Method and device for detecting API misuse based on frequent subgraph mining
By automatically extracting API patterns based on frequent subgraph mining, this method solves the problems of high detection threshold and limited scope caused by manually defined API patterns in existing technologies, achieving efficient and accurate API misuse detection and enhancing software security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- INST OF SOFTWARE - CHINESE ACAD OF SCI
- Filing Date
- 2023-07-19
- Publication Date
- 2026-07-24
AI Technical Summary
Existing technologies require manual definition of API patterns when detecting API misuse errors, resulting in high detection thresholds, limited scope, and a high risk of missed detections, thus jeopardizing software security.
By employing a frequent subgraph mining approach, API patterns are automatically extracted from the code. API misuse errors are detected by constructing API paths and performing subgraph matching. Infrequent candidate subgraphs are filtered out using frequent subgraph mining techniques, thereby improving detection efficiency and accuracy.
It reduced labor costs, expanded the detection scope, enhanced software security, and improved the efficiency and accuracy of API misuse detection.
Smart Images
Figure CN116893970B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of API misuse error detection, and more particularly to an API misuse detection method and apparatus based on frequent subgraph mining. Background Technology
[0002] With the rapid development of the software supply chain, more and more software developers are writing code based on APIs encapsulated in code repositories. However, due to the lack of, incompleteness, and lag in API documentation, coupled with developers' often insufficient understanding of APIs, developers often violate the API's pattern when using it, leading to API misuse errors. Statistics show that in 2021, MITRE disclosed 92 Linux kernel vulnerabilities with suggested fixes, of which 27 were caused by API misuse, accounting for 29.3%, making it a major type of vulnerability. Taking common kmalloc APIs (including kmalloc, kvmalloc, kcalloc, etc.) as an example, their pattern is {check memory allocation size → kmalloc allocates memory → check the returned pointer → free the pointer}. Missing the "check memory allocation size" step can lead to remote code invocation, such as CVE-2021-33909 and CVE-2021-43267. However, if the "release pointer" step is missing, it will lead to a memory leak error, such as CVE-2021-45480.
[0003] Current technologies for detecting API misuse errors require manually defining API patterns, then using pattern matching to detect violations in the code. This not only raises the barrier to API misuse detection but also limits the scope of detection. Therefore, manually setting API patterns can lead to a large number of missed detections, thereby jeopardizing software security. Summary of the Invention
[0004] To address the shortcomings of existing technologies, this invention discloses an API misuse detection method and apparatus based on frequent subgraph mining. This method uses frequent subgraph mining technology to automatically extract the required API patterns from the code for API misuse detection, thereby reducing manual costs, expanding the detection scope, and enhancing software security.
[0005] To achieve the above objectives, the present invention adopts the following technical solution:
[0006] A method for detecting API misuse based on frequent subgraph mining, the method comprising:
[0007] Build a dataset containing the source code of several APIs, and generate at least one API path from each API source code;
[0008] Based on the frequency of occurrence of each subgraph in all API paths, the set of API path patterns corresponding to the dataset is obtained.
[0009] The API path of the source code to be detected is matched with the API path pattern set to obtain the API misuse detection result of the source code to be detected.
[0010] Furthermore, generating the API path from the source code includes:
[0011] The source code is converted into an intermediate representation, which contains the control flow graph of the functions, and the intermediate representation is in the format of an LLVM IR file;
[0012] The control flow graph of each function in the intermediate representation is traversed using a depth-first strategy to obtain API call operations, and the application interface in the LLVM C library is called to parse the API call operations in order to obtain the API data association operations.
[0013] By connecting the data association operations according to the execution order during traversal, the API path is obtained and stored as a control flow graph.
[0014] Furthermore, the process of traversing the control flow graph of each function in the intermediate representation using a depth-first strategy to obtain API call operations, and then calling the application interface in the LLVM C library to parse the API call operations to obtain the API data association operations, includes:
[0015] By iterating through each function, each basic block within a function, and each operation statement within a basic block in the LLVM IR file using an iterator, the API call operations can be obtained.
[0016] The parseIRFile application interface in the LLVM C library is called to parse the API call operation and obtain the API's return value variable and parameter variable;
[0017] Perform data flow analysis on the API's return value variables and parameter variables to obtain the API's data association operations.
[0018] Furthermore, the data association operation includes:
[0019] Direct data association operations, wherein there are shared variables or direct data associations with assignment relationships;
[0020] and,
[0021] Indirect data association operation, in which there is an indirect data association between variables through pointer passing.
