Boosting API Misuse Detection via Integrating API Constraints from Multiple Sources
In modern software development, developers access reusable functionality provided by third-party libraries through Application Programming Interfaces (APIs). However, using APIs requires developers to conform specific constraints and guidelines, otherwise it may lead to API misuse. Existing approaches for API misuse detection often rely on analyzing API documentation or mining client code. However, these approaches are limited by the quality of API documentation and the naive assumption that deviations from common usage patterns in client code imply potential API misuse, making them less reliable. In this paper, we propose an approach that comprehensively integrates the API usage constraints from multiple sources, including client code, API documentation, and library code, to detect API misuse. First, we convert client code into API Usage Graphs (AUGs), extract the API usage patterns, and apply heuristic filtering rules to obtain API usage constraints. Meanwhile, we also analyze library code and API documentation to obtain various API usage constraints. Next, we combine the obtained API usage constraints from multiple sources together to generate a series of API preliminary constraint graphs. Based on these API preliminary constraint graphs, we design constraint alternative strategies to form API alternative constraint graphs. Finally, we parse the Abstract Syntax Tree (AST) of the test code and match it against API (alternative) constraint graphs to detect API misuses. The experimental evaluation demonstrates that our approach achieves the Precision of 72.22% and the Recall of 43.01% on the MUBench dataset, with an F1 score of 53.91%. These values significantly outperform existing state-of-the-art API misuse detection approaches, highlighting the effectiveness of integrating API usage constraints from various sources. Additionally, the designed heuristic filtering rules and constraint alternative strategies significantly reduce false positives, enhancing the Precision of our approach in API misuse detection.
Mon 15 AprDisplayed time zone: Lisbon change
11:00 - 12:30 | Ecosystems, Reuse and APIs & TutorialsData and Tool Showcase Track / Technical Papers / Tutorials at Almada Negreiros Chair(s): Mahmoud Alfadel University of Waterloo, Ayushi Rastogi University of Groningen, The Netherlands | ||
11:00 12mTalk | Thirty-Three Years of Mathematicians and Software Engineers: A Case Study of Domain Expertise and Participation in Proof Assistant Ecosystems Technical Papers Gwenyth Lincroft Northeastern University, Minsung Cho Northeastern University, Mahsa Bazzaz Northeastern University, Katherine Hough Northeastern University, Jonathan Bell Northeastern University Pre-print Media Attached | ||
11:12 12mTalk | Boosting API Misuse Detection via Integrating API Constraints from Multiple Sources Technical Papers Can Li Nanjing University of Aeronautics and Astronautics, Jingxuan Zhang Nanjing University of Aeronautics and Astronautics, Yixuan Tang Nanjing University of Aeronautics and Astronautics, Zhuhang Li Nanjing University of Aeronautics and Astronautics, Tianyue Sun Nanjing University of Aeronautics and Astronautics | ||
11:24 6mTalk | Availability and Usage of Platform-Specific APIs: A First Empirical Study Technical Papers Pre-print Media Attached File Attached | ||
11:30 4mTalk | AndroLibZoo: A Reliable Dataset of Libraries Based on Software Dependency Analysis Data and Tool Showcase Track Jordan Samhi CISPA Helmholtz Center for Information Security, Tegawendé F. Bissyandé University of Luxembourg, Jacques Klein University of Luxembourg | ||
11:34 4mTalk | Goblin: A Framework for Enriching and Querying the Maven Central Dependency Graph Data and Tool Showcase Track Damien Jaime Sorbonne Université - Lip6 - SAP, Joyce El Haddad Paris Dauphine-PSL Université, CNRS, LAMSADE, Pascal Poizat Université Paris Nanterre & LIP6 Pre-print File Attached | ||
11:38 4mTalk | Dataset: Copy-based Reuse in Open Source Software Data and Tool Showcase Track Mahmoud Jahanshahi Research Assistant, University of Tennessee Knoxville, Audris Mockus The University of Tennessee & Vilnius University Pre-print | ||
11:45 45mTalk | Mining Our Way Back to Incremental Builds for DevOps Pipelines Tutorials Shane McIntosh University of Waterloo Pre-print |