SeHBPL: Behavioral Semantics-Based Patch Presence Test for Binaries

Patch presence testing is a critical component of risk and loss assessment for software vulnerabilities. By determining whether a patch has been applied to their software, organizations can better understand their exposure to potential threats. Many schemes for patch presence testing have be proposed. However, they did not consider the challenges brought about by various compilation options, they are not practical when testing patch presence for binaries compiled with complex compilation configurations. To address the issue, we propose a new semantic-level feature named “behavioral semantics” to represent fixing patches precisely and stably. Behavioral semantics is a high-level abstraction of functions within binaries and is not affected by compilation differences. It consists of the behavior performed by the function and the path constraints for the behavior. We implement a system named SeHBPL based on behavioral semantics, and test patch presence by generating a behavioral semantics signature of the patch and searching for it in the target binary. SeHBPL is tested with 6,912 binaries corresponding to 91 vulnerabilities and achieves high accuracy and precision, outperforming the state-of-the-art tool. This paper presents a novel approach to patch presence testing that overcomes the limitations of current methods and has the potential to significantly improve risk and loss assessment.