[{"abstract":[{"text":"As our lives, our businesses, and indeed our world economy become increasingly reliant on the secure operation of many interconnected software systems, the software engineering research community is faced with unprecedented research challenges, but also with exciting new opportunities. In this roadmap paper, we outline our vision of Software Security Analysis for the systems of the future. Given the recent advances in generative AI, we need new methods to assess and maximize the security of code co-written by machines. As our systems become increasingly heterogeneous, we need practical approaches that work even if some functions are automatically generated, e.g., by deep neural networks. As software systems depend evermore on the software supply chain, we need tools that scale to an entire ecosystem. What kind of vulnerabilities exist in future systems and how do we detect them? When all the shallow bugs are found, how do we discover vulnerabilities hidden deeply in the system? Assuming we cannot find all security flaws, how can we nevertheless protect our system? To answer these questions, we start our roadmap with a survey of recent advances in software security, then discuss open challenges and opportunities, and conclude with a long-term perspective for the field.","lang":"eng"}],"publication":"ACM Transactions on Software Engineering and Methodology","citation":{"apa":"Böhme, M., Bodden, E., Bultan, T., Cadar, C., Liu, Y., & Scanniello, G. (2024). Software Security Analysis in 2030 and Beyond: A Research Roadmap. ACM Transactions on Software Engineering and Methodology. https://doi.org/10.1145/3708533","ieee":"M. Böhme, E. Bodden, T. Bultan, C. Cadar, Y. Liu, and G. Scanniello, “Software Security Analysis in 2030 and Beyond: A Research Roadmap,” ACM Transactions on Software Engineering and Methodology, 2024, doi: 10.1145/3708533.","short":"M. Böhme, E. Bodden, T. Bultan, C. Cadar, Y. Liu, G. Scanniello, ACM Transactions on Software Engineering and Methodology (2024).","chicago":"Böhme, Marcel, Eric Bodden, Tevfik Bultan, Cristian Cadar, Yang Liu, and Giuseppe Scanniello. “Software Security Analysis in 2030 and Beyond: A Research Roadmap.” ACM Transactions on Software Engineering and Methodology, 2024. https://doi.org/10.1145/3708533.","mla":"Böhme, Marcel, et al. “Software Security Analysis in 2030 and Beyond: A Research Roadmap.” ACM Transactions on Software Engineering and Methodology, Association for Computing Machinery (ACM), 2024, doi:10.1145/3708533.","ama":"Böhme M, Bodden E, Bultan T, Cadar C, Liu Y, Scanniello G. Software Security Analysis in 2030 and Beyond: A Research Roadmap. ACM Transactions on Software Engineering and Methodology. Published online 2024. doi:10.1145/3708533","bibtex":"@article{Böhme_Bodden_Bultan_Cadar_Liu_Scanniello_2024, title={Software Security Analysis in 2030 and Beyond: A Research Roadmap}, DOI={10.1145/3708533}, journal={ACM Transactions on Software Engineering and Methodology}, publisher={Association for Computing Machinery (ACM)}, author={Böhme, Marcel and Bodden, Eric and Bultan, Tevfik and Cadar, Cristian and Liu, Yang and Scanniello, Giuseppe}, year={2024} }"},"type":"journal_article","department":[{"_id":"76"}],"date_created":"2025-04-07T10:04:48Z","date_updated":"2025-04-07T10:05:15Z","publication_status":"published","year":"2024","status":"public","title":"Software Security Analysis in 2030 and Beyond: A Research Roadmap","author":[{"full_name":"Böhme, Marcel","first_name":"Marcel","last_name":"Böhme"},{"id":"59256","orcid":"0000-0003-3470-3647","first_name":"Eric","last_name":"Bodden","full_name":"Bodden, Eric"},{"full_name":"Bultan, Tevfik","last_name":"Bultan","first_name":"Tevfik"},{"full_name":"Cadar, Cristian","last_name":"Cadar","first_name":"Cristian"},{"first_name":"Yang","last_name":"Liu","full_name":"Liu, Yang"},{"last_name":"Scanniello","first_name":"Giuseppe","full_name":"Scanniello, Giuseppe"}],"publication_identifier":{"issn":["1049-331X","1557-7392"]},"doi":"10.1145/3708533","user_id":"15249","_id":"59411","language":[{"iso":"eng"}],"publisher":"Association for Computing Machinery (ACM)"},{"_id":"52235","ddc":["006"],"user_id":"88024","status":"public","conference":{"start_date":"2024-04-14","name":"11th International Conference on Mobile Software Engineering and Systems 2024","location":"Lisbon, Portugal","end_date":"2024-04-15"},"has_accepted_license":"1","external_id":{"arxiv":["2402.07889"]},"file_date_updated":"2024-03-03T14:39:08Z","citation":{"mla":"Khedkar, Mugdha, and Eric Bodden. “Toward an Android Static Analysis Approach for Data Protection.” Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing Machinery, New York, NY, USA, 65–68., 2024, doi:10.1145/3647632.3651389.","bibtex":"@inproceedings{Khedkar_Bodden_2024, title={Toward an Android Static Analysis Approach for Data Protection}, DOI={10.1145/3647632.3651389}, booktitle={Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing Machinery, New York, NY, USA, 65–68.}, author={Khedkar, Mugdha and Bodden, Eric}, year={2024} }","ama":"Khedkar M, Bodden E. Toward an Android Static Analysis Approach for Data Protection. In: Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing Machinery, New York, NY, USA, 65–68. ; 2024. doi:10.1145/3647632.3651389","ieee":"M. Khedkar and E. Bodden, “Toward an Android Static Analysis Approach for Data Protection,” presented at the 11th International Conference on Mobile Software Engineering and Systems 2024, Lisbon, Portugal, 2024, doi: 10.1145/3647632.3651389.","apa":"Khedkar, M., & Bodden, E. (2024). Toward an Android Static Analysis Approach for Data Protection. Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing Machinery, New York, NY, USA, 65–68. 11th International Conference on Mobile Software Engineering and Systems 2024, Lisbon, Portugal. https://doi.org/10.1145/3647632.3651389","short":"M. Khedkar, E. Bodden, in: Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing Machinery, New York, NY, USA, 65–68., 2024.","chicago":"Khedkar, Mugdha, and Eric Bodden. “Toward an Android Static Analysis Approach for Data Protection.” In Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing Machinery, New York, NY, USA, 65–68., 2024. https://doi.org/10.1145/3647632.3651389."},"language":[{"iso":"eng"}],"doi":"10.1145/3647632.3651389","title":"Toward an Android Static Analysis Approach for Data Protection","year":"2024","author":[{"id":"88024","first_name":"Mugdha","last_name":"Khedkar","full_name":"Khedkar, Mugdha"},{"id":"59256","full_name":"Bodden, Eric","first_name":"Eric","orcid":"0000-0003-3470-3647","last_name":"Bodden"}],"date_updated":"2026-03-04T08:11:48Z","file":[{"date_created":"2024-03-03T14:39:08Z","creator":"khedkarm","success":1,"content_type":"application/pdf","file_id":"52236","file_size":530812,"access_level":"closed","file_name":"2402.07889v1.pdf","date_updated":"2024-03-03T14:39:08Z","relation":"main_file"}],"date_created":"2024-03-03T14:37:53Z","keyword":["static program analysis","data protection and privacy","GDPR compliance"],"type":"conference","department":[{"_id":"76"}],"publication":"Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft '24). Association for Computing Machinery, New York, NY, USA, 65–68.","abstract":[{"lang":"eng","text":"Android applications collecting data from users must protect it according to the current legal frameworks. Such data protection has become even more important since the European Union rolled out the General Data Protection Regulation (GDPR). Since app developers are not legal experts, they find it difficult to write privacy-aware source code. Moreover, they have limited tool support to reason about data protection throughout their app development process.