Encrypted API misuse detection method and device and terminal equipment

Abstract

The invention relates to a misuse detection method and device of an encrypted API and terminal equipment. The method comprises the following steps: constructing an encrypted API knowledge graph; extracting an encrypted API file from the to-be-detected item file; respectively performing control flow analysis and data flow analysis on the encrypted API file to obtain function call information and static variable information of the encrypted API file; and inputting the encrypted API knowledge graph, the encrypted API file, the function call information and the static variable information into an encrypted API agent for encrypted API misuse detection to obtain a detection report of the to-be-detected item file. Through application of the method and the device, the problems of relatively high false alarm rate and missing report rate of an encrypted API misuse detection method depending on rules in related technologies are solved, and the technical effect of improving misuse detection accuracy of the encrypted API is realized.

Description

Technical Field

[0001] This application belongs to the field of software security technology, and in particular relates to a method, apparatus and terminal device for detecting the misuse of encrypted APIs. Background Technology

[0002] The Java Cryptography API (also known as the Encryption API) is a core security component in modern software development, playing a crucial role in ensuring data confidentiality and integrity. Through frameworks such as Java Cryptography Architecture (JCA) and Java Secure Socket Extension (JSSE), developers can implement core functions such as key generation and secure communication. Therefore, the Encryption API has become the cornerstone of building modern software security defenses.

[0003] However, due to the complexity of encrypted API interface parameters and the significant knowledge fragmentation in Java's official technical documentation, encrypted APIs pose a high risk of misuse in practical applications, such as misuse of weak encryption algorithms or incorrect configuration of security protocols. Currently, rule-driven methods are often used to detect the misuse of encrypted APIs, relying on manually built expert pattern libraries and rule engines to detect misuse of encrypted APIs within the code. However, these methods have a high false positive rate and cannot parse the semantic features of the encrypted API context, which leads to a significantly higher false negative rate.

[0004] Currently, no effective solution has been proposed for the problem of high false positive and false negative rates in rule-based encrypted API misuse detection methods in related technologies. Summary of the Invention

[0005] This application provides a method, apparatus, and terminal device for detecting the misuse of encrypted APIs, in order to at least solve the problem of high false positive and false negative rates in rule-based encrypted API misuse detection methods in related technologies.

[0006] In a first aspect, embodiments of this application provide a method for detecting the misuse of encrypted APIs, comprising: constructing an encrypted API knowledge graph; extracting encrypted API files from a project file to be detected; performing control flow analysis and data flow analysis on the encrypted API files to obtain function call information and static variable information of the encrypted API files; inputting the encrypted API knowledge graph, the encrypted API files, the function call information, and the static variable information into an encrypted API agent to perform encrypted API misuse detection, thereby obtaining a detection report of the project file to be detected.

[0007] In some embodiments, the encrypted API agent includes a code segmentation module, a detection and repair module, and a reflection module. Inputting the encrypted API knowledge graph, the encrypted API file, the function call information, and the static variable information into the encrypted API agent for encrypted API misuse detection, and obtaining a detection report for the project file to be detected, includes: inputting the encrypted API file into the code segmentation module for code splitting to obtain multiple code segments to be detected; inputting each code segment to be detected, along with the encrypted API knowledge graph, the function call information, and the static variable information, into the detection and repair module for encrypted API misuse detection and repair, obtaining an initial detection report for the project file to be detected; inputting the initial detection report, the encrypted API knowledge graph, the function call information, and the static variable information into the reflection module, which reflects on the initial detection report to obtain the detection report, wherein the detection report includes encrypted API misuse information, encrypted API misuse location, and encrypted API misuse repair information in the project file to be detected.

[0008] In some embodiments, each code segment to be detected, along with the encrypted API knowledge graph, the function call information, and the static variable information, is input into the detection and repair module for encrypted API misuse detection and repair, resulting in an initial detection report for the project file to be detected. This includes: constructing a detection and repair template, wherein the detection and repair template includes at least a first query statement; the first query statement includes at least a first judgment, a second judgment, and a third judgment; the first judgment is used to indicate whether encrypted API misuse exists; the first judgment is used to indicate the type, location, and cause of encrypted API misuse; the third judgment is used to indicate the repair method for the encrypted API misuse; for each code segment to be detected, the code segment to be detected, the encrypted API knowledge graph, the function call information, and the static variable information are input into the detection and repair module for encrypted API misuse detection and repair, resulting in an initial detection report for the project file to be detected. Function call information and static variable information are input to the detection and repair module. The detection and repair module determines whether the encrypted API misuse exists in the code segment to be detected based on the first judgment formula. If the encrypted API misuse exists in the code segment to be detected, the detection and repair module determines the type, location, and cause of the encrypted API misuse in the code segment to be detected based on the second judgment formula. The detection and repair module determines the repair method for the encrypted API misuse based on the third judgment formula. The detection and repair module combines the type, location, cause, and repair method of the encrypted API misuse corresponding to each code segment to be detected to obtain the initial detection report.

[0009] In some embodiments, the detection and repair template further includes a first input format and a first output format; for each code segment to be detected, inputting the code segment to be detected, the encrypted API knowledge graph, the function call information, and the static variable information into the detection and repair module includes: for each code segment to be detected, inputting the code segment to be detected, the encrypted API knowledge graph, the function call information, and the static variable information into the detection and repair template according to the first input format in the detection and repair template to obtain first input information; inputting the first input information into the detection and repair module to perform encrypted API misuse detection; and, the detection and repair module combining the encrypted API misuse type, the encrypted API misuse location, the encrypted API misuse reason, and the encrypted API misuse repair method corresponding to each code segment to be detected to obtain the initial detection report includes: the detection and repair module combining the encrypted API misuse type, the encrypted API misuse location, the encrypted API misuse reason, and the encrypted API misuse repair method corresponding to each code segment to be detected according to the first output format in the detection and repair template to obtain the initial detection report.

