一种基于IR模拟执行的密码学API误用检测方法OA

Cryptographic algorithms serve as the core mechanisms for protecting data confidentiality and integrity in modern software systems.However,the misuse of cryptographic application programming interfaces(APIs),such as using predictable keys or insecure cryptographic algorithms,severely compromises software security,leading to software cracking and network attacks,which highlights the necessity of detecting such misuses.Existing studies on cryptographic API misuse detection primarily identify such misuses by analyzing API parameter values,and can be categorized into dynamic and stat-ic methods.While dynamic approaches can retrieve precise runtime parameter values,they suffer from low code coverage,leading to false negatives caused by untriggered code paths.In contrast,static analysis offers higher code coverage,but ex-isting static methods face significant theoretical and practical limitations:they mostly rely on simple constant propagation or pattern matching,which only allow them to identify directly assigned parameters.Consequently,they struggle to resolve tar-get parameters processed by complex"value-transformation"instructions(e.g.,string concatenation or encoding conver-sion),leading to substantial blind spots and false negatives when analyzing cryptographic parameters that undergo complex transformations.To address these limitations,this paper proposes ParamScope,a static detection method for Java crypto-graphic API misuse based on intermediate representation(IR)interpretation and simulation.First,ParamScope implements an"assignment-driven"program slicing algorithm built upon the SootUp framework,which incorporates strict assignment pattern constraints to precisely extract the dependency paths of cryptographic parameters.Second,it utilizes a lightweight IR interpreter to simulate the execution of the sliced statements,and integrates core Android libraries containing actual im-plementations.By combining this with Java reflection mechanisms,it achieves the semantic restoration of complex method calls during static analysis.This approach leverages the high coverage of static analysis and effectively resolves the chal-lenge of statically analyzing parameter values derived from complex instructions.Evaluations on public datasets demon-strate that ParamScope achieves parameter value reconstruction and misuse detection accuracies of 97.31%and 96.2%re-spectively,outperforming state-of-the-art static and dynamic tools.Furthermore,experiments on real-world Android applica-tions reveal that ParamScope effectively identifies typical cases of encoded or hidden real parameters,and reports the misus-es within them.It detects approximately 27%more misuses compared to the leading static tool,CogniCrypt,with an aver-age analysis time of only about 4.85 minutes per application.In summary,ParamScope combines the high coverage of static analysis with the high precision of complex parameter resolution,thereby providing a novel,precise,and efficient solution for cryptographic API misuse detection.