---
_id: '61546'
abstract:
- lang: eng
text: Fuzzing is a powerful software testing technique renowned for its
effectiveness in identifying software vulnerabilities. Traditional fuzzing evaluations
typically focus on overall fuzzer performance across a set of target programs,
yet few benchmarks consider how fine-grained program features influence fuzzing
effectiveness. To bridge this gap, we introduce FeatureBench, a novel benchmark
designed to generate programs with configurable, fine-grained program features
to enhance fuzzing evaluations. We reviewed 25 recent grey-box fuzzing studies,
extracting 7 program features related to control-flow and data-flow that can impact
fuzzer performance. Using these features, we generated a benchmark consisting
of 153 programs controlled by 10 fine-grained configurable parameters. We evaluated
11 fuzzers using this benchmark, with each fuzzer representing either distinct
claimed improvements or serving as a widely used baseline in fuzzing evaluations.
The results indicate that fuzzer performance varies significantly based on the
program features and their strengths, highlighting the importance of incorporating
program characteristics into fuzzing evaluations.
author:
- first_name: Miao
full_name: Miao, Miao
last_name: Miao
- first_name: Sriteja
full_name: Kummita, Sriteja
id: '72582'
last_name: Kummita
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
- first_name: Shiyi
full_name: Wei, Shiyi
last_name: Wei
citation:
ama: Miao M, Kummita S, Bodden E, Wei S. Program Feature-Based Benchmarking for
Fuzz Testing. Proceedings of the ACM on Software Engineering. 2025;2(ISSTA):527-549.
doi:10.1145/3728899
apa: Miao, M., Kummita, S., Bodden, E., & Wei, S. (2025). Program Feature-Based
Benchmarking for Fuzz Testing. Proceedings of the ACM on Software Engineering,
2(ISSTA), 527–549. https://doi.org/10.1145/3728899
bibtex: '@article{Miao_Kummita_Bodden_Wei_2025, title={Program Feature-Based Benchmarking
for Fuzz Testing}, volume={2}, DOI={10.1145/3728899},
number={ISSTA}, journal={Proceedings of the ACM on Software Engineering}, publisher={Association
for Computing Machinery (ACM)}, author={Miao, Miao and Kummita, Sriteja and Bodden,
Eric and Wei, Shiyi}, year={2025}, pages={527–549} }'
chicago: 'Miao, Miao, Sriteja Kummita, Eric Bodden, and Shiyi Wei. “Program Feature-Based
Benchmarking for Fuzz Testing.” Proceedings of the ACM on Software Engineering
2, no. ISSTA (2025): 527–49. https://doi.org/10.1145/3728899.'
ieee: 'M. Miao, S. Kummita, E. Bodden, and S. Wei, “Program Feature-Based Benchmarking
for Fuzz Testing,” Proceedings of the ACM on Software Engineering, vol.
2, no. ISSTA, pp. 527–549, 2025, doi: 10.1145/3728899.'
mla: Miao, Miao, et al. “Program Feature-Based Benchmarking for Fuzz Testing.” Proceedings
of the ACM on Software Engineering, vol. 2, no. ISSTA, Association for Computing
Machinery (ACM), 2025, pp. 527–49, doi:10.1145/3728899.
short: M. Miao, S. Kummita, E. Bodden, S. Wei, Proceedings of the ACM on Software
Engineering 2 (2025) 527–549.
date_created: 2025-10-08T08:29:39Z
date_updated: 2025-10-08T08:32:57Z
department:
- _id: '76'
- _id: '662'
doi: 10.1145/3728899
intvolume: ' 2'
issue: ISSTA
language:
- iso: eng
page: 527-549
publication: Proceedings of the ACM on Software Engineering
publication_identifier:
issn:
- 2994-970X
publication_status: published
publisher: Association for Computing Machinery (ACM)
status: public
title: Program Feature-Based Benchmarking for Fuzz Testing
type: journal_article
user_id: '15249'
volume: 2
year: '2025'
...
---
_id: '61936'
author:
- first_name: Kadiray
full_name: Karakaya, Kadiray
last_name: Karakaya
- first_name: Palaniappan
full_name: Muthuraman, Palaniappan
last_name: Muthuraman
- first_name: Eric
full_name: Bodden, Eric
last_name: Bodden
citation:
ama: 'Karakaya K, Muthuraman P, Bodden E. Pick Your Call Graphs Well: On Scaling
IFDS-Based Data-Flow Analyses. In: Proceedings of the 14th ACM SIGPLAN International
Workshop on the State Of the Art in Program Analysis. ACM; 2025. doi:10.1145/3735544.3735587'
apa: 'Karakaya, K., Muthuraman, P., & Bodden, E. (2025). Pick Your Call Graphs
Well: On Scaling IFDS-Based Data-Flow Analyses. Proceedings of the 14th ACM
SIGPLAN International Workshop on the State Of the Art in Program Analysis.
https://doi.org/10.1145/3735544.3735587'
bibtex: '@inproceedings{Karakaya_Muthuraman_Bodden_2025, title={Pick Your Call Graphs
Well: On Scaling IFDS-Based Data-Flow Analyses}, DOI={10.1145/3735544.3735587},
booktitle={Proceedings of the 14th ACM SIGPLAN International Workshop on the State
Of the Art in Program Analysis}, publisher={ACM}, author={Karakaya, Kadiray and
Muthuraman, Palaniappan and Bodden, Eric}, year={2025} }'
chicago: 'Karakaya, Kadiray, Palaniappan Muthuraman, and Eric Bodden. “Pick Your
Call Graphs Well: On Scaling IFDS-Based Data-Flow Analyses.” In Proceedings
of the 14th ACM SIGPLAN International Workshop on the State Of the Art in Program
Analysis. ACM, 2025. https://doi.org/10.1145/3735544.3735587.'
ieee: 'K. Karakaya, P. Muthuraman, and E. Bodden, “Pick Your Call Graphs Well: On
Scaling IFDS-Based Data-Flow Analyses,” 2025, doi: 10.1145/3735544.3735587.'
mla: 'Karakaya, Kadiray, et al. “Pick Your Call Graphs Well: On Scaling IFDS-Based
Data-Flow Analyses.” Proceedings of the 14th ACM SIGPLAN International Workshop
on the State Of the Art in Program Analysis, ACM, 2025, doi:10.1145/3735544.3735587.'
short: 'K. Karakaya, P. Muthuraman, E. Bodden, in: Proceedings of the 14th ACM SIGPLAN
International Workshop on the State Of the Art in Program Analysis, ACM, 2025.'
date_created: 2025-10-23T12:46:21Z
date_updated: 2025-10-23T12:47:32Z
department:
- _id: '76'
doi: 10.1145/3735544.3735587
publication: Proceedings of the 14th ACM SIGPLAN International Workshop on the State
Of the Art in Program Analysis
publication_status: published
publisher: ACM
status: public
title: 'Pick Your Call Graphs Well: On Scaling IFDS-Based Data-Flow Analyses'
type: conference
user_id: '70410'
year: '2025'
...
---
_id: '62973'
abstract:
- lang: eng
text: "Large Language Models (LLMs) are increasingly being explored for their potential
in software engineering, particularly in static analysis tasks. In this study,
we investigate the potential of current LLMs to enhance call-graph analysis and
type inference for Python and JavaScript programs. We empirically evaluated 24
LLMs, including OpenAI's GPT series and open-source models like LLaMA and Mistral,
using existing and newly developed benchmarks. Specifically, we enhanced TypeEvalPy,
a micro-benchmarking framework for type inference in Python, with auto-generation
capabilities, expanding its scope from 860 to 77,268 type annotations for Python.
Additionally, we introduced SWARM-CG and SWARM-JS, comprehensive benchmarking
suites for evaluating call-graph construction tools across multiple programming
languages.\r\n Our findings reveal a contrasting performance of LLMs in static
analysis tasks. For call-graph generation, traditional static analysis tools such
as PyCG for Python and Jelly for JavaScript consistently outperform LLMs. While
advanced models like mistral-large-it-2407-123b and gpt-4o show promise, they
still struggle with completeness and soundness in call-graph analysis across both
languages. In contrast, LLMs demonstrate a clear advantage in type inference for
Python, surpassing traditional tools like HeaderGen and hybrid approaches such
as HiTyper. These results suggest that, while LLMs hold promise in type inference,
their limitations in call-graph analysis highlight the need for further research.
Our study provides a foundation for integrating LLMs into static analysis workflows,
offering insights into their strengths and current limitations."
author:
- first_name: Ashwin Prasad
full_name: Shivarpatna Venkatesh, Ashwin Prasad
id: '66637'
last_name: Shivarpatna Venkatesh
- first_name: Rose
full_name: Sunil, Rose
id: '97670'
last_name: Sunil
- first_name: Samkutty
full_name: Sabu, Samkutty
last_name: Sabu
- first_name: Amir M.
full_name: Mir, Amir M.
last_name: Mir
- first_name: Sofia
full_name: Reis, Sofia
last_name: Reis
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: Shivarpatna Venkatesh AP, Sunil R, Sabu S, Mir AM, Reis S, Bodden E. An Empirical
Study of Large Language Models for Type and Call Graph Analysis in Python and
JavaScript. Empirical Software Engineering. 2025;30(6). doi:10.48550/ARXIV.2410.00603
apa: Shivarpatna Venkatesh, A. P., Sunil, R., Sabu, S., Mir, A. M., Reis, S., &
Bodden, E. (2025). An Empirical Study of Large Language Models for Type and Call
Graph Analysis in Python and JavaScript. Empirical Software Engineering,
30(6). https://doi.org/10.48550/ARXIV.2410.00603
bibtex: '@article{Shivarpatna Venkatesh_Sunil_Sabu_Mir_Reis_Bodden_2025, title={An
Empirical Study of Large Language Models for Type and Call Graph Analysis in Python
and JavaScript}, volume={30}, DOI={10.48550/ARXIV.2410.00603},
number={6}, journal={Empirical Software Engineering}, publisher={Springer}, author={Shivarpatna
Venkatesh, Ashwin Prasad and Sunil, Rose and Sabu, Samkutty and Mir, Amir M. and
Reis, Sofia and Bodden, Eric}, year={2025} }'
chicago: Shivarpatna Venkatesh, Ashwin Prasad, Rose Sunil, Samkutty Sabu, Amir M.