\r\nThis paper motivates the need for a static analysis approach to diagnose and explain data protection in Android apps. The analysis will recognize personal data sources in the source code, and aims to further examine the data flow originating from these sources. App developers can then address key questions about data manipulation, derived data, and the presence of technical measures. Despite challenges, we explore to what extent one can realize this analysis through static taint analysis, a common method for identifying security vulnerabilities. This is a first step towards designing a tool-based approach that aids app developers and assessors in ensuring data protection in Android apps, based on automated static program analysis. "}]},{"type":"book_chapter","department":[{"_id":"76"}],"date_created":"2024-05-06T11:29:36Z","place":"Cham","abstract":[{"text":"AbstractSince its inception two decades ago, Soot has become one of the most widely used open-source static analysis frameworks. Over time it has been extended with the contributions of countless researchers. Yet, at the same time, the requirements for Soot have changed over the years and become increasingly at odds with some of the major design decisions that underlie it. In this work, we thus present SootUp, a complete reimplementation of Soot that seeks to fulfill these requirements with a novel design, while at the same time keeping elements that Soot users have grown accustomed to.","lang":"eng"}],"project":[{"_id":"107","name":"Reaktor: SFB 901 - Automatisierte Risikoanalyse in Bezug auf Open-Source-Abhängigkeiten (Hektor) (Transferproject T3)"},{"name":"HEKTOR: Automatisierte Risikoanalyse unter Berücksichtigung von Open-Source-Abhängigkeiten","_id":"668"},{"_id":"1","name":"SFB 901: On-The-Fly Computing - Individualisierte IT-Dienstleistungen in dynamischen Märkten"},{"name":"SFB 901; Projektbereich T: Transferprojekte des Sonderforschungsbereichs","_id":"82"},{"_id":"107","name":"SFB 901; TP T3: Automatisierte Risikoanalyse in Bezug auf Open-Source-Abhängigkeiten (Hektor)"}],"publication":"Tools and Algorithms for the Construction and Analysis of Systems","citation":{"chicago":"Karakaya, Kadiray, Stefan Schott, Jonas Klauke, Eric Bodden, Markus Schmidt, Linghui Luo, and Dongjie He. “SootUp: A Redesign of the Soot Static Analysis Framework.” In Tools and Algorithms for the Construction and Analysis of Systems. Cham: Springer Nature Switzerland, 2024. https://doi.org/10.1007/978-3-031-57246-3_13.","short":"K. Karakaya, S. Schott, J. Klauke, E. Bodden, M. Schmidt, L. Luo, D. He, in: Tools and Algorithms for the Construction and Analysis of Systems, Springer Nature Switzerland, Cham, 2024.","apa":"Karakaya, K., Schott, S., Klauke, J., Bodden, E., Schmidt, M., Luo, L., & He, D. (2024). SootUp: A Redesign of the Soot Static Analysis Framework. In Tools and Algorithms for the Construction and Analysis of Systems. Springer Nature Switzerland. https://doi.org/10.1007/978-3-031-57246-3_13","ieee":"K. Karakaya et al., “SootUp: A Redesign of the Soot Static Analysis Framework,” in Tools and Algorithms for the Construction and Analysis of Systems, Cham: Springer Nature Switzerland, 2024.","ama":"Karakaya K, Schott S, Klauke J, et al. SootUp: A Redesign of the Soot Static Analysis Framework. In: Tools and Algorithms for the Construction and Analysis of Systems. Springer Nature Switzerland; 2024. doi:10.1007/978-3-031-57246-3_13","bibtex":"@inbook{Karakaya_Schott_Klauke_Bodden_Schmidt_Luo_He_2024, place={Cham}, title={SootUp: A Redesign of the Soot Static Analysis Framework}, DOI={10.1007/978-3-031-57246-3_13}, booktitle={Tools and Algorithms for the Construction and Analysis of Systems}, publisher={Springer Nature Switzerland}, author={Karakaya, Kadiray and Schott, Stefan and Klauke, Jonas and Bodden, Eric and Schmidt, Markus and Luo, Linghui and He, Dongjie}, year={2024} }","mla":"Karakaya, Kadiray, et al. “SootUp: A Redesign of the Soot Static Analysis Framework.” Tools and Algorithms for the Construction and Analysis of Systems, Springer Nature Switzerland, 2024, doi:10.1007/978-3-031-57246-3_13."},"user_id":"477","doi":"10.1007/978-3-031-57246-3_13","_id":"53942","publisher":"Springer Nature Switzerland","language":[{"iso":"eng"}],"publication_status":"published","date_updated":"2025-11-11T14:26:52Z","status":"public","title":"SootUp: A Redesign of the Soot Static Analysis Framework","year":"2024","author":[{"full_name":"Karakaya, Kadiray","orcid":"https://orcid.org/0000-0001-9266-2084","first_name":"Kadiray","last_name":"Karakaya","id":"70410"},{"first_name":"Stefan","last_name":"Schott","full_name":"Schott, Stefan","id":"54847"},{"id":"40915","first_name":"Jonas","last_name":"Klauke","orcid":"0000-0001-9160-9636","full_name":"Klauke, Jonas"},{"orcid":"0000-0003-3470-3647","first_name":"Eric","last_name":"Bodden","full_name":"Bodden, Eric","id":"59256"},{"first_name":"Markus","last_name":"Schmidt","full_name":"Schmidt, Markus"},{"first_name":"Linghui","last_name":"Luo","full_name":"Luo, Linghui"},{"last_name":"He","first_name":"Dongjie","full_name":"He, Dongjie"}],"publication_identifier":{"isbn":["9783031572456","9783031572463"],"issn":["0302-9743","1611-3349"]}},{"publication":"38th European Conference on Object-Oriented Programming (ECOOP 2024)","citation":{"short":"S. Schott, S.E. Ponta, W. Fischer, J. Klauke, E. Bodden, in: 38th European Conference on Object-Oriented Programming (ECOOP 2024), 2024.","ama":"Schott S, Ponta SE, Fischer W, Klauke J, Bodden E. Java Bytecode Normalization for Code Similarity Analysis. In: 38th European Conference on Object-Oriented Programming (ECOOP 2024). ; 2024. doi:10.4230/LIPIcs.ECOOP.2024.37","chicago":"Schott, Stefan, Serena Elisa Ponta, Wolfram Fischer, Jonas Klauke, and Eric Bodden. “Java Bytecode Normalization for Code Similarity Analysis.” In 38th European Conference on Object-Oriented Programming (ECOOP 2024), 2024. https://doi.org/10.4230/LIPIcs.ECOOP.2024.37.","bibtex":"@inproceedings{Schott_Ponta_Fischer_Klauke_Bodden_2024, title={Java Bytecode Normalization for Code Similarity Analysis}, DOI={10.4230/LIPIcs.ECOOP.2024.37}, booktitle={38th European Conference on Object-Oriented Programming (ECOOP 2024)}, author={Schott, Stefan and Ponta, Serena Elisa and Fischer, Wolfram and Klauke, Jonas and Bodden, Eric}, year={2024} }","apa":"Schott, S., Ponta, S. E., Fischer, W., Klauke, J., & Bodden, E. (2024). Java Bytecode Normalization for Code Similarity Analysis. 38th European Conference on Object-Oriented Programming (ECOOP 2024). 38th European Conference on Object-Oriented Programming (ECOOP 2024), Vienna. https://doi.org/10.4230/LIPIcs.ECOOP.2024.37","mla":"Schott, Stefan, et al. “Java Bytecode Normalization for Code Similarity Analysis.” 38th European Conference on Object-Oriented Programming (ECOOP 2024), 2024, doi:10.4230/LIPIcs.ECOOP.2024.37.","ieee":"S. Schott, S. E. Ponta, W. Fischer, J. Klauke, and E. Bodden, “Java Bytecode Normalization for Code Similarity Analysis,” presented at the 38th European Conference on Object-Oriented Programming (ECOOP 2024), Vienna, 2024, doi: 10.4230/LIPIcs.ECOOP.2024.37."},"project":[{"_id":"668","name":"HEKTOR: Automatisierte Risikoanalyse unter Berücksichtigung von Open-Source-Abhängigkeiten"},{"_id":"107","name":"Reaktor: SFB 901 - Automatisierte Risikoanalyse in Bezug auf Open-Source-Abhängigkeiten (Hektor) (Transferproject T3)"},{"_id":"1","name":"SFB 901: On-The-Fly Computing - Individualisierte IT-Dienstleistungen in dynamischen Märkten"},{"_id":"82","name":"SFB 901; Projektbereich T: Transferprojekte des Sonderforschungsbereichs"},{"_id":"107","name":"SFB 901; TP T3: Automatisierte Risikoanalyse in Bezug auf Open-Source-Abhängigkeiten (Hektor)"}],"date_created":"2024-12-03T08:15:07Z","type":"conference","department":[{"_id":"76"}],"year":"2024","status":"public","title":"Java Bytecode Normalization for Code Similarity Analysis","conference":{"name":"38th European Conference on Object-Oriented Programming (ECOOP 2024)","location":"Vienna"},"author":[{"id":"54847","full_name":"Schott, Stefan","last_name":"Schott","first_name":"Stefan"},{"first_name":"Serena Elisa","last_name":"Ponta","full_name":"Ponta, Serena Elisa"},{"full_name":"Fischer, Wolfram","first_name":"Wolfram","last_name":"Fischer"},{"id":"40915","first_name":"Jonas","orcid":"0000-0001-9160-9636","last_name":"Klauke","full_name":"Klauke, Jonas"},{"first_name":"Eric","orcid":"0000-0003-3470-3647","last_name":"Bodden","full_name":"Bodden, Eric","id":"59256"}],"date_updated":"2025-11-11T14:29:43Z","language":[{"iso":"eng"}],"_id":"57550","doi":"10.4230/LIPIcs.ECOOP.2024.37","user_id":"477"},{"language":[{"iso":"eng"}],"_id":"58716","publisher":"IEEE","user_id":"54847","doi":"10.1109/icsme58944.2024.00038","author":[{"first_name":"Stefan","last_name":"Schott","full_name":"Schott, Stefan","id":"54847"},{"last_name":"Fischer","first_name":"Wolfram","full_name":"Fischer, Wolfram"},{"full_name":"Ponta, Serena Elisa","first_name":"Serena Elisa","last_name":"Ponta"},{"orcid":"0000-0001-9160-9636","first_name":"Jonas","last_name":"Klauke","full_name":"Klauke, Jonas","id":"40915"},{"full_name":"Bodden, Eric","first_name":"Eric","last_name":"Bodden","orcid":"0000-0003-3470-3647","id":"59256"}],"title":"Compilation of Commit Changes Within Java Source Code Repositories","year":"2024","status":"public","publication_status":"published","date_updated":"2025-11-11T15:01:44Z","date_created":"2025-02-19T15:47:18Z","department":[{"_id":"76"}],"type":"conference","citation":{"mla":"Schott, Stefan, et al. “Compilation of Commit Changes Within Java Source Code Repositories.” 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME), IEEE, 2024, doi:10.1109/icsme58944.2024.00038.","bibtex":"@inproceedings{Schott_Fischer_Ponta_Klauke_Bodden_2024, title={Compilation of Commit Changes Within Java Source Code Repositories}, DOI={10.1109/icsme58944.2024.00038}, booktitle={2024 IEEE International Conference on Software Maintenance and Evolution (ICSME)}, publisher={IEEE}, author={Schott, Stefan and Fischer, Wolfram and Ponta, Serena Elisa and Klauke, Jonas and Bodden, Eric}, year={2024} }","ama":"Schott S, Fischer W, Ponta SE, Klauke J, Bodden E. Compilation of Commit Changes Within Java Source Code Repositories. In: 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME). IEEE; 2024. doi:10.1109/icsme58944.2024.00038","ieee":"S. Schott, W. Fischer, S. E. Ponta, J. Klauke, and E. Bodden, “Compilation of Commit Changes Within Java Source Code Repositories,” 2024, doi: 10.1109/icsme58944.2024.00038.","apa":"Schott, S., Fischer, W., Ponta, S. E., Klauke, J., & Bodden, E. (2024). Compilation of Commit Changes Within Java Source Code Repositories. 