A Dataset of Parametric Cryptographic Misuses
| Autor: | Mira Mezini, Anam Dodhy, Anna-Katharina Wickert, Michael Reif, Michael Eichberg |
|---|---|
| Rok vydání: | 2019 |
| Předmět: |
Computer science
business.industry Initialization vector Hash function ComputingMilieux_LEGALASPECTSOFCOMPUTING 020207 software engineering Cryptography 02 engineering and technology Computer security computer.software_genre Misuse detection ComputingMilieux_MANAGEMENTOFCOMPUTINGANDINFORMATIONSYSTEMS Constant (computer programming) 020204 information systems 0202 electrical engineering electronic engineering information engineering Benchmark (computing) business Precision and recall computer Parametric statistics |
| Zdroj: | MSR |
| DOI: | 10.1109/msr.2019.00023 |
| Popis: | Cryptographic APIs (Crypto APIs) provide the foundations for the development of secure applications. Unfortunately, most applications do not use Crypto APIs securely and end up being insecure, e.g., by the usage of an outdated algorithm, a constant initialization vector, or an inappropriate hashing algorithm. Two different studies [1], [2] have recently shown that 88% to 95% of those applications using Crypto APIs are insecure due to misuses. To facilitate further research on these kinds of misuses, we created a collection of 201 misuses found in real-world applications along with a classification of those misuses. In the provided dataset, each misuse consists of the corresponding open-source project, the project's build information, a description of the misuse, and the misuse's location. Further, we integrated our dataset into MUBench [3], a benchmark for API misuse detection. Our dataset provides a foundation for research on Crypto API misuses. For example, it can be used to evaluate the precision and recall of detection tools, as a foundation for studies related to Crypto API misuses, or as a training set. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|