@article{59411, abstract = {{As our lives, our businesses, and indeed our world economy become increasingly reliant on the secure operation of many interconnected software systems, the software engineering research community is faced with unprecedented research challenges, but also with exciting new opportunities. In this roadmap paper, we outline our vision of Software Security Analysis for the systems of the future. Given the recent advances in generative AI, we need new methods to assess and maximize the security of code co-written by machines. As our systems become increasingly heterogeneous, we need practical approaches that work even if some functions are automatically generated, e.g., by deep neural networks. As software systems depend evermore on the software supply chain, we need tools that scale to an entire ecosystem. What kind of vulnerabilities exist in future systems and how do we detect them? When all the shallow bugs are found, how do we discover vulnerabilities hidden deeply in the system? Assuming we cannot find all security flaws, how can we nevertheless protect our system? To answer these questions, we start our roadmap with a survey of recent advances in software security, then discuss open challenges and opportunities, and conclude with a long-term perspective for the field.}}, author = {{Böhme, Marcel and Bodden, Eric and Bultan, Tevfik and Cadar, Cristian and Liu, Yang and Scanniello, Giuseppe}}, issn = {{1049-331X}}, journal = {{ACM Transactions on Software Engineering and Methodology}}, publisher = {{Association for Computing Machinery (ACM)}}, title = {{{Software Security Analysis in 2030 and Beyond: A Research Roadmap}}}, doi = {{10.1145/3708533}}, year = {{2024}}, } @inproceedings{52235, abstract = {{Android applications collecting data from users must protect it according to the current legal frameworks. Such data protection has become even more important since the European Union rolled out the General Data Protection Regulation (GDPR). Since app developers are not legal experts, they find it difficult to write privacy-aware source code. Moreover, they have limited tool support to reason about data protection throughout their app development process. This paper motivates the need for a static analysis approach to diagnose and explain data protection in Android apps. The analysis will recognize personal data sources in the source code, and aims to further examine the data flow originating from these sources. App developers can then address key questions about data manipulation, derived data, and the presence of technical measures. Despite challenges, we explore to what extent one can realize this analysis through static taint analysis, a common method for identifying security vulnerabilities. This is a first step towards designing a tool-based approach that aids app developers and assessors in ensuring data protection in Android apps, based on automated static program analysis. }}, author = {{Khedkar, Mugdha and Bodden, Eric}}, booktitle = {{Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft '24). Association for Computing Machinery, New York, NY, USA, 65–68.}}, keywords = {{static program analysis, data protection and privacy, GDPR compliance}}, location = {{Lisbon, Portugal}}, title = {{{Toward an Android Static Analysis Approach for Data Protection}}}, doi = {{10.1145/3647632.3651389}}, year = {{2024}}, } @inbook{53942, abstract = {{AbstractSince its inception two decades ago, Soot has become one of the most widely used open-source static analysis frameworks. Over time it has been extended with the contributions of countless researchers. Yet, at the same time, the requirements for Soot have changed over the years and become increasingly at odds with some of the major design decisions that underlie it. In this work, we thus present SootUp, a complete reimplementation of Soot that seeks to fulfill these requirements with a novel design, while at the same time keeping elements that Soot users have grown accustomed to.