一句话：提出 MASC 工具，用 12 个变异算子与三种变异范围评估静态 crypto-API 误用检测器，发现 19 个未记录缺陷
软件工程师日益广泛地采用 crypto-API 误用检测器，但其实际有效性缺乏严格评估。本文介绍工具 MASC 的技术细节与使用场景：它提供 12 个可泛化的、基于使用方式的变异算子，以及 Main、Similarity、Exhaustive 三种变异范围，能够实例化出可编译的 crypto-API 误用变体，从而对静态检测器开展变异分析。MASC 支持参数配置，并同时提供命令行接口与 Web 前端，便于不同经验水平的用户使用。作者用 MASC 评估了 9 个主流 crypto-detectors，发现 19 个此前未记录的独特缺陷。
While software engineers are optimistically adopting crypto-API misuse detectors (or crypto-detectors) in their software development cycles, this momentum must be accompanied by a rigorous understanding of crypto-detectors’ effectiveness at finding crypto-API misuses in practice. This demo paper presents the technical details and usage scenarios of our tool, namely Mutation Analysis for evaluating Static Crypto-API misuse detectors (MASC). We developed 12 generalizable, usage based mutation operators and three mutation scopes, namely Main Scope, Similarity Scope, and Exhaustive Scope, which can be used to expressively instantiate compilable variants of the crypto-API misuse cases. Using MASC, we evaluated nine major crypto-detectors, and discovered 19 unique, undocumented flaws. We designed MASC to be configurable and user-friendly; a user can configure the parameters to change the nature of generated mutations. Furthermore, MASC comes with both Command Line Interface and Web-based front-end, making it practical for users of different levels of expertise.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{AmiARCKMPN23,
title = {MASC: A Tool for Mutation-Based Evaluation of Static Crypto-API Misuse Detectors},
author = {Amit Seal Ami and Syed Yusuf Ahmed and Radowan Mahmud Redoy and Nathan Cooper and Kaushal Kafle and Kevin Moran and Denys Poshyvanyk and Adwait Nadkarni},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3613099}
}