Mir, Sofia Reis, and Eric Bodden. “An Empirical Study of Large Language Models
for Type and Call Graph Analysis in Python and JavaScript.” Empirical Software
Engineering 30, no. 6 (2025). https://doi.org/10.48550/ARXIV.2410.00603.
ieee: 'A. P. Shivarpatna Venkatesh, R. Sunil, S. Sabu, A. M. Mir, S. Reis, and E.
Bodden, “An Empirical Study of Large Language Models for Type and Call Graph Analysis
in Python and JavaScript,” Empirical Software Engineering, vol. 30, no.
6, 2025, doi: 10.48550/ARXIV.2410.00603.'
mla: Shivarpatna Venkatesh, Ashwin Prasad, et al. “An Empirical Study of Large Language
Models for Type and Call Graph Analysis in Python and JavaScript.” Empirical
Software Engineering, vol. 30, no. 6, Springer, 2025, doi:10.48550/ARXIV.2410.00603.
short: A.P. Shivarpatna Venkatesh, R. Sunil, S. Sabu, A.M. Mir, S. Reis, E. Bodden,
Empirical Software Engineering 30 (2025).
date_created: 2025-12-08T13:20:30Z
date_updated: 2025-12-08T13:25:49Z
department:
- _id: '76'
doi: 10.48550/ARXIV.2410.00603
intvolume: ' 30'
issue: '6'
language:
- iso: eng
publication: Empirical Software Engineering
publisher: Springer
status: public
title: An Empirical Study of Large Language Models for Type and Call Graph Analysis
in Python and JavaScript
type: journal_article
user_id: '15249'
volume: 30
year: '2025'
...
---
_id: '61108'
abstract:
- lang: eng
text: "Greybox fuzzing is used extensively in research and practice. There
are umpteen publications that improve greybox fuzzing. However, to what extent
do these improvements affect the internal components or internals of a given fuzzer
is not yet understood as the improvements are mostly evaluated using code coverage
and bug finding capability. Such an evaluation is insufficient to understand the
effect of improvements on the fuzzer internals. Some of the literature visualizes
the outcomes of fuzzing to enhance the understanding. However, they only focus
on high-level information and no previous research on visualization has been dedicated
to understanding fuzzing internals.\r\n To close this
gap, we propose the first step towards development of a fuzzing-specific visualization
framework: a taxonomy of visualization analysis tasks that fuzzing experts desire
to help them understand the fuzzing internals. Our approach involves conducting
interviews with fuzzing experts and using qualitative data analysis to systematically
extract the task taxonomy from the interview data. We also evaluate the support
of existing fuzzing visualization tools through the lens of our taxonomy. In our
study, we have conducted 33 interviews with fuzzing practitioners and extracted
a taxonomy of 120 visualization analysis tasks. Our evaluation shows that the
existing fuzzing visualization tools only provide aids to support 10 of them."
article_number: '3718346'
author:
- first_name: Sriteja
full_name: Kummita, Sriteja
id: '72582'
last_name: Kummita
- first_name: Miao
full_name: Miao, Miao
last_name: Miao
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
- first_name: Shiyi
full_name: Wei, Shiyi
last_name: Wei
citation:
ama: Kummita S, Miao M, Bodden E, Wei S. Visualization Task Taxonomy to Understand
the Fuzzing Internals. ACM Transactions on Software Engineering and Methodology.
Published online 2025. doi:10.1145/3718346
apa: Kummita, S., Miao, M., Bodden, E., & Wei, S. (2025). Visualization Task
Taxonomy to Understand the Fuzzing Internals. ACM Transactions on Software
Engineering and Methodology, Article 3718346. https://doi.org/10.1145/3718346
bibtex: '@article{Kummita_Miao_Bodden_Wei_2025, title={Visualization Task Taxonomy
to Understand the Fuzzing Internals}, DOI={10.1145/3718346},
number={3718346}, journal={ACM Transactions on Software Engineering and Methodology},
publisher={Association for Computing Machinery (ACM)}, author={Kummita, Sriteja
and Miao, Miao and Bodden, Eric and Wei, Shiyi}, year={2025} }'
chicago: Kummita, Sriteja, Miao Miao, Eric Bodden, and Shiyi Wei. “Visualization
Task Taxonomy to Understand the Fuzzing Internals.” ACM Transactions on Software
Engineering and Methodology, 2025. https://doi.org/10.1145/3718346.
ieee: 'S. Kummita, M. Miao, E. Bodden, and S. Wei, “Visualization Task Taxonomy
to Understand the Fuzzing Internals,” ACM Transactions on Software Engineering
and Methodology, Art. no. 3718346, 2025, doi: 10.1145/3718346.'
mla: Kummita, Sriteja, et al. “Visualization Task Taxonomy to Understand the Fuzzing
Internals.” ACM Transactions on Software Engineering and Methodology, 3718346,
Association for Computing Machinery (ACM), 2025, doi:10.1145/3718346.
short: S. Kummita, M. Miao, E. Bodden, S. Wei, ACM Transactions on Software Engineering
and Methodology (2025).
date_created: 2025-09-01T10:15:26Z
date_updated: 2025-09-01T10:16:03Z
department:
- _id: '76'
doi: 10.1145/3718346
language:
- iso: eng
publication: ACM Transactions on Software Engineering and Methodology
publication_identifier:
issn:
- 1049-331X
- 1557-7392
publication_status: published
publisher: Association for Computing Machinery (ACM)
status: public
title: Visualization Task Taxonomy to Understand the Fuzzing Internals
type: journal_article
user_id: '15249'
year: '2025'
...
---
_id: '65018'
abstract:
- lang: eng
text: "Android applications collecting data from users must protect it according
to the current legal frameworks. Such data protection has become even more important
since in 2018 the European Union rolled out the General Data Protection Regulation
(GDPR). Since app developers are not legal experts, they find it difficult to
integrate privacy-aware practices into source code development. Despite these
legal obligations, developers have limited tool support to reason about data protection
throughout their app development process.\r\n This paper explores the use of
static program slicing and software visualization to analyze privacy-relevant
data flows in Android apps. We introduce SliceViz, a web tool that analyzes an
Android app by slicing all privacy-relevant data sources detected in the source
code on the back-end. It then helps developers by visualizing these privacy-relevant
program slices.\r\n We conducted a user study with 12 participants demonstrating
that SliceViz effectively aids developers in identifying privacy-relevant properties
in Android apps.\r\n Our findings indicate that program slicing can be employed
to identify and reason about privacy-relevant data flows in Android applications.
With further usability improvements, developers can be better equipped to handle
privacy-sensitive information."
author:
- first_name: Mugdha
full_name: Khedkar, Mugdha
id: '88024'
last_name: Khedkar
- first_name: Michael
full_name: Schlichtig, Michael
id: '32312'
last_name: Schlichtig
orcid: 0000-0001-6600-6171
- first_name: Santhosh
full_name: Mohan, Santhosh
last_name: Mohan
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: Khedkar M, Schlichtig M, Mohan S, Bodden E. Visualizing Privacy-Relevant Data
Flows in Android Applications. arXiv:250316640. Published online 2025.
apa: Khedkar, M., Schlichtig, M., Mohan, S., & Bodden, E. (2025). Visualizing
Privacy-Relevant Data Flows in Android Applications. In arXiv:2503.16640.
bibtex: '@article{Khedkar_Schlichtig_Mohan_Bodden_2025, title={Visualizing Privacy-Relevant
Data Flows in Android Applications}, journal={arXiv:2503.16640}, author={Khedkar,
Mugdha and Schlichtig, Michael and Mohan, Santhosh and Bodden, Eric}, year={2025}
}'
chicago: Khedkar, Mugdha, Michael Schlichtig, Santhosh Mohan, and Eric Bodden. “Visualizing
Privacy-Relevant Data Flows in Android Applications.” ArXiv:2503.16640,
2025.
ieee: M. Khedkar, M. Schlichtig, S. Mohan, and E. Bodden, “Visualizing Privacy-Relevant
Data Flows in Android Applications,” arXiv:2503.16640. 2025.
mla: Khedkar, Mugdha, et al. “Visualizing Privacy-Relevant Data Flows in Android
Applications.” ArXiv:2503.16640, 2025.
short: M. Khedkar, M. Schlichtig, S. Mohan, E. Bodden, ArXiv:2503.16640 (2025).
date_created: 2026-03-16T17:39:12Z
date_updated: 2026-03-16T17:40:56Z
department:
- _id: '76'
external_id:
arxiv:
- '2503.16640'
language:
- iso: eng
publication: arXiv:2503.16640
status: public
title: Visualizing Privacy-Relevant Data Flows in Android Applications
type: preprint
user_id: '32312'
year: '2025'
...
