The number of vulnerabilities reported in open source software has increased substantially in recent years. Security patches provide the necessary measures to protect software from attacks and vulnerabilities. In practice, it is difficult to identify whether patches have been integrated into software, especially if we only have binary files. Therefore, the ability to test whether a patch is applied to the target binary, a.k.a. patch presence test, is crucial for practitioners. However, it is challenging to obtain accurate semantic information from patches, which could lead to incorrect results. In this paper, we propose a new patch presence test framework named PPT4J ($\textbf{P}$atch $\textbf{P}$resence $\textbf{T}$est $\textbf{for}$ $\textbf{J}$ava Binaries). PPT4J is designed for open-source Java libraries. It takes Java binaries (i.e. bytecode files) as input, extracts semantic information from patches, and uses feature-based techniques to identify patch lines in the binaries. To evaluate the effectiveness of our proposed approach PPT4J, we construct a dataset with binaries that include 110 vulnerabilities. The results show that PPT4J achieves an F1 score of 98.5% with reasonable efficiency, improving the baseline by 15.6%. Furthermore, we conduct an in-the-wild evaluation of PPT4J on JetBrains IntelliJ IDEA. The results suggest that a third-party library included in the software is not patched for two CVEs, and we have reported this potential security problem to the vendor.

翻译：近年来，开源软件中报告的漏洞数量大幅增加。安全补丁提供了保护软件免受攻击和漏洞侵害的必要措施。实践中，识别补丁是否已集成到软件中十分困难，尤其是当仅拥有二进制文件时。因此，检测补丁是否应用于目标二进制文件的能力（即补丁存在性测试）对从业人员至关重要。然而，从补丁中获取准确的语义信息存在挑战，这可能导致错误结果。本文提出了一种名为PPT4J（$\textbf{P}$atch $\textbf{P}$resence $\textbf{T}$est $\textbf{for}$ $\textbf{J}$ava Binaries）的新型补丁存在性测试框架。PPT4J专为开源Java库设计，以Java二进制文件（即字节码文件）为输入，从补丁中提取语义信息，并采用基于特征的技术识别二进制文件中的补丁行。为评估所提方法PPT4J的有效性，我们构建了包含110个漏洞的二进制文件数据集。结果表明，PPT4J在合理效率下实现了98.5%的F1分数，将基线提升了15.6%。此外，我们在JetBrains IntelliJ IDEA上对PPT4J进行了实际环境评估。结果表明，软件中包含的第三方库存在两个CVE未打补丁，我们已向供应商报告了这一潜在安全问题。