}}, author = {{Karakaya, Kadiray and Schott, Stefan and Klauke, Jonas and Bodden, Eric and Schmidt, Markus and Luo, Linghui and He, Dongjie}}, booktitle = {{Tools and Algorithms for the Construction and Analysis of Systems}}, isbn = {{9783031572456}}, issn = {{0302-9743}}, publisher = {{Springer Nature Switzerland}}, title = {{{SootUp: A Redesign of the Soot Static Analysis Framework}}}, doi = {{10.1007/978-3-031-57246-3_13}}, year = {{2024}}, } @inproceedings{57550, author = {{Schott, Stefan and Ponta, Serena Elisa and Fischer, Wolfram and Klauke, Jonas and Bodden, Eric}}, booktitle = {{38th European Conference on Object-Oriented Programming (ECOOP 2024)}}, location = {{Vienna}}, title = {{{Java Bytecode Normalization for Code Similarity Analysis}}}, doi = {{10.4230/LIPIcs.ECOOP.2024.37}}, year = {{2024}}, } @inproceedings{58716, author = {{Schott, Stefan and Fischer, Wolfram and Ponta, Serena Elisa and Klauke, Jonas and Bodden, Eric}}, booktitle = {{2024 IEEE International Conference on Software Maintenance and Evolution (ICSME)}}, publisher = {{IEEE}}, title = {{{Compilation of Commit Changes Within Java Source Code Repositories}}}, doi = {{10.1109/icsme58944.2024.00038}}, year = {{2024}}, } @inproceedings{56863, author = {{Schiebel, Fabian Benedikt and Sattler, Florian and Schubert, Philipp Dominik and Apel, Sven and Bodden, Eric}}, booktitle = {{38th European Conference on Object-Oriented Programming (ECOOP 2024)}}, editor = {{Aldrich, Jonathan and Salvaneschi, Guido}}, isbn = {{978-3-95977-341-6}}, issn = {{1868-8969}}, pages = {{36:1–36:28}}, publisher = {{Schloss Dagstuhl – Leibniz-Zentrum für Informatik}}, title = {{{Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report}}}, doi = {{10.4230/LIPIcs.ECOOP.2024.36}}, volume = {{313}}, year = {{2024}}, } @inproceedings{56137, abstract = {{Many Android applications collect data from users. The European Union's General Data Protection Regulation (GDPR) requires vendors to faithfully disclose which data their apps collect. This task is complicated because many apps use third-party code for which the same information is not readily available. Hence we ask: how accurately do current Android apps fulfill these requirements? In this work, we first expose a multi-layered definition of privacy-related data to correctly report data collection in Android apps. We further create a dataset of privacy-sensitive data classes that may be used as input by an Android app. This dataset takes into account data collected both through the user interface and system APIs. We manually examine the data safety sections of 70 Android apps to observe how data collection is reported, identifying instances of over- and under-reporting. Additionally, we develop a prototype to statically extract and label privacy-related data collected via app source code, user interfaces, and permissions. Comparing the prototype's results with the data safety sections of 20 apps reveals reporting discrepancies. Using the results from two Messaging and Social Media apps (Signal and Instagram), we discuss how app developers under-report and over-report data collection, respectively, and identify inaccurately reported data categories. Our results show that app developers struggle to accurately report data collection, either due to Google's abstract definition of collected data or insufficient existing tool support. }}, author = {{Khedkar, Mugdha and Mondal, Ambuj Kumar and Bodden, Eric}}, booktitle = {{In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)}}, location = {{Sacramento, California}}, title = {{{Do Android App Developers Accurately Report Collection of Privacy-Related Data?}}}, doi = {{10.1145/3691621.3694949}}, year = {{2024}}, } @misc{57416, abstract = {{The increased complexity of modern software has led to much more sophisticated attack vectors. As a result, we require newer vulnerability detection methods to ensure software security without compromising efficiency. The Code Property Graph (CPG) is a program representation that provides a comprehensive overview of program behavior, combining abstract syntax trees, control flow graphs, and program dependence graphs. With such a detailed data structure, we can detect patterns that characterize known vulnerabilities and identify various security threats. Querying the combined data structure instead of the individual graphs enables the detection of multidimensional scenarios. This work aims to integrate the advantages of CPGs into software systems that utilize the Jimple intermediate representation. We introduce JimNode, a novel approach for generating CPGs specifically tailored to Jimple. Despite the model incompatibility, our evaluation, which covered approximately 50,800 methods, reveals an 88.07% similarity of the inter-statement edges compared to Joern, the state-of-the-art tool for CPG generation. We provide a detailed analysis of our methodology and discuss why it is better suited for Jimple programs than Joern’s language-agnostic approach.