API misuse detection method based on historical code change information

Abstract

The present invention provides an API misuse detection method based on historical code change information, which belongs to the field of software engineering technology. The method first pulls the historical code change information of the open source project from the code hosting tool, and extracts the repair information related to the API misuse. The AUG before and after the program repair is used to reversely extract the program mutation operator, rather than manually designing the mutation operator, so as to effectively and efficiently generate a large number of program sets containing API misuse. After the API misuse set passes the test suite as a test case, the information in the termination trace stack is analyzed. If the termination stack trace information is not caused by the target API misuse, or also contains information caused by other API misuses, it means that the original program contains API misuse. It avoids learning the correct API usage pattern from a large number of programs and improves the efficiency of API misuse detection.

Description

Technical Field

[0001] The present invention belongs to the field of software engineering technology, and relates to a technology for detecting incorrect use of APIs (referred to as API misuse) in software, specifically an API misuse detection method based on historical code change information. Background Art

[0002] In the process of software development, in order to save software development time and improve software development efficiency, developers often need to use various application programming interfaces (APIs) to reuse existing software frameworks or class libraries. By using the API information hiding mechanism, developers do not need to access the source code or understand the details of the internal working mechanism of the called API. They can directly complete the corresponding functions by calling the specific methods in the corresponding API implementation class. However, due to the large number of API types, incomplete documentation information, and untimely updates and maintenance, developers face severe challenges in the process of learning to use APIs, resulting in some potential misuses in the software development process.

[0003] API misuse refers to the violation of the correct API usage specifications, such as incorrect API calls, missing API calls or redundant API calls. These irregular API uses seriously endanger the security of the software. For example, when reading and writing files, if the developer forgets to call the close() function to close the file reading and writing data stream, it will lead to the continuous occupation of system resources and the hidden danger of memory overflow. In addition, during the collaborative development process of the team, one or more team members introduce new APIs for a specific program. Other developers must review and learn the correct API usage methods in a timely manner. This process is confusing and error-prone in the absence of documentation. However, such errors are often not easy to be discovered during the development process, and may not even be noticed for a long time. API misuse brings huge security risks to software development.

[0004] After years of development, a large number of API misuse detection methods have been proposed. There are methods for pattern mining from a large number of correct API uses, such as PR-Miner, a mining technology based on frequent itemsets. And a change pattern mining method for API misuse (patent number: CN201910030995.9), which detects API misuse in open source projects by mining the change patterns of API misuse that frequently appear in massive open source projects. The API misuse defect detection method using frequent items has a high false alarm rate. Starting from the API document, natural language processing technology is used to analyze the API document and infer the API usage specifications. This method cannot be well combined with the actual software development process, resulting in its low accuracy. The invention of the API misuse defect detection method based on sequence pattern matching (patent number: CN202010972588.2), by characterizing the API misuse pattern, and then using the search algorithm in the target tested software to search for the API call sequence that meets the misuse pattern, this method is heavily dependent on the effect of API misuse pattern characterization and has certain limitations. There are API misuse detection methods based on probability models, such as HAPI based on hidden Markov models, API misuse detection based on deep learning, etc. Probability-based methods often train a large amount of code. If the sample data is not sufficient or limited to a specific project, the model applicability is often not very wide. The present invention does not mine the correct API usage pattern from the massive code, but extracts mutation operators in the mutation process between the correct API usage pattern and the incorrect API usage pattern by repairing the code before and after, rather than manually designing mutation operators. This greatly improves the generation rate of client API misuse generated by mutating the client program using mutation operators, thereby improving the coverage and accuracy of API misuse detection. Summary of the invention

[0005] To solve the above problems, the present invention provides an API misuse detection method based on historical code change information.

[0006] The technical solution of the present invention:

[0007] An API misuse detection method based on historical code change information, the steps are as follows:

[0008] Step 1: Collect historical code change information of software projects: Collect historical code change information of open source software projects from the source code hosting platform.

[0009] Step 2, extract the changed code related to API misuse: For the historical code change information of the open source software project collected in step 1, extract the information related to API misuse, and obtain a set of code snippets S containing API misuse and a set of code snippets S′ after fixing the API misuse.