[0022] Furthermore, the data flow analysis of the API's return value variables and parameter variables to obtain direct data association operations includes:
[0023] Use the getOperand application interface to retrieve API parameters;
[0024] Recursively call getOperand to retrieve the variable assigned to the API parameter;
[0025] Recursively call the users application interface to obtain the API return value;
[0026] Add the API parameter variables and the API return value to the associated variables;
[0027] Obtain the operations that use associated variables in the function control flow graph to obtain the directly associated operations.
[0028] Furthermore, the data flow analysis of the API's return value variables and parameter variables to obtain indirect data association operations includes:
[0029] For memory read / write operations in direct associative operations, the corresponding memory write / read operations at the same address are treated as indirect associative operations.
[0030] Furthermore, based on the frequency of occurrence of each subgraph in all API paths, the set of API path patterns corresponding to the dataset is obtained, including:
[0031] Each API path is split into a subgraph containing one edge, and each subgraph is added to the 1-edge-candidate set;
[0032] Select the frequent set of 1-edges from the candidate set based on the frequency of occurrence of the subgraph;
[0033] By pairwise combining subgraphs with k-2 identical edges, a candidate set of k edges is generated from the frequent set of k-1 edges.
[0034] Select the k-edge frequent set from the k-edge candidate set according to the frequency of edge occurrence;
[0035] If the k-edge-frequent set is not empty, let k = k + 1, and return to the step of generating the k-edge-candidate set from the k-1 edge-frequent set by pairwise combination of subgraphs with k-2 identical edges;
[0036] When the k-edge-frequent set is empty, the subgraph in the k-1 edge-frequent set is taken as the API path pattern set corresponding to the dataset.
[0037] Furthermore, the step of filtering the 1-edge-frequent set from the 1-edge-candidate set according to the occurrence frequency of the subgraph includes:
[0038] Calculate the number of times each subgraph appears in all API paths; where, if the same subgraph appears multiple times in any API path, the number of times the subgraph appears in that API path is determined to be 1.
[0039] Calculate the ratio of the number of times the subgraph appears in all API paths to the total number of API paths;
[0040] If the number of occurrences exceeds a first preset threshold and the ratio exceeds a second preset threshold, the subgraph is added to the 1-edge-frequent set.
[0041] If the number of occurrences is less than a first set threshold, or the ratio is less than a second set threshold, the subgraph is discarded.
[0042] An API misuse detection device based on frequent subgraph mining, the device comprising:
[0043] The API path extraction module is used to build a dataset containing the source code of several APIs and generate at least one API path from each API source code.
[0044] The path pattern generation module is used to obtain the set of API path patterns corresponding to the dataset based on the frequency of occurrence of each subgraph in all API paths.
[0045] The misuse detection module is used to perform subgraph matching between the API path of the source code to be detected and the API path pattern set to obtain the API misuse detection result of the source code to be detected.
[0046] A computer device, characterized in that the computer device comprises: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the API misuse detection method based on frequent subgraph mining as described above.
[0047] Compared with the prior art, the present invention has at least the following technical effects:
[0048] The source code is transformed from text to graph form and defined as an API path. Each node in the API path represents an operation that has data association with the API (including the API itself), and each edge represents the execution order between nodes.
[0049] Frequent subgraphs are extracted from API paths and defined as API path patterns.
[0050] By leveraging downward closure, a large number of infrequent candidate subgraphs are filtered out in advance, overcoming the problem of low efficiency in frequent subgraph mining and enabling rapid mining of frequent subgraphs.
[0051] Subgraph matching is performed between API path patterns and API paths, and API paths that fail to match are identified as potential API misuse errors.
[0052] Potential API misuse errors are sorted according to the number of times their corresponding API path patterns appear in the API path. The more times they appear, the higher the probability that the potential API misuse error is real. Attached Figure Description
[0053] Figure 1 This is a flowchart of a method for automatic extraction of API path patterns and detection of API misuse based on frequent subgraph mining.
[0054] Figure 2 This is a flowchart of API path generation.
[0055] Figure 3 This is a flowchart for extracting API path patterns.
[0056] Figure 4 These are examples of API path patterns and API misuse diagrams; the top left shows the source code of the API path pattern, the top right shows the API path pattern converted from the source code, the bottom left shows the source code of API misuse, and the bottom right shows the API misuse converted from the source code. Detailed Implementation
[0057] The present invention will be further described below with reference to the accompanying drawings.