}}, author = {{Youkeim, Michael Hany Fawzy}}, publisher = {{Paderborn University}}, title = {{{Tailoring Code Property Graphs to Jimple}}}, year = {{2024}}, } @inproceedings{56140, abstract = {{ Android apps collecting data from users must comply with legal frameworks to ensure data protection. This requirement has become even more important since the implementation of the General Data Protection Regulation (GDPR) by the European Union in 2018. Moreover, with the proposed Cyber Resilience Act on the horizon, stakeholders will soon need to assess software against even more stringent security and privacy standards. Effective privacy assessments require collaboration among groups with diverse expertise to function effectively as a cohesive unit. This paper motivates the need for an automated approach that enhances understanding of data protection in Android apps and improves communication between the various parties involved in privacy assessments. We propose the Assessor View, a tool designed to bridge the knowledge gap between these parties, facilitating more effective privacy assessments of Android applications. }}, author = {{Khedkar, Mugdha and Schlichtig, Michael and Bodden, Eric}}, booktitle = {{In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)}}, location = {{Sacramento, California}}, title = {{{Advancing Android Privacy Assessments with Automation}}}, doi = {{10.1145/3691621.3694953}}, year = {{2024}}, } @article{52587, author = {{Bodden, Eric and Pottebaum, Jens and Fockel, Markus and Gräßler, Iris}}, issn = {{1540-7993}}, journal = {{IEEE Security & Privacy}}, keywords = {{Law, Electrical and Electronic Engineering, Computer Networks and Communications}}, number = {{1}}, pages = {{69--72}}, publisher = {{Institute of Electrical and Electronics Engineers (IEEE)}}, title = {{{Evaluating Security Through Isolation and Defense in Depth}}}, doi = {{10.1109/msec.2023.3336028}}, volume = {{22}}, year = {{2024}}, } @inproceedings{66834, author = {{Schott, Stefan and Fischer, Wolfram and Ponta, Serena Elisa and Klauke, Jonas and Bodden, Eric}}, booktitle = {{2024 IEEE International Conference on Software Maintenance and Evolution (ICSME)}}, publisher = {{IEEE}}, title = {{{Compilation of Commit Changes Within Java Source Code Repositories}}}, doi = {{10.1109/icsme58944.2024.00038}}, year = {{2024}}, } @article{46816, author = {{Torres, Adriano and Costa, Pedro and Amaral, Luis and Pastro, Jonata and Bonifácio, Rodrigo and d'Amorim, Marcelo and Legunsen, Owolabi and Bodden, Eric and Dias Canedo, Edna}}, issn = {{0098-5589}}, journal = {{IEEE Transactions on Software Engineering}}, keywords = {{Software}}, number = {{10}}, pages = {{4510 -- 4525}}, publisher = {{Institute of Electrical and Electronics Engineers (IEEE)}}, title = {{{Runtime Verification of Crypto APIs: An Empirical Study}}}, doi = {{10.1109/tse.2023.3301660}}, volume = {{49}}, year = {{2023}}, } @article{49439, abstract = {{AbstractThe use of static analysis security testing (SAST) tools has been increasing in recent years. However, previous studies have shown that, when shipped to end users such as development or security teams, the findings of these tools are often unsatisfying. Users report high numbers of false positives or long analysis times, making the tools unusable in the daily workflow. To address this, SAST tool creators provide a wide range of configuration options, such as customization of rules through domain-specific languages or specification of the application-specific analysis scope. In this paper, we study the configuration space of selected existing SAST tools when used within the integrated development environment (IDE). We focus on the configuration options that impact three dimensions, for which a trade-off is unavoidable, i.e., precision, recall, and analysis runtime. We perform a between-subjects