Exposing Resource-Exhaustion DoS Vulnerabilities with Leak-Oriented Minimum Path Covers

LeakHunter This is the repository for the LeakHunter. We strongly recommend reading our artifact-appendix for detailed step-by-step instructions. Abstract Resource leaks—failures to properly release scarce GC-unmanaged resources such as file descriptors, sockets, and database connections—are a pervasive root cause of resource-exhaustion DoS risks in Java programs. Prior approaches typically enumerate execution paths to identify resources that are not properly released. However, exceptions can trigger non-local control transfers that bypass resource releases, and exhaustive path enumeration may trigger path explosion, significantly reducing the practicality of existing methods. We propose LeakHunter, a novel Java resource leak detector. For more details, please read our paper. Project Structure . /Docker/ |--leakhunter-ae-docker.tar Docker image /source/ |-- requirements.txt List of required Python packages |-- run.py Unified runner script (install + run scans) |-- src/ | |-- __init__.py Python package marker | |-- intention.py Resource intention constants (acquire/release/check/throw) | |-- prompts.py LLM prompt templates | |-- prompt_pure_code.py Code repair prompt templates (fix/syntax repair) | |-- llms.py LLM wrappers and factory | |-- llm4leak.py Main detection pipeline (LLM extraction + CFG + MPC) | |-- cfg2.py Lightweight CFG construction (for MPC/path analysis) | |-- cfgGraph.py CFG semantic enrichment (resources/exceptions/branches/loops) | |-- mpc.py Minimum path cover and leak-path detection | |-- scan_droidleaks_mpc.py DroidLeaks dataset evaluation script | |-- scan_apps.py Open-source app demo scan | |-- scan_jleaks_mpc.py JLeaks dataset evaluation script |-- dataset/ | |-- DroidLeaks/ | | |-- DroidLeaks.csv Original DroidLeaks dataset | | `-- files/ Java samples (bug-*.java / fix-*.java) | `-- JLeaks/ | `-- JLeaksDataset/ | |-- JLeaks.xlsx JLeaks annotation table | |-- all_bug_files/ Buggy file set | |-- all_fix_files/ Fixed file set | |-- bug_method/ buggy methods | |-- fix_method/ fixed methods |-- runnableDEMO/ | `-- DroidLeaks-refined_demo.csv Demo dataset subset Primary Code Structure The main modules of LeakHunter are organized as follows: src/llm4leak.py: Core detection engine that orchestrates LLM-based analysis and MPC-based path enumeration src/mpc.py: Implements the LMPC algorithm for efficient path selection src/cfg2.py: Constructs iCFG from Java method code src/cfgGraph.py: Analyzes iCFG, handles exception flows, and performs graph pruning src/llms.py: Provides unified interface for different LLM providers (OpenAI, Anthropic, etc.) src/intention.py: Defines resource operation types (acquire, release, validate, throw) For more details, please refer to the provided source code. Detailed Workflow We provide two ways to run LeakHunter: Start with Docker and Native Start. Start with docker: Setup Environment: Enter the directory containing \texttt{leakhunter-ae-docker.tar} and load the image with docker load -i leakhunter-ae-docker.tar A successful import should produce output similar to: Loaded image: leakhunter-ae:latest The evaluator may confirm that the image is available by running: docker images leakhunter-ae 2. Run Evaluation on Benchmarks: For JLeaks dataset: Run python src/scan_jleaks_mpc.py For DroidLeaks dataset: Run python src/scan_droidleaks_mpc.py For DroidLeaks Demo dataset: Run python runnableDEMO/scan_droidleaks_demo.py For open-source app demo: Run python src/scan_apps.py (uses dataset/open-source-app-demo/LogActivity.java; open-source-app-demo contains a single file from the app dataset as a minimal runnable demo, not a full app) These scripts will: Load dataset entries For each method, use LLM to extract resource operations (acquire, release, validate, exceptions) Build iCFG and perform graph analysis Apply LMPC algorithm Detect resource leaks along paths Output detection results and metrics