---
_id: '52663'
abstract:
- lang: eng
text: "Context\r\nStatic analyses are well-established to aid in understanding bugs
or vulnerabilities during the development process or in large-scale studies. A
low false-positive rate is essential for the adaption in practice and for precise
results of empirical studies. Unfortunately, static analyses tend to report where
a vulnerability manifests rather than the fix location. This can cause presumed
false positives or imprecise results.\r\nMethod\r\nTo address this problem, we
designed an adaption of an existing static analysis algorithm that can distinguish
between a manifestation and fix location, and reports error chains. An error chain
represents at least two interconnected errors that occur successively, thus building
the connection between the fix and manifestation location. We used our tool CogniCryptSUBS
for a case study on 471 GitHub repositories, a performance benchmark to compare
different analysis configurations, and conducted an expert interview.\r\nResult\r\nWe
found that 50 % of the projects with a report had at least one error chain. Our
runtime benchmark demonstrated that our improvement caused only a minimal runtime
overhead of less than 4 %. The results of our expert interview indicate that with
our adapted version participants require fewer executions of the analysis.\r\nConclusion\r\nOur
results indicate that error chains occur frequently in real-world projects, and
ignoring them can lead to imprecise evaluation results. The runtime benchmark
indicates that our tool is a feasible and efficient solution for detecting error
chains in real-world projects. Further, our results gave a hint that the usability
of static analyses may benefit from supporting error chains."
author:
- first_name: Anna-Katharina
full_name: Wickert, Anna-Katharina
last_name: Wickert
- first_name: Michael
full_name: Schlichtig, Michael
id: '32312'
last_name: Schlichtig
orcid: 0000-0001-6600-6171
- first_name: Marvin
full_name: Vogel, Marvin
last_name: Vogel
- first_name: Lukas
full_name: Winter, Lukas
last_name: Winter
- first_name: Mira
full_name: Mezini, Mira
last_name: Mezini
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: Wickert A-K, Schlichtig M, Vogel M, Winter L, Mezini M, Bodden E. Supporting
Error Chains in Static Analysis for Precise Evaluation Results and Enhanced Usability.;
2024.
apa: Wickert, A.-K., Schlichtig, M., Vogel, M., Winter, L., Mezini, M., & Bodden,
E. (2024). Supporting Error Chains in Static Analysis for Precise Evaluation
Results and Enhanced Usability.
bibtex: '@book{Wickert_Schlichtig_Vogel_Winter_Mezini_Bodden_2024, title={Supporting
Error Chains in Static Analysis for Precise Evaluation Results and Enhanced Usability},
author={Wickert, Anna-Katharina and Schlichtig, Michael and Vogel, Marvin and
Winter, Lukas and Mezini, Mira and Bodden, Eric}, year={2024} }'
chicago: Wickert, Anna-Katharina, Michael Schlichtig, Marvin Vogel, Lukas Winter,
Mira Mezini, and Eric Bodden. Supporting Error Chains in Static Analysis for
Precise Evaluation Results and Enhanced Usability, 2024.
ieee: A.-K. Wickert, M. Schlichtig, M. Vogel, L. Winter, M. Mezini, and E. Bodden,
Supporting Error Chains in Static Analysis for Precise Evaluation Results and
Enhanced Usability. 2024.
mla: Wickert, Anna-Katharina, et al. Supporting Error Chains in Static Analysis
for Precise Evaluation Results and Enhanced Usability. 2024.
short: A.-K. Wickert, M. Schlichtig, M. Vogel, L. Winter, M. Mezini, E. Bodden,
Supporting Error Chains in Static Analysis for Precise Evaluation Results and
Enhanced Usability, 2024.
date_created: 2024-03-20T09:28:36Z
date_updated: 2024-03-20T09:32:29Z
department:
- _id: '76'
keyword:
- Static analysis
- error chains
- false positive re- duction
- empirical studies
language:
- iso: eng
main_file_link:
- url: https://arxiv.org/abs/2403.07808
status: public
title: Supporting Error Chains in Static Analysis for Precise Evaluation Results and
Enhanced Usability
type: misc
user_id: '32312'
year: '2024'
...
---
_id: '53938'
abstract:
- lang: eng
text: Previous work has shown that one can often greatly speed up static analysis
by computing data flows not for every edge in the program’s control-flow graph
but instead only along definition-use chains. This yields a so-called sparse static
analysis. Recent work on SparseDroid has shown that specifically taint analysis
can be “sparsified” with extraordinary effectiveness because the taint state of
one variable does not depend on those of others. This allows one to soundly omit
more flow-function computations than in the general case. In this work, we now
assess whether this result carries over to the more generic setting of so-called
Interprocedural Distributive Environment (IDE) problems. Opposed to taint analysis,
IDE comprises distributive problems with large or even infinitely broad domains,
such as typestate analysis or linear constant propagation. Specifically, this
paper presents Sparse IDE, a framework that realizes sparsification for any static
analysis that fits the IDE framework. We implement Sparse IDE in SparseHeros,
as an extension to the popular Heros IDE solver, and evaluate its performance
on real-world Java libraries by comparing it to the baseline IDE algorithm. To
this end, we design, implement and evaluate a linear constant propagation analysis
client on top of SparseHeros. Our experiments show that, although IDE analyses
can only be sparsified with respect to symbols and not (numeric) values, Sparse
IDE can nonetheless yield significantly lower runtimes and often also memory consumptions
compared to the original IDE.
author:
- first_name: Kadiray
full_name: Karakaya, Kadiray
id: '70410'
last_name: Karakaya
orcid: https://orcid.org/0000-0001-9266-2084
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Karakaya K, Bodden E. Symbol-Specific Sparsification of Interprocedural Distributive
Environment Problems. In: Proceedings of the IEEE/ACM 46th International Conference
on Software Engineering. ACM; 2024. doi:10.1145/3597503.3639092'
apa: Karakaya, K., & Bodden, E. (2024). Symbol-Specific Sparsification of Interprocedural
Distributive Environment Problems. Proceedings of the IEEE/ACM 46th International
Conference on Software Engineering. https://doi.org/10.1145/3597503.3639092
bibtex: '@inproceedings{Karakaya_Bodden_2024, title={Symbol-Specific Sparsification
of Interprocedural Distributive Environment Problems}, DOI={10.1145/3597503.3639092},
booktitle={Proceedings of the IEEE/ACM 46th International Conference on Software
Engineering}, publisher={ACM}, author={Karakaya, Kadiray and Bodden, Eric}, year={2024}
}'
chicago: Karakaya, Kadiray, and Eric Bodden. “Symbol-Specific Sparsification of
Interprocedural Distributive Environment Problems.” In Proceedings of the IEEE/ACM
46th International Conference on Software Engineering. ACM, 2024. https://doi.org/10.1145/3597503.3639092.
ieee: 'K. Karakaya and E. Bodden, “Symbol-Specific Sparsification of Interprocedural
Distributive Environment Problems,” 2024, doi: 10.1145/3597503.3639092.'
mla: Karakaya, Kadiray, and Eric Bodden. “Symbol-Specific Sparsification of Interprocedural
Distributive Environment Problems.” Proceedings of the IEEE/ACM 46th International
Conference on Software Engineering, ACM, 2024, doi:10.1145/3597503.3639092.
short: 'K. Karakaya, E. Bodden, in: Proceedings of the IEEE/ACM 46th International
Conference on Software Engineering, ACM, 2024.'
date_created: 2024-05-06T11:20:21Z
date_updated: 2024-05-06T11:23:06Z
department:
- _id: '76'
doi: 10.1145/3597503.3639092
language:
- iso: eng
publication: Proceedings of the IEEE/ACM 46th International Conference on Software
Engineering
publication_status: published
publisher: ACM
status: public
title: Symbol-Specific Sparsification of Interprocedural Distributive Environment
Problems
type: conference
user_id: '15249'
year: '2024'
...
---
_id: '53958'
abstract:
- lang: eng
text: "To detect security vulnerabilities, static analysis tools need to be configured
with security-relevant methods. Current approaches can automatically identify
such methods using binary relevance machine learning approaches. However, they
ignore dependencies among security-relevant methods, over-generalize and perform
poorly in practice. Additionally, users have to nevertheless manually configure
static analysis tools using the detected methods. Based on feedback from users
and our observations, the excessive manual steps can often be tedious, error-prone
and counter-intuitive.\r\n In this paper, we present Dev-Assist, an IntelliJ IDEA
plugin that detects security-relevant methods using a multi-label machine learning
approach that considers dependencies among labels. The plugin can automatically
generate configurations for static analysis tools, run the static analysis, and
show the results in IntelliJ IDEA. Our experiments reveal that Dev-Assist's machine
learning approach has a higher F1-Measure than related approaches. Moreover, the
plugin reduces and simplifies the manual effort required when configuring and
using static analysis tools."
author:
- first_name: Oshando
full_name: Johnson, Oshando
id: '66583'
last_name: Johnson
- first_name: Goran
full_name: Piskachev, Goran
id: '41936'
last_name: Piskachev
orcid: 0000-0003-4424-5838
- first_name: Ranjith
full_name: Krishnamurthy, Ranjith
id: '78060'
last_name: Krishnamurthy
orcid: 0000-0002-0906-5463
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Johnson O, Piskachev G, Krishnamurthy R, Bodden E. Detecting Security-Relevant
Methods using Multi-label Machine Learning. In: Proceedings of the 46th International
Conference on Software Engineering, IDE Workshop. ; 2024. doi:10.48550/ARXIV.2403.07501'
apa: Johnson, O., Piskachev, G., Krishnamurthy, R., & Bodden, E. (2024). Detecting
Security-Relevant Methods using Multi-label Machine Learning. Proceedings of
the 46th International Conference on Software Engineering, IDE Workshop. https://doi.org/10.48550/ARXIV.2403.07501
bibtex: '@inproceedings{Johnson_Piskachev_Krishnamurthy_Bodden_2024, title={Detecting
Security-Relevant Methods using Multi-label Machine Learning}, DOI={10.48550/ARXIV.2403.07501},
booktitle={Proceedings of the 46th International Conference on Software Engineering,
IDE Workshop}, author={Johnson, Oshando and Piskachev, Goran and Krishnamurthy,
Ranjith and Bodden, Eric}, year={2024} }'
chicago: Johnson, Oshando, Goran Piskachev, Ranjith Krishnamurthy, and Eric Bodden.
