@article{21597,
  author       = {{Holzinger, Philipp and Bodden, Eric}},
  journal      = {{International Symposium on Advanced Security on Software and Systems (ASSS)}},
  title        = {{{A Systematic Hardening of Java's Information Hiding}}},
  year         = {{2021}},
}

@article{21599,
  author       = {{Bonifacio, Rodrigo and Krüger, Stefan and Narasimhan, Krishna and Bodden, Eric and Mezini, Mira}},
  journal      = {{European Conference on Object-Oriented Programming (ECOOP)}},
  title        = {{{Dealing with Variability in API Misuse Specification}}},
  year         = {{2021}},
}

@inproceedings{23374,
  author       = {{Kummita, Sriteja and Piskachev, Goran and Spath, Johannes and Bodden, Eric}},
  booktitle    = {{2021 International Conference on Code Quality (ICCQ)}},
  title        = {{{Qualitative and Quantitative Analysis of Callgraph Algorithms for Python}}},
  doi          = {{10.1109/iccq51190.2021.9392986}},
  year         = {{2021}},
}

@inproceedings{30084,
  author       = {{Karakaya, Kadiray and Bodden, Eric}},
  booktitle    = {{2021 IEEE 21st International Working Conference on Source Code Analysis and Manipulation (SCAM)}},
  publisher    = {{IEEE}},
  title        = {{{SootFX: A Static Code Feature Extraction Tool for Java and Android}}},
  doi          = {{10.1109/scam52516.2021.00030}},
  year         = {{2021}},
}

@inproceedings{21598,
  abstract     = {{Static analysis is used to automatically detect bugs and security breaches, and aids compileroptimization. Whole-program analysis (WPA) can yield high precision, however causes long analysistimes and thus does not match common software-development workflows, making it often impracticalto use for large, real-world applications.This paper thus presents the design and implementation ofModAlyzer, a novel static-analysisapproach that aims at accelerating whole-program analysis by making the analysis modular andcompositional. It shows how to computelossless, persisted summaries for callgraph, points-to anddata-flow information, and it reports under which circumstances this function-level compositionalanalysis outperforms WPA.We implementedModAlyzeras an extension to LLVM and PhASAR, and applied it to 12 real-world C and C++ applications. At analysis time,ModAlyzermodularly and losslessly summarizesthe analysis effect of the library code those applications share, hence avoiding its repeated re-analysis.The experimental results show that the reuse of these summaries can save, on average, 72% ofanalysis time over WPA. Moreover, because it is lossless, the module-wise analysis fully retainsprecision and recall. Surprisingly, as our results show, it sometimes even yields precision superior toWPA. The initial summary generation, on average, takes about 3.67 times as long as WPA.}},
  author       = {{Schubert, Philipp and Hermann, Ben and Bodden, Eric}},
  booktitle    = {{European Conference on Object-Oriented Programming (ECOOP)}},
  title        = {{{Lossless, Persisted Summarization of Static Callgraph, Points-To and Data-Flow Analysis}}},
  year         = {{2021}},
}

@inproceedings{26407,
  author       = {{Piskachev, Goran and Krishnamurthy, Ranjith and Bodden, Eric}},
  booktitle    = {{2021 IEEE 21st International Working Conference on Source Code Analysis and Manipulation (SCAM)}},
  title        = {{{SecuCheck: Engineering configurable taint analysis for software developers}}},
  year         = {{2021}},
}

@inproceedings{22463,
  author       = {{Luo, Linghui and Schäf, Martin and Sanchez, Daniel and Bodden, Eric}},
  booktitle    = {{Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering}},
  title        = {{{IDE Support for Cloud-Based Static Analyses}}},
  year         = {{2021}},
}

@inproceedings{33840,
  author       = {{Karakaya, Kadiray and Bodden, Eric}},
  booktitle    = {{2021 IEEE 21st International Working Conference on Source Code Analysis and Manipulation (SCAM)}},
  pages        = {{181–186}},
  title        = {{{SootFX: A Static Code Feature Extraction Tool for Java and Android}}},
  year         = {{2021}},
}

@inproceedings{26406,
  author       = {{Schubert, Philipp and Hermann, Ben and Bodden, Eric and Leer, Richard}},
  booktitle    = {{SCAM '21: IEEE International Working Conference on Source Code Analysis and Manipulation (Engineering Track)}},
  title        = {{{Into the Woods: Experiences from Building a Dataflow Analysis Framework for C/C++}}},
  year         = {{2021}},
}

@inproceedings{22462,
  author       = {{Shivarpatna Venkatesh, Ashwin Prasad and Bodden, Eric}},
  booktitle    = {{International Workshop on AI and Software Testing/Analysis (AISTA)}},
  title        = {{{Automated Cell Header Generator for Jupyter Notebooks}}},
  doi          = {{10.1145/3464968.3468410}},
  year         = {{2021}},
}

@article{31132,
  author       = {{Dann, Andreas Peter and Plate, Henrik and Hermann, Ben and Ponta, Serena Elisa and Bodden, Eric}},
  issn         = {{0098-5589}},
  journal      = {{IEEE Transactions on Software Engineering}},
  keywords     = {{Software}},
  pages        = {{1--1}},
  publisher    = {{Institute of Electrical and Electronics Engineers (IEEE)}},
  title        = {{{Identifying Challenges for OSS Vulnerability Scanners - A Study & Test Suite}}},
  doi          = {{10.1109/tse.2021.3101739}},
  year         = {{2021}},
}