[0010] In some embodiments, constructing an encrypted API knowledge graph includes: obtaining an encrypted API knowledge document; inputting the encrypted API knowledge document into a large language model for knowledge graph extraction to obtain an initial knowledge graph; performing cross-validation between the initial knowledge graph and the encrypted API knowledge document, and performing redundancy detection and completion processing on the initial knowledge graph to obtain the encrypted API knowledge graph.

[0011] In some embodiments, inputting the encrypted API knowledge document into a large language model for knowledge graph extraction to obtain an initial knowledge graph includes: constructing a knowledge extraction template, wherein the knowledge extraction template includes at least a second input format, a second query statement, and a second output format; the second query statement includes at least a fourth judgment and a fifth judgment; the fourth judgment is used to indicate whether the encrypted API knowledge document contains an encrypted API function; the fifth judgment is used to indicate information for determining the encrypted API function; inputting the encrypted API knowledge document into the knowledge extraction template according to the second input format in the knowledge extraction template to obtain second input information; and inputting the second input information into the large language model. The large language model determines whether the encrypted API knowledge document contains the encrypted API function based on the fourth judgment. If the encrypted API knowledge document contains the encrypted API function, the large language model determines the information of the encrypted API function based on the fifth judgment. The large language model combines the information of the encrypted API function in the encrypted API knowledge document according to the second output format in the knowledge extraction template to obtain the initial knowledge graph. The initial knowledge graph includes multiple encrypted API functions, and the name, definition, parameters, return value, exception handling, normal usage examples, and abnormal usage examples corresponding to each encrypted API function.

[0012] In some embodiments, extracting encrypted API files from a project file to be detected includes: obtaining a list of encrypted APIs; performing structured analysis on the project file to be detected to generate an AST tree to be detected; and extracting the encrypted API files from the AST tree to be detected based on the list of encrypted APIs.

[0013] Secondly, embodiments of this application provide a device for detecting the misuse of encrypted APIs, comprising: a construction module for constructing an encrypted API knowledge graph; an extraction module for extracting encrypted API files from a project file to be detected; an analysis module for performing control flow analysis and data flow analysis on the encrypted API files to obtain function call information and static variable information of the encrypted API files; and a detection module for inputting the encrypted API knowledge graph, the encrypted API files, the function call information, and the static variable information into an encrypted API agent to perform encrypted API misuse detection and obtain a detection report of the project file to be detected.

[0014] Thirdly, embodiments of this application provide a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the method for detecting the misuse of the encryption API of any of the first aspects described above.

[0015] Fourthly, embodiments of this application provide a computer program product, including a computer program, which, when run, causes the misuse detection method of the encrypted API described in any of the first aspects to be executed.

[0016] Compared to related technologies, the encryption API misuse detection method, apparatus, and terminal device provided in this application construct an encryption API knowledge graph, extract encryption API files from the project file to be detected, and perform control flow analysis and data flow analysis on the encryption API files to obtain function call information and static variable information. Then, the encryption API knowledge graph, encryption API files, function call information, and static variable information are input into the encryption API agent for encryption API misuse detection, resulting in a detection report for the project file to be detected. In this way, by constructing an encryption API knowledge graph and inputting it into the encryption API agent, the encryption API agent's understanding of the domain knowledge of encryption APIs can be enhanced, thereby improving the performance of the encryption API agent in detecting encryption API misuse. Simultaneously, by performing structured analysis on the project file to be detected (including control flow analysis and data flow analysis of the encryption API files), the encryption API agent's structured understanding of the project file to be detected can be enhanced, improving the encryption API agent's context awareness of the project file to be detected, thereby enhancing the performance of the encryption API agent in detecting and repairing the misuse of encryption APIs in the project file to be detected. This application solves the problem of high false positive and false negative rates in rule-based encrypted API misuse detection methods in related technologies, and achieves the technical effect of improving the accuracy of encrypted API misuse detection.

[0017] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a method for detecting the misuse of an encrypted API according to an embodiment of this application;

[0020] Figure 2 This is a flowchart illustrating the construction of an encrypted API knowledge graph according to one embodiment of this application;

[0021] Figure 3 This is a flowchart illustrating the process of obtaining an encrypted API file according to one embodiment of this application;

[0022] Figure 4 This is a schematic diagram of the structure of a device for detecting the misuse of an encrypted API according to an embodiment of this application;

[0023] Figure 5 This is a schematic diagram of the structure of a terminal device according to an embodiment of this application. Detailed Implementation

[0024] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0025] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0026] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0027] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0028] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0029] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0030] Encryption APIs, as core security components in modern software development, play a crucial role in ensuring data confidentiality and integrity. Through frameworks such as JCA and JSSE, developers can implement core functions such as key generation and secure communication; therefore, encryption APIs have become the cornerstone of building modern software security defenses.

[0031] However, encrypted APIs face a series of challenges in practical applications, and the risk of API misuse caused by the complexity of encrypted APIs has attracted high attention from the industry. These challenges include three parts: (1) Complex interface parameters of encrypted APIs: The interface parameters of encrypted APIs are too complex. Taking the cipher.init interface as an example, developers need to deal with complex combinations of up to 8 parameter types. The complex professional threshold makes it difficult for non-cryptography experts to master; (2) Fragmented official Java technical documentation: The official Java technical documentation presents a clear state of knowledge fragmentation. Key cryptographic knowledge is scattered in multiple Java documentation resources, lacking systematic guidance and best practice integration for actual development scenarios; (3) Lack of developer experience: Industry surveys show that Java development team members lack professional cryptography training, which leads to the continuous infiltration of dangerous code design patterns into the production environment. Typical manifestations include: misuse of weak encryption algorithms, incorrect configuration of security protocols, and other systemic risks.