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME). https://doi.org/10.1109/icsme58944.2024.00038","chicago":"Schott, Stefan, Wolfram Fischer, Serena Elisa Ponta, Jonas Klauke, and Eric Bodden. “Compilation of Commit Changes Within Java Source Code Repositories.” In 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME). IEEE, 2024. https://doi.org/10.1109/icsme58944.2024.00038.","short":"S. Schott, W. Fischer, S.E. Ponta, J. Klauke, E. Bodden, in: 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME), IEEE, 2024."},"publication":"2024 IEEE International Conference on Software Maintenance and Evolution (ICSME)","project":[{"_id":"1072","name":"SFB 901; TP T5: Zuverlässige und automatisierte codebasierte Analyse von Open-Source-Abhängigkeiten (Reaktor)"}]},{"_id":"56863","publisher":"Schloss Dagstuhl – Leibniz-Zentrum für Informatik","page":"36:1–36:28","editor":[{"last_name":"Aldrich","first_name":"Jonathan","full_name":"Aldrich, Jonathan"},{"full_name":"Salvaneschi, Guido","first_name":"Guido","last_name":"Salvaneschi"}],"volume":313,"user_id":"15249","status":"public","place":"Dagstuhl, Germany","citation":{"ieee":"F. B. Schiebel, F. Sattler, P. D. Schubert, S. Apel, and E. Bodden, “Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report,” in 38th European Conference on Object-Oriented Programming (ECOOP 2024), 2024, vol. 313, p. 36:1–36:28, doi: 10.4230/LIPIcs.ECOOP.2024.36.","apa":"Schiebel, F. B., Sattler, F., Schubert, P. D., Apel, S., & Bodden, E. (2024). Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report. In J. Aldrich & G. Salvaneschi (Eds.), 38th European Conference on Object-Oriented Programming (ECOOP 2024) (Vol. 313, p. 36:1–36:28). Schloss Dagstuhl – Leibniz-Zentrum für Informatik. https://doi.org/10.4230/LIPIcs.ECOOP.2024.36","short":"F.B. Schiebel, F. Sattler, P.D. Schubert, S. Apel, E. Bodden, in: J. Aldrich, G. Salvaneschi (Eds.), 38th European Conference on Object-Oriented Programming (ECOOP 2024), Schloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl, Germany, 2024, p. 36:1–36:28.","chicago":"Schiebel, Fabian Benedikt, Florian Sattler, Philipp Dominik Schubert, Sven Apel, and Eric Bodden. “Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report.” In 38th European Conference on Object-Oriented Programming (ECOOP 2024), edited by Jonathan Aldrich and Guido Salvaneschi, 313:36:1–36:28. Leibniz International Proceedings in Informatics (LIPIcs). Dagstuhl, Germany: Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 2024. https://doi.org/10.4230/LIPIcs.ECOOP.2024.36.","mla":"Schiebel, Fabian Benedikt, et al. “Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report.” 38th European Conference on Object-Oriented Programming (ECOOP 2024), edited by Jonathan Aldrich and Guido Salvaneschi, vol. 313, Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 2024, p. 36:1–36:28, doi:10.4230/LIPIcs.ECOOP.2024.36.","bibtex":"@inproceedings{Schiebel_Sattler_Schubert_Apel_Bodden_2024, place={Dagstuhl, Germany}, series={Leibniz International Proceedings in Informatics (LIPIcs)}, title={Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report}, volume={313}, DOI={10.4230/LIPIcs.ECOOP.2024.36}, booktitle={38th European Conference on Object-Oriented Programming (ECOOP 2024)}, publisher={Schloss Dagstuhl – Leibniz-Zentrum für Informatik}, author={Schiebel, Fabian Benedikt and Sattler, Florian and Schubert, Philipp Dominik and Apel, Sven and Bodden, Eric}, editor={Aldrich, Jonathan and Salvaneschi, Guido}, year={2024}, pages={36:1–36:28}, collection={Leibniz International Proceedings in Informatics (LIPIcs)} }","ama":"Schiebel FB, Sattler F, Schubert PD, Apel S, Bodden E. Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report. In: Aldrich J, Salvaneschi G, eds. 38th European Conference on Object-Oriented Programming (ECOOP 2024). Vol 313. Leibniz International Proceedings in Informatics (LIPIcs). Schloss Dagstuhl – Leibniz-Zentrum für Informatik; 2024:36:1–36:28. doi:10.4230/LIPIcs.ECOOP.2024.36"},"series_title":"Leibniz International Proceedings in Informatics (LIPIcs)","language":[{"iso":"eng"}],"doi":"10.4230/LIPIcs.ECOOP.2024.36","author":[{"last_name":"Schiebel","orcid":"0009-0008-6867-9802","first_name":"Fabian Benedikt","full_name":"Schiebel, Fabian Benedikt","id":"55745"},{"full_name":"Sattler, Florian","last_name":"Sattler","first_name":"Florian"},{"full_name":"Schubert, Philipp Dominik","last_name":"Schubert","first_name":"Philipp Dominik"},{"last_name":"Apel","first_name":"Sven","full_name":"Apel, Sven"},{"full_name":"Bodden, Eric","first_name":"Eric","last_name":"Bodden","orcid":"0000-0003-3470-3647","id":"59256"}],"publication_identifier":{"issn":["1868-8969"],"isbn":["978-3-95977-341-6"]},"year":"2024","title":"Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report","intvolume":" 313","date_updated":"2025-12-04T10:41:59Z","date_created":"2024-11-04T13:37:23Z","department":[{"_id":"76"},{"_id":"662"}],"type":"conference","publication":"38th European Conference on Object-Oriented Programming (ECOOP 2024)"},{"file_date_updated":"2024-09-16T08:49:42Z","citation":{"mla":"Khedkar, Mugdha, et al. “Do Android App Developers Accurately Report Collection of Privacy-Related Data?” In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24), 2024, doi:10.1145/3691621.3694949.","ama":"Khedkar M, Mondal AK, Bodden E. Do Android App Developers Accurately Report Collection of Privacy-Related Data? In: In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24). ; 2024. doi:10.1145/3691621.3694949","bibtex":"@inproceedings{Khedkar_Mondal_Bodden_2024, title={Do Android App Developers Accurately Report Collection of Privacy-Related Data?}, DOI={10.1145/3691621.3694949}, booktitle={In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)}, author={Khedkar, Mugdha and Mondal, Ambuj Kumar and Bodden, Eric}, year={2024} }","apa":"Khedkar, M., Mondal, A. K., & Bodden, E. (2024). Do Android App Developers Accurately Report Collection of Privacy-Related Data? In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24). 39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024), Sacramento, California. https://doi.org/10.1145/3691621.3694949","ieee":"M. Khedkar, A. K. Mondal, and E. Bodden, “Do Android App Developers Accurately Report Collection of Privacy-Related Data?,” presented at the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024), Sacramento, California, 2024, doi: 10.1145/3691621.3694949.","chicago":"Khedkar, Mugdha, Ambuj Kumar Mondal, and Eric Bodden. “Do Android App Developers Accurately Report Collection of Privacy-Related Data?” In In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24), 2024. https://doi.org/10.1145/3691621.3694949.","short":"M. Khedkar, A.K. Mondal, E. Bodden, in: In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24), 2024."},"external_id":{"arxiv":["2409.04167"]},"status":"public","conference":{"location":"Sacramento, California","name":"39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024)","start_date":"2024-10-27","end_date":"2024-11-01"},"has_accepted_license":"1","_id":"56137","ddc":["000"],"user_id":"88024","publication":"In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)","abstract":[{"text":"Many Android applications collect data from users. The European Union's General Data Protection Regulation (GDPR) requires vendors to faithfully disclose which data their apps collect. This task is complicated because many apps use third-party code for which the same information is not readily available. Hence we ask: how accurately do current Android apps fulfill these requirements?\r\nIn this work, we first expose a multi-layered definition of privacy-related data to correctly report data collection in Android apps. We further create a dataset of privacy-sensitive data classes that may be used as input by an Android app. This dataset takes into account data collected both through the user interface and system APIs.\r\nWe manually examine the data safety sections of 70 Android apps to observe how data collection is reported, identifying instances of over- and under-reporting. Additionally, we develop a prototype to statically extract and label privacy-related data collected via app source code, user interfaces, and permissions. Comparing the prototype's results with the data safety sections of 20 apps reveals reporting discrepancies. Using the results from two Messaging and Social Media apps (Signal and Instagram), we discuss how app developers under-report and over-report data collection, respectively, and identify inaccurately reported data categories.