# CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects

arXiv: https://arxiv.org/abs/1806.06881 · HTML: https://mlsanity.com/paper/1806.06881/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Jun 2018.

## Built on by (most cited first, 8 of 8)

- [An Investigation into Misuse of Java Security APIs by Large Language Models](https://mlsanity.com/paper/2404.03823/) (2024)
- [Towards Trustworthy AI Software Development Assistance](https://mlsanity.com/paper/2312.09126/) (2023)
- [ChatGPT's Potential in Cryptography Misuse Detection: A Comparative Analysis with Static Analysis Tools](https://mlsanity.com/paper/2409.06561/) (2024)
- [CryptoScope: Utilizing Large Language Models for Automated Cryptographic Logic Vulnerability Detection](https://mlsanity.com/paper/2508.11599/) (2025)
- [Embedding Code Contexts for Cryptographic API Suggestion:New Methodologies and Comparisons](https://mlsanity.com/paper/2103.08747/) (2021)
- [Beyond Static Tools: Evaluating Large Language Models for Cryptographic Misuse Detection](https://mlsanity.com/paper/2411.09772/) (2024)
- [Detecting and Understanding Vulnerabilities in Fully Homomorphic Encryption Frameworks](https://mlsanity.com/paper/2606.22519/) (2026)
- [Understanding the Impact of AI Code Assistants on Security API Usage: An Empirical Study](https://mlsanity.com/paper/2607.11348/) (2026)

## Abstract (arXiv)

Cryptographic API misuses, such as exposed secrets, predictable random numbers, and vulnerable certificate verification, seriously threaten software security. The vision of automatically screening cryptographic API calls in massive-sized (e.g., millions of LoC) Java programs is not new. However, hindered by the practical difficulty of reducing false positives without compromising analysis quality, this goal has not been accomplished. State-of-the-art crypto API screening solutions are not designed to operate on a large scale. Our technical innovation is a set of fast and highly accurate slicing algorithms. Our algorithms refine program slices by identifying language-specific irrelevant elements. The refinements reduce false alerts by 76% to 80% in our experiments. Running our tool, CrytoGuard, on 46 high-impact large-scale Apache projects and 6,181 Android apps generate many security insights. Our findings helped multiple popular Apache projects to harden their code, including Spark, Ranger, and Ofbiz. We also have made substantial progress towards the science of analysis in this space, including: i) manually analyzing 1,295 Apache alerts and confirming 1,277 true positives (98.61% precision), ii) creating a benchmark with 38-unit basic cases and 74-unit advanced cases, iii) performing an in-depth comparison with leading solutions including CrySL, SpotBugs, and Coverity. We are in the process of integrating CryptoGuard with the Software Assurance Marketplace (SWAMP).