AIPD: A Novel API Interception-Based Patch Deployment Method to Boost Software Security

Open source software (OSS) vulnerabilities are crucial for ensuring the security of software systems. Existing methods typically require application developers to patch their own operational environment clients, overlooking the security responsibilities that should be assumed by the operational environment providers. This often leads to failed patch deployments and affects the stability of the software systems. To address this issue, this paper proposes AIPD, a novel method for completing patch deployment at the manufacturing side. AIPD does not require modification of the OSS source code; instead, it extracts the core APIs involved in the vulnerability fixes and their dependencies from the source version, dynamically intercepts them in the target version's system environment, and replaces them with the patched API for secure updates. Experiments show that AIPD achieves a 91.35% patching accuracy on a dataset of 104 vulnerability patches containing 10 Python packages. In compatibility testing for the patch deployment environment, the pass rate for the relevant APIs reached 97.69%, effectively reducing the compatibility risks of the system environment.