一句话：结合静态依赖分析与依赖上下文引导的 LLM 推理，精准检测 Python 密码学 API 误用。
密码学 API 被广泛用于保障数据安全，但其误用会悄然危及整个系统。现有方法难以跨过程捕获密码对象的初始化与使用方式，无法检测上下文相关的误用。Cryptbara 的核心创新在于将静态依赖分析与由依赖上下文引导的 LLM 推理协同结合：它从 Python 代码中提取过程内与过程间依赖，编码为上下文丰富的提示，使 LLM 能在语法复杂的情况下进行语义感知分析。作者在两个真实世界的密码学 API 误用基准上评估，Cryptbara 的 F1 分别达到 95.43% 与 84%，显著优于现有最优方法的 73.68% 与 70.59%。此外，它在流行 Python 仓库中发现了此前未知的误用，其中 22 个代表性案例得到维护者确认，展示了实际影响。
We present Cryptbara, a precise approach for detecting Python cryptographic API misuses. Cryptographic APIs are widely used to ensure data security, but their improper use can inadvertently compromise the security of entire systems. Existing approaches often fail to capture how cryptographic objects are initialized and used across inter-procedural contexts, limiting their ability to detect context-dependent misuses. In contrast, the key innovation of Cryptbara lies in synergistically combining static dependency analysis with LLM reasoning guided by dependency context, enabling context-sensitive misuse detection. To this end, Cryptbara extracts intra- and inter-procedural dependencies from Python code and encodes them into context-rich prompts, allowing the LLM to perform semantically-aware analysis despite syntactic complexity. We evaluated Cryptbara on two benchmarks containing real-world cryptographic API misuses. Cryptbara achieved F1 scores of 95.43% and 84%, outperforming existing approaches that achieved at most 73.68% and 70.59% F1 scores, respectively. Cryptbara further demonstrated its practical impact by discovering previously unknown misuses in popular Python repositories, with 22 representative cases reported to and confirmed by maintainers.
DOI 原文 ·
@inproceedings{paperbot9331,
title = {Cryptbara: Dependency-Guided Detection of Python Cryptographic API Misuses},
author = {Seogyeong Cho and Seungeun Yu and Seunghoon Woo},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00133}
}