TY - GEN
T1 - CryptoAPI-bench
T2 - 2019 IEEE Secure Development, SecDev 2019
AU - Afrose, Sharmin
AU - Rahaman, Sazzadur
AU - Yao, Danfeng Daphne
N1 - Publisher Copyright:
© 2019 IEEE.
PY - 2019/9
Y1 - 2019/9
N2 - Several studies showed that misuses of cryptographic APIs are common in real-world code (e.g., Apache projects and Android apps). There exist several open-sourced and commercial security tools that automatically screen Java programs to detect misuses. In order to compare their accuracy and security guarantees, we develop a comprehensive benchmark named CryptoAPI-Bench. CryptoAPI-Bench consists of 171 unit test cases that cover basic cases, as well as complex cases, including interprocedural, field sensitive, multiple class test cases, and path sensitive data flow of misuse cases. The benchmark also includes correct cases for testing false positive rates. We evaluate CryptoAPI-Bench on four tools, namely, SpotBugs, CryptoGuard, CrySL, and Coverity and present their performance and comparative analysis. Our benchmark is useful for advancing state-of-the-art solutions in the space of misuse detection.
AB - Several studies showed that misuses of cryptographic APIs are common in real-world code (e.g., Apache projects and Android apps). There exist several open-sourced and commercial security tools that automatically screen Java programs to detect misuses. In order to compare their accuracy and security guarantees, we develop a comprehensive benchmark named CryptoAPI-Bench. CryptoAPI-Bench consists of 171 unit test cases that cover basic cases, as well as complex cases, including interprocedural, field sensitive, multiple class test cases, and path sensitive data flow of misuse cases. The benchmark also includes correct cases for testing false positive rates. We evaluate CryptoAPI-Bench on four tools, namely, SpotBugs, CryptoGuard, CrySL, and Coverity and present their performance and comparative analysis. Our benchmark is useful for advancing state-of-the-art solutions in the space of misuse detection.
KW - Accuracy
KW - Benchmark
KW - Cryptographic API misuses
UR - http://www.scopus.com/inward/record.url?scp=85075792580&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85075792580&partnerID=8YFLogxK
U2 - 10.1109/SecDev.2019.00017
DO - 10.1109/SecDev.2019.00017
M3 - Conference contribution
AN - SCOPUS:85075792580
T3 - Proceedings - 2019 IEEE Secure Development, SecDev 2019
SP - 49
EP - 61
BT - Proceedings - 2019 IEEE Secure Development, SecDev 2019
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 25 September 2019 through 27 September 2019
ER -