检索结果-内蒙古大学图书馆

33rd ACM SIGSOFT International Conference on Software Testing and Analysis (ISSTA)

作者： Ma, Yunlong Tian, Wentong Gao, Xiang Sun, Hailong Li, Li Beihang Univ State Key Lab Complex & Crit Software Environm CC Beijing Peoples R China Beihang Univ Hangzhou Innovat Inst Beijing Peoples R China

ISBN: (纸本)9798400706127

api misuses can cause a range of issues in software development, including program crashes, bugs, and vulnerabilities. Different approaches have been developed to automatically detect api misuses by checking the program against usage rules extracted from extensive codebase or api documents. However, these mined rules may not be precise or complete, leading to high false positive/negative rates. In this paper, we propose a novel solution to this problem by representing the mined api usage rules as a probabilistic graphical model, where each rule's probability value represents its trustworthiness of being correct. Our approach automatically constructs probabilistic usage rules by mining codebase and documents, and aggregating knowledge from different sources. Here, the usage rules obtained from the codebase initialize the probabilistic model, while the knowledge from the documents serves as a supplement for adjusting and complementing the probabilities accordingly. We evaluate our approach on the MuBench benchmark. Experimental results show that our approach achieves 42.0% precision and 54.5% recall, significantly outperforming state-of-the-art approaches.

关键词： api misuse detection Mining Software Repository Document Mining Probabilistic Graphical Model

来源：评论

学校读者我要写书评

暂无评论

Boosting api misuse detection via Integrating api Constraints from Multiple Sources 21

Boosting API Misuse Detection via Integrating API Constraint...

引用

IEEE/ACM 21st International Conference on Mining Software Repositories (MSR)

作者： Li, Can Zhang, Jingxuan Tang, Yixuan Li, Zhuhang Sun, Tianyue Nanjing Univ Aeronaut & Astronaut Coll Comp Sci & Technol Nanjing Jiangsu Peoples R China

ISBN: (纸本)9798350363982;9798400705878

In modern software development, developers access reusable functionality provided by third-party libraries through Application Programming Interfaces (apis). However, using apis requires developers to conform specific constraints and guidelines, otherwise it may lead to api misuses. Existing approaches for api misuse detection often rely on analyzing api documentation or mining client code. However, these approaches are limited by the quality of api documentation and the naive assumption that deviations from common usage patterns in client code imply potential api misuses, making them less reliable. In this paper, we propose an approach that comprehensively integrates the api usage constraints from multiple sources, including client code, api documentation, and library code, to detect api misuses. First, we convert client code into api Usage Graphs (AUGs), extract the api usage patterns, and apply heuristic filtering rules to obtain api usage constraints. Meanwhile, we also analyze library code and api documentation to obtain various api usage constraints. Next, we combine the obtained api usage constraints from multiple sources together to generate a series of api preliminary constraint graphs. Based on these api preliminary constraint graphs, we design constraint alternative strategies to form api alternative constraint graphs. Finally, we parse the Abstract Syntax Tree (AST) of the test code and match it against api (alternative) constraint graphs to detect api misuses. The experimental evaluation demonstrates that our approach achieves the Precision of 72.22% and the Recall of 43.01% on the MUBench dataset, with an F1 score of 53.91%. These values significantly outperform existing state-of-the-art api misuse detection approaches, highlighting the effectiveness of integrating api usage constraints from various sources. Additionally, the designed heuristic filtering rules and constraint alternative strategies significantly reduce false positives, enhancing the Pre

关键词： api misuse detection api Constraint Extraction api Usage Graphs api Constraint Graphs

来源：评论

学校读者我要写书评

暂无评论

misuseHint: A Service for api misuse detection Based on Building Knowledge Graph from Documentation and Codebase

MisuseHint: A Service for API Misuse Detection Based on Buil...

