一句话：提出并落地 AWS 的 RAPID 分析，用值相关类型状态自动机与全局值流检查云服务 API 使用。
RAPID 是 AWS 开发的工业级静态分析，目标是自动、快速且可操作地反馈云服务 API 的正确使用方式。其核心洞察是云 API 围绕短生命周期的请求与响应对象组织，使用模式可表示为值相关的类型状态自动机，并通过局部类型状态与全局值流分析相结合进行验证。论文讨论了大规模部署中遇到的挑战，并通过评估验证设计选择与部署启发式。结果表明，RAPID 能在大型工业代码库中快速、精确地报告多种有用的 API 误用违规。
We present RAPID, an industrial-strength analysis developed at AWS that aims to help developers by providing automatic, fast and actionable feedback about correct usage of cloud-service APIs. RAPID’s design is based on the insight that cloud service APIs are structured around short-lived request- and response-objects whose usage patterns can be specified as value-dependent type-state automata and be verified by combining local type-state with global value-flow analyses. We describe various challenges that arose to deploy RAPID at scale. Finally, we present an evaluation that validates our design choices, deployment heuristics, and shows that RAPID is able to quickly and precisely report a wide variety of useful API misuse violations in large, industrial-strength code bases.
DOI 原文 ·
@inproceedings{paperbot6423,
title = {RAPID: checking API usage for the cloud in the cloud},
author = {Michael Emmi and Liana Hadarean and Ranjit Jhala and Lee Pike and Nicolás Rosner and Martin Schäf and Aritra Sengupta and Willem Visser},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3473934}
}