[0032] Currently, rule-driven methods are often used to detect the misuse of encrypted APIs, which rely on manually constructed expert pattern libraries. Although these methods claim to have systematic analytical capabilities, they reveal fundamental defects in accuracy and scalability in practical applications: (1) High false positive rate: Empirical studies have shown that these methods generally have a high false positive rate. Taking CryptoGuard (a file encryption tool) as an example, in the Apache CryptoAPI-Bench (a comprehensive benchmark for the misuse of encrypted APIs) benchmark test, it applied 16 manual rules and only detected 37 valid results from 64 real vulnerabilities, but with 29 false positives, resulting in an accuracy of only 57.8%; (2) Rigid patterns: Traditional rule engines are unable to cope with the complexity of cryptographic scenarios. They cannot parse the semantic features of the encrypted API context, nor can they adapt to the iterative updates of API specifications. This leads to the detection system easily missing new vulnerability patterns, i.e., a high false negative rate.

[0033] Currently, no effective solution has been proposed for the problem of high false positive and false negative rates in rule-based encrypted API misuse detection methods in related technologies.

[0034] In view of this, embodiments of this application provide a method for detecting the misuse of encrypted APIs. By constructing an encrypted API knowledge graph, encrypted API files are extracted from the project files to be detected. Control flow analysis and data flow analysis are then performed on the encrypted API files to obtain function call information and static variable information. Finally, the encrypted API knowledge graph, encrypted API files, function call information, and static variable information are input into an encrypted API agent for encrypted API misuse detection, resulting in a detection report for the project files to be detected. In this way, by constructing an encrypted API knowledge graph and inputting it into the encrypted API agent, the agent's understanding of the domain knowledge of encrypted APIs can be enhanced, thereby improving its performance in detecting encrypted API misuse. Simultaneously, by performing structured analysis on the project files to be detected (including control flow analysis and data flow analysis of the encrypted API files), the agent's structured understanding of the project files can be enhanced, improving its context awareness and thus improving its performance in detecting and correcting the misuse of encrypted APIs in the project files. This application solves the problem of high false positive and false negative rates in rule-based encrypted API misuse detection methods in related technologies, and achieves the technical effect of improving the accuracy of encrypted API misuse detection.

[0035] The following will combine Figure 1This application describes a method for detecting the misuse of an encrypted API according to one embodiment. Please refer to [link to relevant documentation]. Figure 1 , Figure 1 This is a flowchart of a method for detecting the misuse of an encrypted API according to an embodiment of this application, as follows: Figure 1 As shown, the method includes:

[0036] Step S101: Construct a knowledge graph of encrypted APIs.

[0037] The correct use of cryptographic APIs relies on a domain-specific knowledge graph of those APIs, but the training corpora of Large Language Models (LLMs) often lack such specialized content. Different combinations of API parameters have strict cryptographic semantic constraints, and complex parameter combinations can easily lead to cognitive biases in LLMs. Existing LLMs lack sufficient understanding of security protocols and lag significantly in updating cryptographic specifications. Therefore, in this embodiment, by constructing a fine-grained cryptographic API knowledge graph and subsequently inputting it into the cryptographic API agent, the agent's understanding of the domain-specific knowledge of cryptographic APIs can be enhanced. Furthermore, establishing a secure coding specification knowledge base can further enhance the cryptographic API agent's understanding of the domain-specific knowledge of cryptographic APIs.

[0038] In this embodiment, a knowledge graph of cryptographic APIs related to frameworks such as JCA and JSSE can be extracted from the official Java documentation to enhance the cryptographic API agent's understanding of domain-specific knowledge of cryptographic APIs.

[0039] The following will combine Figure 2 An exemplary process for constructing an encrypted API knowledge graph according to one embodiment of this application will be described below. Please refer to [link to documentation]. Figure 2 , Figure 2 This is a flowchart illustrating the construction of an encrypted API knowledge graph according to one embodiment of this application, such as... Figure 2 As shown, constructing the cryptographic API knowledge graph includes:

[0040] Step S201: Obtain the encryption API knowledge document.

[0041] In this embodiment, encryption API knowledge documents can be extracted from the official Java documentation. Specifically, the official Oracle Java SE technical documentation can be analyzed, and the JCA and JSSE frameworks can be deeply analyzed. Through a combination of automated crawling and manual verification, the core functional modules of the two frameworks can be systematically identified. For the JCA knowledge system, a knowledge graph covering core cryptographic capabilities can be constructed. This knowledge graph integrates digital signature and message digest mechanisms, certificate management systems and encryption algorithm implementations, key lifecycle management specifications, and secure random number generation standards. For the JSSE protocol stack, processes such as encrypted channel establishment, two-way authentication mechanisms, protocol version compatibility management, and session key negotiation can be analyzed.

[0042] By constructing a knowledge graph covering core cryptographic capabilities and analyzing various aspects of the JSSE protocol stack, cryptographic API knowledge documents can be extracted from the official Java documentation. Subsequent construction of a cryptographic API knowledge graph using these documents allows cryptographic API agents that input the knowledge graph to gain a more comprehensive understanding of the relevant cryptographic API knowledge, thereby improving the accuracy of the agent's detection of cryptographic API misuse.

[0043] Step S202: Input the encrypted API knowledge document into the large language model for knowledge graph extraction to obtain the initial knowledge graph.

[0044] In this embodiment, natural language processing techniques and knowledge extraction tools can be used to process encrypted API knowledge documents, and graph databases or semantic web technologies can be used to construct an initial knowledge graph.

[0045] As an example, step S202 may include the following steps:

[0046] Step a1: Construct a knowledge extraction template, wherein the knowledge extraction template includes at least a second input format, a second query statement, and a second output format; the second query statement includes at least a fourth judgment and a fifth judgment; the fourth judgment is used to indicate whether the encrypted API knowledge document contains an encrypted API function; the fifth judgment is used to indicate the information for determining the encrypted API function.

[0047] In this embodiment, the second input format is used to indicate the input format of the large language model, and the second output format is used to guide the large language model to output in accordance with the specified format.