“Detecting Security-Relevant Methods Using Multi-Label Machine Learning.” In Proceedings
of the 46th International Conference on Software Engineering, IDE Workshop,
2024. https://doi.org/10.48550/ARXIV.2403.07501.
ieee: 'O. Johnson, G. Piskachev, R. Krishnamurthy, and E. Bodden, “Detecting Security-Relevant
Methods using Multi-label Machine Learning,” 2024, doi: 10.48550/ARXIV.2403.07501.'
mla: Johnson, Oshando, et al. “Detecting Security-Relevant Methods Using Multi-Label
Machine Learning.” Proceedings of the 46th International Conference on Software
Engineering, IDE Workshop, 2024, doi:10.48550/ARXIV.2403.07501.
short: 'O. Johnson, G. Piskachev, R. Krishnamurthy, E. Bodden, in: Proceedings of
the 46th International Conference on Software Engineering, IDE Workshop, 2024.'
date_created: 2024-05-06T11:43:19Z
date_updated: 2024-05-06T11:47:14Z
department:
- _id: '76'
- _id: '662'
doi: 10.48550/ARXIV.2403.07501
language:
- iso: eng
publication: Proceedings of the 46th International Conference on Software Engineering,
IDE Workshop
status: public
title: Detecting Security-Relevant Methods using Multi-label Machine Learning
type: conference
user_id: '15249'
year: '2024'
...
---
_id: '53959'
abstract:
- lang: eng
text: In light of the growing interest in type inference research for Python, both
researchers and practitioners require a standardized process to assess the performance
of various type inference techniques. This paper introduces TypeEvalPy, a comprehensive
micro-benchmarking framework for evaluating type inference tools. TypeEvalPy contains
154 code snippets with 845 type annotations across 18 categories that target various
Python features. The framework manages the execution of containerized tools, transforms
inferred types into a standardized format, and produces meaningful metrics for
assessment. Through our analysis, we compare the performance of six type inference
tools, highlighting their strengths and limitations. Our findings provide a foundation
for further research and optimization in the domain of Python type inference.
author:
- first_name: Ashwin Prasad
full_name: Shivarpatna Venkatesh, Ashwin Prasad
id: '66637'
last_name: Shivarpatna Venkatesh
- first_name: Samkutty
full_name: Sabu, Samkutty
last_name: Sabu
- first_name: Jiawei
full_name: Wang, Jiawei
last_name: Wang
- first_name: Amir M.
full_name: Mir, Amir M.
last_name: Mir
- first_name: Li
full_name: Li, Li
last_name: Li
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Shivarpatna Venkatesh AP, Sabu S, Wang J, Mir AM, Li L, Bodden E. TypeEvalPy:
A Micro-benchmarking Framework for Python Type Inference Tools. In: Proceedings
of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion
Proceedings. ICSE-Companion 24. Association for Computing Machinery; 2024:49-53.
doi:10.1145/3639478.3640033'
apa: 'Shivarpatna Venkatesh, A. P., Sabu, S., Wang, J., Mir, A. M., Li, L., &
Bodden, E. (2024). TypeEvalPy: A Micro-benchmarking Framework for Python Type
Inference Tools. Proceedings of the 2024 IEEE/ACM 46th International Conference
on Software Engineering: Companion Proceedings, 49–53. https://doi.org/10.1145/3639478.3640033'
bibtex: '@inproceedings{Shivarpatna Venkatesh_Sabu_Wang_Mir_Li_Bodden_2024, place={New
York, NY, USA}, series={ICSE-Companion 24}, title={TypeEvalPy: A Micro-benchmarking
Framework for Python Type Inference Tools}, DOI={10.1145/3639478.3640033},
booktitle={Proceedings of the 2024 IEEE/ACM 46th International Conference on Software
Engineering: Companion Proceedings}, publisher={Association for Computing Machinery},
author={Shivarpatna Venkatesh, Ashwin Prasad and Sabu, Samkutty and Wang, Jiawei
and Mir, Amir M. and Li, Li and Bodden, Eric}, year={2024}, pages={49–53}, collection={ICSE-Companion
24} }'
chicago: 'Shivarpatna Venkatesh, Ashwin Prasad, Samkutty Sabu, Jiawei Wang, Amir
M. Mir, Li Li, and Eric Bodden. “TypeEvalPy: A Micro-Benchmarking Framework for
Python Type Inference Tools.” In Proceedings of the 2024 IEEE/ACM 46th International
Conference on Software Engineering: Companion Proceedings, 49–53. ICSE-Companion
24. New York, NY, USA: Association for Computing Machinery, 2024. https://doi.org/10.1145/3639478.3640033.'
ieee: 'A. P. Shivarpatna Venkatesh, S. Sabu, J. Wang, A. M. Mir, L. Li, and E. Bodden,
“TypeEvalPy: A Micro-benchmarking Framework for Python Type Inference Tools,”
in Proceedings of the 2024 IEEE/ACM 46th International Conference on Software
Engineering: Companion Proceedings, Lisbon, Portugal, 2024, pp. 49–53, doi:
10.1145/3639478.3640033.'
mla: 'Shivarpatna Venkatesh, Ashwin Prasad, et al. “TypeEvalPy: A Micro-Benchmarking
Framework for Python Type Inference Tools.” Proceedings of the 2024 IEEE/ACM
46th International Conference on Software Engineering: Companion Proceedings,
Association for Computing Machinery, 2024, pp. 49–53, doi:10.1145/3639478.3640033.'
short: 'A.P. Shivarpatna Venkatesh, S. Sabu, J. Wang, A.M. Mir, L. Li, E. Bodden,
in: Proceedings of the 2024 IEEE/ACM 46th International Conference on Software
Engineering: Companion Proceedings, Association for Computing Machinery, New York,
NY, USA, 2024, pp. 49–53.'
conference:
location: Lisbon, Portugal
date_created: 2024-05-06T11:49:22Z
date_updated: 2024-08-05T07:49:33Z
department:
- _id: '76'
doi: 10.1145/3639478.3640033
external_id:
arxiv:
- '2312.16882'
language:
- iso: eng
page: 49-53
place: New York, NY, USA
publication: 'Proceedings of the 2024 IEEE/ACM 46th International Conference on Software
Engineering: Companion Proceedings'
publication_identifier:
isbn:
- '9798400705021'
publisher: Association for Computing Machinery
series_title: ICSE-Companion 24
status: public
title: 'TypeEvalPy: A Micro-benchmarking Framework for Python Type Inference Tools'
type: conference
user_id: '15249'
year: '2024'
...
---
_id: '55516'
author:
- first_name: Ashwin Prasad
full_name: Shivarpatna Venkatesh, Ashwin Prasad
id: '66637'
last_name: Shivarpatna Venkatesh
- first_name: Samkutty
full_name: Sabu, Samkutty
last_name: Sabu
- first_name: Amir M.
full_name: Mir, Amir M.
last_name: Mir
- first_name: Sofia
full_name: Reis, Sofia
last_name: Reis
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Shivarpatna Venkatesh AP, Sabu S, Mir AM, Reis S, Bodden E. The Emergence
of Large Language Models in Static Analysis: A First Look through Micro-Benchmarks.
In: Proceedings of the 2024 IEEE/ACM First International Conference on AI Foundation
Models and Software Engineering. ACM; 2024. doi:10.1145/3650105.3652288'
apa: 'Shivarpatna Venkatesh, A. P., Sabu, S., Mir, A. M., Reis, S., & Bodden,
E. (2024). The Emergence of Large Language Models in Static Analysis: A First
Look through Micro-Benchmarks. Proceedings of the 2024 IEEE/ACM First International
Conference on AI Foundation Models and Software Engineering. https://doi.org/10.1145/3650105.3652288'
bibtex: '@inproceedings{Shivarpatna Venkatesh_Sabu_Mir_Reis_Bodden_2024, title={The
Emergence of Large Language Models in Static Analysis: A First Look through Micro-Benchmarks},
DOI={10.1145/3650105.3652288},
booktitle={Proceedings of the 2024 IEEE/ACM First International Conference on
AI Foundation Models and Software Engineering}, publisher={ACM}, author={Shivarpatna
Venkatesh, Ashwin Prasad and Sabu, Samkutty and Mir, Amir M. and Reis, Sofia and
Bodden, Eric}, year={2024} }'
chicago: 'Shivarpatna Venkatesh, Ashwin Prasad, Samkutty Sabu, Amir M. Mir, Sofia
Reis, and Eric Bodden. “The Emergence of Large Language Models in Static Analysis:
A First Look through Micro-Benchmarks.” In Proceedings of the 2024 IEEE/ACM
First International Conference on AI Foundation Models and Software Engineering.
ACM, 2024. https://doi.org/10.1145/3650105.3652288.'
ieee: 'A. P. Shivarpatna Venkatesh, S. Sabu, A. M. Mir, S. Reis, and E. Bodden,
“The Emergence of Large Language Models in Static Analysis: A First Look through
Micro-Benchmarks,” 2024, doi: 10.1145/3650105.3652288.'
mla: 'Shivarpatna Venkatesh, Ashwin Prasad, et al. “The Emergence of Large Language
Models in Static Analysis: A First Look through Micro-Benchmarks.” Proceedings
of the 2024 IEEE/ACM First International Conference on AI Foundation Models and
Software Engineering, ACM, 2024, doi:10.1145/3650105.3652288.'
short: 'A.P. Shivarpatna Venkatesh, S. Sabu, A.M. Mir, S. Reis, E. Bodden, in: Proceedings
of the 2024 IEEE/ACM First International Conference on AI Foundation Models and
Software Engineering, ACM, 2024.'
date_created: 2024-08-05T09:12:59Z
date_updated: 2024-08-05T09:14:11Z
department:
- _id: '76'
doi: 10.1145/3650105.3652288
language:
- iso: eng
publication: Proceedings of the 2024 IEEE/ACM First International Conference on AI
Foundation Models and Software Engineering
publication_status: published
publisher: ACM
status: public
title: 'The Emergence of Large Language Models in Static Analysis: A First Look through
Micro-Benchmarks'
type: conference
user_id: '15249'
year: '2024'
...
---
_id: '59411'
abstract:
- lang: eng
text: As our lives, our businesses, and indeed our world economy become
increasingly reliant on the secure operation of many interconnected software systems,
the software engineering research community is faced with unprecedented research
challenges, but also with exciting new opportunities. In this roadmap paper, we
outline our vision of Software Security Analysis for the systems of the future.