[0010] Step 3: Construct the API usage graph AUG: First, parse the Java source code into an abstract syntax tree (AST) through JavaParser, and extract the operation nodes and control nodes; determine the data dependency relationship and the overall usage order between the operation nodes and the control nodes, and use solid arrow edges and dotted arrow edges to represent the control flow and data flow respectively. The node set and edge set constitute the overall API usage graph AUG; convert the code snippets in the code snippet set S and S′ obtained in step 2 into the API usage graph AUG, denoted as AUG(S) and AUG(S′).

[0011] Step 4, extract mutation operators: From AUG(S) to AUG(S′) represents the program repair process, and vice versa, from AUG(S′) to AUG(S) represents an API misuse pattern of the program. Each misuse pattern contains a mutation process from correct API use to incorrect API use, and each mutation process corresponds to a mutation operator; traverse the code set before and after the repair, compare the differences between AUG(S′) and AUG(S), and extract the following mutation operators: 1) Exchange the order of nodes in the API usage graph; 2) Add calls to existing API nodes in the API usage graph to form a new call loop; 3) Change the call nodes in the API usage graph; 4) Add API call nodes to the API usage graph; 5) Delete the call nodes in the API usage graph; 6) Delete the control structure in the API usage graph; 7) Change the API method parameters; 8) Change the control condition parameters; Store the extracted mutation operators in the mutation operator set Mu.

[0012] Step 5, mutation operation: extract the API usage files in the target project to be detected, and convert the files containing API usage into the AUG (target) set; use the mutation operator in step 4 to mutate the AUG set, which is recorded as AUG′ (target).

[0013] Step 6, filtering mutation operation: filter the AUG′(target) obtained by mutation in step 5, remove the AUG containing pseudo API misuse and redundant API misuse, and record it as AUG″(target).

[0014] Step 7, target project detection: First, convert the AUG″(target) set into an executable program to obtain a program variant set Program(target) containing API misuse; execute the test suite on all variant programs and collect the termination stack information Kill i .

[0015] Step 8. Analyze the termination stack trace information: The stack trace information caused by the program variant set Program(target) containing API misuse should be specific to this target API misuse, and the trace information caused by the target API misuse should be at the top of the termination stack trace; if the termination stack trace information is not caused by the API misuse, or also contains information caused by other API misuses, it means that the original program contains API misuse.

[0016] Step 9: Report the detection results: When the original program contains API misuse in step 8, calculate the probability P of the actual API misuse m. m , the greater the probability, the greater the possibility of API misuse m. Finally, the candidate misuses are reported to the developer. If the number of candidate misuses exceeds three, only the top three candidate misuses are reported to the developer.

[0017] The probability of actual API misuse m is P m The calculation formula is as follows, where m t is the number of times API misuse m is observed to be triggered in the termination trace stack; L represents the depth of the entire termination trace stack.

[0018] P m =m t / L

[0019] Beneficial effects of the present invention: The method of the present invention can effectively detect incorrect API usage in software development, and uses AUGs before and after program repair to reversely extract program mutation operators, rather than manually designing mutation operators, to effectively and efficiently generate a large number of program sets containing API misuses. After the API misuse set passes the test suite as a test case, the information in the termination trace stack is analyzed. If the termination stack trace information is not caused by the target API misuse, or also contains information caused by other API misuses, it means that the original program contains API misuse. This avoids learning the correct API usage pattern from a large number of programs and improves the efficiency of API misuse detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flow chart of the API misuse detection method based on historical code change information of the present invention. DETAILED DESCRIPTION

[0021] The specific implementation of the present invention is further described below in conjunction with the accompanying drawings and technical solutions.

[0022] The method of the present invention is deployed on an application server, and corresponding software such as version control tools, databases, etc. are installed according to experimental requirements. The method consists of preprocessing operations including collecting source code and extracting code fragments before and after repair, building an API usage graph AUG, extracting mutation operators, mutation operations, use case testing, and stack information analysis.

