{"id":"https://openalex.org/W4411523022","doi":"https://doi.org/10.1145/3728875","title":"Beyond Static Pattern Matching? Rethinking Automatic Cryptographic API Misuse Detection in the Era of LLMs","display_name":"Beyond Static Pattern Matching? Rethinking Automatic Cryptographic API Misuse Detection in the Era of LLMs","publication_year":2025,"publication_date":"2025-06-22","ids":{"openalex":"https://openalex.org/W4411523022","doi":"https://doi.org/10.1145/3728875"},"language":"en","primary_location":{"id":"doi:10.1145/3728875","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728875","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3728875","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5103034399","display_name":"Yifan Xia","orcid":"https://orcid.org/0009-0005-7986-8519"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yifan Xia","raw_affiliation_strings":["Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0009-0005-7986-8519","affiliations":[{"raw_affiliation_string":"Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zichen Xie","orcid":"https://orcid.org/0009-0008-3905-3456"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zichen Xie","raw_affiliation_strings":["Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0009-0008-3905-3456","affiliations":[{"raw_affiliation_string":"Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100716210","display_name":"Peiyu Liu","orcid":"https://orcid.org/0000-0001-7793-7633"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Peiyu Liu","raw_affiliation_strings":["Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0001-7793-7633","affiliations":[{"raw_affiliation_string":"Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043198742","display_name":"Kangjie Lu","orcid":"https://orcid.org/0000-0002-4763-7354"},"institutions":[{"id":"https://openalex.org/I130238516","display_name":"University of Minnesota","ror":"https://ror.org/017zqws13","country_code":"US","type":"education","lineage":["https://openalex.org/I130238516"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kangjie Lu","raw_affiliation_strings":["University of Minnesota, Minneapolis, USA"],"raw_orcid":"https://orcid.org/0000-0002-4763-7354","affiliations":[{"raw_affiliation_string":"University of Minnesota, Minneapolis, USA","institution_ids":["https://openalex.org/I130238516"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102113575","display_name":"Yan Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yan Liu","raw_affiliation_strings":["Ant Group, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-6021-1358","affiliations":[{"raw_affiliation_string":"Ant Group, Hangzhou, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030133562","display_name":"Wenhai Wang","orcid":"https://orcid.org/0000-0002-1936-2840"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenhai Wang","raw_affiliation_strings":["Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-1936-2840","affiliations":[{"raw_affiliation_string":"Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058611515","display_name":"Shouling Ji","orcid":"https://orcid.org/0000-0003-4268-372X"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shouling Ji","raw_affiliation_strings":["Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-4268-372X","affiliations":[{"raw_affiliation_string":"Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.9361,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.94331945,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"2","issue":"ISSTA","first_page":"113","last_page":"136"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9969000220298767,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7241656184196472},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.5354106426239014},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.5011448860168457},{"id":"https://openalex.org/keywords/python","display_name":"Python (programming language)","score":0.48603278398513794},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.46757203340530396},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.46482518315315247},{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.42652803659439087},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.3305617570877075},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.23650625348091125},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.2239440679550171}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7241656184196472},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5354106426239014},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.5011448860168457},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.48603278398513794},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46757203340530396},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