\r\nOur results show that app developers struggle to accurately report data collection, either due to Google's abstract definition of collected data or insufficient existing tool support. ","lang":"eng"}],"file":[{"date_updated":"2024-09-16T08:49:42Z","relation":"main_file","file_size":1270058,"access_level":"closed","file_name":"2409.04167v1.pdf","content_type":"application/pdf","success":1,"file_id":"56138","creator":"khedkarm","date_created":"2024-09-16T08:49:42Z"}],"date_created":"2024-09-16T08:50:54Z","type":"conference","department":[{"_id":"76"}],"year":"2024","title":"Do Android App Developers Accurately Report Collection of Privacy-Related Data?","author":[{"last_name":"Khedkar","first_name":"Mugdha","full_name":"Khedkar, Mugdha","id":"88024"},{"last_name":"Mondal","first_name":"Ambuj Kumar","full_name":"Mondal, Ambuj Kumar"},{"full_name":"Bodden, Eric","orcid":"0000-0003-3470-3647","first_name":"Eric","last_name":"Bodden","id":"59256"}],"date_updated":"2024-11-18T13:19:51Z","language":[{"iso":"eng"}],"doi":"10.1145/3691621.3694949"},{"language":[{"iso":"eng"}],"date_updated":"2024-11-27T01:16:38Z","title":"Tailoring Code Property Graphs to Jimple","year":"2024","author":[{"id":"77394","first_name":"Michael Hany Fawzy","last_name":"Youkeim","full_name":"Youkeim, Michael Hany Fawzy"}],"type":"bachelorsthesis","department":[{"_id":"76"}],"file":[{"date_created":"2024-11-27T01:16:06Z","creator":"myoukeim","file_id":"57444","content_type":"application/pdf","file_name":"Bachelor_Thesis__Michael_Youkeim_unsigned.pdf","file_size":432800,"access_level":"open_access","relation":"main_file","date_updated":"2024-11-27T01:16:06Z"}],"date_created":"2024-11-26T09:13:02Z","abstract":[{"text":"The increased complexity of modern software has led to much more\r\nsophisticated attack vectors. As a result, we require newer vulnerability detection\r\nmethods to ensure software security without compromising efficiency.\r\nThe Code Property Graph (CPG) is a program representation that provides a comprehensive overview of program behavior, combining abstract syntax trees, control flow\r\ngraphs, and program dependence graphs. With such a detailed data structure, we can\r\ndetect patterns that characterize known vulnerabilities and identify various security\r\nthreats. Querying the combined data structure instead of the individual graphs enables the detection of multidimensional scenarios.\r\nThis work aims to integrate the advantages of CPGs into software systems that utilize\r\nthe Jimple intermediate representation. We introduce JimNode, a novel approach for\r\ngenerating CPGs specifically tailored to Jimple. Despite the model incompatibility, our\r\nevaluation, which covered approximately 50,800 methods, reveals an 88.07% similarity\r\nof the inter-statement edges compared to Joern, the state-of-the-art tool for CPG\r\ngeneration. We provide a detailed analysis of our methodology and discuss why it is\r\nbetter suited for Jimple programs than Joern’s language-agnostic approach.","lang":"eng"}],"ddc":["000"],"user_id":"77394","_id":"57416","publisher":"Paderborn University","has_accepted_license":"1","status":"public","oa":"1","place":"Paderborn","file_date_updated":"2024-11-27T01:16:06Z","supervisor":[{"id":"59256","orcid":"0000-0003-3470-3647","last_name":"Bodden","first_name":"Eric","full_name":"Bodden, Eric"}],"citation":{"bibtex":"@book{Youkeim_2024, place={Paderborn}, title={Tailoring Code Property Graphs to Jimple}, publisher={Paderborn University}, author={Youkeim, Michael Hany Fawzy}, year={2024} }","ama":"Youkeim MHF. Tailoring Code Property Graphs to Jimple. Paderborn University; 2024.","mla":"Youkeim, Michael Hany Fawzy. Tailoring Code Property Graphs to Jimple. Paderborn University, 2024.","chicago":"Youkeim, Michael Hany Fawzy. Tailoring Code Property Graphs to Jimple. Paderborn: Paderborn University, 2024.","short":"M.H.F. Youkeim, Tailoring Code Property Graphs to Jimple, Paderborn University, Paderborn, 2024.","ieee":"M. H. F. Youkeim, Tailoring Code Property Graphs to Jimple. Paderborn: Paderborn University, 2024.","apa":"Youkeim, M. H. F. (2024). Tailoring Code Property Graphs to Jimple. Paderborn University."}},{"_id":"56140","user_id":"32312","ddc":["000"],"conference":{"location":"Sacramento, California","start_date":"2024-10-27","name":"39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024)","end_date":"2024-11-01"},"status":"public","has_accepted_license":"1","external_id":{"arxiv":["2409.06564"]},"citation":{"mla":"Khedkar, Mugdha, et al. “Advancing Android Privacy Assessments with Automation.” In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24), 2024, doi:10.1145/3691621.3694953.","bibtex":"@inproceedings{Khedkar_Schlichtig_Bodden_2024, title={Advancing Android Privacy Assessments with Automation}, DOI={10.1145/3691621.3694953}, booktitle={In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)}, author={Khedkar, Mugdha and Schlichtig, Michael and Bodden, Eric}, year={2024} }","ama":"Khedkar M, Schlichtig M, Bodden E. Advancing Android Privacy Assessments with Automation. In: In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24). ; 2024. doi:10.1145/3691621.3694953","ieee":"M. Khedkar, M. Schlichtig, and E. Bodden, “Advancing Android Privacy Assessments with Automation,” presented at the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024), Sacramento, California, 2024, doi: 10.1145/3691621.3694953.","apa":"Khedkar, M., Schlichtig, M., & Bodden, E. (2024). Advancing Android Privacy Assessments with Automation. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24). 39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024), Sacramento, California. https://doi.org/10.1145/3691621.3694953","chicago":"Khedkar, Mugdha, Michael Schlichtig, and Eric Bodden. “Advancing Android Privacy Assessments with Automation.” In In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24), 2024. https://doi.org/10.1145/3691621.3694953.","short":"M. Khedkar, M. Schlichtig, E. Bodden, in: In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24), 2024."},"file_date_updated":"2024-09-16T08:55:23Z","language":[{"iso":"eng"}],"doi":"10.1145/3691621.3694953","author":[{"full_name":"Khedkar, Mugdha","first_name":"Mugdha","last_name":"Khedkar","id":"88024"},{"full_name":"Schlichtig, Michael","first_name":"Michael","last_name":"Schlichtig","orcid":"0000-0001-6600-6171","id":"32312"},{"id":"59256","first_name":"Eric","last_name":"Bodden","orcid":"0000-0003-3470-3647","full_name":"Bodden, Eric"}],"title":"Advancing Android Privacy Assessments with Automation","year":"2024","date_updated":"2026-03-13T12:12:45Z","date_created":"2024-09-16T08:55:34Z","file":[{"creator":"khedkarm","date_created":"2024-09-16T08:55:23Z","date_updated":"2024-09-16T08:55:23Z","relation":"main_file","access_level":"closed","file_size":1207856,"file_name":"2409.06564v1.pdf","content_type":"application/pdf","success":1,"file_id":"56141"}],"department":[{"_id":"76"}],"type":"conference","publication":"In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)","abstract":[{"text":" Android apps collecting data from users must comply with legal frameworks to ensure data protection. This requirement has become even more important since the implementation of the General Data Protection Regulation (GDPR) by the European Union in 2018. Moreover, with the proposed Cyber Resilience Act on the horizon, stakeholders will soon need to assess software against even more stringent security and privacy standards. Effective privacy assessments require collaboration among groups with diverse expertise to function effectively as a cohesive unit.\r\n This paper motivates the need for an automated approach that enhances understanding of data protection in Android apps and improves communication between the various parties involved in privacy assessments. We propose the Assessor View, a tool designed to bridge the knowledge gap between these parties, facilitating more effective privacy assessments of Android applications. ","lang":"eng"}]},{"volume":22,"user_id":"405","publisher":"Institute of Electrical and Electronics Engineers (IEEE)","_id":"52587","page":"69-72","status":"public","quality_controlled":"1","citation":{"ieee":"E. Bodden, J. Pottebaum, M. Fockel, and I. Gräßler, “Evaluating Security Through Isolation and Defense in Depth,” IEEE Security & Privacy, vol. 22, no. 1, pp. 69–72, 2024, doi: 10.1109/msec.2023.3336028.","apa":"Bodden, E., Pottebaum, J., Fockel, M., & Gräßler, I. (2024). Evaluating Security Through Isolation and Defense in Depth. IEEE Security & Privacy, 22(1), 69–72. https://doi.org/10.1109/msec.2023.3336028","chicago":"Bodden, Eric, Jens Pottebaum, Markus Fockel, and Iris Gräßler. “Evaluating Security Through Isolation and Defense in Depth.” IEEE Security & Privacy 22, no. 1 (2024): 69–72. https://doi.org/10.1109/msec.2023.3336028.","short":"E. Bodden, J. Pottebaum, M. Fockel, I. Gräßler, IEEE Security & Privacy 22 (2024) 69–72.","mla":"Bodden, Eric, et al. “Evaluating Security Through Isolation and Defense in Depth.” IEEE Security & Privacy, vol. 22, no. 1, Institute of Electrical and Electronics Engineers (IEEE), 2024, pp. 69–72, doi:10.1109/msec.2023.3336028.","bibtex":"@article{Bodden_Pottebaum_Fockel_Gräßler_2024, title={Evaluating Security Through Isolation and Defense in Depth}, volume={22}, DOI={10.1109/msec.2023.3336028}, number={1}, journal={IEEE Security & Privacy}, publisher={Institute of Electrical and Electronics Engineers (IEEE)}, author={Bodden, Eric and Pottebaum, Jens and Fockel, Markus and Gräßler, Iris}, year={2024}, pages={69–72} }","ama":"Bodden E, Pottebaum J, Fockel M, Gräßler I. Evaluating Security Through Isolation and Defense in Depth. IEEE Security & Privacy. 