Hierarchical Comparison of Executable Objects Based on Patches
Shuai Jian-mei · Journal of Chinese Computer Systems · 2008
Comparison of security patches is able to detect the changes between different versions of executables,analyzing changes can get the specific information of security vulnerability.This paper presents a security patch hierarchical comparison technology for discovery security vulnerability information,first uses structural comparison to compare program in call graph and control flow graph level,then use graphic comparison to detect instruction change in instruction level.This method utilizes strongpoint of both graphic and structural comparison,performs less false positive and false negative,is almost completely independence of the underlying CPU architecture and get unstructured changes.A prototype system of security patch analysis tool is designed and implemented which is proved by experiment that this method can effectively discover the changes because of the patch.