Should I Bother?
Fast Patch Filtering for Statically-Configured Software Variants
- verfasst von
- Tobias Landsberg, Christian Dietrich, Daniel Lohmann
- Abstract
In the face of critical security vulnerabilities, patch and update management are a crucial and challenging part of the software life cycle. In software product families, patching becomes even more challenging as we have to support different variants, which are not equally affected by critical patches. While the naive “better-patched-than-sorry” approach will apply all necessary updates, it provokes avoidable costs for developers and customers. In this paper we introduce SiB (Should I Bother?), a heuristic patch-filtering method for statically-configurable software that efficiently identifies irrelevant patches for specific variants. To solve the variability-aware patch-filtering problem, SiB compares modified line ranges from patches with those source-code ranges included in variants currently deployed. We apply our prototype for CPP-managed variability to four open-source projects (Linux, OpenSSL, SQLite, Bochs), demonstrating that SiB is both effective and efficient in reducing the number of to-be-considered patches for unaffected software variants. It correctly classifies up to 68 percent of variants as unaffected, with a recall of 100 percent, thus reducing deployments significantly, without missing any relevant patches.
- Organisationseinheit(en)
-
Fachgebiet System- und Rechnerarchitektur
- Externe Organisation(en)
-
Technische Universität Braunschweig
- Typ
- Aufsatz in Konferenzband
- Seiten
- 12-23
- Anzahl der Seiten
- 12
- Publikationsdatum
- 02.09.2024
- Publikationsstatus
- Veröffentlicht
- Peer-reviewed
- Ja
- ASJC Scopus Sachgebiete
- Mensch-Maschine-Interaktion, Computernetzwerke und -kommunikation, Maschinelles Sehen und Mustererkennung, Software
- Elektronische Version(en)
-
https://doi.org/10.1145/3646548.3672585 (Zugang:
Offen)
