Security Is More Than a Library Call: How Security Features Live in Code

2026-10-05

AI Summary

This study addresses the limited understanding of how security features are implemented at the code level by conducting an empirical analysis of 561 security features across nine open-source Java systems, employing a combination of code mining and manual inspection. The research systematically examines the size, distribution, and coupling patterns of these features, revealing that their implementation extends far beyond simple library invocations. Furthermore, it uncovers pervasive large-scale code scattering and tight coupling throughout the analyzed systems. By quantifying the substantial code complexity required to integrate external security libraries, this work deepens the understanding of software security implementation mechanisms and provides critical evidence for advancing more secure software engineering practices.

Abstract

Implementing security features---functionalities that protect sensitive data or prevent malicious actions by attackers---is important for ensuring the security and integrity of software systems. Correctly implementing access control, cryptography, or other security features is challenging as they require substantial domain expertise, careful design, and custom implementation to integrate them within the software system. Previous work has thoroughly studied security awareness, perception, practices, and expertise via surveys, interviews, and experiments. While they have shown that the implementation of security features are often supported by security libraries and frameworks, they have also shown that developers rarely are security experts, and make mistakes that introduce vulnerabilities into software when using them. Despite this extensive knowledge of security practices and developer behavior, we still lack a comprehensive understanding of how security features actually manifest at the code level across full software systems. We close this gap by conducting a mining study of security features in 9 popular and large open-source Java systems. We manually inspected 2,127,761 lines of code across 19,121 files, identifying and annotating 183,395 lines implementing 561 security features corresponding to 54 security features in our taxonomy. We analyzed the characteristics of the identified security features, such as their size, scattering, tangling, common implementation patterns, and the use of internal and external functionalities. Our findings show that security features are far more than mere calls to external libraries. Security features, such as access control, can grow large in size, scatter across the whole codebase, and frequently tangle with each other. External security libraries are commonly used, but they require substantial amounts of code for integration.

Problem

• security features
• code-level implementation
• software security
• access control
• open-source systems

Innovation

• Security Features
• Code Mining
• Software Security
• Feature Scattering
• Feature Tangling