東華大學圖書館 |

Language: English

Help

回圖書館首頁

手機版館藏查詢

Back

Switch To: Labeled | MARC Mode | ISBD

N-Day Vulnerabilities: Detection, Bi...

Zhang, Zheng,

Linked to FindBook

Google Book

Amazon

博客來

N-Day Vulnerabilities: Detection, Bisection, and Measurement /

Record Type:	Electronic resources : Monograph/item
Title/Author:	N-Day Vulnerabilities: Detection, Bisection, and Measurement // Zheng Zhang.
Author:	Zhang, Zheng,
Description:	1 electronic resource (177 pages)
Notes:	Source: Dissertations Abstracts International, Volume: 86-10, Section: B.
Contained By:	Dissertations Abstracts International86-10B.
Subject:	Computer science. -
Online resource:	https://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=31847612
ISBN:	9798314813096

N-Day Vulnerabilities: Detection, Bisection, and Measurement /
Zhang, Zheng,

N-Day Vulnerabilities: Detection, Bisection, and Measurement /Zheng Zhang. - 1 electronic resource (177 pages)

Source: Dissertations Abstracts International, Volume: 86-10, Section: B.

Open-source projects are widely reused in commercial software, yet its collaborative nature exposes it to significant security challenges, particularly N-day vulnerabilities. These vulnerabilities remain exploitable after patches have been released, largely due to delayed patch propagation in decentralized ecosystems. This research addresses the critical issue of prolonged vulnerability exposure by exploring the underlying causes of patch delays and developing automated tools that can help accelerate the patch porting process and reduce the window for attackers. We first present a comprehensive measurement study of the Android kernel patch ecosystem, which systematically analyzes how security patches move from the Linux mainline through various layers of customization by chipset manufacturers and OEM vendors. Our findings indicate that patch delays are a systemic issue, with some patches taking months-or even over a year-to fully reach end-users, which increases the risk of exploitation. We analyzed the underlying causes, and one significant reason is that maintainers lack knowledge about which versions are affected by vulnerabilities. In other words, they are unsure when a vulnerability was introduced and which versions are impacted, making it unclear whether the versions they maintain need to be patched.Based on the above observations, we need to speed up the patch porting process to reduce the attack window of N-day vulnerabilities. Identifying the affected versions of these vulnerabilities is crucial for the patch porting process. Therefore, we tackle the challenge of bug bisection-the process of tracing vulnerabilities back to their originating commits. Traditional methods, such as dynamic testing and heuristic-based BIC (bug-inducing-commit, the change that first introduced the vulnerability into the codebase) identification, have shown limitations due to environmental inconsistencies and oversimplified assumptions. To overcome these issues, we introduce a novel approach that uses under-constrained symbolic execution to analyze code statically across multiple versions. This method precisely identifies whether the vulnerability logic exists in a given version, thereby isolating the bug-inducing commit. However, the above method still faces several limitations. It requires a proof-of-concept, supports only a narrow range of bug types, and its accuracy is not very high (although it is higher than that of traditional methods). These shortcomings drive us to explore alternative approaches. Finally, we enhance bug bisection by employing large language models (LLMs) that combine code diffs and contextual commit messages. This multi-step filtering approach, which uses both coarse-grained and fine-grained analysis, significantly improves the accuracy of vulnerability detection. Together, these integrated techniques can help accelerate the patching process and reduce the exposure window for N-day vulnerabilities, contributing to a more secure open-source ecosystem. These contributions offer practical solutions for swiftly mitigating vulnerabilities, enhancing open-source security, and ensuring robust resilience in critical software systems.

