2021/03/31 by Hong Jin Kang, David Lo · 21 citations
Computer Science · #Anomaly detection #Artificial intelligence #Benchmark (surveying) #Computer science #Correctness #Data mining #Debugging #Discriminative model #False positive paradox #Machine learning #Programming language #Software #Software Engineering Research #Software System Performance and Reliability #Software Testing and Debugging Techniques #Software bug #cs.SE
paper · pdf · doi:10.1109/tse.2021.3069978
published in IEEE Transactions on Software Engineering 48(8), 2761-2783 (IEEE Computer Society)
openalex publication_date 2021/03/31 · arxiv created 2022/04/21 · arxiv updated 2022/04/22 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05
A common cause of bugs and vulnerabilities are the violations of usage constraints associated with Application Programming Interfaces (APIs). API misuses are common in software projects, and while there have been techniques proposed to detect such misuses, studies have shown that they fail to reliably detect misuses while reporting many false positives. One limitation of prior work is the inability to reliably identify correct patterns of usage. Many approaches confuse a usage pattern's frequency for correctness. Due to the variety of alternative usage patterns that may be uncommon but correct, anomaly detection-based techniques have limited success in identifying misuses. We address these challenges and propose ALP (Actively Learned Patterns), reformulating API misuse detection as a classification problem. After representing programs as graphs, ALP mines discriminative subgraphs. While still incorporating frequency information, through limited human supervision, we reduce the reliance on the assumption relating frequency and correctness. The principles of active learning are incorporated to shift human attention away from the most frequent patterns. Instead, ALP samples informative and representative examples while minimizing labeling effort. In our empirical evaluation, ALP substantially outperforms prior approaches on both MUBench, an API Misuse benchmark, and a new dataset that we constructed from real-world software projects.