Wed 7 Nov 2018 13:30 - 13:52 at Horizons 5 - Software Analysis II Chair(s): Myra Cohen

Application Programming Interfaces (APIs) often have usage constraints, such as restrictions on call order or call conditions. API misuses, i.e., violations of these constraints, may lead to software crashes, bugs, and vulnerabilities. Though researchers developed many API-misuse detectors over the last two decades, recent studies show that API misuses are still prevalent. Therefore, we need to understand the capabilities and limitations of existing detectors in order to advance the state of the art. In this paper, we present the first-ever qualitative and quantitative evaluation that compares static API-misuse detectors along the same dimensions, and with original author validation. To accomplish this, we develop MuC, a classification of API misuses, and MuBenchPipe, an automated benchmark for detector comparison, on top of our misuse dataset, MuBench. Our results show that the capabilities of existing detectors vary greatly and that existing detectors, though capable of detecting misuses, suffer from extremely low precision and recall. A systematic root-cause analysis reveals that, most importantly, detectors need to go beyond the naive assumption that a deviation from the most-frequent usage corresponds to a misuse and need to obtain additional usage examples to train their models. We present possible directions towards more-powerful API-misuse detectors.

Conference Day
Wed 7 Nov

Displayed time zone: Guadalajara, Mexico City, Monterrey change

13:30 - 15:00
Software Analysis IIResearch Papers / Journal-First at Horizons 5
Chair(s): Myra CohenIowa State University
13:30
22m
Talk
A Systematic Evaluation of Static API-Misuse Detectors
Journal-First
Sven AmannTechnische Universit├Ąt Darmstadt, Hoan NguyenIowa State University, Sarah NadiUniversity of Alberta, Tien N. NguyenUniversity of Texas at Dallas, Mira MeziniTU Darmstadt
DOI
13:52
22m
Talk
Do Android Taint Analysis Tools Keep Their Promises?
Research Papers
Felix PauckPaderborn University, Germany, Eric BoddenHeinz Nixdorf Institut, Paderborn University and Fraunhofer IEM, Heike WehrheimPaderborn University
14:15
22m
Talk
Neural-Augmented Static Analysis of Android Communication
Research Papers
Jinman ZhaoUniversity of Wisconsin-Madison, USA, Aws AlbarghouthiUniversity of Wisconsin-Madison, Vaibhav RastogiUniversity of Wisconsin-Madison, USA, Somesh JhaUniversity of Wisconsin, Madison, Damien OcteauUniversity of Wisconsin and Pennsylvania State University
14:37
22m
Talk
Oreo: Detection of Clones in the Twilight Zone
Research Papers
Vaibhav SainiUniversity of California at Irvine, USA, Farima FarmahinifarahaniUniversity of California at Irvine, USA, Yadong LuUniversity of California at Irvine, USA, Pierre BaldiUniversity of California at Irvine, USA, Crista Lopes