Schlichtig, Michael ; Sassalla, Steffen ; Narasimhan, Krishna ; Bodden, Eric (2023)
Introducing FUM: A Framework for API Usage Constraint and Misuse Classification.
Software Engineering 2023 - Fachtagung des GI-Fachbereichs Softwaretechnik. Paderborn, Germany (20.02.2023 – 24.02.2023)
Konferenzveröffentlichung, Bibliographie
Kurzbeschreibung (Abstract)
Application Programming Interfaces (APIs) are the primary mechanism developers use to obtain access to third-party algorithms and services. Unfortunately, APIs can be misused, which can have catastrophic consequences, especially if the APIs provide security-critical functionalities like cryptography. Understanding what API misuses are, and how they are caused, is important to prevent them, e.g., with API misuse detectors. However, definitions for API misuses and related terms in literature vary. This paper presents a systematic literature review to clarify these terms and introduces FUM, a novel Framework for API Usage constraint and Misuse classification. The literature review revealed that API misuses are violations of API usage constraints. To address this, we provide unified definitions and use them to derive FUM. To assess the extent to which FUM aids in determining and guiding the improvement of an API misuses detector’s capabilities, we performed a case study on the state-of the-art misuse detection tool CogniCrypt. The study showed that FUM can be used to properly assess CogniCrypt’s capabilities, identify weaknesses and assist in deriving mitigations and improvements.
| Typ des Eintrags: | Konferenzveröffentlichung |
|---|---|
| Erschienen: | 2023 |
| Autor(en): | Schlichtig, Michael ; Sassalla, Steffen ; Narasimhan, Krishna ; Bodden, Eric |
| Art des Eintrags: | Bibliographie |
| Titel: | Introducing FUM: A Framework for API Usage Constraint and Misuse Classification |
| Sprache: | Englisch |
| Publikationsjahr: | Februar 2023 |
| Verlag: | Gesellschaft für Informatik e.V. |
| Buchtitel: | Software Engineering 2023 |
| Reihe: | GI Editions : Lecture Notes in Informatics |
| Band einer Reihe: | P332 |
| Veranstaltungstitel: | Software Engineering 2023 - Fachtagung des GI-Fachbereichs Softwaretechnik |
| Veranstaltungsort: | Paderborn, Germany |
| Veranstaltungsdatum: | 20.02.2023 – 24.02.2023 |
| URL / URN: | https://dl.gi.de/items/c4825557-cf3d-4038-933a-d8f95fd324a2 |
| Kurzbeschreibung (Abstract): | Application Programming Interfaces (APIs) are the primary mechanism developers use to obtain access to third-party algorithms and services. Unfortunately, APIs can be misused, which can have catastrophic consequences, especially if the APIs provide security-critical functionalities like cryptography. Understanding what API misuses are, and how they are caused, is important to prevent them, e.g., with API misuse detectors. However, definitions for API misuses and related terms in literature vary. This paper presents a systematic literature review to clarify these terms and introduces FUM, a novel Framework for API Usage constraint and Misuse classification. The literature review revealed that API misuses are violations of API usage constraints. To address this, we provide unified definitions and use them to derive FUM. To assess the extent to which FUM aids in determining and guiding the improvement of an API misuses detector’s capabilities, we performed a case study on the state-of the-art misuse detection tool CogniCrypt. The study showed that FUM can be used to properly assess CogniCrypt’s capabilities, identify weaknesses and assist in deriving mitigations and improvements. |
| Freie Schlagworte: | API misuses, API usage constraints, classification framework, API misuse detection, static analysis, E1 |
| Fachbereich(e)/-gebiet(e): | 20 Fachbereich Informatik 20 Fachbereich Informatik > Softwaretechnik 20 Fachbereich Informatik > Telekooperation DFG-Sonderforschungsbereiche (inkl. Transregio) DFG-Sonderforschungsbereiche (inkl. Transregio) > Sonderforschungsbereiche DFG-Graduiertenkollegs DFG-Graduiertenkollegs > Graduiertenkolleg 2050 Privacy and Trust for Mobile Users 20 Fachbereich Informatik > EC SPRIDE 20 Fachbereich Informatik > EC SPRIDE > Secure Software Engineering DFG-Sonderforschungsbereiche (inkl. Transregio) > Sonderforschungsbereiche > SFB 1119: CROSSING – Kryptographiebasierte Sicherheitslösungen als Grundlage für Vertrauen in heutigen und zukünftigen IT-Systemen |
| Hinterlegungsdatum: | 25 Okt 2024 13:59 |
| Letzte Änderung: | 25 Okt 2024 13:59 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
 |
Frage zum Eintrag |
Optionen (nur für Redakteure)
 |
Redaktionelle Details anzeigen |
Drucken
Impressum