基于决策树算法的API误用检测

Decision Tree Algorithm-based API Misuse Detection

通过应用程序编程接口(Application Programming Interface,API)复用已有的软件框架或类库,可有效地提高软件开发效率。然而,正确使用API须遵守很多规约,如调用顺序、异常处理等。若违反了这些规约就会造成API误用,进而可能导致软件崩溃、产生错误或漏洞。尽管很多API误用检测技术已经被提出,但是这些技术仍面临两个方面的挑战:1)难以获取API使用规约;2)难以同时检测多种不同类型的API误用。为了应对上述挑战,提出了一种基于决策树算法的API误用检测方法。首先,将API使用源代码转换为API使用图,从图中挖掘API使用规约,有效地应对了第一个挑战。其次,在获取的API规约信息的基础上构建API使用决策树,并通过融入剪枝策略来提高API使用决策树的泛化能力。最后,在检测阶段提出了粗粒度和细粒度相结合的检测方式,来提高API使用决策树的检测能力,有效地应对了第二个挑战。实验结果表明,该方法能够在一定程度上发现API误用缺陷。

Application programming interface(API)benefits to effectively improve software development efficiency by reusing existing software frameworks or libraries.However,many constraints must be satisfied to correctly use APIs,such as call order,exception handling.Violation of these constraints will cause API misuse,which may result in software crashes,errors,or vulnerabilities.Although many API misuse detection techniques have been proposed,these techniques still face two challenges:1)the acquisition of API usage specification is difficult,and 2)the detection of many different types of API misuse at the same time is difficult.To address the above challenges,a decision tree algorithm-based API misuse detection method is proposed.First,the API usage source code is converted into an API usage graph,and the API usage specification is mined from the graph to effectively solve the first challenge.Second,an API usage decision tree is constructed based on the obtained API specification information,and the generalization ability of the API usage decision tree is improved by incorporating pruning strategies.Finally,a combination of coarse-grained and fine-grained detection is proposed in the detection phase to improve the detection capability of the API usage decision tree,which effectively solves the second challenge.Experimental results show that the proposed approach can rea-lize detection of API misuse defects to a certain extent.