API Blindspots: Why Experienced Developers Write Vulnerable Code
API Blindspots: Why Experienced Developers Write Vulnerable Code
复制标题
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
D. Oliveira;Tian Lin;Muhammad Sajidur Rahman;Rad Akefirad;D. Ellis;Eliany Perez;Rahul Bobhate;L. DeLong;Justin Cappos;Yuriy Brun
中科院分区：
文献类型：
--
作者：
D. Oliveira;Tian Lin;Muhammad Sajidur Rahman;Rad Akefirad;D. Ellis;Eliany Perez;Rahul Bobhate;L. DeLong;Justin Cappos;Yuriy Brun
尽管安全社区尽了最大的努力，软件中的安全漏洞仍然普遍存在，每天都有新的漏洞报告，旧的漏洞顽固地重复出现。这些漏洞的一个潜在来源是所使用的语言和库API中的缺陷。开发人员倾向于信任API，但可能会误解或滥用它们，从而引入漏洞。我们把这种滥用的原因称为盲点。在本文中，我们从开发人员的角度研究API盲点，以：（1）确定开发人员在代码中检测API盲点的程度，以及（2）检查开发人员特征（即，对代码正确性的感知、对代码的熟悉程度、自信心、专业经验、认知功能和个性）都会影响这种能力。我们对来自四个国家的109名开发人员进行了一项研究，他们解决了涉及已知包含盲点的Java API的编程难题。我们发现（1）盲点的存在与开发人员回答隐含安全问题的准确性以及开发人员识别代码中潜在安全问题的能力呈负相关。这种影响对于与I/O相关的API和圈复杂度较高的谜题更为明显。(2)更高的认知功能和更多的编程经验并不能预测更好的检测API盲点的能力。(3)开发人员表现出更大的开放性作为一种个性特征，更有可能发现API盲点。这项研究有可能在以下方面推进API安全性：（1）新API的设计、实现和测试;（2）解决传统API中的盲点;（3）开发基于认知和个性评估的开发人员招募和培训新方法;以及（4）改进软件开发流程（例如，建立安全和功能团队）。
Despite the best efforts of the security community, security vulnerabilities in software are still prevalent, with new vulnerabilities reported daily and older ones stubbornly repeating themselves. One potential source of these vulnerabilities is shortcomings in the used language and library APIs. Developers tend to trust APIs, but can misunderstand or misuse them, introducing vulnerabilities. We call the causes of such misuse blindspots. In this paper, we study API blindspots from the developers’ perspective to: (1) determine the extent to which developers can detect API blindspots in code and (2) examine the extent to which developer characteristics (i.e., perception of code correctness, familiarity with code, confidence, professional experience, cognitive function, and personality) affect this capability. We conducted a study with 109 developers from four countries solving programming puzzles that involve Java APIs known to contain blindspots. We find that (1) The presence of blindspots correlated negatively with the developers’ accuracy in answering implicit security questions and the developers’ ability to identify potential security concerns in the code. This effect was more pronounced for I/O-related APIs and for puzzles with higher cyclomatic complexity. (2) Higher cognitive functioning and more programming experience did not predict better ability to detect API blindspots. (3) Developers exhibiting greater openness as a personality trait were more likely to detect API blindspots. This study has the potential to advance API security in (1) design, implementation, and testing of new APIs; (2) addressing blindspots in legacy APIs; (3) development of novel methods for developer recruitment and training based on cognitive and personality assessments; and (4) improvement of software development processes (e.g., establishment of security and functionality teams).