user study with 40 users from multiple development and security teams - to our knowledge, the largest population for this kind of user study in the software engineering community. The results show that users who configure SAST tools are more effective in resolving security vulnerabilities detected by the tools than those using the default configuration. Based on post-study interviews, we identify common strategies that users have while configuring the SAST tools to provide further insights for tool creators. Finally, an evaluation of the configuration options of two commercial SAST tools, Fortify and CheckMarx, reveals that a quarter of the users do not understand the configuration options provided. The configuration options that are found most useful relate to the analysis scope.}}, author = {{Piskachev, Goran and Becker, Matthias and Bodden, Eric}}, issn = {{1382-3256}}, journal = {{Empirical Software Engineering}}, keywords = {{Software}}, number = {{5}}, publisher = {{Springer Science and Business Media LLC}}, title = {{{Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study}}}, doi = {{10.1007/s10664-023-10354-3}}, volume = {{28}}, year = {{2023}}, } @article{48946, abstract = {{inhalt Der verlässliche Betrieb von technischen Produkten wird zunehmend durch bewusste Angriffe bedroht. Vollständige Sicherheit ist dabei nicht möglich, durchschlagende Angriffe sind unvermeidbar (Assume Breach). Dies erfordert einen Paradigmenwechsel in der sicherheitsgerechten Entwicklung mechatronischer und cyber-physischer Systeme hin zu Defense-in-Depth. Systeme müssen so ausgelegt werden, dass sie auch bei gezielten Angriffen möglichst hohe Zuverlässigkeit und Sicherheit gewährleisten. Der hier beschriebene Lösungsansatz erweitert das Systemmodell um Angriffsszenarien und Verteidigungslinien. Diese werden am Beispiel eines industriellen Schließsystems zur Anlagensicherheit erläutert. Entwickler werden sensibilisiert, Angriffe systematisch zu berücksichtigen und interdisziplinär Verteidigungselemente gegenüber Bedrohungen und Angriffen zu spezifizieren.}}, author = {{Gräßler, Iris and Bodden, Eric and Wiechel, Dominik and Pottebaum, Jens}}, issn = {{0720-5953}}, journal = {{Konstruktion}}, keywords = {{Mechanical Engineering, Mechanics of Materials, General Materials Science, Theoretical Computer Science}}, number = {{11-12}}, pages = {{60--65}}, publisher = {{VDI Fachmedien GmbH and Co. KG}}, title = {{{Defense-in-Depth als neues Paradigma der sicherheitsgerechten Produktentwicklung: interdisziplinäre, bedrohungsbewusste und lösungsorientierte Security}}}, doi = {{10.37544/0720-5953-2023-11-12-60}}, volume = {{75}}, year = {{2023}}, } @inbook{52662, abstract = {{Static analysis tools support developers in detecting potential coding issues, such as bugs or vulnerabilities. Research emphasizes technical challenges of such tools but also mentions severe usability shortcomings. These shortcomings hinder the adoption of static analysis tools, and user dissatisfaction may even lead to tool abandonment. To comprehensively assess the state of the art, we present the first systematic usability evaluation of a wide range of static analysis tools. We derived a set of 36 relevant criteria from the literature and used them to evaluate a total of 46 static analysis tools complying with our inclusion and exclusion criteria - a representative set of mainly non-proprietary tools. The evaluation against the usability criteria in a multiple-raters approach shows that two thirds of the considered tools off er poor warning messages, while about three-quarters provide hardly any fix support. Furthermore, the integration of user knowledge is strongly neglected, which could be used for instance, to improve handling of false positives. Finally, issues regarding workflow integration and specialized user interfaces are revealed. These findings should prove useful in guiding and focusing further research and development in user experience for static code analyses.}}, author = {{Nachtigall, Marcus and Schlichtig, Michael and Bodden, Eric}}, booktitle = {{Software Engineering 2023}}, isbn = {{978-3-88579-726-5}}, keywords = {{Automated static analysis, Software usability}}, pages = {{95–96}}, publisher = {{Gesellschaft für Informatik e.V.