Automated Patch Impact Analysis (PATCH)

自动补丁影响分析 (PATCH)

• 批准号: EP/X040836/1
• 负责人: Cristian Cadar
• 金额: $ 16.47万
• 依托单位: Imperial College London
• 依托单位国家: 英国
• 项目类别: Research Grant
• 财政年份: 2023
• 资助国家: 英国
• 起止时间: 2023 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=EP%2FX040836%2F1
• 关键词: Automated; Patch; Impact; Analysis; PATCH

Software is in constant evolution. Software changes to implement new features, adapt to new hardware and platforms, fix bugs and security vulnerabilities, or improve non-functional properties, such as performance and energy consumption.Reasoning about all possible new behaviours introduced by a software change is hard. As a result, software changes -- usually called patches -- frequently introduce new bugs and security vulnerabilities, often with disastrous consequences.In this project, we aim to leverage recent research results from the ERC Consolidator Grant "PASS: Program Analysis for Safe and Secure Software Evolution" to provide an automatic patch impact analysis as part of a continuous integration platform. The key ideas are to reuse the work performed while analysing previous versions of the system and to target the analysis toward the code impacted by the patch.The end result of the analysis will be a set of test inputs that trigger the new behaviours introduced by the patch and detect any bugs that may have been introduced. The generated inputs can be either directly added to the test suite or extended to validate that the patch reflects the programmers' intended changes.

软件在不断发展。软件变更是为了实现新功能、适应新的硬件和平台、修复漏洞和安全漏洞，或改善非功能属性（如性能和能耗）。很难对软件变更引入的所有可能的新行为进行推理。因此，软件的变化-通常称为补丁-经常引入新的错误和安全漏洞，往往与灾难性的后果。在这个项目中，我们的目标是利用最近的研究结果，从ERC Consolidator赠款“通过：程序分析安全和安全的软件进化”，提供一个自动补丁的影响分析，作为一个持续集成平台的一部分。其核心思想是重用在分析系统以前版本时执行的工作，并将分析目标锁定在受补丁影响的代码上。分析的最终结果将是一组测试输入，这些输入触发补丁引入的新行为，并检测可能引入的任何错误。生成的输入可以直接添加到测试套件中，也可以扩展以验证补丁是否反映了程序员的预期更改。