[0058] This example uses a method for automatic extraction of API path patterns and detection of API misuse based on frequent subgraph mining. The overall flowchart is as follows: Figure 1 As shown, the main steps include:
[0059] Step 1: Generate API paths from the source code.
[0060] An API path is a control flow graph consisting of operations that have data relationships with an API. These data relationships include direct and indirect relationships. Direct relationships refer to shared variables or assignment relationships, while indirect relationships refer to pointer passing between variables, i.e., memory read / write. This invention utilizes the LLVM front-end compiler Clang to transform the source code into the intermediate representation LLVM IR. Then, by traversing the function control flow graph in LLVM IR, it obtains the API call operations, performs data flow analysis on the APIs, generates API paths, and stores them in graph form.
[0061] Specifically, the API path generation flowchart is as follows: Figure 2 As shown.
[0062] 1a) The source code is transformed into an intermediate representation, LLVM IR, using the LLVM compiler front-end Clang. LLVM IR contains the control flow graphs of each function, and this intermediate representation is stored in a file of type "bc," representing a structured data representation. (Proceed to 1b)
[0063] 1b) Call the application interface in the LLVM C library, use a depth-first strategy to traverse each function control flow graph in LLVM IR, and then proceed to 1c).
[0064] In one example, the parseIRFile API from the LLVM C library is used for parsing. Then, an iterator is used to traverse the various functions, basic blocks within functions, and operation statements within those basic blocks to obtain the API call operation. This API call operation is an operation statement of type "CallInst," and its API name can be obtained by calling the getCalledFunction and getName APIs.
[0065] 1c) During each API call operation during traversal, perform data flow analysis on the API's return value and parameter variables to obtain the API's data association operations. For each API data association operation, if the operation is not a memory read / write operation, it is considered a direct data association operation; if the operation is a memory read / write operation, the corresponding memory write / read operation to the same address is considered an indirect data association operation. (Go to 1d).
[0066] In one example, data association operations include direct data association operations and indirect data association operations. Direct data association operations involve shared variables or direct data associations with assignment relationships, while indirect data association operations involve indirect data associations where pointers are passed between variables.
[0067] Specifically, obtaining direct data association operations involves the following steps when performing data flow analysis on an API: First, the `getOperand` application interface is used to retrieve the API parameters. Then, `getOperand` is recursively called to retrieve the variables assigned to the API parameters, which are then used as part of the association variables. Next, the `users` application interface is recursively called to retrieve the variables that use the API return value and the association variables retrieved in the previous step, and these are also added to the association variables. Finally, the function control flow graph is traversed to retrieve the operations that use the association variables, which are then used as direct association operations.
[0068] The indirect data association operation is a memory read / write operation within a direct association operation. It retrieves the corresponding memory write / read operation at the same address as an indirect association operation and unifies it with the direct association operation as an association operation.
[0069] 1d) Perform a depth-first traversal of the function control flow graph again, connecting data association operations according to the execution order during traversal, and finally obtain a control flow graph composed of API data association operations, which is output as the API path and stored in the form of a graph.
[0070] exist Figure 4 In the example, the source code on the left is used to generate the API path on the right. The API is represented by gray-background _usecs_to_jiffies, each node in the path is a data association operation of _usecs_to_jiffies, and each edge represents the execution order between nodes.
[0071] Step 2: Extract API path pattern.
[0072] Generally, most of the code is correct, meaning most APIs follow API path patterns, and these patterns typically consist of API data association operations. Therefore, reasonable inference can be made: frequently occurring sub-paths in the API path... Figure 1 Generally, this can be identified as an API path pattern. Based on the above reasoning, this invention utilizes frequent subgraph mining technology to automatically extract API path patterns from API paths. However, frequent subgraph mining has a bottleneck: the number of subgraphs is exponential. For any graph with n edges, its total number of subgraphs is 2^n. n The specific calculation formula is as follows: add up the number of subgraphs with 1 to n edges.
[0073]
[0074] To address this issue, this invention utilizes the downward closure property of frequent subgraphs: if a graph is frequent, then any subgraph of that graph must also be frequent. Therefore, its contrapositive is also true: if a subgraph is infrequent, then any graph containing that subgraph must also be infrequent. Using this contrapositive, infrequent candidate graphs can be eliminated in advance, thereby effectively improving the efficiency of frequent subgraph mining.
[0075] In one embodiment, the present invention provides an automatic API path pattern extraction algorithm, such as... Figure 3 As shown, the algorithm takes an API path as input and outputs an API path pattern. The specific steps include:
[0076] 2a) Split each API path from the graph into a set of edges, add each edge as a 1-edge-subgraph to the "1-edge-candidate set", and go to 2b).
