As we move to memory safe language, pointer arithmetic no longer is the main source of bugs, instead API misuse becomes a key issue. Complex code is hidden behind API abstractions and developers may make mistakes in how they use these APIs. While API mining has been an active field in software engineering, finding good API definitions is a challenging problem.
Our key idea is to leverage security patches where API misues are fixed to derive correct API usage. Based on these patch patterns, we can infer both good API uses and bad API uses, thereby searching for bugs that are similar to the bad patterns along with proposing potential fixes. The security patches serve as a pool of validates known-good examples for API uses and, looking at enough code that uses an API, we can construct a good data set of valid API interactions (along with invalid ones).
Our design of VulGenie consists of three stages. First, we collect security patches and extract them into a Modification Behavior Graph (MBG). This graph collects individual patch information along with an initial clustering. We then process and filter the individual patches into an SAPI Modification Behavior Graph (SMBG) by slicing the MBGs based on individual APIs of interest. This gives us a neat set of API constraints. Second, we use these constraint informations to filter for security relevant variables and analyze attack paths. In this stage we process clustered patches and patch information into API Security Rules, i.e., how individual APIs should be used. Together, these two stages take security patches and turn them into security rules. Last, we apply the security rules and search for violations to detect new bugs.
For our evaluation, we create a benchmark of 150 API security violations, extract 198 API security rules and apply those to real software. In our analysis, we discovered 46 0-days that we responsibly disclosed.
Chibin Zhang collaborated with Bofei Chen on this paper and we helped with the pattern analysis and rule extraction. This was an interesting journey from discovering API patterns to turning them into a bug finding tool. This work was published at Usenix SEC'26.