Trace-weighted binary comparison for software update management

As software systems grow in complexity, they become difficult to manage. This applies to both developers, who must maintain the code, and users, who must decide when to accept updates. A software patch intended to fix one error may introduce a new problem in a more important part of the executable. This can be difficult to predict even when source code is available, which is often not the case. To help simplify this decision, we introduce a technique to estimate the impact of a software patch, based on how the software has been used in the past. We analyze programs for which we have source code to check the results, but our approach is intended to be useful even when there is no source code available. By analyzing a large number of related programs, which tend to share a substantial amount of code, we show that adding execution traces to the static binary analysis creates much more informative results than binary diffing alone