[0048] As an example, the second output format includes JSON format and follows the data format: {encryption API function: name: "**", definition: "**", parameters: "**", return value: "**", exception handling: "**", normal usage example: "**", exception usage example: "**"}.

[0049] In this embodiment, in addition to the second input format, the second query statement, and the second output format, the knowledge extraction template may also include a role definition for guiding the large language model to extract the initial knowledge graph. For example, the role definition may include the following statement: "You will be defined as an assistant to extract cryptographic API function knowledge from the second input information."

[0050] Step a2: Input the encrypted API knowledge document into the knowledge extraction template according to the second input format in the knowledge extraction template to obtain the second input information.

[0051] In this embodiment, the encrypted API knowledge document can be input into the knowledge extraction template according to the second input format in the knowledge extraction template to obtain the second input information. As an example, the second input format can limit the input length and data format of the large language model. The encrypted API knowledge document can be segmented according to the input length, and the segmented encrypted API knowledge document can be standardized according to the data format, thereby improving the input quality of the large language model and thus improving the accuracy and completeness of the initial knowledge graph output by the large language model.

[0052] Step a3: Input the second input information into the large language model. The large language model determines whether the encrypted API knowledge document contains encrypted API functions based on the fourth judgment. If the encrypted API knowledge document contains encrypted API functions, the large language model determines the information of the encrypted API functions based on the fifth judgment.

[0053] In this embodiment, the fourth conditional statement can be expressed as: "You need to analyze the second input information step by step to determine whether it contains encrypted API functions"; the fifth conditional statement can be expressed as: "If the second input information contains encrypted API functions, then output the function information related to that encrypted API function." The large language model can output all encrypted API functions in the encrypted API knowledge document, along with information related to each encrypted API function, based on the fourth and fifth conditional statements.

[0054] Step 4: The large language model combines the information of the encrypted API functions in the encrypted API knowledge document according to the second output format in the knowledge extraction template to obtain the initial knowledge graph. The initial knowledge graph includes multiple encrypted API functions, and for each encrypted API function, the name, definition, parameters, return value, exception handling, normal usage examples, and exception usage examples.

[0055] In this embodiment, in addition to the second input format, second query statement, second output format, and role definition, the knowledge extraction template may also include constraints to constrain the output of the large language model. As an example, these constraints may include the following statements: "If the second input information contains conflicting encryption API functions with the same function name but different parameters, output the function information associated with each conflicting encryption API function" and "If the second input information does not contain any encryption API functions, output 'N / A'".

[0056] By setting constraints, when a large language model encounters conflicting encryption API functions, it can output the function information of all conflicting encryption API functions, thus avoiding omissions.

[0057] Step S203: Cross-validate the initial knowledge graph with the encrypted API knowledge document, and perform redundancy detection and completion processing on the initial knowledge graph to obtain the encrypted API knowledge graph.

[0058] In this embodiment, the extracted initial knowledge graph can be checked, duplicate content can be deleted, and normal usage examples and abnormal usage examples related to each encrypted API function can be added to the initial knowledge graph, thereby improving the coverage of encrypted API knowledge in the encrypted API knowledge graph.

[0059] Specifically, the initial knowledge graph can be validated, and the function-level description of each encrypted API function in the initial knowledge graph can be cross-validated with the official Java documentation (i.e., the encrypted API knowledge document) to ensure that the extracted information meets the preset completeness standards. Then, redundancy detection can be performed on the cross-validated initial knowledge graph to remove redundant or duplicate encrypted API function information. Furthermore, considering that a large language model may not be able to extract complete encrypted API function information from the encrypted API knowledge document, the initial knowledge graph can be completed to fill in incomplete encrypted API function information. For example, if a certain encrypted API function lacks normal usage examples and abnormal usage examples, it can be manually completed.

[0060] Step S102: Extract the encrypted API file from the project file to be detected.

[0061] In this embodiment, the project file to be detected can be an Apache project file. Structured analysis can be performed on the project file to be detected to extract files related to the encryption API, i.e., encryption API files.

[0062] The following will combine Figure 3 An exemplary process for obtaining encrypted API files according to one embodiment of this application will be described below. Please refer to [link to relevant documentation]. Figure 3 , Figure 3 This is a flowchart illustrating the process of obtaining an encrypted API file according to one embodiment of this application, such as... Figure 3 As shown, obtaining the encrypted API file includes:

[0063] Step S301: Obtain the list of encrypted APIs.

[0064] Step S302: Perform structured analysis on the project file to be tested to generate the AST tree to be tested.

[0065] Step S303: Extract encrypted API files from the AST tree to be detected based on the encrypted API list.

[0066] In this embodiment, since Apache project files often contain multiple Java files, some of which include encrypted API calls and others do not, to avoid the subsequent encrypted API agent analyzing Java files that do not include encrypted API calls, thus reducing the detection efficiency of encrypted API misuse, files related to the encrypted API, i.e., encrypted API files, can be extracted in advance from the project files to be detected, thereby improving the detection efficiency of the encrypted API agent for encrypted API misuse.

[0067] Specifically, a list of encrypted APIs can be obtained, then all Java files in the project file to be tested can be traversed, and an AST (Abstract Syntax Tree) to be tested can be generated for each Java file. Finally, based on the list of encrypted APIs, it can be verified whether each AST to be tested contains encrypted API calls, and based on the verification results, the encrypted API files can be extracted.

[0068] Step S103: Perform control flow analysis and data flow analysis on the encrypted API file to obtain function call information and static variable information of the encrypted API file.

[0069] Misuse of encrypted APIs in real-world projects often involves multiple function call chains. For example, a typical misuse case in the Apache CryptoAPI-Bench benchmark involves an average of 20 variable calls and 5 function calls. While existing research employs cue engineering, it fails to construct a project-level structural analysis framework. Shallow analysis methods struggle to capture the deep-seated characteristics of encrypted API misuse, especially those involving the correlation between data flow and control flow. Therefore, the lack of a project-level context-aware agent easily overlooks cross-module and cross-function characteristics, significantly reducing the effectiveness of encrypted API misuse detection and remediation strategies.

