AutoPaG: towards automated software patch generation with source code root cause identification and repair

摘要: Software patch generation is a critical phase in the life-cycle of software vulnerability. The longer it takes to generate patch, higher risk vulnerable system needs take avoid from being compromised. However, practice, rather lengthy process and release patches. For example, analysis on 10 recent Microsoft patches (MS06-045 MS06-054) shows that, for an identified vulnerability, took 75 days average patch.In this paper, we present design, implementation, evaluation AutoPaG, that aims at reducing time needed generation. In our current work, mainly focus common serious type vulnerability: out-of-bound vulnerability which includes buffer overflows general boundary condition errors. Given working exploit may be previously unknown, AutoPaG able catch fly violation, then, based data flow analysis, automatically analyzes program source code identifies root cause - source-level statements. Furthermore, within seconds, generates fine-grained temporarily fix without any human intervention. We have built proof-of-concept Linux preliminary results are promising: successfully identify seconds every test Wilander's overflow benchmark test-suite. addition, with number real-world exploits also demonstrates its effectiveness practicality identifying (vulnerable) causes generating corresponding