Given the recent advances in generative AI, we need new methods to assess and
maximize the security of code co-written by machines. As our systems become increasingly
heterogeneous, we need practical approaches that work even if some functions are
automatically generated, e.g., by deep neural networks. As software systems depend
evermore on the software supply chain, we need tools that scale to an entire ecosystem.
What kind of vulnerabilities exist in future systems and how do we detect them?
When all the shallow bugs are found, how do we discover vulnerabilities hidden
deeply in the system? Assuming we cannot find all security flaws, how can we nevertheless
protect our system? To answer these questions, we start our roadmap with a survey
of recent advances in software security, then discuss open challenges and opportunities,
and conclude with a long-term perspective for the field.
author:
- first_name: Marcel
full_name: Böhme, Marcel
last_name: Böhme
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
- first_name: Tevfik
full_name: Bultan, Tevfik
last_name: Bultan
- first_name: Cristian
full_name: Cadar, Cristian
last_name: Cadar
- first_name: Yang
full_name: Liu, Yang
last_name: Liu
- first_name: Giuseppe
full_name: Scanniello, Giuseppe
last_name: Scanniello
citation:
ama: 'Böhme M, Bodden E, Bultan T, Cadar C, Liu Y, Scanniello G. Software Security
Analysis in 2030 and Beyond: A Research Roadmap. ACM Transactions on Software
Engineering and Methodology. Published online 2024. doi:10.1145/3708533'
apa: 'Böhme, M., Bodden, E., Bultan, T., Cadar, C., Liu, Y., & Scanniello, G.
(2024). Software Security Analysis in 2030 and Beyond: A Research Roadmap. ACM
Transactions on Software Engineering and Methodology. https://doi.org/10.1145/3708533'
bibtex: '@article{Böhme_Bodden_Bultan_Cadar_Liu_Scanniello_2024, title={Software
Security Analysis in 2030 and Beyond: A Research Roadmap}, DOI={10.1145/3708533},
journal={ACM Transactions on Software Engineering and Methodology}, publisher={Association
for Computing Machinery (ACM)}, author={Böhme, Marcel and Bodden, Eric and Bultan,
Tevfik and Cadar, Cristian and Liu, Yang and Scanniello, Giuseppe}, year={2024}
}'
chicago: 'Böhme, Marcel, Eric Bodden, Tevfik Bultan, Cristian Cadar, Yang Liu, and
Giuseppe Scanniello. “Software Security Analysis in 2030 and Beyond: A Research
Roadmap.” ACM Transactions on Software Engineering and Methodology, 2024.
https://doi.org/10.1145/3708533.'
ieee: 'M. Böhme, E. Bodden, T. Bultan, C. Cadar, Y. Liu, and G. Scanniello, “Software
Security Analysis in 2030 and Beyond: A Research Roadmap,” ACM Transactions
on Software Engineering and Methodology, 2024, doi: 10.1145/3708533.'
mla: 'Böhme, Marcel, et al. “Software Security Analysis in 2030 and Beyond: A Research
Roadmap.” ACM Transactions on Software Engineering and Methodology, Association
for Computing Machinery (ACM), 2024, doi:10.1145/3708533.'
short: M. Böhme, E. Bodden, T. Bultan, C. Cadar, Y. Liu, G. Scanniello, ACM Transactions
on Software Engineering and Methodology (2024).
date_created: 2025-04-07T10:04:48Z
date_updated: 2025-04-07T10:05:15Z
department:
- _id: '76'
doi: 10.1145/3708533
language:
- iso: eng
publication: ACM Transactions on Software Engineering and Methodology
publication_identifier:
issn:
- 1049-331X
- 1557-7392
publication_status: published
publisher: Association for Computing Machinery (ACM)
status: public
title: 'Software Security Analysis in 2030 and Beyond: A Research Roadmap'
type: journal_article
user_id: '15249'
year: '2024'
...
---
_id: '52235'
abstract:
- lang: eng
text: "Android applications collecting data from users must protect it according
to the current legal frameworks. Such data protection has become even more important
since the European Union rolled out the General Data Protection Regulation (GDPR).
Since app developers are not legal experts, they find it difficult to write privacy-aware
source code. Moreover, they have limited tool support to reason about data protection
throughout their app development process.\r\nThis paper motivates the need for
a static analysis approach to diagnose and explain data protection in Android
apps. The analysis will recognize personal data sources in the source code, and
aims to further examine the data flow originating from these sources. App developers
can then address key questions about data manipulation, derived data, and the
presence of technical measures. Despite challenges, we explore to what extent
one can realize this analysis through static taint analysis, a common method for
identifying security vulnerabilities. This is a first step towards designing a
tool-based approach that aids app developers and assessors in ensuring data protection
in Android apps, based on automated static program analysis. "
author:
- first_name: Mugdha
full_name: Khedkar, Mugdha
id: '88024'
last_name: Khedkar
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Khedkar M, Bodden E. Toward an Android Static Analysis Approach for Data Protection.
In: Proceedings of the IEEE/ACM 11th International Conference on Mobile Software
Engineering and Systems (MOBILESoft ’24). Association for Computing Machinery,
New York, NY, USA, 65–68. ; 2024. doi:10.1145/3647632.3651389'
apa: Khedkar, M., & Bodden, E. (2024). Toward an Android Static Analysis Approach
for Data Protection. Proceedings of the IEEE/ACM 11th International Conference
on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing
Machinery, New York, NY, USA, 65–68. 11th International Conference on Mobile
Software Engineering and Systems 2024, Lisbon, Portugal. https://doi.org/10.1145/3647632.3651389
bibtex: '@inproceedings{Khedkar_Bodden_2024, title={Toward an Android Static Analysis
Approach for Data Protection}, DOI={10.1145/3647632.3651389},
booktitle={Proceedings of the IEEE/ACM 11th International Conference on Mobile
Software Engineering and Systems (MOBILESoft ’24). Association for Computing Machinery,
New York, NY, USA, 65–68.}, author={Khedkar, Mugdha and Bodden, Eric}, year={2024}
}'
chicago: Khedkar, Mugdha, and Eric Bodden. “Toward an Android Static Analysis Approach
for Data Protection.” In Proceedings of the IEEE/ACM 11th International Conference
on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing
Machinery, New York, NY, USA, 65–68., 2024. https://doi.org/10.1145/3647632.3651389.
ieee: 'M. Khedkar and E. Bodden, “Toward an Android Static Analysis Approach for
Data Protection,” presented at the 11th International Conference on Mobile Software
Engineering and Systems 2024, Lisbon, Portugal, 2024, doi: 10.1145/3647632.3651389.'
mla: Khedkar, Mugdha, and Eric Bodden. “Toward an Android Static Analysis Approach
for Data Protection.” Proceedings of the IEEE/ACM 11th International Conference
on Mobile Software Engineering and Systems (MOBILESoft ’24). Association for Computing
Machinery, New York, NY, USA, 65–68., 2024, doi:10.1145/3647632.3651389.
short: 'M. Khedkar, E. Bodden, in: Proceedings of the IEEE/ACM 11th International
Conference on Mobile Software Engineering and Systems (MOBILESoft ’24). Association
for Computing Machinery, New York, NY, USA, 65–68., 2024.'
conference:
end_date: 2024-04-15
location: Lisbon, Portugal
name: 11th International Conference on Mobile Software Engineering and Systems 2024
start_date: 2024-04-14
date_created: 2024-03-03T14:37:53Z
date_updated: 2026-03-04T08:11:48Z
ddc:
- '006'
department:
- _id: '76'
doi: 10.1145/3647632.3651389
external_id:
arxiv:
- '2402.07889'
file:
- access_level: closed
content_type: application/pdf
creator: khedkarm
date_created: 2024-03-03T14:39:08Z
date_updated: 2024-03-03T14:39:08Z
file_id: '52236'
file_name: 2402.07889v1.pdf
file_size: 530812
relation: main_file
success: 1
file_date_updated: 2024-03-03T14:39:08Z
has_accepted_license: '1'
keyword:
- static program analysis
- data protection and privacy
- GDPR compliance
language:
- iso: eng
publication: Proceedings of the IEEE/ACM 11th International Conference on Mobile Software
Engineering and Systems (MOBILESoft '24). Association for Computing Machinery, New
York, NY, USA, 65–68.
status: public
title: Toward an Android Static Analysis Approach for Data Protection
type: conference
user_id: '88024'
year: '2024'
...
---
_id: '53942'
abstract:
- lang: eng
text: AbstractSince its inception two decades ago,
Soot has become one of the most widely used open-source static
analysis frameworks. Over time it has been extended with the contributions of
countless researchers. Yet, at the same time, the requirements for Soot
have changed over the years and become increasingly at odds with some of the major
design decisions that underlie it. In this work, we thus present SootUp,
a complete reimplementation of Soot that seeks to fulfill these
requirements with a novel design, while at the same time keeping elements that
Soot users have grown accustomed to.
author:
- first_name: Kadiray
full_name: Karakaya, Kadiray
id: '70410'
last_name: Karakaya
orcid: https://orcid.org/0000-0001-9266-2084
- first_name: Stefan
full_name: Schott, Stefan
id: '54847'
last_name: Schott
- first_name: Jonas
full_name: Klauke, Jonas
id: '40915'
last_name: Klauke
orcid: 0000-0001-9160-9636
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
- first_name: Markus
full_name: Schmidt, Markus
last_name: Schmidt
- first_name: Linghui
full_name: Luo, Linghui
last_name: Luo
- first_name: Dongjie
full_name: He, Dongjie
last_name: He
citation:
ama: 'Karakaya K, Schott S, Klauke J, et al. SootUp: A Redesign of the Soot Static
Analysis Framework. In: Tools and Algorithms for the Construction and Analysis
of Systems. Springer Nature Switzerland; 2024. doi:10.1007/978-3-031-57246-3_13'
apa: 'Karakaya, K., Schott, S., Klauke, J., Bodden, E., Schmidt, M., Luo, L., &
He, D. (2024). SootUp: A Redesign of the Soot Static Analysis Framework. In Tools
and Algorithms for the Construction and Analysis of Systems. Springer Nature
Switzerland. https://doi.org/10.1007/978-3-031-57246-3_13'
bibtex: '@inbook{Karakaya_Schott_Klauke_Bodden_Schmidt_Luo_He_2024, place={Cham},
title={SootUp: A Redesign of the Soot Static Analysis Framework}, DOI={10.1007/978-3-031-57246-3_13},
booktitle={Tools and Algorithms for the Construction and Analysis of Systems},
publisher={Springer Nature Switzerland}, author={Karakaya, Kadiray and Schott,
Stefan and Klauke, Jonas and Bodden, Eric and Schmidt, Markus and Luo, Linghui
and He, Dongjie}, year={2024} }'
chicago: 'Karakaya, Kadiray, Stefan Schott, Jonas Klauke, Eric Bodden, Markus Schmidt,
Linghui Luo, and Dongjie He. “SootUp: A Redesign of the Soot Static Analysis Framework.”
