一种层次化的安全补丁比较技术

Hierarchical Comparison of Executable Objects Based on Patches

安全补丁比较技术能有效揭示同一程序补丁前后的差异,通过差异分析得到所补漏洞的详细信息.提出一种层次化的安全补丁比较方法,设计并实现了一个层次化的安全补丁比较分析原型系统.首先利用结构化的比较方法基于函数调用图和函数控制流图进行程序分析,然后利用指令级图形化的比较方法从指令级分析程序的变化.该方法融合了图形化和结构化比较算法的优点,独立于CPU体系结构,能找出结构化和非结构化变动,实验证明了层次化比较方法的有效性,具有较低的误报率和漏报率.

Comparison of security patches is able to detect the changes between different versions of executables, analyzing changes can get the specific information of security vulnerability. This paper presents a security patch hierarchical comparison technology for discovery security vulnerability information, first uses structural comparison to compare program in call graph and control flow graph level, then use graphic comparison to detect instruction change in instruction level. This method utilizes strongpoint of both graphic and structural comparison, performs less false positive and false negative, is almost completely independence of the underlying CPU architecture and get unstructured changes. A prototype system of security patch analysis tool is designed and implemented which is proved by experiment that this method can effectively discover the changes because of the patch.