电子学报2026，Vol.54Issue(3)：1132-1146,15.DOI:10.12263/DZXB.20250813
一种基于IR模拟执行的密码学API误用检测方法
A Cryptographic API Misuse Detection Method Based on Intermediate Representation Simulation
摘要
Abstract
Cryptographic algorithms serve as the core mechanisms for protecting data confidentiality and integrity in modern software systems.However,the misuse of cryptographic application programming interfaces(APIs),such as using predictable keys or insecure cryptographic algorithms,severely compromises software security,leading to software cracking and network attacks,which highlights the necessity of detecting such misuses.Existing studies on cryptographic API misuse detection primarily identify such misuses by analyzing API parameter values,and can be categorized into dynamic and stat-ic methods.While dynamic approaches can retrieve precise runtime parameter values,they suffer from low code coverage,leading to false negatives caused by untriggered code paths.In contrast,static analysis offers higher code coverage,but ex-isting static methods face significant theoretical and practical limitations:they mostly rely on simple constant propagation or pattern matching,which only allow them to identify directly assigned parameters.Consequently,they struggle to resolve tar-get parameters processed by complex"value-transformation"instructions(e.g.,string concatenation or encoding conver-sion),leading to substantial blind spots and false negatives when analyzing cryptographic parameters that undergo complex transformations.To address these limitations,this paper proposes ParamScope,a static detection method for Java crypto-graphic API misuse based on intermediate representation(IR)interpretation and simulation.First,ParamScope implements an"assignment-driven"program slicing algorithm built upon the SootUp framework,which incorporates strict assignment pattern constraints to precisely extract the dependency paths of cryptographic parameters.Second,it utilizes a lightweight IR interpreter to simulate the execution of the sliced statements,and integrates core Android libraries containing actual im-plementations.By combining this with Java reflection mechanisms,it achieves the semantic restoration of complex method calls during static analysis.This approach leverages the high coverage of static analysis and effectively resolves the chal-lenge of statically analyzing parameter values derived from complex instructions.Evaluations on public datasets demon-strate that ParamScope achieves parameter value reconstruction and misuse detection accuracies of 97.31%and 96.2%re-spectively,outperforming state-of-the-art static and dynamic tools.Furthermore,experiments on real-world Android applica-tions reveal that ParamScope effectively identifies typical cases of encoded or hidden real parameters,and reports the misus-es within them.It detects approximately 27%more misuses compared to the leading static tool,CogniCrypt,with an aver-age analysis time of only about 4.85 minutes per application.In summary,ParamScope combines the high coverage of static analysis with the high precision of complex parameter resolution,thereby providing a novel,precise,and efficient solution for cryptographic API misuse detection.关键词
静态分析/程序切片/模拟执行/Java程序分析/密码学API/误用检测Key words
static analysis/program slicing/simulation execution/Java program analysis/cryptographic application program interface/misuse detection分类
信息技术与安全科学引用本文复制引用
何亚非,占力戈,聂宇,傅建明,彭国军..一种基于IR模拟执行的密码学API误用检测方法[J].电子学报,2026,54(3):1132-1146,15.基金项目
国家自然科学基金(No.62272351,No.62572354) National Natural Science Foundation of China(No.62272351,No.62572354) （No.62272351,No.62572354）
