerable function, then it is determined that the target function does not have a patch. If the patch type is new, the target patch path fails to match the reference patch path of the repair function, and the target context path successfully matches the reference context path of the repair function, then it is determined that the target function does not have a patch.

7. A patch detection device, characterized in that, include: The reference module is used to construct a reference anchor graph of the reference function based on the control flow graph of the reference function, and to determine the reference patch path and reference context path from the reference anchor graph; The candidate module is used to construct a target anchor graph of the objective function based on the control flow graph of the objective function; and to determine each candidate patch path and each candidate context path from the target anchor graph based on the reference patch path and the reference context path. The determination module is used to determine the target patch path from the candidate patch paths based on the distance between each candidate patch path and each candidate context path, and the distance between the reference patch path and the reference context path, and to determine the target context path based on the target patch path; The detection module is used to determine the existence status of the patch in the target function based on the patch type of the reference function, the reference patch path, the reference context path, the target patch path, and the target context path.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the patch detection method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the patch detection method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the patch detection method as described in any one of claims 1 to 6.

Images