@article{61546,
abstract = {{Fuzzing is a powerful software testing technique renowned for its effectiveness in identifying software vulnerabilities. Traditional fuzzing evaluations typically focus on overall fuzzer performance across a set of target programs, yet few benchmarks consider how fine-grained program features influence fuzzing effectiveness. To bridge this gap, we introduce FeatureBench, a novel benchmark designed to generate programs with configurable, fine-grained program features to enhance fuzzing evaluations. We reviewed 25 recent grey-box fuzzing studies, extracting 7 program features related to control-flow and data-flow that can impact fuzzer performance. Using these features, we generated a benchmark consisting of 153 programs controlled by 10 fine-grained configurable parameters. We evaluated 11 fuzzers using this benchmark, with each fuzzer representing either distinct claimed improvements or serving as a widely used baseline in fuzzing evaluations. The results indicate that fuzzer performance varies significantly based on the program features and their strengths, highlighting the importance of incorporating program characteristics into fuzzing evaluations.}},
author = {{Miao, Miao and Kummita, Sriteja and Bodden, Eric and Wei, Shiyi}},
issn = {{2994-970X}},
journal = {{Proceedings of the ACM on Software Engineering}},
number = {{ISSTA}},
pages = {{527--549}},
publisher = {{Association for Computing Machinery (ACM)}},
title = {{{Program Feature-Based Benchmarking for Fuzz Testing}}},
doi = {{10.1145/3728899}},
volume = {{2}},
year = {{2025}},
}
@inproceedings{61936,
author = {{Karakaya, Kadiray and Muthuraman, Palaniappan and Bodden, Eric}},
booktitle = {{Proceedings of the 14th ACM SIGPLAN International Workshop on the State Of the Art in Program Analysis}},
publisher = {{ACM}},
title = {{{Pick Your Call Graphs Well: On Scaling IFDS-Based Data-Flow Analyses}}},
doi = {{10.1145/3735544.3735587}},
year = {{2025}},
}
@article{62973,
abstract = {{Large Language Models (LLMs) are increasingly being explored for their potential in software engineering, particularly in static analysis tasks. In this study, we investigate the potential of current LLMs to enhance call-graph analysis and type inference for Python and JavaScript programs. We empirically evaluated 24 LLMs, including OpenAI's GPT series and open-source models like LLaMA and Mistral, using existing and newly developed benchmarks. Specifically, we enhanced TypeEvalPy, a micro-benchmarking framework for type inference in Python, with auto-generation capabilities, expanding its scope from 860 to 77,268 type annotations for Python. Additionally, we introduced SWARM-CG and SWARM-JS, comprehensive benchmarking suites for evaluating call-graph construction tools across multiple programming languages.
Our findings reveal a contrasting performance of LLMs in static analysis tasks. For call-graph generation, traditional static analysis tools such as PyCG for Python and Jelly for JavaScript consistently outperform LLMs. While advanced models like mistral-large-it-2407-123b and gpt-4o show promise, they still struggle with completeness and soundness in call-graph analysis across both languages. In contrast, LLMs demonstrate a clear advantage in type inference for Python, surpassing traditional tools like HeaderGen and hybrid approaches such as HiTyper. These results suggest that, while LLMs hold promise in type inference, their limitations in call-graph analysis highlight the need for further research. Our study provides a foundation for integrating LLMs into static analysis workflows, offering insights into their strengths and current limitations.}},
author = {{Shivarpatna Venkatesh, Ashwin Prasad and Sunil, Rose and Sabu, Samkutty and Mir, Amir M. and Reis, Sofia and Bodden, Eric}},
journal = {{Empirical Software Engineering}},
number = {{6}},
publisher = {{Springer}},
title = {{{An Empirical Study of Large Language Models for Type and Call Graph Analysis in Python and JavaScript}}},
doi = {{10.48550/ARXIV.2410.00603}},
volume = {{30}},
year = {{2025}},
}
@article{61108,
abstract = {{Greybox fuzzing is used extensively in research and practice. There are umpteen publications that improve greybox fuzzing. However, to what extent do these improvements affect the internal components or internals of a given fuzzer is not yet understood as the improvements are mostly evaluated using code coverage and bug finding capability. Such an evaluation is insufficient to understand the effect of improvements on the fuzzer internals. Some of the literature visualizes the outcomes of fuzzing to enhance the understanding. However, they only focus on high-level information and no previous research on visualization has been dedicated to understanding fuzzing internals.