2024;22(1):69-72. doi:10.1109/msec.2023.3336028"},"doi":"10.1109/msec.2023.3336028","language":[{"iso":"eng"}],"main_file_link":[{"url":"https://ieeexplore.ieee.org/document/10411721"}],"intvolume":" 22","publication_status":"published","date_updated":"2026-03-31T02:19:49Z","publication_identifier":{"issn":["1540-7993","1558-4046"]},"author":[{"id":"59256","last_name":"Bodden","orcid":"0000-0003-3470-3647","first_name":"Eric","full_name":"Bodden, Eric"},{"orcid":"http://orcid.org/0000-0001-8778-2989","first_name":"Jens","last_name":"Pottebaum","full_name":"Pottebaum, Jens","id":"405"},{"last_name":"Fockel","first_name":"Markus","orcid":"0000-0002-1269-0702","full_name":"Fockel, Markus","id":"8472"},{"id":"47565","full_name":"Gräßler, Iris","last_name":"Gräßler","first_name":"Iris","orcid":"0000-0001-5765-971X"}],"year":"2024","title":"Evaluating Security Through Isolation and Defense in Depth","department":[{"_id":"152"},{"_id":"76"},{"_id":"662"}],"keyword":["Law","Electrical and Electronic Engineering","Computer Networks and Communications"],"type":"journal_article","date_created":"2024-03-15T20:16:18Z","publication":"IEEE Security & Privacy","issue":"1"},{"publication":"2024 IEEE International Conference on Software Maintenance and Evolution (ICSME)","citation":{"short":"S. Schott, W. Fischer, S.E. Ponta, J. Klauke, E. Bodden, in: 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME), IEEE, 2024.","chicago":"Schott, Stefan, Wolfram Fischer, Serena Elisa Ponta, Jonas Klauke, and Eric Bodden. “Compilation of Commit Changes Within Java Source Code Repositories.” In 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME). IEEE, 2024. https://doi.org/10.1109/icsme58944.2024.00038.","ieee":"S. Schott, W. Fischer, S. E. Ponta, J. Klauke, and E. Bodden, “Compilation of Commit Changes Within Java Source Code Repositories,” 2024, doi: 10.1109/icsme58944.2024.00038.","apa":"Schott, S., Fischer, W., Ponta, S. E., Klauke, J., & Bodden, E. (2024). Compilation of Commit Changes Within Java Source Code Repositories. 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME). https://doi.org/10.1109/icsme58944.2024.00038","bibtex":"@inproceedings{Schott_Fischer_Ponta_Klauke_Bodden_2024, title={Compilation of Commit Changes Within Java Source Code Repositories}, DOI={10.1109/icsme58944.2024.00038}, booktitle={2024 IEEE International Conference on Software Maintenance and Evolution (ICSME)}, publisher={IEEE}, author={Schott, Stefan and Fischer, Wolfram and Ponta, Serena Elisa and Klauke, Jonas and Bodden, Eric}, year={2024} }","ama":"Schott S, Fischer W, Ponta SE, Klauke J, Bodden E. Compilation of Commit Changes Within Java Source Code Repositories. In: 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME). IEEE; 2024. doi:10.1109/icsme58944.2024.00038","mla":"Schott, Stefan, et al. “Compilation of Commit Changes Within Java Source Code Repositories.” 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME), IEEE, 2024, doi:10.1109/icsme58944.2024.00038."},"type":"conference","department":[{"_id":"76"}],"date_created":"2026-08-24T12:02:51Z","date_updated":"2026-08-24T12:03:25Z","publication_status":"published","status":"public","title":"Compilation of Commit Changes Within Java Source Code Repositories","year":"2024","author":[{"id":"54847","orcid":"0000-0002-0644-3297","last_name":"Schott","first_name":"Stefan","full_name":"Schott, Stefan"},{"full_name":"Fischer, Wolfram","last_name":"Fischer","first_name":"Wolfram"},{"first_name":"Serena Elisa","last_name":"Ponta","full_name":"Ponta, Serena Elisa"},{"id":"40915","last_name":"Klauke","orcid":"0000-0001-9160-9636","first_name":"Jonas","full_name":"Klauke, Jonas"},{"id":"59256","orcid":"0000-0003-3470-3647","last_name":"Bodden","first_name":"Eric","full_name":"Bodden, Eric"}],"doi":"10.1109/icsme58944.2024.00038","user_id":"15249","_id":"66834","language":[{"iso":"eng"}],"publisher":"IEEE"},{"citation":{"ama":"Torres A, Costa P, Amaral L, et al. Runtime Verification of Crypto APIs: An Empirical Study. IEEE Transactions on Software Engineering. 2023;49(10):4510-4525. doi:10.1109/tse.2023.3301660","bibtex":"@article{Torres_Costa_Amaral_Pastro_Bonifácio_d’Amorim_Legunsen_Bodden_Dias Canedo_2023, title={Runtime Verification of Crypto APIs: An Empirical Study}, volume={49}, DOI={10.1109/tse.2023.3301660}, number={10}, journal={IEEE Transactions on Software Engineering}, publisher={Institute of Electrical and Electronics Engineers (IEEE)}, author={Torres, Adriano and Costa, Pedro and Amaral, Luis and Pastro, Jonata and Bonifácio, Rodrigo and d’Amorim, Marcelo and Legunsen, Owolabi and Bodden, Eric and Dias Canedo, Edna}, year={2023}, pages={4510–4525} }","mla":"Torres, Adriano, et al. “Runtime Verification of Crypto APIs: An Empirical Study.” IEEE Transactions on Software Engineering, vol. 49, no. 10, Institute of Electrical and Electronics Engineers (IEEE), 2023, pp. 4510–25, doi:10.1109/tse.2023.3301660.","short":"A. Torres, P. Costa, L. Amaral, J. Pastro, R. Bonifácio, M. d’Amorim, O. Legunsen, E. Bodden, E. Dias Canedo, IEEE Transactions on Software Engineering 49 (2023) 4510–4525.","chicago":"Torres, Adriano, Pedro Costa, Luis Amaral, Jonata Pastro, Rodrigo Bonifácio, Marcelo d’Amorim, Owolabi Legunsen, Eric Bodden, and Edna Dias Canedo. “Runtime Verification of Crypto APIs: An Empirical Study.” IEEE Transactions on Software Engineering 49, no. 10 (2023): 4510–25. https://doi.org/10.1109/tse.2023.3301660.","apa":"Torres, A., Costa, P., Amaral, L., Pastro, J., Bonifácio, R., d’Amorim, M., Legunsen, O., Bodden, E., & Dias Canedo, E. (2023). Runtime Verification of Crypto APIs: An Empirical Study. IEEE Transactions on Software Engineering, 49(10), 4510–4525. https://doi.org/10.1109/tse.2023.3301660","ieee":"A. Torres et al., “Runtime Verification of Crypto APIs: An Empirical Study,” IEEE Transactions on Software Engineering, vol. 49, no. 10, pp. 4510–4525, 2023, doi: 10.1109/tse.2023.3301660."},"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","_id":"46816","page":"4510 - 4525","volume":49,"user_id":"15249","status":"public","date_created":"2023-09-06T07:42:40Z","department":[{"_id":"76"}],"keyword":["Software"],"type":"journal_article","issue":"10","publication":"IEEE Transactions on Software Engineering","language":[{"iso":"eng"}],"doi":"10.1109/tse.2023.3301660","publication_identifier":{"issn":["0098-5589","1939-3520","2326-3881"]},"author":[{"full_name":"Torres, Adriano","last_name":"Torres","first_name":"Adriano"},{"full_name":"Costa, Pedro","first_name":"Pedro","last_name":"Costa"},{"full_name":"Amaral, Luis","last_name":"Amaral","first_name":"Luis"},{"last_name":"Pastro","first_name":"Jonata","full_name":"Pastro, Jonata"},{"full_name":"Bonifácio, Rodrigo","first_name":"Rodrigo","last_name":"Bonifácio"},{"last_name":"d'Amorim","first_name":"Marcelo","full_name":"d'Amorim, Marcelo"},{"last_name":"Legunsen","first_name":"Owolabi","full_name":"Legunsen, Owolabi"},{"id":"59256","last_name":"Bodden","first_name":"Eric","orcid":"0000-0003-3470-3647","full_name":"Bodden, Eric"},{"last_name":"Dias Canedo","first_name":"Edna","full_name":"Dias Canedo, Edna"}],"title":"Runtime Verification of Crypto APIs: An Empirical Study","year":"2023","intvolume":" 49","date_updated":"2023-12-04T11:05:26Z","publication_status":"published"},{"status":"public","publisher":"Springer Science and Business Media LLC","_id":"49439","user_id":"15249","volume":28,"citation":{"ieee":"G. Piskachev, M. Becker, and E. Bodden, “Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study,” Empirical Software Engineering, vol. 28, no. 5, Art. no. 118, 2023, doi: 10.1007/s10664-023-10354-3.","apa":"Piskachev, G., Becker, M., & Bodden, E. (2023). Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study. Empirical Software Engineering, 28(5), Article 118. https://doi.org/10.1007/s10664-023-10354-3","chicago":"Piskachev, Goran, Matthias Becker, and Eric Bodden. “Can the Configuration of Static Analyses Make Resolving Security Vulnerabilities More Effective? - A User Study.” Empirical Software Engineering 28, no. 5 (2023). https://doi.org/10.1007/s10664-023-10354-3.","short":"G. Piskachev, M. Becker, E. Bodden, Empirical Software Engineering 28 (2023).","mla":"Piskachev, Goran, et al. “Can the Configuration of Static Analyses Make Resolving Security Vulnerabilities More Effective? - A User Study.” Empirical Software Engineering, vol. 28, no. 5, 118, Springer Science and Business Media LLC, 2023, doi:10.1007/s10664-023-10354-3.","bibtex":"@article{Piskachev_Becker_Bodden_2023, title={Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study}, volume={28}, DOI={10.1007/s10664-023-10354-3}, number={5118}, journal={Empirical Software Engineering}, publisher={Springer Science and Business Media LLC}, author={Piskachev, Goran and Becker, Matthias and Bodden, Eric}, year={2023} }","ama":"Piskachev G, Becker M, Bodden E. Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study. Empirical Software Engineering. 2023;28(5). doi:10.1007/s10664-023-10354-3"},"year":"2023","title":"Can the configuration of static analyses make resolving security vulnerabilities more effective? - A user study","author":[{"id":"41936","first_name":"Goran","last_name":"Piskachev","orcid":"0000-0003-4424-5838","full_name":"Piskachev, Goran"},{"id":"4870","orcid":"https://orcid.org/0000-0003-2465-9347","first_name":"Matthias","last_name":"Becker","full_name":"Becker, Matthias"},{"full_name":"Bodden, Eric","last_name":"Bodden","orcid":"0000-0003-3470-3647","first_name":"Eric","id":"59256"}],"publication_identifier":{"issn":["1382-3256","1573-7616"]},"publication_status":"published","date_updated":"2023-12-04T11:29:49Z","intvolume":" 28","article_number":"118","language":[{"iso":"eng"}],"doi":"10.1007/s10664-023-10354-3","issue":"5","publication":"Empirical Software Engineering","abstract":[{"lang":"eng","text":"AbstractThe use of static analysis security testing (SAST) tools has been increasing in recent years. However, previous studies have shown that, when shipped to end users such as development or security teams, the findings of these tools are often unsatisfying. Users report high numbers of false positives or long analysis times, making the tools unusable in the daily workflow. To address this, SAST tool creators provide a wide range of configuration options, such as customization of rules through domain-specific languages or specification of the application-specific analysis scope. In this paper, we study the configuration space of selected existing SAST tools when used within the integrated development environment (IDE). We focus on the configuration options that impact three dimensions, for which a trade-off is unavoidable, i.e., precision, recall, and analysis runtime. We perform a between-subjects user study with 40 users from multiple development and security teams - to our knowledge, the largest population for this kind of user study in the software engineering community. The results show that users who configure SAST tools are more effective in resolving security vulnerabilities detected by the tools than those using the default configuration. Based on post-study interviews, we identify common strategies that users have while configuring the SAST tools to provide further insights for tool creators. Finally, an evaluation of the configuration options of two commercial SAST tools, Fortify and CheckMarx, reveals that a quarter of the users do not understand the configuration options provided. The configuration options that are found most useful relate to the analysis scope."}],"date_created":"2023-12-04T11:14:34Z","keyword":["Software"],"type":"journal_article","department":[{"_id":"76"},{"_id":"662"}]},{"status":"public","page":"60-65","_id":"48946","publisher":"VDI Fachmedien GmbH and Co. KG","user_id":"405","volume":75,"citation":{"ieee":"I. Gräßler, E. Bodden, D. Wiechel, and J. Pottebaum, “Defense-in-Depth als neues Paradigma der sicherheitsgerechten Produktentwicklung: interdisziplinäre, bedrohungsbewusste und lösungsorientierte Security,” Konstruktion, vol. 75, no. 11–12, pp. 60–65, 2023, doi: 10.37544/0720-5953-2023-11-12-60.","apa":"Gräßler, I., Bodden, E., Wiechel, D., & Pottebaum, J. (2023). Defense-in-Depth als neues Paradigma der sicherheitsgerechten Produktentwicklung: interdisziplinäre, bedrohungsbewusste und lösungsorientierte Security. Konstruktion, 75(11–12), 60–65. https://doi.org/10.37544/0720-5953-2023-11-12-60","mla":"Gräßler, Iris, et al. “Defense-in-Depth als neues Paradigma der sicherheitsgerechten Produktentwicklung: interdisziplinäre, bedrohungsbewusste und lösungsorientierte Security.” Konstruktion, vol. 75, no. 11–12, VDI Fachmedien GmbH and Co. KG, 2023, pp. 60–65, doi:10.37544/0720-5953-2023-11-12-60.","bibtex":"@article{Gräßler_Bodden_Wiechel_Pottebaum_2023, title={Defense-in-Depth als neues Paradigma der sicherheitsgerechten Produktentwicklung: interdisziplinäre, bedrohungsbewusste und lösungsorientierte Security}, volume={75}, DOI={10.37544/0720-5953-2023-11-12-60}, number={11–12}, journal={Konstruktion}, publisher={VDI Fachmedien GmbH and Co. KG}, author={Gräßler, Iris and Bodden, Eric and Wiechel, Dominik and Pottebaum, Jens}, year={2023}, pages={60–65} }","chicago":"Gräßler, Iris, Eric Bodden, Dominik Wiechel, and Jens Pottebaum. “Defense-in-Depth als neues Paradigma der sicherheitsgerechten Produktentwicklung: interdisziplinäre, bedrohungsbewusste und lösungsorientierte Security.” Konstruktion 75, no. 11–12 (2023): 60–65. https://doi.org/10.37544/0720-5953-2023-11-12-60.","ama":"Gräßler I, Bodden E, Wiechel D, Pottebaum J. Defense-in-Depth als neues Paradigma der sicherheitsgerechten Produktentwicklung: interdisziplinäre, bedrohungsbewusste und lösungsorientierte Security. Konstruktion. 2023;75(11-12):60-65. doi:10.37544/0720-5953-2023-11-12-60","short":"I. Gräßler, E. Bodden, D. Wiechel, J. Pottebaum, Konstruktion 75 (2023) 60–65."},"quality_controlled":"1","title":"Defense-in-Depth als neues Paradigma der sicherheitsgerechten Produktentwicklung: interdisziplinäre, bedrohungsbewusste und lösungsorientierte Security","year":"2023","author":[{"orcid":"0000-0001-5765-971X","last_name":"Gräßler","first_name":"Iris","full_name":"Gräßler, Iris","id":"47565"},{"last_name":"Bodden","orcid":"0000-0003-3470-3647","first_name":"Eric","full_name":"Bodden, Eric","id":"59256"},{"id":"67161","first_name":"Dominik","last_name":"Wiechel","full_name":"Wiechel, Dominik"},{"id":"405","first_name":"Jens","last_name":"Pottebaum","orcid":"http://orcid.org/0000-0001-8778-2989","full_name":"Pottebaum, Jens"}],"publication_identifier":{"issn":["0720-5953"]},"date_updated":"2023-12-20T14:10:51Z","publication_status":"published","intvolume":" 75","article_type":"original","language":[{"iso":"ger"}],"doi":"10.37544/0720-5953-2023-11-12-60","issue":"11-12","publication":"Konstruktion","abstract":[{"text":"inhalt Der verlässliche Betrieb von technischen Produkten wird zunehmend durch bewusste Angriffe bedroht. Vollständige Sicherheit ist dabei nicht möglich, durchschlagende Angriffe sind unvermeidbar (Assume Breach). Dies erfordert einen Paradigmenwechsel in der sicherheitsgerechten Entwicklung mechatronischer und cyber-physischer Systeme hin zu Defense-in-Depth. Systeme müssen so ausgelegt werden, dass sie auch bei gezielten Angriffen möglichst hohe Zuverlässigkeit und Sicherheit gewährleisten. Der hier beschriebene Lösungsansatz erweitert das Systemmodell um Angriffsszenarien und Verteidigungslinien. Diese werden am Beispiel eines industriellen Schließsystems zur Anlagensicherheit erläutert. Entwickler werden sensibilisiert, Angriffe systematisch zu berücksichtigen und interdisziplinär Verteidigungselemente gegenüber Bedrohungen und Angriffen zu spezifizieren.","lang":"ger"},{"text":"The reliable operation of technical products is increasingly threatened by deliberate attacks. Complete security is not possible, striking attacks are unavoidable (assume breach). This requires a paradigm shift in security-oriented engineering of mechatronic and cyber-physical systems towards Defense-in-Depth. Systems need to be engineered in a way that full reliability and security are ensured even in case of targeted attacks. The solution approach described here expands the system model to include attack scenarios and lines of defence. It is applied to an industrial locking system for plant security as an example. Developers are sensitised to systematically consider attacks and to specify interdisciplinary defence elements against threats and attacks.","lang":"eng"}],"date_created":"2023-11-16T08:23:12Z","type":"journal_article","keyword":["Mechanical Engineering","Mechanics of Materials","General Materials Science","Theoretical Computer Science"],"department":[{"_id":"152"},{"_id":"76"}]},{"status":"public","title":"Evaluation of Usability Criteria Addressed by Static Analysis Tools on a Large Scale","year":"2023","author":[{"id":"41213","first_name":"Marcus","last_name":"Nachtigall","full_name":"Nachtigall, Marcus"},{"last_name":"Schlichtig","first_name":"Michael","orcid":"0000-0001-6600-6171","full_name":"Schlichtig, Michael","id":"32312"},{"id":"59256","full_name":"Bodden, Eric","orcid":"0000-0003-3470-3647","first_name":"Eric","last_name":"Bodden"}],"publication_identifier":{"isbn":["978-3-88579-726-5"]},"date_updated":"2024-03-20T09:27:41Z","main_file_link":[{"url":"https://dl.gi.de/items/5afe477f-2f6a-4b3d-b391-f024baf0b7a5"}],"page":"95–96","publisher":"Gesellschaft für Informatik e.V.","_id":"52662","language":[{"iso":"eng"}],"user_id":"32312","publication":"Software Engineering 2023","citation":{"ama":"Nachtigall M, Schlichtig M, Bodden E. Evaluation of Usability Criteria Addressed by Static Analysis Tools on a Large Scale. In: Software Engineering 2023. Gesellschaft für Informatik e.V.; 2023:95–96.","bibtex":"@inbook{Nachtigall_Schlichtig_Bodden_2023, place={Bonn}, title={Evaluation of Usability Criteria Addressed by Static Analysis Tools on a Large Scale}, booktitle={Software Engineering 2023}, publisher={Gesellschaft für Informatik e.V.