In Tools and Algorithms for the Construction and Analysis of Systems. Cham:
Springer Nature Switzerland, 2024. https://doi.org/10.1007/978-3-031-57246-3_13.'
ieee: 'K. Karakaya et al., “SootUp: A Redesign of the Soot Static Analysis
Framework,” in Tools and Algorithms for the Construction and Analysis of Systems,
Cham: Springer Nature Switzerland, 2024.'
mla: 'Karakaya, Kadiray, et al. “SootUp: A Redesign of the Soot Static Analysis
Framework.” Tools and Algorithms for the Construction and Analysis of Systems,
Springer Nature Switzerland, 2024, doi:10.1007/978-3-031-57246-3_13.'
short: 'K. Karakaya, S. Schott, J. Klauke, E. Bodden, M. Schmidt, L. Luo, D. He,
in: Tools and Algorithms for the Construction and Analysis of Systems, Springer
Nature Switzerland, Cham, 2024.'
date_created: 2024-05-06T11:29:36Z
date_updated: 2025-11-11T14:26:52Z
department:
- _id: '76'
doi: 10.1007/978-3-031-57246-3_13
language:
- iso: eng
place: Cham
project:
- _id: '107'
name: 'Reaktor: SFB 901 - Automatisierte Risikoanalyse in Bezug auf Open-Source-Abhängigkeiten
(Hektor) (Transferproject T3)'
- _id: '668'
name: 'HEKTOR: Automatisierte Risikoanalyse unter Berücksichtigung von Open-Source-Abhängigkeiten'
- _id: '1'
name: 'SFB 901: On-The-Fly Computing - Individualisierte IT-Dienstleistungen in
dynamischen Märkten'
- _id: '82'
name: 'SFB 901; Projektbereich T: Transferprojekte des Sonderforschungsbereichs'
- _id: '107'
name: 'SFB 901; TP T3: Automatisierte Risikoanalyse in Bezug auf Open-Source-Abhängigkeiten
(Hektor)'
publication: Tools and Algorithms for the Construction and Analysis of Systems
publication_identifier:
isbn:
- '9783031572456'
- '9783031572463'
issn:
- 0302-9743
- 1611-3349
publication_status: published
publisher: Springer Nature Switzerland
status: public
title: 'SootUp: A Redesign of the Soot Static Analysis Framework'
type: book_chapter
user_id: '477'
year: '2024'
...
---
_id: '57550'
author:
- first_name: Stefan
full_name: Schott, Stefan
id: '54847'
last_name: Schott
- first_name: Serena Elisa
full_name: Ponta, Serena Elisa
last_name: Ponta
- first_name: Wolfram
full_name: Fischer, Wolfram
last_name: Fischer
- first_name: Jonas
full_name: Klauke, Jonas
id: '40915'
last_name: Klauke
orcid: 0000-0001-9160-9636
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Schott S, Ponta SE, Fischer W, Klauke J, Bodden E. Java Bytecode Normalization
for Code Similarity Analysis. In: 38th European Conference on Object-Oriented
Programming (ECOOP 2024). ; 2024. doi:10.4230/LIPIcs.ECOOP.2024.37'
apa: Schott, S., Ponta, S. E., Fischer, W., Klauke, J., & Bodden, E. (2024).
Java Bytecode Normalization for Code Similarity Analysis. 38th European Conference
on Object-Oriented Programming (ECOOP 2024). 38th European Conference on Object-Oriented
Programming (ECOOP 2024), Vienna. https://doi.org/10.4230/LIPIcs.ECOOP.2024.37
bibtex: '@inproceedings{Schott_Ponta_Fischer_Klauke_Bodden_2024, title={Java Bytecode
Normalization for Code Similarity Analysis}, DOI={10.4230/LIPIcs.ECOOP.2024.37},
booktitle={38th European Conference on Object-Oriented Programming (ECOOP 2024)},
author={Schott, Stefan and Ponta, Serena Elisa and Fischer, Wolfram and Klauke,
Jonas and Bodden, Eric}, year={2024} }'
chicago: Schott, Stefan, Serena Elisa Ponta, Wolfram Fischer, Jonas Klauke, and
Eric Bodden. “Java Bytecode Normalization for Code Similarity Analysis.” In 38th
European Conference on Object-Oriented Programming (ECOOP 2024), 2024. https://doi.org/10.4230/LIPIcs.ECOOP.2024.37.
ieee: 'S. Schott, S. E. Ponta, W. Fischer, J. Klauke, and E. Bodden, “Java Bytecode
Normalization for Code Similarity Analysis,” presented at the 38th European Conference
on Object-Oriented Programming (ECOOP 2024), Vienna, 2024, doi: 10.4230/LIPIcs.ECOOP.2024.37.'
mla: Schott, Stefan, et al. “Java Bytecode Normalization for Code Similarity Analysis.”
38th European Conference on Object-Oriented Programming (ECOOP 2024), 2024,
doi:10.4230/LIPIcs.ECOOP.2024.37.
short: 'S. Schott, S.E. Ponta, W. Fischer, J. Klauke, E. Bodden, in: 38th European
Conference on Object-Oriented Programming (ECOOP 2024), 2024.'
conference:
location: Vienna
name: 38th European Conference on Object-Oriented Programming (ECOOP 2024)
date_created: 2024-12-03T08:15:07Z
date_updated: 2025-11-11T14:29:43Z
department:
- _id: '76'
doi: 10.4230/LIPIcs.ECOOP.2024.37
language:
- iso: eng
project:
- _id: '668'
name: 'HEKTOR: Automatisierte Risikoanalyse unter Berücksichtigung von Open-Source-Abhängigkeiten'
- _id: '107'
name: 'Reaktor: SFB 901 - Automatisierte Risikoanalyse in Bezug auf Open-Source-Abhängigkeiten
(Hektor) (Transferproject T3)'
- _id: '1'
name: 'SFB 901: On-The-Fly Computing - Individualisierte IT-Dienstleistungen in
dynamischen Märkten'
- _id: '82'
name: 'SFB 901; Projektbereich T: Transferprojekte des Sonderforschungsbereichs'
- _id: '107'
name: 'SFB 901; TP T3: Automatisierte Risikoanalyse in Bezug auf Open-Source-Abhängigkeiten
(Hektor)'
publication: 38th European Conference on Object-Oriented Programming (ECOOP 2024)
status: public
title: Java Bytecode Normalization for Code Similarity Analysis
type: conference
user_id: '477'
year: '2024'
...
---
_id: '58716'
author:
- first_name: Stefan
full_name: Schott, Stefan
id: '54847'
last_name: Schott
- first_name: Wolfram
full_name: Fischer, Wolfram
last_name: Fischer
- first_name: Serena Elisa
full_name: Ponta, Serena Elisa
last_name: Ponta
- first_name: Jonas
full_name: Klauke, Jonas
id: '40915'
last_name: Klauke
orcid: 0000-0001-9160-9636
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Schott S, Fischer W, Ponta SE, Klauke J, Bodden E. Compilation of Commit Changes
Within Java Source Code Repositories. In: 2024 IEEE International Conference
on Software Maintenance and Evolution (ICSME). IEEE; 2024. doi:10.1109/icsme58944.2024.00038'
apa: Schott, S., Fischer, W., Ponta, S. E., Klauke, J., & Bodden, E. (2024).
Compilation of Commit Changes Within Java Source Code Repositories. 2024 IEEE
International Conference on Software Maintenance and Evolution (ICSME). https://doi.org/10.1109/icsme58944.2024.00038
bibtex: '@inproceedings{Schott_Fischer_Ponta_Klauke_Bodden_2024, title={Compilation
of Commit Changes Within Java Source Code Repositories}, DOI={10.1109/icsme58944.2024.00038},
booktitle={2024 IEEE International Conference on Software Maintenance and Evolution
(ICSME)}, publisher={IEEE}, author={Schott, Stefan and Fischer, Wolfram and Ponta,
Serena Elisa and Klauke, Jonas and Bodden, Eric}, year={2024} }'
chicago: Schott, Stefan, Wolfram Fischer, Serena Elisa Ponta, Jonas Klauke, and
Eric Bodden. “Compilation of Commit Changes Within Java Source Code Repositories.”