To close this gap, we propose the first step towards development of a fuzzing-specific visualization framework: a taxonomy of visualization analysis tasks that fuzzing experts desire to help them understand the fuzzing internals. Our approach involves conducting interviews with fuzzing experts and using qualitative data analysis to systematically extract the task taxonomy from the interview data. We also evaluate the support of existing fuzzing visualization tools through the lens of our taxonomy. In our study, we have conducted 33 interviews with fuzzing practitioners and extracted a taxonomy of 120 visualization analysis tasks. Our evaluation shows that the existing fuzzing visualization tools only provide aids to support 10 of them.}},
author = {{Kummita, Sriteja and Miao, Miao and Bodden, Eric and Wei, Shiyi}},
issn = {{1049-331X}},
journal = {{ACM Transactions on Software Engineering and Methodology}},
publisher = {{Association for Computing Machinery (ACM)}},
title = {{{Visualization Task Taxonomy to Understand the Fuzzing Internals}}},
doi = {{10.1145/3718346}},
year = {{2025}},
}
@unpublished{65018,
abstract = {{Android applications collecting data from users must protect it according to the current legal frameworks. Such data protection has become even more important since in 2018 the European Union rolled out the General Data Protection Regulation (GDPR). Since app developers are not legal experts, they find it difficult to integrate privacy-aware practices into source code development. Despite these legal obligations, developers have limited tool support to reason about data protection throughout their app development process.
This paper explores the use of static program slicing and software visualization to analyze privacy-relevant data flows in Android apps. We introduce SliceViz, a web tool that analyzes an Android app by slicing all privacy-relevant data sources detected in the source code on the back-end. It then helps developers by visualizing these privacy-relevant program slices.
We conducted a user study with 12 participants demonstrating that SliceViz effectively aids developers in identifying privacy-relevant properties in Android apps.
Our findings indicate that program slicing can be employed to identify and reason about privacy-relevant data flows in Android applications. With further usability improvements, developers can be better equipped to handle privacy-sensitive information.}},
author = {{Khedkar, Mugdha and Schlichtig, Michael and Mohan, Santhosh and Bodden, Eric}},
booktitle = {{arXiv:2503.16640}},
title = {{{Visualizing Privacy-Relevant Data Flows in Android Applications}}},
year = {{2025}},
}
@misc{52663,
abstract = {{Context
Static analyses are well-established to aid in understanding bugs or vulnerabilities during the development process or in large-scale studies. A low false-positive rate is essential for the adaption in practice and for precise results of empirical studies. Unfortunately, static analyses tend to report where a vulnerability manifests rather than the fix location. This can cause presumed false positives or imprecise results.
Method
To address this problem, we designed an adaption of an existing static analysis algorithm that can distinguish between a manifestation and fix location, and reports error chains. An error chain represents at least two interconnected errors that occur successively, thus building the connection between the fix and manifestation location. We used our tool CogniCryptSUBS for a case study on 471 GitHub repositories, a performance benchmark to compare different analysis configurations, and conducted an expert interview.
Result
We found that 50 % of the projects with a report had at least one error chain. Our runtime benchmark demonstrated that our improvement caused only a minimal runtime overhead of less than 4 %. The results of our expert interview indicate that with our adapted version participants require fewer executions of the analysis.
Conclusion
Our results indicate that error chains occur frequently in real-world projects, and ignoring them can lead to imprecise evaluation results. The runtime benchmark indicates that our tool is a feasible and efficient solution for detecting error chains in real-world projects. Further, our results gave a hint that the usability of static analyses may benefit from supporting error chains.}},
author = {{Wickert, Anna-Katharina and Schlichtig, Michael and Vogel, Marvin and Winter, Lukas and Mezini, Mira and Bodden, Eric}},
keywords = {{Static analysis, error chains, false positive re- duction, empirical studies}},
title = {{{Supporting Error Chains in Static Analysis for Precise Evaluation Results and Enhanced Usability}}},
year = {{2024}},
}
@inproceedings{53938,
abstract = {{Previous work has shown that one can often greatly speed up static analysis by computing data flows not for every edge in the program’s control-flow graph but instead only along definition-use chains. This yields a so-called sparse static analysis. Recent work on SparseDroid has shown that specifically taint analysis can be “sparsified” with extraordinary effectiveness because the taint state of one variable does not depend on those of others. This allows one to soundly omit more flow-function computations than in the general case. In this work, we now assess whether this result carries over to the more generic setting of so-called Interprocedural Distributive Environment (IDE) problems. Opposed to taint analysis, IDE comprises distributive problems with large or even infinitely broad domains, such as typestate analysis or linear constant propagation. Specifically, this paper presents Sparse IDE, a framework that realizes sparsification for any static analysis that fits the IDE framework. We implement Sparse IDE in SparseHeros, as an extension to the popular Heros IDE solver, and evaluate its performance on real-world Java libraries by comparing it to the baseline IDE algorithm. To this end, we design, implement and evaluate a linear constant propagation analysis client on top of SparseHeros. Our experiments show that, although IDE analyses can only be sparsified with respect to symbols and not (numeric) values, Sparse IDE can nonetheless yield significantly lower runtimes and often also memory consumptions compared to the original IDE.}},
author = {{Karakaya, Kadiray and Bodden, Eric}},
booktitle = {{Proceedings of the IEEE/ACM 46th International Conference on Software Engineering}},
publisher = {{ACM}},
title = {{{Symbol-Specific Sparsification of Interprocedural Distributive Environment Problems}}},
doi = {{10.1145/3597503.3639092}},
year = {{2024}},
}
@inproceedings{53958,
abstract = {{To detect security vulnerabilities, static analysis tools need to be configured with security-relevant methods. Current approaches can automatically identify such methods using binary relevance machine learning approaches. However, they ignore dependencies among security-relevant methods, over-generalize and perform poorly in practice. Additionally, users have to nevertheless manually configure static analysis tools using the detected methods. Based on feedback from users and our observations, the excessive manual steps can often be tedious, error-prone and counter-intuitive.