引用

IEEE International Conference on Web Services (IEEE ICWS) / IEEE World Congress on Services (IEEE SERVICES)

作者： Liang, Qingmi Kuai, Zhirui Zhang, Yangqi Zhang, Zhiyang Kuang, Li Zhang, Lingyan Cent South Univ Sch Comp Sci & Engn Changsha Peoples R China

ISBN: (数字)9781665481434

ISBN: (纸本)9781665481434

Developers often call apis to improve development efficiency, but they misuse apis due to lack of understanding of source code logic and other unavoidable reasons, resulting in serious consequences such as program crashes. Many studies that extract api usage constraints from api documentation or codebases expect to get out of this dilemma through api misuse detection. However, low recall remains a hurdle for researchers to overcome. In this work, we make full use of api documentation and codebases to construct constraint knowledge graph, and propose a new api misuse detector, misuseHint. We precisely define api constraints into seven categories, utilize api caveat knowledge in documentation and api usage patterns in codebases, and fuse knowledge from both to build knowledge graph with rich constraints. To detect api misuses, we obtain api usage constraints in the knowledge graph and analyze static code to propose different strategies to determine whether api misuses exist. Through defect pattern analysis, object variable tracking, and Z3 SAT solver, our detector can identify various complex situations of code at a fine-grained level, especially solving various complex problems of Call Order and State Checking constraints. Experimental results on MUBench show that our recall reaches 39.78%, demonstrating the validity and theoretical feasibility of fusing documentation and codebases using knowledge graphs. misuseHint achieves a recall of 76.34% when it is always given sufficient api constraints. This detector can practically help developers program effectively.

关键词： api misuse detection Static Code Analysis Knowledge Graph Codebases api Documentation Program Structure Interface

来源：评论

学校读者我要写书评

暂无评论

On the Impact of Order Information in api Usage Patterns 13th

On the Impact of Order Information in API Usage Patterns

引用

13th International Conference on Software Technologies (ICSOFT)

作者： Cergani, Ervina Mezini, Mira Tech Univ Darmstadt Software Technol Grp Darmstadt Germany

ISBN: (纸本)9783030291570;9783030291563

Many approaches have been proposed for learning Application Programming Interface (api) usage patterns from code repositories. Depending on the underlying technique, the mined patterns may (1) be strictly sequential, (2) consider partial order between method calls, or (3) not consider order information. Understanding the trade-offs between these pattern types with respect to real code is important in many applications (e.g. misuse detection), given that apis often have usage constraints, such as restrictions on call order. api misuses, i.e., violations of these constraints, may lead to software crashes, bugs and vulnerabilities. In this paper, we present the results of a work that addresses this need. We have constructed a benchmark based on an episode mining algorithm that can be configured to learn three type of patterns: sequential, partial, and no-order patterns. We use the benchmark in two ways. First, we use it to empirically study the different types of the mined api usage patterns based on three well-defined metrics: expressiveness, consistency and generalizability. Second, we evaluate the effect of the different pattern types within the real application context of using them as an input to a misuse detector. We run the benchmark on two existing datasets consisting of: (1) 360 C# code repositories, and (2) four Java projects. We use the C# data set to empirically study the resulting api usage patterns, and the Java data set to evaluate the effect of different pattern types on the application context of misuse detection. For this purpose, we build EMDetect for detecting api misuses in Java projects. Our results show practical evidence that not only do partial-order patterns represent a generalized super set of sequential-order patterns, partial-order mining also finds additional patterns missed by sequence mining, which are used by a larger number of developers across code repositories. Additionally, our study empirically quantifies the importance of the orde

关键词： api usage pattern types api misuse detection Events mining Empirical study Benchmark

来源：评论

学校读者我要写书评

暂无评论

FUM - A Framework for api Usage constraint and misuse Classification 29

FUM - A Framework for API Usage constraint and Misuse Classi...

