PATEN: Identifying Unpatched Third-Party APIs via Fine-Grained Patch-Enhanced AST-Level Signature

Using a third-party library (TPL) API that is still unpatched with respect to known vulnerabilities would introduce severe security threats, and thus it is important to detect unpatched API as early as possible. Existing vulnerability detection methods often fail to identify subtle differences between patched and vulnerable versions of code, leading to high rates of false positives and missed vulnerabilities. Addressing these limitations, we propose a novel approach that employs a fine-grained, patch-enhanced Abstract Syntax Tree (AST) level signature. This approach consists of two key steps: patch-induced AST difference extraction and vulnerability trace refinement. These steps enable the detailed analysis of structural changes due to patches and enhance the accuracy of vulnerability detection by focusing on the critical elements of code changes. Building on this methodology, we introduce PATEN, a tool designed to accurately detect unpatched TPL APIs. Our evaluation, conducted on a large dataset, demonstrates that PATEN significantly outperforms the state-of-the-art approaches. Specifically, PATEN identified 82 critical vulnerabilities across numerous open-source projects, demonstrating a substantial advancement in the field of unpatched TPL API detection and highlighting its practical implications for improving software security.