Visible to the public Inferring Crypto API Rules from Code Changes

TitleInferring Crypto API Rules from Code Changes
Publication TypeConference Paper
Year of Publication2018
AuthorsPaletov, Rumen, Tsankov, Petar, Raychev, Veselin, Vechev, Martin
Conference NameProceedings of the 39th ACM SIGPLAN Conference on Programming Language Design and Implementation
PublisherACM
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-5698-5
Keywordscryptology, Human Behavior, learning, Metrics, Misuse of Cryptography, policy-based governance, pubcrawl, Resiliency, Scalability, security
AbstractCreating and maintaining an up-to-date set of security rules that match misuses of crypto APIs is challenging, as crypto APIs constantly evolve over time with new cryptographic primitives and settings, making existing ones obsolete. To address this challenge, we present a new approach to extract security fixes from thousands of code changes. Our approach consists of: (i) identifying code changes, which often capture security fixes, (ii) an abstraction that filters irrelevant code changes (such as refactorings), and (iii) a clustering analysis that reveals commonalities between semantic code changes and helps in eliciting security rules. We applied our approach to the Java Crypto API and showed that it is effective: (i) our abstraction effectively filters non-semantic code changes (over 99% of all changes) without removing security fixes, and (ii) over 80% of the code changes are security fixes identifying security rules. Based on our results, we identified 13 rules, including new ones not supported by existing security checkers.
URLhttp://doi.acm.org/10.1145/3192366.3192403
DOI10.1145/3192366.3192403
Citation Keypaletov_inferring_2018