[0070] In this embodiment, by performing structured analysis (including control flow analysis and data flow analysis) on the encrypted API file, function call information and static variable information of the encrypted API file are obtained. Subsequently, after inputting the function call information and static variable information into the encrypted API agent, the encrypted API agent's structured understanding of the project file to be detected can be enhanced, thereby improving the encrypted API agent's context awareness of the encrypted API in the project file to be detected, and thus improving the accuracy of the encrypted API agent in detecting the misuse of encrypted APIs.

[0071] Specifically, structured analysis of encrypted API files can include control flow analysis and data flow analysis. Control flow analysis involves analyzing the function call control flow graphs across and within encrypted API files. This analysis helps improve the performance of the encrypted API agent in detecting cross-file and intra-file encrypted API misuse scenarios. Cross-file function call analysis includes examining the call relationships between encrypted API files to analyze cross-file dependencies. Understanding these cross-file dependencies can improve the detection performance of the encrypted API agent in cross-file encrypted API misuse scenarios. Intra-file function call analysis includes extracting function call relationships within encrypted API files based on abstract syntax trees. First, encrypted API functions and unencrypted API functions within the encrypted API files are distinguished. By traversing these functions and analyzing their call relationships, the interaction mechanisms between encrypted and unencrypted API functions can be identified.

[0072] In data flow analysis, each encrypted API file can be analyzed separately. Since static variable information (including global and local static variables) is central to the structure and behavior of Java programs, the abstract syntax tree generation process of each encrypted API file can be analyzed. Then, detailed information about global static variables can be extracted from the encrypted API file. For example, static variable information may include postfix operators, prefix operators, type parameters, qualifiers, selectors, and value data related to each global static variable. By understanding the calling relationships of global static variables, the detection performance of the encrypted API agent regarding variable-related encrypted API misuse can be improved. This static variable analysis enables the encrypted API agent to make more informed predictions about variable usage and potential misuse in the encrypted environment.

[0073] Step S104: Input the encrypted API knowledge graph, encrypted API files, function call information and static variable information into the encrypted API agent to detect the misuse of encrypted APIs and obtain a detection report of the project file to be detected.

[0074] In this embodiment, the encrypted API agent may include a code segmentation module, a detection and repair module, and a reflection module. The code segmentation module can split the encrypted API file into multiple code fragments, or it can pre-split the encrypted API file into multiple code fragments and then input the resulting code fragments into the encrypted API agent (in this case, the encrypted API agent may not include the code segmentation module). The detection and repair module can use a preset detection and repair template to detect and repair encrypted API misuse in the code fragments input to the encrypted API agent. The reflection module allows the encrypted API agent to re-analyze its output detection report and optimize its final output.

[0075] As an example, step S104 may include the following steps:

[0076] Step b1: Input the encrypted API file into the code segmentation module for code splitting to obtain multiple code fragments to be detected.

[0077] Step b2: Input each code segment to be detected, along with the encrypted API knowledge graph, function call information, and static variable information, into the detection and repair module to detect and repair the misuse of encrypted APIs, and obtain the initial detection report of the project file to be detected.

[0078] In this embodiment, step b2 may include the following steps:

[0079] Step c1: Construct a detection and repair template, wherein the detection and repair template includes at least a first query statement; the first query statement includes at least a first judgment statement, a second judgment statement, and a third judgment statement; the first judgment statement is used to indicate whether there is a misuse of the encrypted API; the first judgment statement is used to indicate the type of misuse of the encrypted API, the location of the misuse of the encrypted API, and the reason for the misuse of the encrypted API; the third judgment statement is used to indicate the repair method for the misuse of the encrypted API.

[0080] Step c2: For each code segment to be detected, the code segment to be detected, the encrypted API knowledge graph, function call information, and static variable information are input into the detection and repair module. The detection and repair module determines whether there is any misuse of encrypted APIs in the code segment to be detected based on the first judgment formula. If there is misuse of encrypted APIs in the code segment to be detected, the detection and repair module determines the type, location, and cause of the misuse of encrypted APIs in the code segment to be detected based on the second judgment formula. The detection and repair module determines the repair method for the misuse of encrypted APIs based on the third judgment formula.

[0081] Step c3: The detection and repair module combines the type of encrypted API misuse, location of encrypted API misuse, reason for encrypted API misuse, and repair method for each code segment to be detected to obtain an initial detection report.

[0082] In this embodiment, a detection and repair template can be constructed. GPT-4o can be used as a baseline large model to construct an encrypted API agent. The input code fragment to be detected can be analyzed by referencing function call information, static variable information, and the encrypted API knowledge graph.

[0083] As an example, the first condition in the first query statement may include the following statement: "If there is a misuse of the encrypted API in the code segment to be detected, please output 'Yes' or 'No'"; the second condition may include the following statement: "If there is a misuse of the encrypted API in the code segment to be detected, output the type of the misuse of the encrypted API, the location of the misuse of the encrypted API, and the reason for the misuse of the encrypted API"; the third condition may include the following statement: "If there is a misuse of the encrypted API in the code segment to be detected, output the method to fix the misuse of the encrypted API".

[0084] In addition to the first query statement, the detection and repair template may also include role definitions and constraints for guiding the detection and repair module in the encrypted API agent to perform encrypted API misuse detection and repair on the code fragment to be detected.

[0085] As an example, the role definition in the detection and repair template can include the following statement: "You will be regarded as an assistant in detecting whether there is any misuse of cryptographic APIs in the input code snippet to be detected. You need to analyze the code snippet to be detected step by step and refer to function call information, static variable information and cryptographic API knowledge graph to determine whether there is any misuse of cryptographic APIs in the code snippet to be detected."

