Beyond Fuzzy Matching: Constraint-Guided Patch Presence Testing for Obfuscated Java Binaries

Patch presence testing (PPT) is critical for mitigating vulnerabilities introduced by the use of third-party libraries (TPLs) in Java programs. However, the widespread use of obfuscation significantly undermines its accuracy by altering patch-relevant features. To preserve feature consistency before and after obfuscation for reliable comparison, existing studies summarize patch digests using several representative fuzzy features. These fuzzy features, designed to generalize obfuscation-prone details, have proven effective in TPL detection. Nevertheless, this approach faces limitations when directly applied to PPT, where finer features are needed to capture subtle patch changes. Although patch digests facilitate feature matching under obfuscation-induced code changes with high efficiency, methods with similar semantic structures—common in TPLs due to factors such as overriding and inheritance—often exhibit identical digests. Relying solely on feature similarity without considering method constraints often results in inaccurate outcomes.