}}, title = {{{Evaluation of Usability Criteria Addressed by Static Analysis Tools on a Large Scale}}}, year = {{2023}}, } @inbook{52660, abstract = {{Application Programming Interfaces (APIs) are the primary mechanism developers use to obtain access to third-party algorithms and services. Unfortunately, APIs can be misused, which can have catastrophic consequences, especially if the APIs provide security-critical functionalities like cryptography. Understanding what API misuses are, and how they are caused, is important to prevent them, eg, with API misuse detectors. However, definitions for API misuses and related terms in literature vary. This paper presents a systematic literature review to clarify these terms and introduces FUM, a novel Framework for API Usage constraint and Misuse classification. The literature review revealed that API misuses are violations of API usage constraints. To address this, we provide unified definitions and use them to derive FUM. To assess the extent to which FUM aids in determining and guiding the improvement of an API misuses detector’s capabilities, we performed a case study on the state-of the-art misuse detection tool CogniCrypt. The study showed that FUM can be used to properly assess CogniCrypt’s capabilities, identify weaknesses and assist in deriving mitigations and improvements.}}, author = {{Schlichtig, Michael and Sassalla, Steffen and Narasimhan, Krishna and Bodden, Eric}}, booktitle = {{Software Engineering 2023}}, isbn = {{978-3-88579-726-5}}, keywords = {{API misuses API usage constraints, classification framework, API misuse detection, static analysis}}, pages = {{105–106}}, publisher = {{Gesellschaft für Informatik e.V.}}, title = {{{Introducing FUM: A Framework for API Usage Constraint and Misuse Classification}}}, year = {{2023}}, } @inproceedings{49438, author = {{Krüger, Stefan and Reif, Michael and Wickert, Anna-Katharina and Nadi, Sarah and Ali, Karim and Bodden, Eric and Acar, Yasemin and Mezini, Mira and Fahl, Sascha}}, booktitle = {{2023 IEEE Secure Development Conference (SecDev)}}, publisher = {{IEEE}}, title = {{{Securing Your Crypto-API Usage Through Tool Support - A Usability Study}}}, doi = {{10.1109/secdev56634.2023.00015}}, year = {{2023}}, } @inproceedings{41813, author = {{Shivarpatna Venkatesh, Ashwin Prasad and Wang, Jiawei and Li, Li and Bodden, Eric}}, booktitle = {{IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)}}, title = {{{Enhancing Comprehension and Navigation in Jupyter Notebooks with Static Analysis}}}, year = {{2023}}, } @inproceedings{45312, author = {{Karakaya, Kadiray and Bodden, Eric}}, booktitle = {{2023 IEEE Conference on Software Testing, Verification and Validation (ICST)}}, publisher = {{IEEE}}, title = {{{Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis}}}, doi = {{10.1109/icst57152.2023.00036}}, year = {{2023}}, } @inproceedings{44146, abstract = {{Many Android applications collect data from users. When they do, they must protect this collected data according to the current legal frameworks. Such data protection has become even more important since the European Union rolled out the General Data Protection Regulation (GDPR). App developers have limited tool support to reason about data protection throughout their app development process. Although many Android applications state a privacy policy, privacy policy compliance checks are currently manual, expensive, and prone to error. One of the major challenges in privacy audits is the significant gap between legal privacy statements (in English text) and technical measures that Android apps use to protect their user's privacy. In this thesis, we will explore to what extent we can use static analysis to answer important questions regarding data protection. Our main goal is to design a tool based approach that aids app developers and auditors in ensuring data protection in Android applications, based on automated static program analysis.}}, author = {{Khedkar, Mugdha}}, booktitle = {{2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), Melbourne, Australia, 2023, pp. 197-199}}, keywords = {{static analysis, data protection and privacy, GDPR compliance}}, title = {{{Static Analysis for Android GDPR Compliance Assurance}}}, doi = {{10.1109/ICSE-Companion58688.2023.00054}}, year = {{2023}}, }