Example-Based Vulnerability Detection and Repair in Java Code
Example-Based Vulnerability Detection and Repair in Java Code
复制标题
DOI：
10.1145/3524610.3527895
复制
发表时间：
2022-03
期刊：
影响因子：
--
通讯作者：
Y. Zhang;Ya Xiao;Md Mahir Asef Kabir;D. Yao;Na Meng
中科院分区：
文献类型：
--
作者：
Y. Zhang;Ya Xiao;Md Mahir Asef Kabir;D. Yao;Na Meng
Java 库 JCA 和 JSSE 提供加密 API，以促进安全编码。当开发人员滥用某些 API 时，他们的代码就容易受到网络攻击。为了消除这些漏洞，人们开发了一些工具，通过模式匹配来检测安全 API 的滥用。然而，大多数工具都不能（1）修复滥用，或（2）允许用户扩展工具的模式集。为了克服这两个局限性，我们创建了Seader--一种基于示例的方法来检测和修复安全API误用。给定一个 $/langle\text{insecure，secure}/rangle$代码对范例，Seader会对代码段进行比较，以推断出任何API滥用模板和相应的修复编辑。根据推断出的信息，Seader 会对给定的程序进行程序间静态分析，以搜索安全-API 滥用，并提出定制的修复方案。为了进行评估，我们将Seader应用于28个$\langle\text{insecure, secure}\rangle$代码对；Seader成功地推断出21个独特的API滥用模板和相关修复。利用这些 $\langle\text{vulnerability, fix}\rangle$ 模式，我们将 Seader 应用于一个有 86 个已知漏洞的程序基准。Seader 以 95% 的精确度、72% 的召回率和 82% 的 F 分数检测到了漏洞。我们还将 Seader 应用于 100 个开源项目，并手动检查了 77 项修复建议；其中 76 项修复是正确的。Seader 可以帮助开发人员正确使用安全 API。
The Java libraries JCA and JSSE offer cryptographic APIs to facilitate secure coding. When developers misuse some of the APIs, their code becomes vulnerable to cyber-attacks. To eliminate such vulnerabilities, people built tools to detect security-API misuses via pattern matching. However, most tools do not (1) fix misuses or (2) allow users to extend tools' pattern sets. To overcome both limitations, we created Seader-an example-based approach to detect and repair security-API misuses. Given an exemplar $\langle\text{insecure, secure}\rangle$ code pair, Seader compares the snippets to infer any API-misuse template and corresponding fixing edit. Based on the inferred info, given a program, Seader performs inter-procedural static analysis to search for security-API misuses and to propose customized fixes. For evaluation, we applied Seader to 28 $\langle\text{insecure, secure}\rangle$ code pairs; Seader successfully inferred 21 unique API-misuse templates and related fixes. With these $\langle\text{vulnerability, fix}\rangle$ patterns, we applied Seader to a program benchmark that has 86 known vulnerabilities. Seader detected vulnerabilities with 95% precision, 72% recall, and 82% F-score. We also applied Seader to 100 open-source projects and manually checked 77 suggested repairs; 76 of the repairs were correct. Seader can help developers correctly use security APIs.