论文标题
基于示例的漏洞检测和修复Java代码
Example-Based Vulnerability Detection and Repair in Java Code
论文作者
论文摘要
JAVA库JCA和JSSE提供加密API，以促进安全编码。当开发人员滥用某些API时，他们的代码就会容易受到网络攻击的影响。为了消除这种漏洞，人们建立了通过模式匹配来检测安全性滥用的工具。但是，大多数工具不会（1）修复滥用或（2）允许用户扩展工具的模式集。为了克服这两个局限性，我们创建了基于示例的示例方法来检测和修复安全性滥用。给定示例<iNSEACURE，安全>代码对，SIADER比较了摘要以推断任何API-MISUSE模板和相应的修复编辑。根据推论信息，给定一个程序，Seader执行了手术间静态分析，以搜索安全性滥用并提出定制的修复程序。为了进行评估，我们将SIADER应用于28 <Insecure，Secure> codepairs; Seader成功推断了21个独特的API-Misuse模板和相关修复程序。有了这些<漏洞，修复>模式，我们将SIADER应用于具有86个已知漏洞的程序基准。 Seader检测到95％精度，72％的召回和82％的F-评分检测到漏洞。我们还将SIADER应用于100个开源项目，并手动检查了77个建议的维修； 76个维修是正确的。 SIDER可以帮助开发人员正确使用安全性API。
The Java libraries JCA and JSSE offer cryptographic APIs to facilitate secure coding. When developers misuse some of the APIs, their code becomes vulnerable to cyber-attacks. To eliminate such vulnerabilities, people built tools to detect security-API misuses via pattern matching. However, most tools do not (1) fix misuses or (2) allow users to extend tools' pattern sets. To overcome both limitations, we created Seader-an example-based approach to detect and repair security-API misuses. Given an exemplar <insecure, secure>code pair, Seader compares the snippets to infer any API-misuse template and corresponding fixing edit. Based on the inferred info, given a program, Seader performs inter-procedural static analysis to search for security-API misuses and to propose customized fixes. For evaluation, we applied Seader to 28 <insecure, secure> codepairs; Seader successfully inferred 21 unique API-misuse templates and related fixes. With these <vulnerability, fix> patterns, we applied SEADER to a program benchmark that has 86 known vulnerabilities. Seader detected vulnerabilities with 95% precision, 72% recall, and82% F-score. We also applied Seader to 100 open-source projects and manually checked 77 suggested repairs; 76 of the repairs were correct. Seader can help developers correctly use security APIs.