}, author={Nachtigall, Marcus and Schlichtig, Michael and Bodden, Eric}, year={2023}, pages={95–96} }","mla":"Nachtigall, Marcus, et al. “Evaluation of Usability Criteria Addressed by Static Analysis Tools on a Large Scale.” Software Engineering 2023, Gesellschaft für Informatik e.V., 2023, pp. 95–96.","short":"M. Nachtigall, M. Schlichtig, E. Bodden, in: Software Engineering 2023, Gesellschaft für Informatik e.V., Bonn, 2023, pp. 95–96.","chicago":"Nachtigall, Marcus, Michael Schlichtig, and Eric Bodden. “Evaluation of Usability Criteria Addressed by Static Analysis Tools on a Large Scale.” In Software Engineering 2023, 95–96. Bonn: Gesellschaft für Informatik e.V., 2023.","apa":"Nachtigall, M., Schlichtig, M., & Bodden, E. (2023). Evaluation of Usability Criteria Addressed by Static Analysis Tools on a Large Scale. In Software Engineering 2023 (pp. 95–96). Gesellschaft für Informatik e.V.","ieee":"M. Nachtigall, M. Schlichtig, and E. Bodden, “Evaluation of Usability Criteria Addressed by Static Analysis Tools on a Large Scale,” in Software Engineering 2023, Bonn: Gesellschaft für Informatik e.V., 2023, pp. 95–96."},"abstract":[{"text":"Static analysis tools support developers in detecting potential coding issues, such as bugs or vulnerabilities. Research emphasizes technical challenges of such tools but also mentions severe usability shortcomings. These shortcomings hinder the adoption of static analysis tools, and user dissatisfaction may even lead to tool abandonment. To comprehensively assess the state of the art, we present the first systematic usability evaluation of a wide range of static analysis tools. We derived a set of 36 relevant criteria from the literature and used them to evaluate a total of 46 static analysis tools complying with our inclusion and exclusion criteria - a representative set of mainly non-proprietary tools. The evaluation against the usability criteria in a multiple-raters approach shows that two thirds of the considered tools off er poor warning messages, while about three-quarters provide hardly any fix support. Furthermore, the integration of user knowledge is strongly neglected, which could be used for instance, to improve handling of false positives. Finally, issues regarding workflow integration and specialized user interfaces are revealed. These findings should prove useful in guiding and focusing further research and development in user experience for static code analyses.","lang":"eng"}],"place":"Bonn","date_created":"2024-03-20T09:26:29Z","keyword":["Automated static analysis","Software usability"],"type":"book_chapter","department":[{"_id":"76"}]},{"date_created":"2024-03-20T09:22:27Z","place":"Bonn","type":"book_chapter","keyword":["API misuses API usage constraints","classification framework","API misuse detection","static analysis"],"department":[{"_id":"76"}],"publication":"Software Engineering 2023","citation":{"ama":"Schlichtig M, Sassalla S, Narasimhan K, Bodden E. Introducing FUM: A Framework for API Usage Constraint and Misuse Classification. In: Software Engineering 2023. Gesellschaft für Informatik e.V.; 2023:105–106.","bibtex":"@inbook{Schlichtig_Sassalla_Narasimhan_Bodden_2023, place={Bonn}, title={Introducing FUM: A Framework for API Usage Constraint and Misuse Classification}, booktitle={Software Engineering 2023}, publisher={Gesellschaft für Informatik e.V.}, author={Schlichtig, Michael and Sassalla, Steffen and Narasimhan, Krishna and Bodden, Eric}, year={2023}, pages={105–106} }","mla":"Schlichtig, Michael, et al. “Introducing FUM: A Framework for API Usage Constraint and Misuse Classification.” Software Engineering 2023, Gesellschaft für Informatik e.V., 2023, pp. 105–106.","short":"M. Schlichtig, S. Sassalla, K. Narasimhan, E. Bodden, in: Software Engineering 2023, Gesellschaft für Informatik e.V., Bonn, 2023, pp. 105–106.","chicago":"Schlichtig, Michael, Steffen Sassalla, Krishna Narasimhan, and Eric Bodden. “Introducing FUM: A Framework for API Usage Constraint and Misuse Classification.” In Software Engineering 2023, 105–106. Bonn: Gesellschaft für Informatik e.V., 2023.","apa":"Schlichtig, M., Sassalla, S., Narasimhan, K., & Bodden, E. (2023). Introducing FUM: A Framework for API Usage Constraint and Misuse Classification. In Software Engineering 2023 (pp. 105–106). Gesellschaft für Informatik e.V.","ieee":"M. Schlichtig, S. Sassalla, K. Narasimhan, and E. Bodden, “Introducing FUM: A Framework for API Usage Constraint and Misuse Classification,” in Software Engineering 2023, Bonn: Gesellschaft für Informatik e.V., 2023, pp. 105–106."},"abstract":[{"lang":"eng","text":"Application Programming Interfaces (APIs) are the primary mechanism developers use to obtain access to third-party algorithms and services. Unfortunately, APIs can be misused, which can have catastrophic consequences, especially if the APIs provide security-critical functionalities like cryptography. Understanding what API misuses are, and how they are caused, is important to prevent them, eg, with API misuse detectors. However, definitions for API misuses and related terms in literature vary. This paper presents a systematic literature review to clarify these terms and introduces FUM, a novel Framework for API Usage constraint and Misuse classification. The literature review revealed that API misuses are violations of API usage constraints. To address this, we provide unified definitions and use them to derive FUM. To assess the extent to which FUM aids in determining and guiding the improvement of an API misuses detector’s capabilities, we performed a case study on the state-of the-art misuse detection tool CogniCrypt. The study showed that FUM can be used to properly assess CogniCrypt’s capabilities, identify weaknesses and assist in deriving mitigations and improvements."}],"page":"105–106","main_file_link":[{"url":"https://dl.gi.de/items/c4825557-cf3d-4038-933a-d8f95fd324a2"}],"language":[{"iso":"eng"}],"_id":"52660","publisher":"Gesellschaft für Informatik e.V.","user_id":"32312","status":"public","year":"2023","title":"Introducing FUM: A Framework for API Usage Constraint and Misuse Classification","author":[{"full_name":"Schlichtig, Michael","orcid":"0000-0001-6600-6171","last_name":"Schlichtig","first_name":"Michael","id":"32312"},{"last_name":"Sassalla","first_name":"Steffen","full_name":"Sassalla, Steffen"},{"full_name":"Narasimhan, Krishna","last_name":"Narasimhan","first_name":"Krishna"},{"last_name":"Bodden","first_name":"Eric","orcid":"0000-0003-3470-3647","full_name":"Bodden, Eric","id":"59256"}],"publication_identifier":{"isbn":["978-3-88579-726-5"]},"date_updated":"2024-03-20T09:25:46Z"},{"user_id":"14931","doi":"10.1109/secdev56634.2023.00015","publisher":"IEEE","_id":"49438","language":[{"iso":"eng"}],"publication_status":"published","date_updated":"2024-06-05T13:51:00Z","author":[{"full_name":"Krüger, Stefan","first_name":"Stefan","last_name":"Krüger"},{"last_name":"Reif","first_name":"Michael","full_name":"Reif, Michael"},{"last_name":"Wickert","first_name":"Anna-Katharina","full_name":"Wickert, Anna-Katharina"},{"first_name":"Sarah","last_name":"Nadi","full_name":"Nadi, Sarah"},{"full_name":"Ali, Karim","first_name":"Karim","last_name":"Ali"},{"last_name":"Bodden","orcid":"0000-0003-3470-3647","first_name":"Eric","full_name":"Bodden, Eric","id":"59256"},{"id":"94636","first_name":"Yasemin","last_name":"Acar","full_name":"Acar, Yasemin"},{"last_name":"Mezini","first_name":"Mira","full_name":"Mezini, Mira"},{"first_name":"Sascha","last_name":"Fahl","full_name":"Fahl, Sascha"}],"status":"public","title":"Securing Your Crypto-API Usage Through Tool Support - A Usability Study","year":"2023","department":[{"_id":"76"},{"_id":"858"}],"type":"conference","date_created":"2023-12-04T11:07:08Z","citation":{"mla":"Krüger, Stefan, et al. “Securing Your Crypto-API Usage Through Tool Support - A Usability Study.” 2023 IEEE Secure Development Conference (SecDev), IEEE, 2023, doi:10.1109/secdev56634.2023.00015.","ama":"Krüger S, Reif M, Wickert A-K, et al. Securing Your Crypto-API Usage Through Tool Support - A Usability Study. In: 2023 IEEE Secure Development Conference (SecDev). IEEE; 2023. doi:10.1109/secdev56634.2023.00015","bibtex":"@inproceedings{Krüger_Reif_Wickert_Nadi_Ali_Bodden_Acar_Mezini_Fahl_2023, title={Securing Your Crypto-API Usage Through Tool Support - A Usability Study}, DOI={10.1109/secdev56634.2023.00015}, booktitle={2023 IEEE Secure Development Conference (SecDev)}, publisher={IEEE}, author={Krüger, Stefan and Reif, Michael and Wickert, Anna-Katharina and Nadi, Sarah and Ali, Karim and Bodden, Eric and Acar, Yasemin and Mezini, Mira and Fahl, Sascha}, year={2023} }","apa":"Krüger, S., Reif, M., Wickert, A.