In this paper, we present Dev-Assist, an IntelliJ IDEA plugin that detects security-relevant methods using a multi-label machine learning approach that considers dependencies among labels. The plugin can automatically generate configurations for static analysis tools, run the static analysis, and show the results in IntelliJ IDEA. Our experiments reveal that Dev-Assist's machine learning approach has a higher F1-Measure than related approaches. Moreover, the plugin reduces and simplifies the manual effort required when configuring and using static analysis tools.}},
author = {{Johnson, Oshando and Piskachev, Goran and Krishnamurthy, Ranjith and Bodden, Eric}},
booktitle = {{Proceedings of the 46th International Conference on Software Engineering, IDE Workshop}},
title = {{{Detecting Security-Relevant Methods using Multi-label Machine Learning}}},
doi = {{10.48550/ARXIV.2403.07501}},
year = {{2024}},
}
@inproceedings{53959,
abstract = {{In light of the growing interest in type inference research for Python, both researchers and practitioners require a standardized process to assess the performance of various type inference techniques. This paper introduces TypeEvalPy, a comprehensive micro-benchmarking framework for evaluating type inference tools. TypeEvalPy contains 154 code snippets with 845 type annotations across 18 categories that target various Python features. The framework manages the execution of containerized tools, transforms inferred types into a standardized format, and produces meaningful metrics for assessment. Through our analysis, we compare the performance of six type inference tools, highlighting their strengths and limitations. Our findings provide a foundation for further research and optimization in the domain of Python type inference.}},
author = {{Shivarpatna Venkatesh, Ashwin Prasad and Sabu, Samkutty and Wang, Jiawei and Mir, Amir M. and Li, Li and Bodden, Eric}},
booktitle = {{Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings}},
isbn = {{9798400705021}},
location = {{Lisbon, Portugal}},
pages = {{49--53}},
publisher = {{Association for Computing Machinery}},
title = {{{TypeEvalPy: A Micro-benchmarking Framework for Python Type Inference Tools}}},
doi = {{10.1145/3639478.3640033}},
year = {{2024}},
}
@inproceedings{55516,
author = {{Shivarpatna Venkatesh, Ashwin Prasad and Sabu, Samkutty and Mir, Amir M. and Reis, Sofia and Bodden, Eric}},
booktitle = {{Proceedings of the 2024 IEEE/ACM First International Conference on AI Foundation Models and Software Engineering}},
publisher = {{ACM}},
title = {{{The Emergence of Large Language Models in Static Analysis: A First Look through Micro-Benchmarks}}},
doi = {{10.1145/3650105.3652288}},
year = {{2024}},
}
@article{59411,
abstract = {{As our lives, our businesses, and indeed our world economy become increasingly reliant on the secure operation of many interconnected software systems, the software engineering research community is faced with unprecedented research challenges, but also with exciting new opportunities. In this roadmap paper, we outline our vision of Software Security Analysis for the systems of the future. Given the recent advances in generative AI, we need new methods to assess and maximize the security of code co-written by machines. As our systems become increasingly heterogeneous, we need practical approaches that work even if some functions are automatically generated, e.g., by deep neural networks. As software systems depend evermore on the software supply chain, we need tools that scale to an entire ecosystem. What kind of vulnerabilities exist in future systems and how do we detect them? When all the shallow bugs are found, how do we discover vulnerabilities hidden deeply in the system? Assuming we cannot find all security flaws, how can we nevertheless protect our system? To answer these questions, we start our roadmap with a survey of recent advances in software security, then discuss open challenges and opportunities, and conclude with a long-term perspective for the field.}},
author = {{Böhme, Marcel and Bodden, Eric and Bultan, Tevfik and Cadar, Cristian and Liu, Yang and Scanniello, Giuseppe}},
issn = {{1049-331X}},
journal = {{ACM Transactions on Software Engineering and Methodology}},
publisher = {{Association for Computing Machinery (ACM)}},
title = {{{Software Security Analysis in 2030 and Beyond: A Research Roadmap}}},
doi = {{10.1145/3708533}},
year = {{2024}},
}
@inproceedings{52235,
abstract = {{Android applications collecting data from users must protect it according to the current legal frameworks. Such data protection has become even more important since the European Union rolled out the General Data Protection Regulation (GDPR). Since app developers are not legal experts, they find it difficult to write privacy-aware source code. Moreover, they have limited tool support to reason about data protection throughout their app development process.