[0023] like Figure 1 As shown in the figure, API misuse detection based on historical code change information is carried out according to the following process. It can be mainly divided into two stages, steps 1 to 4 are the historical information collection and mutation operator extraction stages, and steps 5 to 9 are the API misuse detection stages. In the first stage, the historical code change information of open source software is collected by using the GitHub source code hosting platform, and according to the collected API misuse and repair information, it is converted into an API usage graph before and after the repair, and the API usage graph set is traversed in a loop to extract all API mutation operators from it to obtain the mutation operator set Mu. In the second stage, the mutation operator is used to perform mutation operations on the target project to be detected, and the AUG containing pseudo API misuse and redundant API misuse is filtered, and then converted into an executable program. After passing the test suite, it is determined whether the original program contains API misuse. If it contains API misuse, the candidate misuse is reported to the developer.

[0024] Step 1: Collect historical code change information of software projects. Collect historical code change information of open source software projects from the source code hosting platform. A source code hosting platform refers to a website or tool that can perform version management on user code. Popular source code hosting platforms include GitHub, BitBucket, SourceForge, GitKraken, Gitee, etc. GitHub is a large-scale open source code hosting platform and version control system based on Git. The present invention mainly uses the GitHub code hosting platform to collect historical code change information of open source software projects. In actual use, other code hosting platforms or tools can be used to collect historical code change information of open source software projects according to specific needs.

[0025] Step 2: Extraction of code change information related to API misuse. For the historical code change information of the open source software project collected in step 1, extract the information related to API misuse, and obtain a set of code snippets S containing API misuse and a set of code snippets S′ after fixing API misuse.

[0026] Step 3: API-Usage Graph (AUG) construction. First, parse the Java source code into an abstract syntax tree (AST) through JavaParser, and extract the operation nodes and control nodes. Determine the data dependency relationship and the overall usage order between the operation nodes and the control nodes, and use solid arrow edges and dashed arrow edges to represent the control flow and data flow respectively. The nodes and edges constitute the overall API usage graph AUG. Convert the code snippets in the code snippet sets S and S′ obtained in step 2 into the API usage graph AUG, denoted as AUG(S) and AUG(S′).

[0027] AUG,is a directed, labeled multigraph that captures all usage attributes relevant to identifying API misuse and describes the dynamic usage of APIs more specifically.

[0028] JavaParser is a popular Java language parser. It can parse Java source code into an abstract syntax tree, based on which Java code can be analyzed and modified. In actual use, other Java code parsing tools can be used according to specific needs.

[0029] Step 4: Use b from graph collection B from the fixed API i To the API before the fix, use a in the graph collection A i , extract a mutation operator from it. Traverse all the code sets before and after the repair, and store the extracted mutation operators in the mutation operator set Mu. For example, b i In the file, file.flush() is called after reading and writing the file, and a i The file.close() called in the above code, where file.flush()->file.close() represents a mutation operator that changes the calling node in the API usage graph.

[0030] Step 5: Extract the API usage files in the target project to be detected, and convert the files containing API usage into the AUG (target) set. Use the mutation operator in step 4 to randomly mutate the AUG set, recorded as AUG′ (target). For example, delete the call node in the API usage graph, delete the control node in the API usage graph, replace the call node in the API usage graph, etc.

[0031] Step 6: Filter the mutation operation, filter the AUG′(target) obtained by mutation, remove the AUG containing pseudo API misuse and redundant API misuse, and record it as AUG″(target).

[0032] Pseudo API misuse refers to the situation where a mutated code snippet is mistakenly regarded as an API misuse after a mutation operation. Redundant API misuse refers to the situation where a mutated code snippet is repeated after a mutation operation.

[0033] Step 7: Target project detection. First, convert the AUG″(target) set into an executable program to obtain a set of program variants Program(target) containing API misuse. Execute the test suite on all variant programs and collect a large number of termination relations Kill i .

