SpanL: Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions

Sazzadur Rahaman; Miles Frantz; Barton Miller; Danfeng (Daphne) Yao

doi:10.1007/978-3-031-41181-6_28

SpanL: Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions

Sazzadur Rahaman, Miles Frantz, Barton Miller, Danfeng (Daphne) Yao

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

High-level language platforms provide APIs to aid developers in easily integrating security-relevant features in their code. Prior research shows that improper use of these APIs is a major source of insecurity in various application domains. Automatic code screening holds lots of potential to enable secure coding. However, building domain-specific security analysis tools requires both application domain and program analysis expertise. Interestingly, most of the prior works in developing domain-specific security analysis tools leverage some form of data flow analysis in the core. We leverage this insight to build a specification language named SpanL¹ for domain-specific security screening. The expressiveness analysis shows that a rule requiring any composition of dataflow analysis can be modeled in our language. Our evaluation on four cryptographic API misuse problems shows that our prototype implementation of SpanL does not introduce any imprecision due to the expressiveness of the language(¹ SpanL stands for Security sPecificAtioN Language.).

Original language	English (US)
Title of host publication	Applied Cryptography and Network Security Workshops - ACNS 2023 Satellite Workshops, ADSC, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S and P, SCI, SecMT, SiMLA, Proceedings
Editors	Jianying Zhou, Lejla Batina, Stjepan Picek, Zengpeng Li, Jingqiang Lin, Eleonora Losiouk, Suryadipta Majumdar, Daisuke Mashima, Weizhi Meng, Mohammad Ashiqur Rahman, Jun Shao, Masaki Shimaoka, Ezekiel Soremekun, Chunhua Su, Je Sen Teh, Aleksei Udovenko, Cong Wang, Leo Zhang, Yury Zhauniarovich
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	515-529
Number of pages	15
ISBN (Print)	9783031411809
DOIs	https://doi.org/10.1007/978-3-031-41181-6_28
State	Published - 2023
Event	21st International Conference on Applied Cryptography and Network Security, ACNS 2023 - Kyoto, Japan Duration: Jun 19 2023 → Jun 22 2023

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	13907 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	21st International Conference on Applied Cryptography and Network Security, ACNS 2023
Country/Territory	Japan
City	Kyoto
Period	6/19/23 → 6/22/23

Keywords

API Misuse
Program Analysis
Specification Language

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-031-41181-6_28

Cite this

Rahaman, S., Frantz, M., Miller, B., & Yao, D. (2023). SpanL: Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions. In J. Zhou, L. Batina, S. Picek, Z. Li, J. Lin, E. Losiouk, S. Majumdar, D. Mashima, W. Meng, M. A. Rahman, J. Shao, M. Shimaoka, E. Soremekun, C. Su, J. S. Teh, A. Udovenko, C. Wang, L. Zhang, & Y. Zhauniarovich (Eds.), Applied Cryptography and Network Security Workshops - ACNS 2023 Satellite Workshops, ADSC, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S and P, SCI, SecMT, SiMLA, Proceedings (pp. 515-529). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 13907 LNCS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-031-41181-6_28

SpanL: Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions. / Rahaman, Sazzadur; Frantz, Miles; Miller, Barton et al.
Applied Cryptography and Network Security Workshops - ACNS 2023 Satellite Workshops, ADSC, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S and P, SCI, SecMT, SiMLA, Proceedings. ed. / Jianying Zhou; Lejla Batina; Stjepan Picek; Zengpeng Li; Jingqiang Lin; Eleonora Losiouk; Suryadipta Majumdar; Daisuke Mashima; Weizhi Meng; Mohammad Ashiqur Rahman; Jun Shao; Masaki Shimaoka; Ezekiel Soremekun; Chunhua Su; Je Sen Teh; Aleksei Udovenko; Cong Wang; Leo Zhang; Yury Zhauniarovich. Springer Science and Business Media Deutschland GmbH, 2023. p. 515-529 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 13907 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Rahaman, S, Frantz, M, Miller, B & Yao, D 2023, SpanL: Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions. in J Zhou, L Batina, S Picek, Z Li, J Lin, E Losiouk, S Majumdar, D Mashima, W Meng, MA Rahman, J Shao, M Shimaoka, E Soremekun, C Su, JS Teh, A Udovenko, C Wang, L Zhang & Y Zhauniarovich (eds), Applied Cryptography and Network Security Workshops - ACNS 2023 Satellite Workshops, ADSC, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S and P, SCI, SecMT, SiMLA, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 13907 LNCS, Springer Science and Business Media Deutschland GmbH, pp. 515-529, 21st International Conference on Applied Cryptography and Network Security, ACNS 2023, Kyoto, Japan, 6/19/23. https://doi.org/10.1007/978-3-031-41181-6_28