[0086] Constraints may include the following statements: "1. You should analyze the code segment to be tested step by step and refer to function call information, static variable information and encrypted API knowledge graph to determine whether there is any misuse of encrypted API in the code segment to be tested; 2. You can detect the API function call relationship in the code segment to be tested based on function call information and static variable information to detect whether there is any misuse of encrypted API in the code segment to be tested; 3. You can refer to the encrypted API knowledge graph to determine whether there is any misuse of encrypted API in the code segment to be tested."

[0087] In this embodiment, the detection and repair template may include a first input format and a first output format, in addition to the first query statement, role definition, and constraints. The first input format indicates the input format of the encrypted API agent, and the second output format guides the encrypted API agent to output according to the prescribed format.

[0088] As an example, step c2, "for each code segment to be detected, input the code segment to be detected, the encrypted API knowledge graph, function call information, and static variable information into the detection and repair module," may include: for each code segment to be detected, input the code segment to be detected, the encrypted API knowledge graph, function call information, and static variable information into the detection and repair template according to the first input format in the detection and repair template to obtain the first input information; input the first input information into the detection and repair module to perform encrypted API misuse detection.

[0089] Step c3 may include: the detection and repair module combining the type of encrypted API misuse, location of encrypted API misuse, reason for encrypted API misuse, and repair method of encrypted API misuse corresponding to each code segment to be detected according to the first output format in the detection and repair template to obtain an initial detection report.

[0090] In this embodiment, the first input format can follow the following data format: code snippet to be detected: <**>; function call information: <**>; static variable information: <**>; encrypted API knowledge graph: <**>. The first output format can be JSON format and follow the following data format: {encrypted API misuse situation: "**", encrypted API misuse type: "**", encrypted API misuse location: "**", encrypted API misuse reason: "**", encrypted API misuse repair method: "**"}.

[0091] By combining the output information corresponding to each code snippet to be detected, an initial detection report can be obtained. Since the initial detection report may not cover all types of misuse of encrypted APIs in the project file to be detected, a reflection module can be set up to guide the encrypted API agent to reflect on the initial detection report and re-detect based on the encrypted API knowledge graph, function call information, and static variable information to generate a final optimized detection report.

[0092] Step b3: Input the initial detection report, encrypted API knowledge graph, function call information and static variable information into the reflection module. The reflection module will reflect on the initial detection report to obtain a detection report. The detection report includes information on the misuse of encrypted APIs in the project file to be detected, the location of the misuse of encrypted APIs, and information on the correction of the misuse of encrypted APIs.

[0093] In this embodiment, the reflection module can use a preset reflection template to reflect on the detection and repair results of the encryption API misuse based on the initial detection report. After multiple rounds of reflection, a final optimized detection report is obtained.

[0094] As an example, the reflection template could include the following statements: "Step 1: You can refer to the initial detection report to reflect on the detection and remediation results of encrypted API misuse. You can also refer to the encrypted API knowledge graph, function call information, and static variable information to detect encrypted API misuse in the code snippet to be detected. Step 2: Use strong, randomly generated values ​​and a high number of iterations to achieve better security. Step 3: To analyze the encrypted API misuse in the code snippet to be detected, break down the code snippet to be detected step by step and compare it with the encrypted API knowledge graph and the initial detection report. Return to Step 1."

[0095] Based on the above reflection template, the reflection module will conduct multiple rounds of reflection to obtain the final optimized detection report. The detection report includes information on the misuse of encrypted APIs in the project file to be tested, the location of the misuse of encrypted APIs, and information on the correction of the misuse of encrypted APIs.

[0096] Through steps S101 to S104 above, an encrypted API knowledge graph is constructed, encrypted API files are extracted from the project files to be detected, and control flow analysis and data flow analysis are performed on the encrypted API files to obtain function call information and static variable information. Then, the encrypted API knowledge graph, encrypted API files, function call information, and static variable information are input into the encrypted API agent to detect encrypted API misuse, resulting in a detection report for the project files to be detected. In this way, by constructing an encrypted API knowledge graph and inputting it into the encrypted API agent, the encrypted API agent's understanding of the domain knowledge of encrypted APIs can be enhanced, thereby improving the performance of the encrypted API agent in detecting encrypted API misuse. At the same time, by performing structured analysis on the project files to be detected (including control flow analysis and data flow analysis of encrypted API files), the encrypted API agent's structured understanding of the project files to be detected can be enhanced, improving the encrypted API agent's context awareness of the project files to be detected, thereby enhancing the performance of the encrypted API agent in detecting and repairing the misuse of encrypted APIs in the project files to be detected. This application solves the problem of high false positive and false negative rates in rule-based encrypted API misuse detection methods in related technologies, and achieves the technical effect of improving the accuracy of encrypted API misuse detection.

[0097] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0098] Corresponding to the method for detecting the misuse of encrypted APIs described in the above embodiments, Figure 3 A schematic diagram of a misuse detection device for an encrypted API according to an embodiment of this application is shown. The device is used to train a continuous-time dynamic graph model. For ease of explanation, only the parts related to the embodiment of this application are shown.

[0099] Please see Figure 4 The encrypted API misuse detection device 4 includes: a construction module 40 for constructing an encrypted API knowledge graph; an extraction module 41 for extracting encrypted API files from the project files to be detected; an analysis module 42 for performing control flow analysis and data flow analysis on the encrypted API files to obtain function call information and static variable information of the encrypted API files; and a detection module 43 for inputting the encrypted API knowledge graph, encrypted API files, function call information, and static variable information into the encrypted API agent to perform encrypted API misuse detection and obtain a detection report of the project files to be detected.

[0100] In one embodiment, the encrypted API agent includes a code segmentation module, a detection and repair module, and a reflection module. The detection module 43 is further configured to input the encrypted API file into the code segmentation module for code splitting to obtain multiple code segments to be detected; input each code segment to be detected, along with the encrypted API knowledge graph, function call information, and static variable information, into the detection and repair module for encrypted API misuse detection and repair to obtain an initial detection report of the project file to be detected; input the initial detection report, the encrypted API knowledge graph, function call information, and static variable information into the reflection module, which reflects on the initial detection report to obtain a detection report, wherein the detection report includes encrypted API misuse information, encrypted API misuse location, and encrypted API misuse repair information in the project file to be detected.

