Patch-Guided Vulnerability Detection: Extracting Java API Security Rules via Attack–Defense Cross-Analysis

Security-sensitive APIs are critical components in modern Java applications, yet improper usage of these APIs frequently leads to severe vulnerabilities such as remote code execution. Existing methods for generating API security rules are limited as they rely on incomplete documentation or infer patterns from source code based on discovered inconsistencies.

We introduce VULGENIE, a patch-driven framework that extracts precise API security rules from confirmed security patches to then detect API misuse vulnerabilities. VULGENIE addresses three key challenges. First, it isolates violated constraints and defenses-related changes from noisy patches using our novel modification behavior dependency patch graph datastructure. Second, it identifies protected security-sensitive APIs and synthesizes rules through attack-defense crossvalidation. Third, it scales analysis with adaptive, deviationguided static analysis to balance precision and performance. Evaluated on 150 recent Java security patches, VULGENIE extracts 198 correct API security rules with 81.82% precision, uncovering 177 rules absent in CodeQL. On ten popular Java applications, VULGENIE detects 46 0-day vulnerabilities, substantially outperforming state-of-the-art works. Through our responsible vulnerability disclosure, 26 vulnerabilities have already been fixed with ten CVE identifiers assigned.