Pinpointing patch impact test targets using kernel tracing

Prompt updating against the latest security threats is important, and conveniently achieved by using patches (i.e., software updates) on both servers and PCs in a timely manner. To apply patches safely, however, their impact should be examined in advance. Administrators need to pinpoint all the software programs that are potentially influenced by a patch. Our patch impact analyzer monitors the program´s runtime behavior (i.e., library loadings) and identifies the full paths of those programs based on the kernel tracing method. Our method can identify even short-lived processes by introducing a self-constructed database of a program´s full paths and process information. Evaluation using our prototype implementation and method shows that the full paths can be identified in about 99% of the library loading events.