[0077] 2b) Filter the “1-edge-candidate set” to the “1-edge-frequent set” according to the number of times each element appears in the API path, and go to 2c).
[0078] In one embodiment, the present invention calculates the number of times each element in the "1-edge-candidate set" appears in all API paths (if it appears multiple times in the same API path, it is only counted once). If the number is greater than or equal to 10 and the ratio to the total number of API paths is greater than or equal to 0.9, it is added to the "1-edge-frequent set".
[0079] 2c) Generate a "k-edge-candidate set" from the "(k-1)-edge-frequent set", then go to 2d).
[0080] In one embodiment, the present invention combines elements with (k-2) identical edges in the "(k-1) edge-frequent set" in pairs to remove duplicates, and uses them as the "k edge-candidate set".
[0081] 2d) Filter the “k-edge-candidate set” to select the “k-edge-frequent set” based on the frequency of edge occurrence. If the “k-edge-frequent set” is not empty, increment the value of k by 1 and jump to 2c); otherwise, jump to 2e).
[0082] 2e) The final selected “(k-1) edge-frequent set” is used as the frequent subgraph of the API path, which is the path pattern of the API.
[0083] exist Figure 4 In the example, the graph in the upper right corner is the path pattern for _usecs_to_jiffies obtained using the frequent subgraph mining technique. Specifically, it appears as a subgraph 146 times out of 147 paths in _usecs_to_jiffies, so the output obtained using the frequent subgraph mining technique is the graph in the upper right corner, representing the path pattern for _usecs_to_jiffies.
[0084] Step 3: Detect API misuse errors.
[0085] This invention uses API path patterns as matching templates to detect whether the API path contains an API path pattern as a subgraph. If it does not contain the pattern, it outputs and reports it as a potential API misuse error.
[0086] In one embodiment, the present invention takes API path and API path pattern as input and outputs potential API misuse errors.
[0087] Specifically, the process for detecting API misuse errors is as follows.
[0088] 3a) Obtain the API path of the source code to be tested;
[0089] 3b) Perform subgraph matching between the API path of the source code to be detected and the API path pattern. If the matching fails, it is considered a potential API misuse error and proceeds to 3c).
[0090] 3c) The API misuse errors are sorted according to the number of times the violated API path pattern occurs. API misuse errors that violate the API path pattern more often have higher priority, and then the reports are output in order of priority.
[0091] exist Figure 4 In the example, the bottom right path _usecs_to_jiffies is matched with the top right path pattern _usecs_to_jiffies. The result is that the top right path pattern is not a subgraph of the bottom right path, so the match fails and is reported as a potential API misuse error.
[0092] In summary, the present invention addresses the following technical problem: overcoming the shortcomings of existing technologies, it provides an API misuse detection method based on frequent subgraph mining. Without requiring prior knowledge of the software, it extracts commonly used API usage methods from statistical patterns in the code, uses these patterns as API templates, and then uses subgraph matching to detect API misuse errors.
Claims
1. A method for detecting API misuse based on frequent subgraph mining, characterized in that, The method includes: Build a dataset containing the source code of several APIs, and generate at least one API path from each API source code; Based on the frequency of occurrence of each subgraph in all API paths, the set of API path patterns corresponding to the dataset is obtained. The API path of the source code to be detected is matched with the API path pattern set to obtain the API misuse detection result of the source code to be detected. Specifically, based on the frequency of occurrence of each subgraph in all API paths, the set of API path patterns corresponding to the dataset is obtained, including: Each API path is split into a subgraph containing one edge, and each subgraph is added to the 1-edge-candidate set; Select the frequent set of 1-edges from the candidate set based on the frequency of occurrence of the subgraph; By pairwise combining subgraphs with k-2 identical edges, a candidate set of k edges is generated from the frequent set of k-1 edges. Select the k-edge frequent set from the k-edge candidate set according to the frequency of edge occurrence; If the k-edge-frequent set is not empty, let k = k + 1, and return to the step of generating the k-edge-candidate set from the k-1 edge-frequent set by pairwise combination of subgraphs with k-2 identical edges; When the k-edge-frequent set is empty, the subgraph in the k-1 edge-frequent set is taken as the API path pattern set corresponding to the dataset. The step of selecting the 1-edge-frequent set from the 1-edge-candidate set according to the occurrence frequency of the subgraph includes: Calculate the number of times each subgraph appears in all API paths; where, if the same subgraph appears multiple times in any API path, the number of times the subgraph appears in that API path is determined to be 1. Calculate the ratio of the number of times the subgraph appears in all API paths to the total number of API paths; If the number of occurrences exceeds a first preset threshold and the ratio exceeds a second preset threshold, the subgraph is added to the 1-edge-frequent set. If the number of occurrences is less than a first set threshold, or the ratio is less than a second set threshold, the subgraph is discarded.
