The number of vulnerabilities reported in open source software has increased substantially in recent years. Security patches provide the necessary measures to protect software from attacks and vulnerabilities. In practice, it is difficult to identify whether patches have been integrated into software, especially if we only have binary files. Therefore, the ability to test whether a patch is applied to the target binary, a.k.a. patch presence test, is crucial for practitioners. However, it is challenging to obtain accurate semantic information from patches, which could lead to incorrect results. In this paper, we propose a new patch presence test framework named PPT4J ($\textbf{P}$atch $\textbf{P}$resence $\textbf{T}$est $\textbf{for}$ $\textbf{J}$ava Binaries). PPT4J is designed for open-source Java libraries. It takes Java binaries (i.e. bytecode files) as input, extracts semantic information from patches, and uses feature-based techniques to identify patch lines in the binaries. To evaluate the effectiveness of our proposed approach PPT4J, we construct a dataset with binaries that include 110 vulnerabilities. The results show that PPT4J achieves an F1 score of 98.5% with reasonable efficiency, improving the baseline by 14.2%. Furthermore, we conduct an in-the-wild evaluation of PPT4J on JetBrains IntelliJ IDEA. The results suggest that a third-party library included in the software is not patched for two CVEs, and we have reported this potential security problem to the vendor.

翻译：近年来，开源软件中报告的漏洞数量大幅增加。安全补丁为保护软件免受攻击和漏洞侵害提供了必要措施。实践中，判断补丁是否已集成到软件中十分困难，尤其是在仅拥有二进制文件的情况下。因此，检测补丁是否已应用于目标二进制文件（即补丁存在性测试）的能力对从业人员至关重要。然而，从补丁中获取准确的语义信息充满挑战，这可能导致错误结果。本文提出一种名为PPT4J（$\textbf{P}$atch $\textbf{P}$resence $\textbf{T}$est $\textbf{for}$ $\textbf{J}$ava Binaries）的新型补丁存在性测试框架。PPT4J专为开源Java库设计，以Java二进制文件（即字节码文件）为输入，从补丁中提取语义信息，并采用基于特征的技术来识别二进制文件中的补丁代码行。为评估所提方法PPT4J的有效性，我们构建了一个包含110个漏洞的二进制文件数据集。结果表明，PPT4J在合理效率下实现了98.5%的F1分数，相比基线方法提升了14.2%。此外，我们在JetBrains IntelliJ IDEA上对PPT4J进行了真实场景评估。结果发现该软件中包含的某个第三方库未针对两个CVE漏洞进行修补，我们已将此潜在安全问题报告给供应商。