Rahaman S, Frantz M, Miller B, Yao D. SpanL: Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions. In Zhou J, Batina L, Picek S, Li Z, Lin J, Losiouk E, Majumdar S, Mashima D, Meng W, Rahman MA, Shao J, Shimaoka M, Soremekun E, Su C, Teh JS, Udovenko A, Wang C, Zhang L, Zhauniarovich Y, editors, Applied Cryptography and Network Security Workshops - ACNS 2023 Satellite Workshops, ADSC, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S and P, SCI, SecMT, SiMLA, Proceedings. Springer Science and Business Media Deutschland GmbH. 2023. p. 515-529. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-031-41181-6_28

Rahaman, Sazzadur ; Frantz, Miles ; Miller, Barton et al. / SpanL : Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions. Applied Cryptography and Network Security Workshops - ACNS 2023 Satellite Workshops, ADSC, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S and P, SCI, SecMT, SiMLA, Proceedings. editor / Jianying Zhou ; Lejla Batina ; Stjepan Picek ; Zengpeng Li ; Jingqiang Lin ; Eleonora Losiouk ; Suryadipta Majumdar ; Daisuke Mashima ; Weizhi Meng ; Mohammad Ashiqur Rahman ; Jun Shao ; Masaki Shimaoka ; Ezekiel Soremekun ; Chunhua Su ; Je Sen Teh ; Aleksei Udovenko ; Cong Wang ; Leo Zhang ; Yury Zhauniarovich. Springer Science and Business Media Deutschland GmbH, 2023. pp. 515-529 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{83fe373c5e414500afa3cd1858192fa1,

title = "SpanL: Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions",

abstract = "High-level language platforms provide APIs to aid developers in easily integrating security-relevant features in their code. Prior research shows that improper use of these APIs is a major source of insecurity in various application domains. Automatic code screening holds lots of potential to enable secure coding. However, building domain-specific security analysis tools requires both application domain and program analysis expertise. Interestingly, most of the prior works in developing domain-specific security analysis tools leverage some form of data flow analysis in the core. We leverage this insight to build a specification language named SpanL1 for domain-specific security screening. The expressiveness analysis shows that a rule requiring any composition of dataflow analysis can be modeled in our language. Our evaluation on four cryptographic API misuse problems shows that our prototype implementation of SpanL does not introduce any imprecision due to the expressiveness of the language(1 SpanL stands for Security sPecificAtioN Language.).",

keywords = "API Misuse, Program Analysis, Specification Language",

author = "Sazzadur Rahaman and Miles Frantz and Barton Miller and Yao, {Danfeng (Daphne)}",

note = "Publisher Copyright: {\textcopyright} 2023, The Author(s), under exclusive license to Springer Nature Switzerland AG.; 21st International Conference on Applied Cryptography and Network Security, ACNS 2023 ; Conference date: 19-06-2023 Through 22-06-2023",

year = "2023",

doi = "10.1007/978-3-031-41181-6_28",

language = "English (US)",

isbn = "9783031411809",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "515--529",