English

ISBN: 9798314813096Subjects--Topical Terms:

523869
Computer science.
Subjects--Index Terms:

Open-source projects

N-Day Vulnerabilities: Detection, Bisection, and Measurement /
LDR:04634nmm a22004333i 4500 001 2435169
005 20251001062504.5
006 m o d
007 cr|nu||||||||
008 261011s2025 miu||||||m |||||||eng d
020 $a 9798314813096
035 $a (MiAaPQD)AAI31847612
035 $a AAI31847612
040 $a MiAaPQD $b eng $c MiAaPQD $e rda
100 1 $a Zhang, Zheng, $e author. $3 3825382
245 1 0 $a N-Day Vulnerabilities: Detection, Bisection, and Measurement / $c Zheng Zhang.
264 1 $a Ann Arbor : $b ProQuest Dissertations & Theses, $c 2025
300 $a 1 electronic resource (177 pages)
336 $a text $b txt $2 rdacontent
337 $a computer $b c $2 rdamedia
338 $a online resource $b cr $2 rdacarrier
500 $a Source: Dissertations Abstracts International, Volume: 86-10, Section: B.
500 $a Advisors: Qian, Zhiyun Committee members: Yin, Heng; Sridharan, Manu; Song, Chengyu.
502 $b Ph.D. $c University of California, Riverside $d 2025.
520 $a Open-source projects are widely reused in commercial software, yet its collaborative nature exposes it to significant security challenges, particularly N-day vulnerabilities. These vulnerabilities remain exploitable after patches have been released, largely due to delayed patch propagation in decentralized ecosystems. This research addresses the critical issue of prolonged vulnerability exposure by exploring the underlying causes of patch delays and developing automated tools that can help accelerate the patch porting process and reduce the window for attackers. We first present a comprehensive measurement study of the Android kernel patch ecosystem, which systematically analyzes how security patches move from the Linux mainline through various layers of customization by chipset manufacturers and OEM vendors. Our findings indicate that patch delays are a systemic issue, with some patches taking months-or even over a year-to fully reach end-users, which increases the risk of exploitation. We analyzed the underlying causes, and one significant reason is that maintainers lack knowledge about which versions are affected by vulnerabilities. In other words, they are unsure when a vulnerability was introduced and which versions are impacted, making it unclear whether the versions they maintain need to be patched.Based on the above observations, we need to speed up the patch porting process to reduce the attack window of N-day vulnerabilities. Identifying the affected versions of these vulnerabilities is crucial for the patch porting process. Therefore, we tackle the challenge of bug bisection-the process of tracing vulnerabilities back to their originating commits. Traditional methods, such as dynamic testing and heuristic-based BIC (bug-inducing-commit, the change that first introduced the vulnerability into the codebase) identification, have shown limitations due to environmental inconsistencies and oversimplified assumptions. To overcome these issues, we introduce a novel approach that uses under-constrained symbolic execution to analyze code statically across multiple versions. This method precisely identifies whether the vulnerability logic exists in a given version, thereby isolating the bug-inducing commit. However, the above method still faces several limitations. It requires a proof-of-concept, supports only a narrow range of bug types, and its accuracy is not very high (although it is higher than that of traditional methods). These shortcomings drive us to explore alternative approaches. Finally, we enhance bug bisection by employing large language models (LLMs) that combine code diffs and contextual commit messages. This multi-step filtering approach, which uses both coarse-grained and fine-grained analysis, significantly improves the accuracy of vulnerability detection. Together, these integrated techniques can help accelerate the patching process and reduce the exposure window for N-day vulnerabilities, contributing to a more secure open-source ecosystem. These contributions offer practical solutions for swiftly mitigating vulnerabilities, enhancing open-source security, and ensuring robust resilience in critical software systems.
546 $a English
590 $a School code: 0032
650 4 $a Computer science. $3 523869
650 4 $a Computer engineering. $3 621879
650 4 $a Systems science. $3 3168411
653 $a Open-source projects
653 $a N-day vulnerabilities
653 $a Linux mainline
653 $a Bug bisection
653 $a Large language models
690 $a 0984
690 $a 0464
690 $a 0790
710 2 $a University of California, Riverside. $b Computer Science. $e degree granting institution. $3 3816005
720 1 $a Qian, Zhiyun $e degree supervisor.
773 0 $t Dissertations Abstracts International $g 86-10B.
790 $a 0032
791 $a Ph.D.
792 $a 2025
856 4 0 $u https://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=31847612