[0034] Step 8: Analyze the termination stack trace information. The stack trace information caused by the program variant set Program(target) containing API misuse should be specific to this target API misuse, and the trace information caused by the target API misuse should be at the top of the termination stack trace. If the termination stack trace information is not caused by the API misuse, or it also contains information caused by other API misuses, it means that the original program contains API misuses. For example, the target program variant P_mu deletes the exception handling try-catch statement, but in addition to the information about exception handling, the trace stack also includes OutOfMemoryError error information. Through source code tracing, it is found that this is caused by not calling java.io.InputStream.close() after calling java.io.InputStream.read().

[0035] Step 9: When the original program described in step 8 contains API misuse, the probability P of the actual API misuse m is calculated using the following formula: m The greater the probability, the greater the possibility of API misuse m. Finally, the candidate misuse is reported to the developer. If the number of candidate misuses exceeds three, only the top three candidate misuses are reported to the developer. t To observe the number of times API misuse m is triggered in the termination trace stack, L represents the depth of the entire trace stack.

[0036] P m =m t / L.

Claims

1. A method for detecting API misuse based on historical code change information, characterized in that: Here are the steps: Step 1: Collect historical code change information of software projects: Collect historical code change information of open source software projects from the source code hosting platform; Step 2, extracting the changed code related to API misuse: extracting the information related to API misuse from the historical code change information of the open source software project collected in step 1, and obtaining a set of code snippets S containing API misuse and a set of code snippets S′ after fixing API misuse; Step 3: Constructing the API usage graph AUG: First, parse the Java source code into an abstract syntax tree through JavaParser, extract the operation nodes and control nodes; determine the data dependency relationship and the overall usage order between the operation nodes and the control nodes, use solid arrow edges and dashed arrow edges to represent the control flow and data flow respectively, and the node set and edge set constitute the overall API usage graph AUG; convert the code snippets in the code snippet set S and S′ obtained in step 2 into the API usage graph AUG, denoted as AUG(S) and AUG(S′); Step 4, extract mutation operators: From AUG(S) to AUG(S′) represents the program repair process, and vice versa, from AUG(S′) to AUG(S) represents an API misuse pattern of the program. Each misuse pattern contains a mutation process from correct API use to incorrect API use, and each mutation process corresponds to a mutation operator; traverse the code set before and after the repair, compare the differences between AUG(S′) and AUG(S), and extract the following mutation operators: 1) Exchange the order of nodes in the API usage graph; 2) Add calls to existing API nodes in the API usage graph to form a new call loop; 3) Change the call node in the API usage graph; 4) Add a new API call node in the API usage graph; 5) Delete the call node in the API usage graph; 6) Delete the control structure in the API usage diagram; 7) Change the API method parameters; 8) Change the control condition parameters; Store the extracted mutation operator into the mutation operator set Mu; Step 5, mutation operation: extract the API usage files in the target project to be detected, and convert the files containing API usage into an AUG (target) set; use the mutation operator in step 4 to mutate the AUG set, which is recorded as AUG′ (target); Step 6, filtering mutation operation: filter the AUG′(target) obtained by mutation in step 5, remove the AUG containing pseudo API misuse and redundant API misuse, and record it as AUG″(target); Step 7, target project detection: First, convert the AUG″(target) set into an executable program to obtain a program variant set Program(target) containing API misuse; execute the test suite on all variant programs and collect the termination stack information Kill i ; Step 8, analyzing the termination stack trace information: the stack trace information caused by the program variant set Program(target) containing API misuse should be specific to this target API misuse, and the trace information caused by the target API misuse should be at the top of the termination stack trace; if the termination stack trace information is not caused by the API misuse, or also contains information caused by other API misuses, it means that the original program contains API misuse; Step 9: Report the detection results: When the original program contains API misuse in step 8, calculate the probability P of the actual API misuse m. m , the greater the probability, the greater the possibility of API misuse m. Finally, the candidate misuses are reported to the developer. If the number of candidate misuses exceeds three, only the top three candidate misuses are reported to the developer. The probability of actual API misuse m is P m The calculation formula is as follows, where m t The number of times API misuse m was observed to be triggered in the termination traceback stack; L represents the depth of the entire termination traceback stack; P m =m t / L。

Images