Author Identifier (ORCID)
Chadni Islam: https://orcid.org/0000-0002-6349-6483
Abstract
Security Application Programming Interfaces (APIs) are crucial for ensuring software security. However, their misuse introduces vulnerabilities, potentially leading to severe data breaches and substantial financial loss. Complex API design, inadequate documentation, and insufficient security training often lead to unintentional misuse by developers. The software security community has devised and evaluated several approaches to detecting security API misuse to help developers and organizations. This study rigorously reviews the literature on detecting misuse of security APIs to gain a comprehensive understanding of this critical domain. Our goal is to identify and analyze security API misuses, the detection approaches developed, and the evaluation methodologies employed along with the open research avenues to advance the state-of-the-art in this area. Employing the systematic literature review (SLR) methodology, we analyzed 69 research articles. Our review has yielded (a) identification of 6 security API types; (b) classification of 30 distinct misuses; (c) categorization of detection techniques into heuristic-based and ML-based approaches; and (d) identification of 10 performance measures and 9 evaluation benchmarks. The review reveals a lack of coverage of detection approaches in several areas. We recommend that future efforts focus on aligning security API development with developers’ needs and advancing standardized evaluation methods for detection technologies.
Document Type
Journal Article
Date of Publication
7-11-2025
Volume
57
Issue
12
Publisher
Association for Computing Machinery
School
School of Science
Funders
Cyber Security Research Centre Limited
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Comments
Mosavi, S., Islam, C., Babar, M. A., Abuadbba, S., & Moore, K. (2025). Detecting misuse of security APIs: A systematic review. ACM Computing Surveys, 57(12). https://doi.org/10.1145/3735968