引用

29th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)

作者： Schlichtig, Michael Sassalla, Steffen Narasimhan, Krishna Bodden, Eric Paderborn Univ Heinz Nixdorf Inst Paderborn Germany Univ Potsdam Hasso Plattner Inst Potsdam Germany Tech Univ Darmstadt Darmstadt Germany Paderborn Univ Heinz Nixdoif Inst Paderborn Germany Fraunhofer IEM Paderborn Germany Paderborn Univ Paderborn Germany

ISBN: (纸本)9781665437868

Application Programming Interfaces (apis) are the primary mechanism that developers use to obtain access to third-party algorithms and services. Unfortunately, apis can be misused, which can have catastrophic consequences, especially if the apis provide security-critical functionalities like cryptography. Understanding what api misuses are, and for what reasons they are caused, is important to prevent them, e.g., with api misuse detectors. However, definitions and nominations for api misuses and related terms in literature vary and are diverse. This paper addresses the problem of scattered knowledge and definitions of api misuses by presenting a systematic literature review on the subject and introducing FUM, a novel Framework for api Usage constraint and misuse classification. The literature review revealed that api misuses are violations of api usage constraints. To capture this, we provide unified definitions and use them to derive FUM. To assess the extent to which FUM aids in determining and guiding the improvement of an api misuses detectors' capabilities, we performed a case study on CogniCrypt, a state-of-the-art misuse detector for cryptographic apis. The study showed that FUM can be used to properly assess CogniCrypt's capabilities, identify weaknesses and assist in deriving mitigations and improvements. And it appears that also more generally FUM can aid the development and improvement of misuse detection tools.

关键词： api misuses api usage constraints classification framework api misuse detection static analysis

来源：评论

学校读者我要写书评

暂无评论

ArCode: A Tool for Supporting Comprehension and Implementation of Architectural Concerns 29

ArCode: A Tool for Supporting Comprehension and Implementati...

引用

29th IEEE/ACM International Conference on Program Comprehension (ICPC) / 18th IEEE/ACM International Conference on Mining Software Repositories (MSR)

作者： Shokri, Ali Mirakhorli, Mehdi Rochester Inst Technol Dept Software Engn Rochester NY 14623 USA

ISBN: (纸本)9781665414036

Integrated development environments (IDE) play an important role in supporting developers during program comprehension and completion. Many of these supportive features focus on low-level programming and debugging activities. Unfortunately, there is less support in understanding and implementing architectural concerns in the form of patterns, tactics and/or other concerns. In this paper we present ArCode, a tool designed as a plugin for a popular IDE, IntelliJ IDEA. ArCode is able to learn correct ways of using frameworks' api to implement architectural concerns such as Authentication and Authorization from two sources, sample programs that practice the framework, and the byte code of that framework. Analyzing a program under development, this tool is able to find deviations from correct implementation and provide fix recommendations alongside with graphical demonstrations to better communicate the recommendations with the developers. We showcase how programmers can benefit from ArCode by providing an example of api misuse detection and api recommendation for a popular Java framework, Java Authentication and Authorization (JAAS) security framework.

关键词： Terms api Specification Architectural Concerns api Usage Model api Recommendation api misuse detection

来源：评论

学校读者我要写书评

暂无评论

Mining api Constraints from Library and Client to Detect api misuses 28

Mining API Constraints from Library and Client to Detect API...

引用

28th Asia-Pacific Software Engineering Conference (APSEC)

作者： Zcng, Hushuang Chen, Jingxin Shen, Bcijun Zhong, Hao Shanghai Jiao Tong Univ Sch Elect Informat & Elect Engn Shanghai Peoples R China

ISBN: (纸本)9781665437844

Calling Application Programming Interfaces (apis) shall follow various constraints (e.g., call orders). If these constraints are violated, api misuses are introduced to code, and such misuses can cause severe bugs. To effectively detect api misuses, most prior approaches mine constraints from client code, and assume that the violations of constraints are potential misuses. However, as client code only illustrates a small portion of api usages, constraints mined from client code are typically incomplete. As a result, when mined constraints are used to detect bugs, many violations of constraints turn out to be false positives. In this paper, our research purpose is to find more misuses and to reduce false positives. As library code contains many details on apis, we propose an approach that mines api constraints from both client and library code. From client code, our approach builds api usage graphs and uses a frequent subgraph mining algorithm to mine frequent usage patterns as api constraints. From library code, our approach derives various types of constraints with our predefined strategies. With constraints from both sources, our graph matching algorithm can detect api misuses. As a result, our approach takes advantage from both the comprehensiveness and informativeness of library-based constraints and the accuracy of client-based patterns. We compared our approach with MuDetect on the MuBench dataset. Our results show that it significantly improves the detection effectiveness of MuBench from 39.5% to 50.2% of the recall, and from 30.6% to 41.7% of the precision.