In 2024 IEEE International Conference on Software Maintenance and Evolution
(ICSME). IEEE, 2024. https://doi.org/10.1109/icsme58944.2024.00038.
ieee: 'S. Schott, W. Fischer, S. E. Ponta, J. Klauke, and E. Bodden, “Compilation
of Commit Changes Within Java Source Code Repositories,” 2024, doi: 10.1109/icsme58944.2024.00038.'
mla: Schott, Stefan, et al. “Compilation of Commit Changes Within Java Source Code
Repositories.” 2024 IEEE International Conference on Software Maintenance and
Evolution (ICSME), IEEE, 2024, doi:10.1109/icsme58944.2024.00038.
short: 'S. Schott, W. Fischer, S.E. Ponta, J. Klauke, E. Bodden, in: 2024 IEEE International
Conference on Software Maintenance and Evolution (ICSME), IEEE, 2024.'
date_created: 2025-02-19T15:47:18Z
date_updated: 2025-11-11T15:01:44Z
department:
- _id: '76'
doi: 10.1109/icsme58944.2024.00038
language:
- iso: eng
project:
- _id: '1072'
name: 'SFB 901; TP T5: Zuverlässige und automatisierte codebasierte Analyse von
Open-Source-Abhängigkeiten (Reaktor)'
publication: 2024 IEEE International Conference on Software Maintenance and Evolution
(ICSME)
publication_status: published
publisher: IEEE
status: public
title: Compilation of Commit Changes Within Java Source Code Repositories
type: conference
user_id: '54847'
year: '2024'
...
---
_id: '56863'
author:
- first_name: Fabian Benedikt
full_name: Schiebel, Fabian Benedikt
id: '55745'
last_name: Schiebel
orcid: 0009-0008-6867-9802
- first_name: Florian
full_name: Sattler, Florian
last_name: Sattler
- first_name: Philipp Dominik
full_name: Schubert, Philipp Dominik
last_name: Schubert
- first_name: Sven
full_name: Apel, Sven
last_name: Apel
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Schiebel FB, Sattler F, Schubert PD, Apel S, Bodden E. Scaling Interprocedural
Static Data-Flow Analysis to Large C/C++ Applications: An Experience Report. In:
Aldrich J, Salvaneschi G, eds. 38th European Conference on Object-Oriented
Programming (ECOOP 2024). Vol 313. Leibniz International Proceedings in Informatics
(LIPIcs). Schloss Dagstuhl – Leibniz-Zentrum für Informatik; 2024:36:1–36:28.
doi:10.4230/LIPIcs.ECOOP.2024.36'
apa: 'Schiebel, F. B., Sattler, F., Schubert, P. D., Apel, S., & Bodden, E.
(2024). Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications:
An Experience Report. In J. Aldrich & G. Salvaneschi (Eds.), 38th European
Conference on Object-Oriented Programming (ECOOP 2024) (Vol. 313, p. 36:1–36:28).
Schloss Dagstuhl – Leibniz-Zentrum für Informatik. https://doi.org/10.4230/LIPIcs.ECOOP.2024.36'
bibtex: '@inproceedings{Schiebel_Sattler_Schubert_Apel_Bodden_2024, place={Dagstuhl,
Germany}, series={Leibniz International Proceedings in Informatics (LIPIcs)},
title={Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications:
An Experience Report}, volume={313}, DOI={10.4230/LIPIcs.ECOOP.2024.36},
booktitle={38th European Conference on Object-Oriented Programming (ECOOP 2024)},
publisher={Schloss Dagstuhl – Leibniz-Zentrum für Informatik}, author={Schiebel,
Fabian Benedikt and Sattler, Florian and Schubert, Philipp Dominik and Apel, Sven
and Bodden, Eric}, editor={Aldrich, Jonathan and Salvaneschi, Guido}, year={2024},
pages={36:1–36:28}, collection={Leibniz International Proceedings in Informatics
(LIPIcs)} }'
chicago: 'Schiebel, Fabian Benedikt, Florian Sattler, Philipp Dominik Schubert,
Sven Apel, and Eric Bodden. “Scaling Interprocedural Static Data-Flow Analysis
to Large C/C++ Applications: An Experience Report.” In 38th European Conference
on Object-Oriented Programming (ECOOP 2024), edited by Jonathan Aldrich and
Guido Salvaneschi, 313:36:1–36:28. Leibniz International Proceedings in Informatics
(LIPIcs). Dagstuhl, Germany: Schloss Dagstuhl – Leibniz-Zentrum für Informatik,
2024. https://doi.org/10.4230/LIPIcs.ECOOP.2024.36.'
ieee: 'F. B. Schiebel, F. Sattler, P. D. Schubert, S. Apel, and E. Bodden, “Scaling
Interprocedural Static Data-Flow Analysis to Large C/C++ Applications: An Experience
Report,” in 38th European Conference on Object-Oriented Programming (ECOOP
2024), 2024, vol. 313, p. 36:1–36:28, doi: 10.4230/LIPIcs.ECOOP.2024.36.'
mla: 'Schiebel, Fabian Benedikt, et al. “Scaling Interprocedural Static Data-Flow
Analysis to Large C/C++ Applications: An Experience Report.” 38th European
Conference on Object-Oriented Programming (ECOOP 2024), edited by Jonathan
Aldrich and Guido Salvaneschi, vol. 313, Schloss Dagstuhl – Leibniz-Zentrum für
Informatik, 2024, p. 36:1–36:28, doi:10.4230/LIPIcs.ECOOP.2024.36.'
short: 'F.B. Schiebel, F. Sattler, P.D. Schubert, S. Apel, E. Bodden, in: J. Aldrich,
G. Salvaneschi (Eds.), 38th European Conference on Object-Oriented Programming
(ECOOP 2024), Schloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl, Germany,
2024, p. 36:1–36:28.'
date_created: 2024-11-04T13:37:23Z
date_updated: 2025-12-04T10:41:59Z
department:
- _id: '76'
- _id: '662'
doi: 10.4230/LIPIcs.ECOOP.2024.36
editor:
- first_name: Jonathan
full_name: Aldrich, Jonathan
last_name: Aldrich
- first_name: Guido
full_name: Salvaneschi, Guido
last_name: Salvaneschi
intvolume: ' 313'
language:
- iso: eng
page: 36:1–36:28
place: Dagstuhl, Germany
publication: 38th European Conference on Object-Oriented Programming (ECOOP 2024)
publication_identifier:
isbn:
- 978-3-95977-341-6
issn:
- 1868-8969
publisher: Schloss Dagstuhl – Leibniz-Zentrum für Informatik
series_title: Leibniz International Proceedings in Informatics (LIPIcs)
status: public
title: 'Scaling Interprocedural Static Data-Flow Analysis to Large C/C++ Applications:
An Experience Report'
type: conference
user_id: '15249'
volume: 313
year: '2024'
...
---
_id: '56137'
abstract:
- lang: eng
text: "Many Android applications collect data from users. The European Union's General
Data Protection Regulation (GDPR) requires vendors to faithfully disclose which
data their apps collect. This task is complicated because many apps use third-party
code for which the same information is not readily available. Hence we ask: how
accurately do current Android apps fulfill these requirements?\r\nIn this work,
we first expose a multi-layered definition of privacy-related data to correctly
report data collection in Android apps. We further create a dataset of privacy-sensitive
data classes that may be used as input by an Android app. This dataset takes into
account data collected both through the user interface and system APIs.\r\nWe
manually examine the data safety sections of 70 Android apps to observe how data
collection is reported, identifying instances of over- and under-reporting. Additionally,
we develop a prototype to statically extract and label privacy-related data collected
via app source code, user interfaces, and permissions. Comparing the prototype's
results with the data safety sections of 20 apps reveals reporting discrepancies.
Using the results from two Messaging and Social Media apps (Signal and Instagram),
we discuss how app developers under-report and over-report data collection, respectively,
and identify inaccurately reported data categories.\r\nOur results show that app
developers struggle to accurately report data collection, either due to Google's
abstract definition of collected data or insufficient existing tool support. "
author:
- first_name: Mugdha
full_name: Khedkar, Mugdha
id: '88024'
last_name: Khedkar
- first_name: Ambuj Kumar
full_name: Mondal, Ambuj Kumar
last_name: Mondal
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Khedkar M, Mondal AK, Bodden E. Do Android App Developers Accurately Report
Collection of Privacy-Related Data? In: In Proceedings of the 39th IEEE/ACM
International Conference on Automated Software Engineering Workshops (ASEW ’24).
; 2024. doi:10.1145/3691621.3694949'
apa: Khedkar, M., Mondal, A. K., & Bodden, E. (2024). Do Android App Developers
Accurately Report Collection of Privacy-Related Data? In Proceedings of the
39th IEEE/ACM International Conference on Automated Software Engineering Workshops
(ASEW ’24). 39th IEEE/ACM International Conference on Automated Software Engineering
(ASE 2024), Sacramento, California. https://doi.org/10.1145/3691621.3694949
bibtex: '@inproceedings{Khedkar_Mondal_Bodden_2024, title={Do Android App Developers
Accurately Report Collection of Privacy-Related Data?}, DOI={10.1145/3691621.3694949},
booktitle={In Proceedings of the 39th IEEE/ACM International Conference on Automated
Software Engineering Workshops (ASEW ’24)}, author={Khedkar, Mugdha and Mondal,
Ambuj Kumar and Bodden, Eric}, year={2024} }'
chicago: Khedkar, Mugdha, Ambuj Kumar Mondal, and Eric Bodden. “Do Android App Developers
Accurately Report Collection of Privacy-Related Data?” In In Proceedings of
the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops
(ASEW ’24), 2024. https://doi.org/10.1145/3691621.3694949.
ieee: 'M. Khedkar, A. K. Mondal, and E. Bodden, “Do Android App Developers Accurately
Report Collection of Privacy-Related Data?,” presented at the 39th IEEE/ACM International
Conference on Automated Software Engineering (ASE 2024), Sacramento, California,
2024, doi: 10.1145/3691621.3694949.'
mla: Khedkar, Mugdha, et al. “Do Android App Developers Accurately Report Collection
of Privacy-Related Data?” In Proceedings of the 39th IEEE/ACM International
Conference on Automated Software Engineering Workshops (ASEW ’24), 2024, doi:10.1145/3691621.3694949.
short: 'M. Khedkar, A.K. Mondal, E. Bodden, in: In Proceedings of the 39th IEEE/ACM
International Conference on Automated Software Engineering Workshops (ASEW ’24),
2024.'
conference:
end_date: 2024-11-01
location: Sacramento, California
name: 39th IEEE/ACM International Conference on Automated Software Engineering (ASE
2024)
start_date: 2024-10-27
date_created: 2024-09-16T08:50:54Z
date_updated: 2024-11-18T13:19:51Z
ddc:
- '000'
department:
- _id: '76'
doi: 10.1145/3691621.3694949
external_id:
arxiv:
- '2409.04167'
file:
- access_level: closed
content_type: application/pdf
creator: khedkarm
date_created: 2024-09-16T08:49:42Z
date_updated: 2024-09-16T08:49:42Z
file_id: '56138'
file_name: 2409.04167v1.pdf
file_size: 1270058
relation: main_file
success: 1
file_date_updated: 2024-09-16T08:49:42Z
has_accepted_license: '1'
language:
- iso: eng
publication: In Proceedings of the 39th IEEE/ACM International Conference on Automated
Software Engineering Workshops (ASEW ’24)
status: public
title: Do Android App Developers Accurately Report Collection of Privacy-Related Data?
type: conference
user_id: '88024'
year: '2024'
...
