2026-08-03T00:36:05Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:23299 2025-10-02T12:48:06Z ddc:004 open_access

Detecting Functionality-Specific Vulnerabilities via Retrieving Individual Functionality-Equivalent APIs in Open-Source Repositories Chen, Tianyu Wang, Zeyu Li, Lin Li, Ding Li, Zongyang Chang, Xiaoning Bian, Pan Liang, Guangtai Wang, Qianxiang Xie, Tao Application Security Vulnerability Detection Large Language Model Functionality-specific vulnerabilities, which mainly occur in Application Programming Interfaces (APIs) with specific functionalities, are crucial for software developers to detect and avoid. When detecting individual functionality-specific vulnerabilities, the existing two categories of approaches are ineffective because they consider only the API bodies and are unable to handle diverse implementations of functionality-equivalent APIs. To effectively detect functionality-specific vulnerabilities, we propose APISS, the first approach to utilize API doc strings and signatures instead of API bodies. APISS first retrieves functionality-equivalent APIs for APIs with existing vulnerabilities and then migrates Proof-of-Concepts (PoCs) of the existing vulnerabilities for newly detected vulnerable APIs. To retrieve functionality-equivalent APIs, we leverage a Large Language Model for API embedding to improve the accuracy and address the effectiveness and scalability issues suffered by the existing approaches. To migrate PoCs of the existing vulnerabilities for newly detected vulnerable APIs, we design a semi-automatic schema to substantially reduce manual costs. We conduct a comprehensive evaluation to empirically compare APISS with four state-of-the-art approaches of detecting vulnerabilities and two state-of-the-art approaches of retrieving functionality-equivalent APIs. The evaluation subjects include 180 widely used Java repositories using 10 existing vulnerabilities, along with their PoCs. The results show that APISS effectively retrieves functionality-equivalent APIs, achieving a Top-1 Accuracy of 0.81 while the best of the baselines under comparison achieves only 0.55. APISS is highly efficient: the manual costs are within 10 minutes per vulnerability and the end-to-end runtime overhead of testing one candidate API is less than 2 hours. APISS detects 179 new vulnerabilities and receives 60 new CVE IDs, bringing high value to security practice. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Tianyu Chen and Zeyu Wang and Lin Li and Ding Li and Zongyang Li and Xiaoning Chang and Pan Bian and Guangtai Liang and Qianxiang Wang and Tao Xie 2025 Is Part Of LIPIcs, Volume 333, 39th European Conference on Object-Oriented Programming (ECOOP 2025) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/LIPIcs.ECOOP.2025.6 urn:nbn:de:0030-drops-232999 https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ECOOP.2025.6 eng https://creativecommons.org/licenses/by/4.0/legalcode