Mining preconditions of APIs in large-scale code corpus

Abstract

Modern software relies on existing application programming interfaces (APIs) from libraries. Formal specifications for the APIs enable many software engineering tasks as well as help developers correctly use them. In this work, we mine large-scale repositories of existing open-source software to derive potential preconditions for API methods. Our key idea is that APIs' preconditions would appear frequently in an ultra-large code corpus with a large number of API usages, while project-specific conditions will occur less frequently. First, we find all client methods invoking APIs. We then compute a control dependence relation from each call site and mine the potential conditions used to reach those call sites. We use these guard conditions as a starting point to automatically infer the preconditions for each API. We analyzed almost 120 million lines of code from SourceForge and Apache projects to infer preconditions for the standard Java Development Kit (JDK) library. The results show that our technique can achieve high accuracy with recall from 75-80% and precision from 82-84%. We also found 5 preconditions missing from human written specifications. They were all confirmed by a specification expert. In a user study, participants found 82% of the mined preconditions as a good starting point for writing specifications. Using our mining result, we also built a benchmark of more than 4,000 precondition-related bugs.

Parameter-free probabilistic API mining across GitHub

“…The API mining problem we consider (Section 3) is specifically to return sequences of API methods that are used together. Other important but distinct data mining problems that are related to API usage include mining preconditions of API methods [27], and mining code changes [23,26]. An important recent piece of infrastructure for large-scale mining work on code is Boa [13].…”

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

“…As a remedy, several methods have been proposed that make use of statistical methods, machine learning, and data mining techniques for accelerating this process. To this end, several methods automatically infer programming patterns [e.g., 19,32,58] and security specifications [e.g., 28,34,54], from code, revision histories [33], and preconditions of APIs [e.g., 7,41,55]. A related strain of research has followed a more principled approach by modeling and inferring security policies [e.g., 6,36,52,57] for discovering informationflow vulnerabilities.…”

A More Accurate Model for Finding Tutorial Segments Explaining APIs

“…In addition to the recent studies in API documentation and discovery, APIs are hard to be used [18,19,20]. An API method is usually used along with the other methods to implement specific functionality.…”