This paper motivates the need for a static analysis approach to diagnose and explain data protection in Android apps. The analysis will recognize personal data sources in the source code, and aims to further examine the data flow originating from these sources. App developers can then address key questions about data manipulation, derived data, and the presence of technical measures. Despite challenges, we explore to what extent one can realize this analysis through static taint analysis, a common method for identifying security vulnerabilities. This is a first step towards designing a tool-based approach that aids app developers and assessors in ensuring data protection in Android apps, based on automated static program analysis. }},
author = {{Khedkar, Mugdha and Bodden, Eric}},
booktitle = {{Proceedings of the IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft '24). Association for Computing Machinery, New York, NY, USA, 65–68.}},
keywords = {{static program analysis, data protection and privacy, GDPR compliance}},
location = {{Lisbon, Portugal}},
title = {{{Toward an Android Static Analysis Approach for Data Protection}}},
doi = {{10.1145/3647632.3651389}},
year = {{2024}},
}
@inbook{53942,
abstract = {{AbstractSince its inception two decades ago, Soot has become one of the most widely used open-source static analysis frameworks. Over time it has been extended with the contributions of countless researchers. Yet, at the same time, the requirements for Soot have changed over the years and become increasingly at odds with some of the major design decisions that underlie it. In this work, we thus present SootUp, a complete reimplementation of Soot that seeks to fulfill these requirements with a novel design, while at the same time keeping elements that Soot users have grown accustomed to.}},
author = {{Karakaya, Kadiray and Schott, Stefan and Klauke, Jonas and Bodden, Eric and Schmidt, Markus and Luo, Linghui and He, Dongjie}},
booktitle = {{Tools and Algorithms for the Construction and Analysis of Systems}},
isbn = {{9783031572456}},
issn = {{0302-9743}},
publisher = {{Springer Nature Switzerland}},
title = {{{SootUp: A Redesign of the Soot Static Analysis Framework}}},
doi = {{10.1007/978-3-031-57246-3_13}},
year = {{2024}},
}
@inproceedings{57550,
author = {{Schott, Stefan and Ponta, Serena Elisa and Fischer, Wolfram and Klauke, Jonas and Bodden, Eric}},
booktitle = {{38th European Conference on Object-Oriented Programming (ECOOP 2024)}},
location = {{Vienna}},
title = {{{Java Bytecode Normalization for Code Similarity Analysis}}},
doi = {{10.4230/LIPIcs.ECOOP.2024.37}},
year = {{2024}},
}
@inproceedings{58716,
author = {{Schott, Stefan and Fischer, Wolfram and Ponta, Serena Elisa and Klauke, Jonas and Bodden, Eric}},
booktitle = {{2024 IEEE International Conference on Software Maintenance and Evolution (ICSME)}},
publisher = {{IEEE}},
title = {{{Compilation of Commit Changes Within Java Source Code Repositories}}},
doi = {{10.1109/icsme58944.2024.00038}},
year = {{2024}},
}
@inproceedings{56863,
author = {{Schiebel, Fabian Benedikt and Sattler, Florian and Schubert, Philipp Dominik and Apel, Sven and Bodden, Eric}},
booktitle = {{38th European Conference on Object-Oriented Programming (ECOOP 2024)}},
editor = {{Aldrich, Jonathan and Salvaneschi, Guido}},
isbn = {{978-3-95977-341-6}},
issn = {{1868-8969}},
pages = {{36:1–36:28}},
publisher = {{Schloss Dagstuhl – Leibniz-Zentrum für Informatik}},
title = {{{Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report}}},
doi = {{10.4230/LIPIcs.ECOOP.2024.36}},
volume = {{313}},
year = {{2024}},
}
@inproceedings{56137,
abstract = {{Many Android applications collect data from users. The European Union's General Data Protection Regulation (GDPR) requires vendors to faithfully disclose which data their apps collect. This task is complicated because many apps use third-party code for which the same information is not readily available. Hence we ask: how accurately do current Android apps fulfill these requirements?
