Detecting Misuse of Security APIs: A Systematic Review

TL;DR

This systematic review analyzes 69 studies on detecting security API misuse, categorizing misuses and detection techniques, and highlighting gaps and future research directions to improve software security.

Contribution

It provides a comprehensive classification of security API misuses, detection approaches, and evaluation methods, offering a structured overview of the current research landscape.

Findings

Identified 6 security API types and 30 misuse categories.

Classified detection techniques into heuristic and ML-based.

Mapped 10 performance measures and 9 evaluation benchmarks.

Abstract

Security Application Programming Interfaces (APIs) are crucial for ensuring software security. However, their misuse introduces vulnerabilities, potentially leading to severe data breaches and substantial financial loss. Complex API design, inadequate documentation, and insufficient security training often lead to unintentional misuse by developers. The software security community has devised and evaluated several approaches to detecting security API misuse to help developers and organizations. This study rigorously reviews the literature on detecting misuse of security APIs to gain a comprehensive understanding of this critical domain. Our goal is to identify and analyze security API misuses, the detection approaches developed, and the evaluation methodologies employed along with the open research avenues to advance the state-of-the-art in this area. Employing the systematic literature review (SLR) methodology, we analyzed 69 research papers. Our review has yielded (a) identification of 6 security API types; (b) classification of 30 distinct misuses; (c) categorization of detection techniques into heuristic-based and ML-based approaches; and (d) identification of 10 performance measures and 9 evaluation benchmarks. The review reveals a lack of coverage of detection approaches in several areas. We recommend that future efforts focus on aligning security API development with developers' needs and advancing standardized evaluation methods for detection technologies.