Localizing Patch Points From One Exploit

by   Shiqi Shen, et al.

Automatic patch generation can significantly reduce the window of exposure after a vulnerability is disclosed. Towards this goal, a long-standing problem has been that of patch localization: to find a program point at which a patch can be synthesized. We present PatchLoc, one of the first systems which automatically identifies such a location in a vulnerable binary, given just one exploit, with high accuracy. PatchLoc does not make any assumptions about the availability of source code, test suites, or specialized knowledge of the vulnerability. PatchLoc pinpoints valid patch locations in large real-world applications with high accuracy for about 88 results stem from a novel approach to automatically synthesizing a test-suite which enables probabilistically ranking and effectively differentiating between candidate program patch locations.


page 1

page 2

page 3

page 4


Repairnator patches programs automatically

Repairnator is a bot. It constantly monitors software bugs discovered du...

Minority Reports Defense: Defending Against Adversarial Patches

Deep learning image classification is vulnerable to adversarial attack, ...

Exploring Plausible Patches Using Source Code Embeddings in JavaScript

Despite the immense popularity of the Automated Program Repair (APR) fie...

Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response

Considerable delays often exist between the discovery of a vulnerability...

RoBin: Facilitating the Reproduction of Configuration-Related Vulnerability

Vulnerability reproduction paves a way in debugging software failures, w...

Providing Real-time Assistance for Repairing Runtime Exceptions using Stack Overflow Posts

Runtime Exceptions (REs) are an important class of bugs that occur frequ...

Vulnerability Forecasting: In theory and practice

Why wait for zero-days when you could predict them in advance? It is pos...