一句话：将挖掘出的 API 使用规则建模为概率图模型，用概率表示规则可信度以降低误报与漏报。
API 误用会导致程序崩溃、缺陷与安全漏洞。现有方法通常从大规模代码库或 API 文档中挖掘使用规则，再据此检查程序来检测误用，但挖掘出的规则往往不精确、不完整，造成较高的误报率与漏报率。本文提出将挖掘得到的 API 使用规则表示为一个概率图模型，其中每条规则的概率值刻画其作为正确规则的可信程度；方法自动挖掘代码库与文档，构造概率化使用规则并聚合多源知识，其中来自代码库的规则用于初始化概率模型，来自文档的知识则用于相应调整与补充概率。作者在 MuBench 基准上进行了评估，实验结果显示该方法达到 42.0% 的精确率与 54.5% 的召回率，显著优于当前最优方法。
API misuses can cause a range of issues in software development, including program crashes, bugs, and vulnerabilities. Different approaches have been developed to automatically detect API misuses by checking the program against usage rules extracted from extensive codebase or API documents. However, these mined rules may not be precise or complete, leading to high false positive/negative rates. In this paper, we propose a novel solution to this problem by representing the mined API usage rules as a probabilistic graphical model, where each rule's probability value represents its trustworthiness of being correct. Our approach automatically constructs probabilistic usage rules by mining codebase and documents, and aggregating knowledge from different sources. Here, the usage rules obtained from the codebase initialize the probabilistic model, while the knowledge from the documents serves as a supplement for adjusting and complementing the probabilities accordingly. We evaluate our approach on the MuBench benchmark. Experimental results show that our approach achieves 42.0% precision and 54.5% recall, significantly outperforming state-of-the-art approaches.
DOI 原文 ·
@inproceedings{paperbot8492,
title = {API Misuse Detection via Probabilistic Graphical Model},
author = {Yunlong Ma and Wentong Tian and Xiang Gao and Hailong Sun and Li Li},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3652112}
}