Cooperative API misuse detection using correction rules

Nielebock, Sebastian; Heumüller, Robert; Krüger, Jacob; Ortmeier, Frank

doi:10.1145/3377816.3381735

Cited by 12 publications

(11 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In contrast, our approach considers API usages at the time of a commit. However, we also worked on re-using previous fixes to detect misuses in other repositories (Nielebock et al 2020a). Whether using historical fixes is beneficial for our approach will be the subject of our further work.…”

Section: Change-based Error Detectionmentioning

confidence: 99%

Guided pattern mining for API misuse detection by change-based code analysis

et al. 2021

Self Cite

View full text Add to dashboard Cite

Lack of experience, inadequate documentation, and sub-optimal API design frequently cause developers to make mistakes when re-using third-party implementations. Such API misuses can result in unintended behavior, performance losses, or software crashes. Therefore, current research aims to automatically detect such misuses by comparing the way a developer used an API to previously inferred patterns of the correct API usage. While research has made significant progress, these techniques have not yet been adopted in practice. In part, this is due to the lack of a process capable of seamlessly integrating with software development processes. Particularly, existing approaches do not consider how to collect relevant source code samples from which to infer patterns. In fact, an inadequate collection can cause API usage pattern miners to infer irrelevant patterns which leads to false alarms instead of finding true API misuses. In this paper, we target this problem (a) by providing a method that increases the likelihood of finding relevant and true-positive patterns concerning a given set of code changes and agnostic to a concrete static, intra-procedural mining technique and (b) by introducing a concept for just-in-time API misuse detection which analyzes changes at the time of commit. Particularly, we introduce different, lightweight code search and filtering strategies and evaluate them on two real-world API misuse datasets to determine their usefulness in finding relevant intra-procedural API usage patterns. Our main results are (1) commit-based search with subsequent filtering effectively decreases the amount of code to be analyzed, (2) in particular method-level filtering is superior to file-level filtering, (3) project-internal and project-external code search find solutions for different types of misuses and thus are complementary, (4) incorporating prior knowledge of the misused API into the search has a negligible effect.

show abstract

Section: Change-based Error Detectionmentioning

confidence: 99%

Guided pattern mining for API misuse detection by change-based code analysis

et al. 2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…In our previous work, we introduced the notion of correction rules [48]: an AUG-based encoding of changes needed to fix an API misuse, which can be automatically generated from fixing commits. The goal was to transfer the knowledge of one API-misuse fix to similar usages in other projects.…”

Section: B Aug Correction Rulesmentioning

confidence: 99%

“…In this context, techniques for mining and comparing specifications of API usages against the suspicious API client code are prevalent. These specifications may be represented as formal specification, such as finite-state automata [8], [19], [65] and dynamic invariants [18], or as patterns of API usages [3], [5], [36], [45], [48], [62].…”

Section: Introductionmentioning

confidence: 99%

“…This encompasses searching and mining similar API usages [15], [38], [44], [47], [58], comparing pattern candidates [5], [45], or detecting pattern violations [5], [26], [47]. Since API usages are more and more represented as graphs [5], [26], [45], [48], this essentially means to compare the distance of graphs. However, established graph-distance algorithms, such as computing the minimal graph edit distance (GED) or the maximum common subgraph, are NP-hard.…”

Section: Introductionmentioning

confidence: 99%

“…Section II), as well as into so-called API misuse correction rules (cf. Section II-B) that we have proposed [48]. We computed the distances between all AUGs (i.e., correct to correct usages, misused to misused, misused to correct usages, and vice versa) within a framework we implemented.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Replication Package for "An Experimental Analysis of Graph-Distance Algorithms for Comparing API Usages"

Nielebock,

Blockhaus,

Krüger

et al. 2021

Self Cite

View full text Add to dashboard Cite

Modern software development heavily relies on the reuse of functionalities through Application Programming Interfaces (APIs). However, client developers can have issues identifying the correct usage of a certain API, causing misuses accompanied by software crashes or usability bugs. Therefore, researchers have aimed at identifying API misuses automatically by comparing client code usages to correct API usages. Some techniques rely on certain API-specific graph-based data structures to improve the abstract representation of API usages. Such techniques need to compare graphs, for instance, by computing distance metrics based on the minimal graph edit distance or the largest common subgraphs, whose computations are known to be NP-hard problems. Fortunately, there exist many abstractions for simplifying graph distance computation. However, their applicability for comparing graph representations of API usages has not been analyzed. In this paper, we provide a comparison of different distance algorithms of API-usage graphs regarding correctness and runtime. Particularly, correctness relates to the algorithms' ability to identify similar correct API usages, but also to discriminate similar correct and false usages as well as non-similar usages. For this purpose, we systematically identified a set of eight graph-based distance algorithms and applied them on two datasets of real-world API usages and misuses. Interestingly, our results suggest that existing distance algorithms are not reliable for comparing API usage graphs. To improve on this situation, we identified and discuss the algorithms' issues, based on which we formulate hypotheses to initiate research on overcoming them.

show abstract