editor = "Jianying Zhou and Lejla Batina and Stjepan Picek and Zengpeng Li and Jingqiang Lin and Eleonora Losiouk and Suryadipta Majumdar and Daisuke Mashima and Weizhi Meng and Rahman, {Mohammad Ashiqur} and Jun Shao and Masaki Shimaoka and Ezekiel Soremekun and Chunhua Su and Teh, {Je Sen} and Aleksei Udovenko and Cong Wang and Leo Zhang and Yury Zhauniarovich",

booktitle = "Applied Cryptography and Network Security Workshops - ACNS 2023 Satellite Workshops, ADSC, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S and P, SCI, SecMT, SiMLA, Proceedings",

address = "Germany",

}

TY - GEN

T1 - SpanL

T2 - 21st International Conference on Applied Cryptography and Network Security, ACNS 2023

AU - Rahaman, Sazzadur

AU - Frantz, Miles

AU - Miller, Barton

AU - Yao, Danfeng (Daphne)

PY - 2023

Y1 - 2023

N2 - High-level language platforms provide APIs to aid developers in easily integrating security-relevant features in their code. Prior research shows that improper use of these APIs is a major source of insecurity in various application domains. Automatic code screening holds lots of potential to enable secure coding. However, building domain-specific security analysis tools requires both application domain and program analysis expertise. Interestingly, most of the prior works in developing domain-specific security analysis tools leverage some form of data flow analysis in the core. We leverage this insight to build a specification language named SpanL1 for domain-specific security screening. The expressiveness analysis shows that a rule requiring any composition of dataflow analysis can be modeled in our language. Our evaluation on four cryptographic API misuse problems shows that our prototype implementation of SpanL does not introduce any imprecision due to the expressiveness of the language(1 SpanL stands for Security sPecificAtioN Language.).

AB - High-level language platforms provide APIs to aid developers in easily integrating security-relevant features in their code. Prior research shows that improper use of these APIs is a major source of insecurity in various application domains. Automatic code screening holds lots of potential to enable secure coding. However, building domain-specific security analysis tools requires both application domain and program analysis expertise. Interestingly, most of the prior works in developing domain-specific security analysis tools leverage some form of data flow analysis in the core. We leverage this insight to build a specification language named SpanL1 for domain-specific security screening. The expressiveness analysis shows that a rule requiring any composition of dataflow analysis can be modeled in our language. Our evaluation on four cryptographic API misuse problems shows that our prototype implementation of SpanL does not introduce any imprecision due to the expressiveness of the language(1 SpanL stands for Security sPecificAtioN Language.).

KW - API Misuse

KW - Program Analysis

KW - Specification Language

UR - http://www.scopus.com/inward/record.url?scp=85174437429&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85174437429&partnerID=8YFLogxK

U2 - 10.1007/978-3-031-41181-6_28

DO - 10.1007/978-3-031-41181-6_28

M3 - Conference contribution

AN - SCOPUS:85174437429

SN - 9783031411809

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 515

EP - 529

BT - Applied Cryptography and Network Security Workshops - ACNS 2023 Satellite Workshops, ADSC, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S and P, SCI, SecMT, SiMLA, Proceedings

A2 - Zhou, Jianying

A2 - Batina, Lejla

A2 - Picek, Stjepan

A2 - Li, Zengpeng

A2 - Lin, Jingqiang

A2 - Losiouk, Eleonora

A2 - Majumdar, Suryadipta

A2 - Mashima, Daisuke

A2 - Meng, Weizhi

A2 - Rahman, Mohammad Ashiqur

A2 - Shao, Jun

A2 - Shimaoka, Masaki

A2 - Soremekun, Ezekiel

A2 - Su, Chunhua

A2 - Teh, Je Sen

A2 - Udovenko, Aleksei

A2 - Wang, Cong

A2 - Zhang, Leo

A2 - Zhauniarovich, Yury

PB - Springer Science and Business Media Deutschland GmbH

Y2 - 19 June 2023 through 22 June 2023

ER -

SpanL: Creating Algorithms for Automatic API Misuse Detection with Program Analysis Compositions

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this