.46482518315315247},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.42652803659439087},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3305617570877075},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.23650625348091125},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.2239440679550171},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3728875","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728875","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3728875","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728875","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5400000214576721,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W2008810193","https://openalex.org/W2103370348","https://openalex.org/W2537014044","https://openalex.org/W2561521908","https://openalex.org/W2604745103","https://openalex.org/W2759023773","https://openalex.org/W2765671202","https://openalex.org/W2767943400","https://openalex.org/W2804093830","https://openalex.org/W2907964905","https://openalex.org/W2914452207","https://openalex.org/W2973035781","https://openalex.org/W2984297109","https://openalex.org/W2985320478","https://openalex.org/W3158315407","https://openalex.org/W3159259047","https://openalex.org/W3182110757","https://openalex.org/W3198867963","https://openalex.org/W3202114283","https://openalex.org/W4200634422","https://openalex.org/W4211233231","https://openalex.org/W4311165732","https://openalex.org/W4322718191","https://openalex.org/W4383221386","https://openalex.org/W4384345708","https://openalex.org/W4385187421","https://openalex.org/W4390742456","https://openalex.org/W4391724777","https://openalex.org/W4392904724","https://openalex.org/W4396242417","https://openalex.org/W4401041988","https://openalex.org/W4402457546","https://openalex.org/W4403536418","https://openalex.org/W4404782022"],"related_works":["https://openalex.org/W2341492732","https://openalex.org/W3187193180","https://openalex.org/W106542691","https://openalex.org/W1699080303","https://openalex.org/W4297799326","https://openalex.org/W3116064965","https://openalex.org/W1557094818","https://openalex.org/W4287027380","https://openalex.org/W2060145807","https://openalex.org/W4248806346"],"abstract_inverted_index":{"While":[0],"the":[1,19,39,43,58,86,94,134],"automated":[2],"detection":[3,98,105,123,170],"of":[4,77,85,96,136],"cryptographic":[5,67,156],"API":[6,68],"misuses":[7],"has":[8],"progressed":[9],"significantly,":[10],"its":[11],"precision":[12],"diminishes":[13],"for":[14],"intricate":[15],"targets":[16],"due":[17],"to":[18,34,48,62,133],"reliance":[20],"on":[21],"manually":[22],"defined":[23],"patterns.":[24],"Large":[25],"Language":[26],"Models":[27],"(LLMs)":[28],"offer":[29],"a":[30,112,120],"promising":[31],"context-aware":[32],"understanding":[33],"address":[35],"this":[36],"shortcoming,":[37],"yet":[38],"stochastic":[40],"nature":[41],"and":[42,110,131,159,172,185],"hallucination":[44],"issue":[45],"pose":[46],"challenges":[47],"their":[49],"applications":[50],"in":[51,66,82,140,182],"precise":[52],"security":[53],"analysis.":[54],"This":[55,125],"paper":[56],"presents":[57],"first":[59],"systematic":[60],"study":[61],"explore":[63],"LLMs\u2019":[64,152],"application":[65],"misuse":[69],"detection.":[70],"Our":[71],"findings":[72],"are":[73],"noteworthy:":[74],"The":[75],"instability":[76],"directly":[78],"applying":[79],"LLMs":[80],"results":[81],"over":[83],"half":[84],"initial":[87],"reports":[88],"being":[89],"false":[90],"positives.":[91],"Despite":[92],"this,":[93],"reliability":[95],"LLM-based":[97,169],"could":[99],"be":[100],"significantly":[101],"enhanced":[102],"by":[103],"aligning":[104],"scopes":[106],"with":[107],"realistic":[108],"scenarios":[109],"employing":[111],"novel":[113],"code":[114,160],"&":[115],"analysis":[116],"validation":[117],"technique,":[118],"achieving":[119],"nearly":[121],"90%":[122],"recall.":[124],"improvement":[126],"substantially":[127],"surpasses":[128],"traditional":[129],"methods":[130],"leads":[132],"discovery":[135],"previously":[137],"unknown":[138],"vulnerabilities":[139,176],"established":[141],"benchmarks.":[142],"Nevertheless,":[143],"we":[144,166],"identify":[145],"recurring":[146],"failure":[147],"patterns":[148],"that":[149],"illustrate":[150],"current":[151],"blind":[153],"spots,":[154],"including":[155,188],"knowledge":[157],"deficiencies":[158],"semantics":[161],"misinterpretations.":[162],"Leveraging":[163],"these":[164],"findings,":[165],"deploy":[167],"an":[168],"system":[171],"uncover":[173],"63":[174],"new":[175],"(47":[177],"confirmed,":[178],"7":[179],"already":[180],"fixed)":[181],"open-source":[183],"Java":[184],"Python":[186],"repositories,":[187],"prominent":[189],"projects":[190],"like":[191],"Apache.":[192]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}