View Results: Detection results are logged to timestamped log files in the working directory. CFG visualizations (if enabled. Set DEBUG_VISUALIZE = True in src/llm4leak.py to enable) are saved to cfg_output-debug/. Native Start: Setup Environment: Install dependencies from requirements.txt. Configure LLM API keys in src/llms.py. Run Evaluation on Benchmarks: Follow the same steps as those in Quick Start with Docker. View Results: Follow the same steps as those in Quick Start with Docker. Dataset The repository includes the following datasets used in our evaluation: JLeaks: Contains bug-fix method pairs from real-world Java projects, covering various resource types (InputStream, OutputStream, Cursor, Socket, etc.) DroidLeaks: Contains Android-specific resource leak cases from DroidLeaks dataset Note (Important) API key locations: OPENAI_KEY / ANTHROPIC_KEY / HUGGINGFACE_KEY in src/llms.py. Must fill in at least one valid API key before running. Without a valid API key: Only the DroidLeaks demo (--droidleaks-demo) can be run. The demo uses pre-recorded LLM answers from runnableDEMO/DroidLeaks-refined_demo.csv, so no API call is made. All other datasets (DroidLeaks, JLeaks, apps) require at least one valid API key; otherwise, an [ERROR] message will be displayed and execution will abort. Requirements For Start with docker: no additional environment setup is required. For Native Start: Python 3.9+ Dependency installation: Use a virtual environment (venv/conda) to isolate dependencies (recommended) Run pip install -r requirements.txt Visualization dependency (optional): Install Graphviz and ensure dot is on the PATH Run commands: DroidLeaks: python src/scan_droidleaks_mpc.py DroidLeaks demo: python src/scan_droidleaks_demo.py (uses runnableDEMO/DroidLeaks-refined_demo.csv) Open-source app demo: python src/scan_apps.py (uses dataset/open-source-app-demo/LogActivity.java; open-source-app-demo contains a single file from the app dataset as a minimal runnable demo, not a full app) JLeaks: python src/scan_jleaks_mpc.py Live results are printed to the console. Log files are timestamped and saved in the working directory. Or run run.py to install dependencies only. Use flags to run scans (can be combined): python run.py (install dependencies only) python run.py --droidleaks-demo (install dependencies and run DroidLeaks demo) python run.py --droidleaks (install dependencies and run DroidLeaks) python run.py --apps (install dependencies and run open-source app demo) python run.py --jleaks (install dependencies and run JLeaks) python run.py --droidleaks --jleaks --apps (install dependencies and run all) For dataset test scripts, detection results for each case will be generated in real-time to the console (and log files will be generated in the working directory simultaneously). After the run completes, detection metrics will be calculated and printed to the console. Runnable DEMO (Quick Start) If dependencies are already installed, you can run python src/scan_droidleaks_demo.py directly. Runnable DEMO contains a small, curated subset of DroidLeaks for quick functional validation. It includes 5 resource-leak cases and their corresponding non-leak counterparts, and is intended to verify LeakHunter's detection pipeline on representative examples. In the 10 cases, buggy code contains a resource leak and is expected to be detected as LEAK (TP). Fixed code contains no resource leak and is expected to be detected as NO LEAK (TN). Patches (6.09) https://github.com/AntennaPod/AntennaPod/commit/8a14c6e1fe6ca6d3aa0d34c6499ff42eab67c21e (4 fiexd) https://github.com/sadicii/afwall/commit/eadf5e48b8c27c207a8349ab2e5c7d02a6ec2c57 (2 fixed) https://github.com/MuntashirAkon/AppManager/commit/401b1c02548c7da48c3b97af2d215d107afa8991 (1 fixed) https://github.com/nhirokinet/bluelineconsole/pull/430/changes/1c210928b373b5a642a98e8c6ffc4565782ad902 (6 fiexd) https://github.com/billybox1926-jpg/termux-app/commit/a8390f92ce60c7c777055758968f0a062642bdfb (1 fixed)