Detecting Misuse of Security APIs: A Systematic Review

2023-06-15

AI Summary

This study addresses software vulnerabilities and data breaches caused by security API misuse through a systematic literature review (SLR) of 69 publications. Methodologically, it employs classification coding and technical mapping to establish— for the first time—a taxonomy of security API misuse, identifying six critical security APIs and thirty representative misuse patterns. It further proposes a dual-path detection framework—combining heuristic and machine learning approaches—and develops a multidimensional evaluation system comprising ten metrics and nine benchmarks. The results reveal significant coverage gaps in existing detection techniques, advocate a developer-centric paradigm for security API design and standardized evaluation, and explicitly identify three major research gaps. Collectively, these contributions provide both theoretical foundations and empirical evidence to guide future tool development and standardization efforts in secure API usage.

Abstract

Security Application Programming Interfaces (APIs) are crucial for ensuring software security. However, their misuse introduces vulnerabilities, potentially leading to severe data breaches and substantial financial loss. Complex API design, inadequate documentation, and insufficient security training often lead to unintentional misuse by developers. The software security community has devised and evaluated several approaches to detecting security API misuse to help developers and organizations. This study rigorously reviews the literature on detecting misuse of security APIs to gain a comprehensive understanding of this critical domain. Our goal is to identify and analyze security API misuses, the detection approaches developed, and the evaluation methodologies employed along with the open research avenues to advance the state-of-the-art in this area. Employing the systematic literature review (SLR) methodology, we analyzed 69 research papers. Our review has yielded (a) identification of 6 security API types; (b) classification of 30 distinct misuses; (c) categorization of detection techniques into heuristic-based and ML-based approaches; and (d) identification of 10 performance measures and 9 evaluation benchmarks. The review reveals a lack of coverage of detection approaches in several areas. We recommend that future efforts focus on aligning security API development with developers' needs and advancing standardized evaluation methods for detection technologies.

Problem

• Detecting misuse of security APIs in software development
• Analyzing causes and impacts of security API misuse
• Reviewing detection techniques and evaluation methodologies

Innovation

• Systematic review of security API misuse detection
• Classification into heuristic and ML-based techniques
• Identification of performance measures and benchmarks