关键词： api misuse detection api usage pattern api constraint

来源：评论

学校读者我要写书评

暂无评论

ArCode: Facilitating the Use of Application Frameworks to Implement Tactics and Patterns 18

ArCode: Facilitating the Use of Application Frameworks to Im...

引用

18th IEEE International Conference on Software Architecture (ICSA)

作者： Shokri, Ali Santos, Joanna C. S. Mirakhorli, Mehdi Rochester Inst Technol Rochester NY 14623 USA

ISBN: (纸本)9781728162607

Software designers and developers are increasingly relying on application frameworks as first-class design concepts. They instantiate the services that frameworks provide to implement various architectural tactics and patterns. One of the challenges in employing frameworks for such tasks is the difficulty of learning and correctly using the apis of the frameworks. This paper introduces a learning-based approach called ARCODE to help novice programmers correctly use frameworks' apis to implement architectural tactics and patterns. ARCODE has several novel components: a graph-based approach for learning specification of a framework from a limited number of training software, a program analysis algorithm to eliminate erroneous training data, and a recommender module to help programmers use apis correctly and identify api misuses in their program. We evaluated our technique across two popular frameworks: JAAS security framework used for authentication and authorization tactic and Java RMI framework used to enable remote method invocation between client and server and other object oriented patterns. Our results demonstrate (i) the feasibility of using ARCODE to learn the specification of a framework;(ii) ARCODE generates accurate recommendations for finding the next api call to implement an architectural tactic/pattern based on the context of the programmer's code;(iii) it accurately detects api misuses in the code that implements a tactic/pattern and provides fix recommendations. We also demonstrate that ArCode outperforms two famous techniques, MAPO and GrouMiner, on api recommendation and misuse detection tasks.

关键词： Software Framework Architectural Tactics api Specification api Usage Model api Recommendation api misuse detection

来源：评论

学校读者我要写书评

暂无评论

SSDTutor: A feedback-driven intelligent tutoring system for secure software development

引用

SCIENCE OF COMPUTER PROGRAMMING 2023年第1期227卷

作者： Newar, Dip Kiran Pradhan Zhao, Rui Siy, Harvey Soh, Leen-Kiat Song, Myoungkyu Univ Nebraska Dept Comp Sci Omaha NE 68182 USA Univ Nebraska Lincoln Dept Comp Sci Lincoln NE 68588 USA

Application Programming Interfaces (apis) in cryptography typically impose concealed us-age constraints. The violations of these usage constraints can lead to software crashes or security vulnerabilities. Several professional tools can detect these constraints (api misuses) in cryptography;however, in the educational programs, the focus has been less on helping students implement an application without cryptographic api misuses that are caused by either a lack of cryptographic knowledge or programming *** address the problem, we present an intelligent tutoring approach SSDTutor for edu-cating Secure Software Development. Our tutoring approach helps students or developers repair cryptographic api misuse defects by leveraging an automated program repair tech-nique based on the usage patterns of cryptographic apis. We studied the best practices of cryptographic implementations and encoded eight cryptographic api usage patterns. For quality feedback, we leverage a clone detection technique to recommend related feedback for helping students understand why their programs are incorrect, rather than blindly ac-cepting *** evaluated SSDTutor on 456 open source subject projects implemented with crypto-graphic apis. SSDTutor successfully detected 1,553 out of 1,573 misuse defects with 98.9% accuracy and repaired 1,551 out of 1,573 misuse defects with 99.3% accuracy. In a user study involving 22 students, the participants reported that interactive SSDTutor's feedback recommendation could be valuable for novice students to learn about the correct usages of cryptography apis.(c) 2023 Elsevier B.V. All rights reserved.

关键词： api misuse detection Intelligent tutoring system Automated program repair Cryptography Secure software development

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：