[0101] In one embodiment, the detection module 43 is further configured to construct a detection and repair template, wherein the detection and repair template includes at least a first query statement; the first query statement includes at least a first judgment, a second judgment, and a third judgment; the first judgment is used to indicate whether there is misuse of the encrypted API; the first judgment is used to indicate the type of misuse of the encrypted API, the location of the misuse of the encrypted API, and the reason for the misuse of the encrypted API; the third judgment is used to indicate the repair method for the misuse of the encrypted API; for each code segment to be detected, the code segment to be detected, the encrypted API knowledge graph, function call information, and static variable information are input into the detection and repair module, and the detection module performs the repair. The detection and repair module determines whether there is a misuse of encrypted APIs in the code segment to be detected based on the first judgment formula. If there is a misuse of encrypted APIs in the code segment to be detected, the detection and repair module determines the type, location, and cause of the misuse of encrypted APIs in the code segment to be detected based on the second judgment formula. The detection and repair module determines the repair method for the misuse of encrypted APIs based on the third judgment formula. The detection and repair module combines the type, location, cause, and repair method of the misuse of encrypted APIs corresponding to each code segment to be detected to obtain an initial detection report.

[0102] In one embodiment, the detection and repair template further includes a first input format and a first output format; the detection module 43 is further configured to input the code segment to be detected, the encrypted API knowledge graph, function call information and static variable information into the detection and repair template according to the first input format in the detection and repair template for each code segment to be detected, to obtain the first input information; and the detection and repair module combines the encrypted API misuse type, encrypted API misuse location, encrypted API misuse reason and encrypted API misuse repair method corresponding to each code segment to be detected according to the first output format in the detection and repair template to obtain an initial detection report.

[0103] In one embodiment, the construction module 40 is further configured to obtain encrypted API knowledge documents; input the encrypted API knowledge documents into a large language model for knowledge graph extraction to obtain an initial knowledge graph; perform cross-validation between the initial knowledge graph and the encrypted API knowledge documents, and perform redundancy detection and completion processing on the initial knowledge graph to obtain the encrypted API knowledge graph.

[0104] In one embodiment, the construction module 40 is further configured to construct a knowledge extraction template, wherein the knowledge extraction template includes at least a second input format, a second query statement, and a second output format; the second query statement includes at least a fourth judgment and a fifth judgment; the fourth judgment is used to indicate whether the encrypted API knowledge document contains an encrypted API function; the fifth judgment is used to indicate the information of the encrypted API function; the encrypted API knowledge document is input into the knowledge extraction template according to the second input format in the knowledge extraction template to obtain second input information; the second input information is input into a large language model, and the large language model determines whether the encrypted API knowledge document contains an encrypted API function based on the fourth judgment; if the encrypted API knowledge document contains an encrypted API function, the large language model determines the information of the encrypted API function based on the fifth judgment; the large language model combines the information of the encrypted API function in the encrypted API knowledge document according to the second output format in the knowledge extraction template to obtain an initial knowledge graph, wherein the initial knowledge graph includes multiple encrypted API functions, and the name, definition, parameters, return value, exception handling, normal usage examples, and abnormal usage examples corresponding to each encrypted API function.

[0105] In one embodiment, the extraction module 41 is further configured to obtain a list of encrypted APIs; perform structured analysis on the project file to be detected to generate an AST tree to be detected; and extract encrypted API files from the AST tree to be detected based on the list of encrypted APIs.

[0106] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0107] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0108] Figure 5 This is a schematic diagram of the structure of a terminal device according to an embodiment of this application. Figure 5 As shown, the terminal device 5 includes: at least one processor 50 ( Figure 5 (Only one is shown) a processor, a memory 51, and a computer program 52 stored in the memory 51 and executable on at least one processor 50. When the processor 50 executes the computer program 52, it implements the steps in the above embodiments of the misuse detection method for any of the encryption APIs.

[0109] Terminal device 5 can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. Terminal device 5 may include, but is not limited to, processor 50 and memory 51. Those skilled in the art will understand that... Figure 5 This is merely an example of terminal device 5 and does not constitute a limitation on terminal device 5. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0110] The processor 50 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0111] In some embodiments, memory 51 may be an internal storage unit of terminal device 5, such as a hard disk or memory of terminal device 5. In other embodiments, memory 51 may be an external storage device of terminal device 5, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on terminal device 5. In other embodiments, memory 51 may include both internal and external storage units of terminal device 5. Memory 51 is used to store operating system, applications, bootloader, data, and other programs, such as the program code of computer program 52. Memory 51 may also be used to temporarily store data that has been output or will be output.

[0112] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the above-described embodiments of the misuse detection method for various encryption APIs.

[0113] This application provides a computer program product that, when run on a mobile terminal, enables the mobile terminal to implement the steps in the above-described methods for detecting the misuse of various encrypted APIs.

[0114] This application implements all or part of the processes in the methods of the above embodiments, which can be accomplished by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate form. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a misuse detection device or terminal device for an encrypted API, a recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, such as a USB flash drive, portable hard drive, magnetic disk, or optical disk.

[0115] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0116] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0117] In the embodiments provided in this application, it should be understood that the disclosed apparatus / network devices and methods can be implemented in other ways. For example, the apparatus / network device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0118] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0119] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for detecting misuse of an encrypted API, characterized in that, include: Construct a knowledge graph of encrypted APIs; Extract the encrypted API file from the project file to be tested; The encrypted API file is subjected to control flow analysis and data flow analysis to obtain the function call information and static variable information of the encrypted API file. The encrypted API knowledge graph, the encrypted API file, the function call information, and the static variable information are input into the encrypted API agent to detect the misuse of the encrypted API, and a detection report of the project file to be detected is obtained.