@inproceedings{26405,
  author       = {{Schubert, Philipp and Sattler, Florian and Schiebel, Fabian Benedikt and Hermann, Ben and Bodden, Eric}},
  booktitle    = {{2021 IEEE 21st International Working Conference on Source Code Analysis and Manipulation (SCAM)}},
  title        = {{{Modeling the Effects of Global Variables in Data-Flow Analysis for C/C++}}},
  year         = {{2021}},
}

@article{20507,
  author       = {{Geismann, Johannes and Bodden, Eric}},
  issn         = {{0164-1212}},
  journal      = {{Journal of Systems and Software}},
  pages        = {{110697}},
  title        = {{{A systematic literature review of model-driven security engineering for cyber–physical systems}}},
  doi          = {{https://doi.org/10.1016/j.jss.2020.110697}},
  volume       = {{169}},
  year         = {{2020}},
}

@inproceedings{20509,
  author       = {{Fischer, Andreas and Janneck, Jonas and Kussmaul, Jörn and Krätzschmar, Nikolas and Kerschbaum, Florian and Bodden, Eric}},
  booktitle    = {{2020 IEEE Computer Security Foundations Symposium (CSF)}},
  title        = {{{PASAPTO: Policy-aware Security and Performance Trade-off Analysis - Computation on Encrypted Data with Restricted Leakage}}},
  year         = {{2020}},
}

@inproceedings{20511,
  author       = {{Fischer, Andreas and Fuhry, Benny and Kerschbaum, Florian and Bodden, Eric}},
  booktitle    = {{Privacy Enhancing Technologies Symposium (PETS/PoPETS)}},
  title        = {{{Computation on Encrypted Data using Dataflow Authentication}}},
  year         = {{2020}},
}

@inproceedings{20512,
  author       = {{Krüger, Stefan and Ali, Karim and Bodden, Eric}},
  booktitle    = {{International Symposium on Code Generation and Optimization (CGO)}},
  pages        = {{185--198}},
  title        = {{{CogniCrypt_GEN - Generating Code for the Secure Usage of Crypto APIs}}},
  year         = {{2020}},
}

@phdthesis{20513,
  abstract     = {{Frühere Studien haben empirisch offenbart, dass Fehlbenutzungen von kryptographischen APIs in Softwareanwendungen weitverbreitet sind. Dies geschieht vor allem, weil Software-Entwickler_innen aufgrund schlechten API-Designs und fehlenden Kryptographiewissens Probleme bekommen, wenn sie versuchen kryptographische Features zu implementieren. Die Literatur liefert mehrere Ansätze und Vorschläge diese Probleme zu lösen, aber alle scheitern schlussendlich auf die eine oder andere Weise daran die Anforderungen der Entwickler_innenzu erfüllen. Das Resultat ist eine insgesamt lückenhafte Landschaft verschiedener nur wenigkomplementärer Ansätze.In dieser Arbeit adressieren wir das Problem kryptographischer Fehlbenutzungen systematischer durch CogniCrypt. CogniCrypt integriert verschiedene Arten von Tool Supportin einen gemeinsamen Ansatz, der Entwickler_innen davon befreit wissen zu müssen, wie diese APIs benutzt werden müssen. Zentral für unseren Ansatz ist CrySL, eine Beschreibungssprache,die die kognitive Lücke zwischen Kryptographie-Expert_innen und Software-Entwickler_innenüberbrückt. CrySL ermöglicht es Kryptographie-Expert_innen zu spezifizeren, wie die APIs,die sie bereitstellen, richtig benutzt werden. Wir haben einen Compiler für CrySL implementiert, der es erlaubt auf CrySL-Spezifikationen aufbauenden Tool Support zu entwickeln. Wir haben weiterhin die statische Analyse CogniCrypt_SAST und den Code-Generator CogniCrypt_GEN entwickelt. Schlussendlich haben wir CogniCrypt prototypisch implementiert und diesen Prototyp in einem kontrollierten Experiment evaluiert.
}},
  author       = {{Krüger, Stefan}},
  publisher    = {{Universitaetsbibliothek Paderborn}},
  title        = {{{CogniCrypt -- The Secure Integration of Cryptographic Software}}},
  year         = {{2020}},
}

@inproceedings{20518,
  author       = {{Koch, Thorsten and Dziwok, Stefan and Holtmann, Jörg and Bodden, Eric}},
  booktitle    = {{ACM/IEEE 23rd International Conference on Model Driven Engineering Languages and Systems (MODELS ’20)}},
  publisher    = {{ACM}},
  title        = {{{Scenario-based Specification of Security Protocols and Transformation to Security Model Checkers}}},
  doi          = {{10.1145/3365438.3410946}},
  year         = {{2020}},
}

@phdthesis{20521,
  author       = {{Gerking, Christopher}},
  publisher    = {{Paderborn University}},
  title        = {{{Model-Driven Information Flow Security Engineering for Cyber-Physical Systems}}},
  doi          = {{10.17619/UNIPB/1-1033}},
  year         = {{2020}},
}

@techreport{20712,
  author       = {{Schubert, Philipp and Bodden, Eric and Hermann, Ben}},
  title        = {{{Accelerating Static Call-Graph, Points-to and Data-Flow Analysis Through Persisted Summaries}}},
  year         = {{2020}},
}