In this work, we first expose a multi-layered definition of privacy-related data to correctly report data collection in Android apps. We further create a dataset of privacy-sensitive data classes that may be used as input by an Android app. This dataset takes into account data collected both through the user interface and system APIs.
We manually examine the data safety sections of 70 Android apps to observe how data collection is reported, identifying instances of over- and under-reporting. Additionally, we develop a prototype to statically extract and label privacy-related data collected via app source code, user interfaces, and permissions. Comparing the prototype's results with the data safety sections of 20 apps reveals reporting discrepancies. Using the results from two Messaging and Social Media apps (Signal and Instagram), we discuss how app developers under-report and over-report data collection, respectively, and identify inaccurately reported data categories.
Our results show that app developers struggle to accurately report data collection, either due to Google's abstract definition of collected data or insufficient existing tool support. }},
author = {{Khedkar, Mugdha and Mondal, Ambuj Kumar and Bodden, Eric}},
booktitle = {{In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)}},
location = {{Sacramento, California}},
title = {{{Do Android App Developers Accurately Report Collection of Privacy-Related Data?}}},
doi = {{10.1145/3691621.3694949}},
year = {{2024}},
}
@misc{57416,
abstract = {{The increased complexity of modern software has led to much more
sophisticated attack vectors. As a result, we require newer vulnerability detection
methods to ensure software security without compromising efficiency.
The Code Property Graph (CPG) is a program representation that provides a comprehensive overview of program behavior, combining abstract syntax trees, control flow
graphs, and program dependence graphs. With such a detailed data structure, we can
detect patterns that characterize known vulnerabilities and identify various security
threats. Querying the combined data structure instead of the individual graphs enables the detection of multidimensional scenarios.
This work aims to integrate the advantages of CPGs into software systems that utilize
the Jimple intermediate representation. We introduce JimNode, a novel approach for
generating CPGs specifically tailored to Jimple. Despite the model incompatibility, our
evaluation, which covered approximately 50,800 methods, reveals an 88.07% similarity
of the inter-statement edges compared to Joern, the state-of-the-art tool for CPG
generation. We provide a detailed analysis of our methodology and discuss why it is
better suited for Jimple programs than Joern’s language-agnostic approach.}},
author = {{Youkeim, Michael Hany Fawzy}},
publisher = {{Paderborn University}},
title = {{{Tailoring Code Property Graphs to Jimple}}},
year = {{2024}},
}
@inproceedings{56140,
abstract = {{ Android apps collecting data from users must comply with legal frameworks to ensure data protection. This requirement has become even more important since the implementation of the General Data Protection Regulation (GDPR) by the European Union in 2018. Moreover, with the proposed Cyber Resilience Act on the horizon, stakeholders will soon need to assess software against even more stringent security and privacy standards. Effective privacy assessments require collaboration among groups with diverse expertise to function effectively as a cohesive unit.
This paper motivates the need for an automated approach that enhances understanding of data protection in Android apps and improves communication between the various parties involved in privacy assessments. We propose the Assessor View, a tool designed to bridge the knowledge gap between these parties, facilitating more effective privacy assessments of Android applications. }},
author = {{Khedkar, Mugdha and Schlichtig, Michael and Bodden, Eric}},
booktitle = {{In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)}},
location = {{Sacramento, California}},
title = {{{Advancing Android Privacy Assessments with Automation}}},
doi = {{10.1145/3691621.3694953}},
year = {{2024}},
}
@article{52587,
author = {{Bodden, Eric and Pottebaum, Jens and Fockel, Markus and Gräßler, Iris}},
issn = {{1540-7993}},
journal = {{IEEE Security & Privacy}},
keywords = {{Law, Electrical and Electronic Engineering, Computer Networks and Communications}},
number = {{1}},
pages = {{69--72}},
publisher = {{Institute of Electrical and Electronics Engineers (IEEE)}},
title = {{{Evaluating Security Through Isolation and Defense in Depth}}},
doi = {{10.1109/msec.2023.3336028}},
volume = {{22}},
year = {{2024}},
}