2. The method according to claim 1, characterized in that, The encrypted API agent includes a code segmentation module, a detection and repair module, and a reflection module. The encrypted API knowledge graph, the encrypted API file, the function call information, and the static variable information are input into the encrypted API agent to detect encrypted API misuse, resulting in a detection report for the file to be detected, including: The encrypted API file is input into the code segmentation module for code splitting to obtain multiple code fragments to be detected; Each code segment to be detected, along with the encrypted API knowledge graph, the function call information, and the static variable information, is input into the detection and repair module to detect and repair the misuse of the encrypted API, thereby obtaining an initial detection report for the project file to be detected. The initial detection report, the encrypted API knowledge graph, the function call information, and the static variable information are input into the reflection module. The reflection module reflects on the initial detection report to obtain the detection report, wherein the detection report includes the encrypted API misuse information, the location of the encrypted API misuse, and the encrypted API misuse repair information in the project file to be detected.

3. The method according to claim 2, characterized in that, Each of the code fragments to be detected, along with the encrypted API knowledge graph, the function call information, and the static variable information, is input into the detection and repair module for encrypted API misuse detection and repair. The resulting initial detection report for the file to be detected includes: A detection and repair template is constructed, wherein the detection and repair template includes at least a first query statement; the first query statement includes at least a first judgment expression, a second judgment expression, and a third judgment expression; the first judgment expression is used to indicate whether there is a misuse of the encrypted API; the first judgment expression is used to indicate the type of misuse of the encrypted API, the location of the misuse of the encrypted API, and the reason for the misuse of the encrypted API; the third judgment expression is used to indicate the repair method for the misuse of the encrypted API. For each code segment to be detected, the code segment to be detected, the encrypted API knowledge graph, the function call information, and the static variable information are input into the detection and repair module. The detection and repair module determines whether the encrypted API misuse exists in the code segment to be detected based on the first judgment formula. If the encrypted API misuse exists in the code segment to be detected, the detection and repair module determines the type of encrypted API misuse, the location of the encrypted API misuse, and the reason for the encrypted API misuse in the code segment to be detected based on the second judgment formula. The detection and repair module determines the repair method for the encrypted API misuse based on the third judgment formula. The detection and repair module combines the type of encryption API misuse, the location of encryption API misuse, the reason for encryption API misuse, and the repair method for each code segment to be detected to obtain the initial detection report.

4. The method according to claim 3, characterized in that, The detection and repair template further includes a first input format and a first output format; for each code segment to be detected, inputting the code segment to be detected, the encrypted API knowledge graph, the function call information, and the static variable information into the detection and repair module includes: For each code segment to be detected, the code segment to be detected, the encrypted API knowledge graph, the function call information, and the static variable information are input into the detection and repair template according to the first input format in the detection and repair template to obtain the first input information; The first input information is input into the detection and repair module for encrypted API misuse detection; and... The detection and repair module combines the type of encryption API misuse, the location of encryption API misuse, the reason for encryption API misuse, and the repair method for each code segment to be detected to obtain the initial detection report, which includes: The detection and repair module combines the type of encryption API misuse, the location of encryption API misuse, the reason for encryption API misuse, and the repair method for each code segment to be detected according to the first output format in the detection and repair template to obtain the initial detection report.

5. The method according to any one of claims 1 to 4, characterized in that, Building a cryptographic API knowledge graph includes: Obtain the encryption API documentation; The encrypted API knowledge document is input into a large language model for knowledge graph extraction to obtain an initial knowledge graph. The initial knowledge graph is cross-validated with the encrypted API knowledge document, and redundancy detection and completion processing are performed on the initial knowledge graph to obtain the encrypted API knowledge graph.

6. The method according to claim 5, characterized in that, The encrypted API knowledge document is input into a large language model for knowledge graph extraction, resulting in an initial knowledge graph including: A knowledge extraction template is constructed, wherein the knowledge extraction template includes at least a second input format, a second query statement, and a second output format; the second query statement includes at least a fourth judgment expression and a fifth judgment expression; the fourth judgment expression is used to indicate whether the encrypted API knowledge document contains an encrypted API function; the fifth judgment expression is used to indicate information for determining the encrypted API function; The encrypted API knowledge document is input into the knowledge extraction template according to the second input format in the knowledge extraction template to obtain the second input information; The second input information is input into the large language model, which then determines whether the encrypted API knowledge document contains the encrypted API function based on the fourth judgment. If the encrypted API knowledge document contains the encrypted API function, the large language model determines the information of the encrypted API function based on the fifth judgment. The large language model combines the information of the encrypted API functions in the encrypted API knowledge document according to the second output format in the knowledge extraction template to obtain the initial knowledge graph. The initial knowledge graph includes multiple encrypted API functions, and the name, definition, parameters, return value, exception handling, normal usage examples and abnormal usage examples corresponding to each encrypted API function.

7. The method according to any one of claims 1 to 4, characterized in that, Extracting encrypted API files from the files to be tested includes: Get the list of encrypted APIs; The project file to be detected is subjected to structured analysis to generate the AST tree to be detected; Based on the encrypted API list, the encrypted API files are extracted from the AST tree to be detected.

8. A device for detecting misuse of an encrypted API, characterized in that, include: Modules for building cryptographic API knowledge graphs; The extraction module is used to extract encrypted API files from the project files to be detected; The analysis module is used to perform control flow analysis and data flow analysis on the encrypted API file to obtain the function call information and static variable information of the encrypted API file. The detection module is used to input the encrypted API knowledge graph, the encrypted API file, the function call information, and the static variable information into the encrypted API agent to detect the misuse of the encrypted API and obtain a detection report of the project file to be detected.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method for detecting misuse of the encrypted API as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, Includes a computer program, which, when run, causes the method for detecting the misuse of the encrypted API as described in any one of claims 1 to 7 to be executed.

Images