2. The method as described in claim 1, characterized in that, The process of generating API paths from source code includes: The source code is converted into an intermediate representation, which contains the control flow graph of the functions, and the intermediate representation is in the format of an LLVM IR file; The control flow graph of each function in the intermediate representation is traversed using a depth-first strategy to obtain API call operations. The application interface in the LLVM C library is then called to parse the API call operations in order to obtain the API data association operations. By connecting the data association operations according to the execution order during traversal, the API path is obtained and stored as a control flow graph.
3. The method as described in claim 2, characterized in that, The process involves traversing the control flow graph of each function in the intermediate representation using a depth-first strategy to obtain API call operations, and then using the application interface in the LLVM C library to parse the API call operations to obtain the API data association operations, including: By iterating through each function, each basic block within a function, and each operation statement within a basic block in the LLVM IR file using an iterator, the API call operations can be obtained. The parseIRFile application interface in the LLVM C library is called to parse the API call operation and obtain the API's return value variable and parameter variable; Perform data flow analysis on the API's return value variables and parameter variables to obtain the API's data association operations.
4. The method as described in claim 2 or 3, characterized in that, The data association operation includes: Direct data association operations, wherein there are shared variables or direct data associations with assignment relationships; and, Indirect data association operation, in which there is an indirect data association between variables through pointer passing.
5. The method as described in claim 4, characterized in that, The data flow analysis of the API's return value variables and parameter variables to obtain direct data association operations includes: Use the getOperand application interface to retrieve API parameters; Recursively call getOperand to retrieve the variable assigned to the API parameter; Recursively call the users application interface to obtain the API return value; Add the API parameter variables and the API return value to the associated variables; Obtain the operations that use associated variables in the function control flow graph to obtain the directly associated operations.
6. The method as described in claim 5, characterized in that, The data flow analysis of the API's return value variables and parameter variables to obtain indirect data association operations includes: For memory read / write operations in direct associative operations, the corresponding memory write / read operations at the same address are treated as indirect associative operations.
7. An API misuse detection device based on frequent subgraph mining, characterized in that, The device includes: The API path extraction module is used to build a dataset containing the source code of several APIs and generate at least one API path from each API source code. The path pattern generation module is used to obtain the set of API path patterns corresponding to the dataset based on the frequency of occurrence of each subgraph in all API paths. The misuse detection module is used to perform subgraph matching between the API path of the source code to be detected and the API path pattern set to obtain the API misuse detection result of the source code to be detected. Specifically, based on the frequency of occurrence of each subgraph in all API paths, the set of API path patterns corresponding to the dataset is obtained, including: Each API path is split into a subgraph containing one edge, and each subgraph is added to the 1-edge-candidate set; Select the frequent set of 1-edges from the candidate set based on the frequency of occurrence of the subgraph; By pairwise combining subgraphs with k-2 identical edges, a candidate set of k edges is generated from the frequent set of k-1 edges. Select the k-edge frequent set from the k-edge candidate set according to the frequency of edge occurrence; If the k-edge-frequent set is not empty, let k = k + 1, and return to the step of generating the k-edge-candidate set from the k-1 edge-frequent set by pairwise combination of subgraphs with k-2 identical edges; When the k-edge-frequent set is empty, the subgraph in the k-1 edge-frequent set is taken as the API path pattern set corresponding to the dataset. The step of selecting the 1-edge-frequent set from the 1-edge-candidate set according to the occurrence frequency of the subgraph includes: Calculate the number of times each subgraph appears in all API paths; where, if the same subgraph appears multiple times in any API path, the number of times the subgraph appears in that API path is determined to be 1. Calculate the ratio of the number of times the subgraph appears in all API paths to the total number of API paths; If the number of occurrences exceeds a first preset threshold and the ratio exceeds a second preset threshold, the subgraph is added to the 1-edge-frequent set. If the number of occurrences is less than a first set threshold, or the ratio is less than a second set threshold, the subgraph is discarded.
8. A computer device, characterized in that, The computer device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the API misuse detection method based on frequent subgraph mining as described in any one of claims 1-6.