-K., Nadi, S., Ali, K., Bodden, E., Acar, Y., Mezini, M., & Fahl, S. (2023). Securing Your Crypto-API Usage Through Tool Support - A Usability Study. 2023 IEEE Secure Development Conference (SecDev). https://doi.org/10.1109/secdev56634.2023.00015","ieee":"S. Krüger et al., “Securing Your Crypto-API Usage Through Tool Support - A Usability Study,” 2023, doi: 10.1109/secdev56634.2023.00015.","short":"S. Krüger, M. Reif, A.-K. Wickert, S. Nadi, K. Ali, E. Bodden, Y. Acar, M. Mezini, S. Fahl, in: 2023 IEEE Secure Development Conference (SecDev), IEEE, 2023.","chicago":"Krüger, Stefan, Michael Reif, Anna-Katharina Wickert, Sarah Nadi, Karim Ali, Eric Bodden, Yasemin Acar, Mira Mezini, and Sascha Fahl. “Securing Your Crypto-API Usage Through Tool Support - A Usability Study.” In 2023 IEEE Secure Development Conference (SecDev). IEEE, 2023. https://doi.org/10.1109/secdev56634.2023.00015."},"publication":"2023 IEEE Secure Development Conference (SecDev)"},{"date_updated":"2023-02-06T10:46:00Z","author":[{"id":"66637","full_name":"Shivarpatna Venkatesh, Ashwin Prasad","last_name":"Shivarpatna Venkatesh","first_name":"Ashwin Prasad"},{"full_name":"Wang, Jiawei","last_name":"Wang","first_name":"Jiawei"},{"full_name":"Li, Li","first_name":"Li","last_name":"Li"},{"id":"59256","first_name":"Eric","last_name":"Bodden","orcid":"0000-0003-3470-3647","full_name":"Bodden, Eric"}],"year":"2023","title":"Enhancing Comprehension and Navigation in Jupyter Notebooks with Static Analysis","status":"public","user_id":"15249","_id":"41813","language":[{"iso":"eng"}],"citation":{"mla":"Shivarpatna Venkatesh, Ashwin Prasad, et al. “Enhancing Comprehension and Navigation in Jupyter Notebooks with Static Analysis.” IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), 2023.","ama":"Shivarpatna Venkatesh AP, Wang J, Li L, Bodden E. Enhancing Comprehension and Navigation in Jupyter Notebooks with Static Analysis. In: IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER). ; 2023.","bibtex":"@inproceedings{Shivarpatna Venkatesh_Wang_Li_Bodden_2023, title={Enhancing Comprehension and Navigation in Jupyter Notebooks with Static Analysis}, booktitle={IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)}, author={Shivarpatna Venkatesh, Ashwin Prasad and Wang, Jiawei and Li, Li and Bodden, Eric}, year={2023} }","apa":"Shivarpatna Venkatesh, A. P., Wang, J., Li, L., & Bodden, E. (2023). Enhancing Comprehension and Navigation in Jupyter Notebooks with Static Analysis. IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER).","ieee":"A. P. Shivarpatna Venkatesh, J. Wang, L. Li, and E. Bodden, “Enhancing Comprehension and Navigation in Jupyter Notebooks with Static Analysis,” 2023.","chicago":"Shivarpatna Venkatesh, Ashwin Prasad, Jiawei Wang, Li Li, and Eric Bodden. “Enhancing Comprehension and Navigation in Jupyter Notebooks with Static Analysis.” In IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), 2023.","short":"A.P. Shivarpatna Venkatesh, J. Wang, L. Li, E. Bodden, in: IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), 2023."},"publication":"IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)","department":[{"_id":"76"}],"type":"conference","date_created":"2023-02-06T10:44:08Z"},{"citation":{"short":"K. Karakaya, E. Bodden, in: 2023 IEEE Conference on Software Testing, Verification and Validation (ICST), IEEE, 2023.","chicago":"Karakaya, Kadiray, and Eric Bodden. “Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis.” In 2023 IEEE Conference on Software Testing, Verification and Validation (ICST). IEEE, 2023. https://doi.org/10.1109/icst57152.2023.00036.","apa":"Karakaya, K., & Bodden, E. (2023). Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis. 2023 IEEE Conference on Software Testing, Verification and Validation (ICST). https://doi.org/10.1109/icst57152.2023.00036","ieee":"K. Karakaya and E. Bodden, “Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis,” 2023, doi: 10.1109/icst57152.2023.00036.","ama":"Karakaya K, Bodden E. Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis. In: 2023 IEEE Conference on Software Testing, Verification and Validation (ICST). IEEE; 2023. doi:10.1109/icst57152.2023.00036","bibtex":"@inproceedings{Karakaya_Bodden_2023, title={Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis}, DOI={10.1109/icst57152.2023.00036}, booktitle={2023 IEEE Conference on Software Testing, Verification and Validation (ICST)}, publisher={IEEE}, author={Karakaya, Kadiray and Bodden, Eric}, year={2023} }","mla":"Karakaya, Kadiray, and Eric Bodden. “Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis.” 2023 IEEE Conference on Software Testing, Verification and Validation (ICST), IEEE, 2023, doi:10.1109/icst57152.2023.00036."},"publication":"2023 IEEE Conference on Software Testing, Verification and Validation (ICST)","department":[{"_id":"76"}],"type":"conference","date_created":"2023-05-29T12:09:43Z","publication_status":"published","date_updated":"2023-05-29T12:12:17Z","author":[{"first_name":"Kadiray","last_name":"Karakaya","full_name":"Karakaya, Kadiray"},{"last_name":"Bodden","first_name":"Eric","full_name":"Bodden, Eric"}],"title":"Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis","status":"public","year":"2023","user_id":"70410","doi":"10.1109/icst57152.2023.00036","publisher":"IEEE","_id":"45312"},{"status":"public","has_accepted_license":"1","_id":"44146","ddc":["004"],"user_id":"88024","file_date_updated":"2023-04-24T12:15:27Z","citation":{"ieee":"M. Khedkar, “Static Analysis for Android GDPR Compliance Assurance,” doi: 10.1109/ICSE-Companion58688.2023.00054.","apa":"Khedkar, M. (n.d.). Static Analysis for Android GDPR Compliance Assurance. 2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), Melbourne, Australia, 2023, Pp. 197-199. https://doi.org/10.1109/ICSE-Companion58688.2023.00054","short":"M. Khedkar, in: 2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), Melbourne, Australia, 2023, Pp. 197-199, n.d.","chicago":"Khedkar, Mugdha. “Static Analysis for Android GDPR Compliance Assurance.” In 2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), Melbourne, Australia, 2023, Pp. 197-199, n.d. https://doi.org/10.1109/ICSE-Companion58688.2023.00054.","mla":"Khedkar, Mugdha. “Static Analysis for Android GDPR Compliance Assurance.” 2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), Melbourne, Australia, 2023, Pp. 197-199, doi:10.1109/ICSE-Companion58688.2023.00054.","bibtex":"@inproceedings{Khedkar, title={Static Analysis for Android GDPR Compliance Assurance}, DOI={10.1109/ICSE-Companion58688.2023.00054}, booktitle={2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), Melbourne, Australia, 2023, pp. 197-199}, author={Khedkar, Mugdha} }","ama":"Khedkar M. Static Analysis for Android GDPR Compliance Assurance. In: 2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), Melbourne, Australia, 2023, Pp. 197-199. doi:10.1109/ICSE-Companion58688.2023.00054"},"external_id":{"arxiv":["2303.09606"]},"year":"2023","title":"Static Analysis for Android GDPR Compliance Assurance","author":[{"full_name":"Khedkar, Mugdha","first_name":"Mugdha","last_name":"Khedkar","id":"88024"}],"date_updated":"2024-09-16T08:46:25Z","publication_status":"accepted","language":[{"iso":"eng"}],"doi":"10.1109/ICSE-Companion58688.2023.00054","publication":"2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), Melbourne, Australia, 2023, pp. 197-199","abstract":[{"text":"Many Android applications collect data from users. When they do, they must\r\nprotect this collected data according to the current legal frameworks. Such\r\ndata protection has become even more important since the European Union rolled\r\nout the General Data Protection Regulation (GDPR). App developers have limited\r\ntool support to reason about data protection throughout their app development\r\nprocess. Although many Android applications state a privacy policy, privacy\r\npolicy compliance checks are currently manual, expensive, and prone to error.\r\nOne of the major challenges in privacy audits is the significant gap between\r\nlegal privacy statements (in English text) and technical measures that Android\r\napps use to protect their user's privacy. In this thesis, we will explore to\r\nwhat extent we can use static analysis to answer important questions regarding\r\ndata protection. Our main goal is to design a tool based approach that aids app\r\ndevelopers and auditors in ensuring data protection in Android applications,\r\nbased on automated static program analysis.","lang":"eng"}],"file":[{"access_level":"closed","file_size":85313,"file_name":"2023047614.pdf","date_updated":"2023-04-24T12:15:27Z","relation":"main_file","content_type":"application/pdf","success":1,"file_id":"44147","creator":"khedkarm","date_created":"2023-04-24T12:15:27Z"}],"date_created":"2023-04-24T12:14:17Z","type":"conference","keyword":["static analysis","data protection and privacy","GDPR compliance"],"department":[{"_id":"76"}]}]