---
_id: '57416'
abstract:
- lang: eng
text: "The increased complexity of modern software has led to much more\r\nsophisticated
attack vectors. As a result, we require newer vulnerability detection\r\nmethods
to ensure software security without compromising efficiency.\r\nThe Code Property
Graph (CPG) is a program representation that provides a comprehensive overview
of program behavior, combining abstract syntax trees, control flow\r\ngraphs,
and program dependence graphs. With such a detailed data structure, we can\r\ndetect
patterns that characterize known vulnerabilities and identify various security\r\nthreats.
Querying the combined data structure instead of the individual graphs enables
the detection of multidimensional scenarios.\r\nThis work aims to integrate the
advantages of CPGs into software systems that utilize\r\nthe Jimple intermediate
representation. We introduce JimNode, a novel approach for\r\ngenerating CPGs
specifically tailored to Jimple. Despite the model incompatibility, our\r\nevaluation,
which covered approximately 50,800 methods, reveals an 88.07% similarity\r\nof
the inter-statement edges compared to Joern, the state-of-the-art tool for CPG\r\ngeneration.
We provide a detailed analysis of our methodology and discuss why it is\r\nbetter
suited for Jimple programs than Joern’s language-agnostic approach."
author:
- first_name: Michael Hany Fawzy
full_name: Youkeim, Michael Hany Fawzy
id: '77394'
last_name: Youkeim
citation:
ama: Youkeim MHF. Tailoring Code Property Graphs to Jimple. Paderborn University;
2024.
apa: Youkeim, M. H. F. (2024). Tailoring Code Property Graphs to Jimple.
Paderborn University.
bibtex: '@book{Youkeim_2024, place={Paderborn}, title={Tailoring Code Property Graphs
to Jimple}, publisher={Paderborn University}, author={Youkeim, Michael Hany Fawzy},
year={2024} }'
chicago: 'Youkeim, Michael Hany Fawzy. Tailoring Code Property Graphs to Jimple.
Paderborn: Paderborn University, 2024.'
ieee: 'M. H. F. Youkeim, Tailoring Code Property Graphs to Jimple. Paderborn:
Paderborn University, 2024.'
mla: Youkeim, Michael Hany Fawzy. Tailoring Code Property Graphs to Jimple.
Paderborn University, 2024.
short: M.H.F. Youkeim, Tailoring Code Property Graphs to Jimple, Paderborn University,
Paderborn, 2024.
date_created: 2024-11-26T09:13:02Z
date_updated: 2024-11-27T01:16:38Z
ddc:
- '000'
department:
- _id: '76'
file:
- access_level: open_access
content_type: application/pdf
creator: myoukeim
date_created: 2024-11-27T01:16:06Z
date_updated: 2024-11-27T01:16:06Z
file_id: '57444'
file_name: Bachelor_Thesis__Michael_Youkeim_unsigned.pdf
file_size: 432800
relation: main_file
file_date_updated: 2024-11-27T01:16:06Z
has_accepted_license: '1'
language:
- iso: eng
oa: '1'
place: Paderborn
publisher: Paderborn University
status: public
supervisor:
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
title: Tailoring Code Property Graphs to Jimple
type: bachelorsthesis
user_id: '77394'
year: '2024'
...
---
_id: '56140'
abstract:
- lang: eng
text: " Android apps collecting data from users must comply with legal frameworks
to ensure data protection. This requirement has become even more important since
the implementation of the General Data Protection Regulation (GDPR) by the European
Union in 2018. Moreover, with the proposed Cyber Resilience Act on the horizon,
stakeholders will soon need to assess software against even more stringent security
and privacy standards. Effective privacy assessments require collaboration among
groups with diverse expertise to function effectively as a cohesive unit.\r\n
\ This paper motivates the need for an automated approach that enhances understanding
of data protection in Android apps and improves communication between the various
parties involved in privacy assessments. We propose the Assessor View, a tool
designed to bridge the knowledge gap between these parties, facilitating more
effective privacy assessments of Android applications. "
author:
- first_name: Mugdha
full_name: Khedkar, Mugdha
id: '88024'
last_name: Khedkar
- first_name: Michael
full_name: Schlichtig, Michael
id: '32312'
last_name: Schlichtig
orcid: 0000-0001-6600-6171
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
citation:
ama: 'Khedkar M, Schlichtig M, Bodden E. Advancing Android Privacy Assessments with
Automation. In: In Proceedings of the 39th IEEE/ACM International Conference
on Automated Software Engineering Workshops (ASEW ’24). ; 2024. doi:10.1145/3691621.3694953'
apa: Khedkar, M., Schlichtig, M., & Bodden, E. (2024). Advancing Android Privacy
Assessments with Automation. In Proceedings of the 39th IEEE/ACM International
Conference on Automated Software Engineering Workshops (ASEW ’24). 39th IEEE/ACM
International Conference on Automated Software Engineering (ASE 2024), Sacramento,
California. https://doi.org/10.1145/3691621.3694953
bibtex: '@inproceedings{Khedkar_Schlichtig_Bodden_2024, title={Advancing Android
Privacy Assessments with Automation}, DOI={10.1145/3691621.3694953},
booktitle={In Proceedings of the 39th IEEE/ACM International Conference on Automated
Software Engineering Workshops (ASEW ’24)}, author={Khedkar, Mugdha and Schlichtig,
Michael and Bodden, Eric}, year={2024} }'
chicago: Khedkar, Mugdha, Michael Schlichtig, and Eric Bodden. “Advancing Android
Privacy Assessments with Automation.” In In Proceedings of the 39th IEEE/ACM
International Conference on Automated Software Engineering Workshops (ASEW ’24),
2024. https://doi.org/10.1145/3691621.3694953.
ieee: 'M. Khedkar, M. Schlichtig, and E. Bodden, “Advancing Android Privacy Assessments
with Automation,” presented at the 39th IEEE/ACM International Conference on Automated
Software Engineering (ASE 2024), Sacramento, California, 2024, doi: 10.1145/3691621.3694953.'
mla: Khedkar, Mugdha, et al. “Advancing Android Privacy Assessments with Automation.”
In Proceedings of the 39th IEEE/ACM International Conference on Automated Software
Engineering Workshops (ASEW ’24), 2024, doi:10.1145/3691621.3694953.
short: 'M. Khedkar, M. Schlichtig, E. Bodden, in: In Proceedings of the 39th IEEE/ACM
International Conference on Automated Software Engineering Workshops (ASEW ’24),
2024.'
conference:
end_date: 2024-11-01
location: Sacramento, California
name: 39th IEEE/ACM International Conference on Automated Software Engineering (ASE
2024)
start_date: 2024-10-27
date_created: 2024-09-16T08:55:34Z
date_updated: 2026-03-13T12:12:45Z
ddc:
- '000'
department:
- _id: '76'
doi: 10.1145/3691621.3694953
external_id:
arxiv:
- '2409.06564'
file:
- access_level: closed
content_type: application/pdf
creator: khedkarm
date_created: 2024-09-16T08:55:23Z
date_updated: 2024-09-16T08:55:23Z
file_id: '56141'
file_name: 2409.06564v1.pdf
file_size: 1207856
relation: main_file
success: 1
file_date_updated: 2024-09-16T08:55:23Z
has_accepted_license: '1'
language:
- iso: eng
publication: In Proceedings of the 39th IEEE/ACM International Conference on Automated
Software Engineering Workshops (ASEW ’24)
status: public
title: Advancing Android Privacy Assessments with Automation
type: conference
user_id: '32312'
year: '2024'
...
---
_id: '52587'
author:
- first_name: Eric
full_name: Bodden, Eric
id: '59256'
last_name: Bodden
orcid: 0000-0003-3470-3647
- first_name: Jens
full_name: Pottebaum, Jens
id: '405'
last_name: Pottebaum
orcid: http://orcid.org/0000-0001-8778-2989
- first_name: Markus
full_name: Fockel, Markus
id: '8472'
last_name: Fockel
orcid: 0000-0002-1269-0702
- first_name: Iris
full_name: Gräßler, Iris
id: '47565'
last_name: Gräßler
orcid: 0000-0001-5765-971X
citation:
ama: Bodden E, Pottebaum J, Fockel M, Gräßler I. Evaluating Security Through Isolation
and Defense in Depth. IEEE Security & Privacy. 2024;22(1):69-72. doi:10.1109/msec.2023.3336028
apa: Bodden, E., Pottebaum, J., Fockel, M., & Gräßler, I. (2024). Evaluating
Security Through Isolation and Defense in Depth. IEEE Security & Privacy,
22(1), 69–72. https://doi.org/10.1109/msec.2023.3336028
bibtex: '@article{Bodden_Pottebaum_Fockel_Gräßler_2024, title={Evaluating Security
Through Isolation and Defense in Depth}, volume={22}, DOI={10.1109/msec.2023.3336028},
number={1}, journal={IEEE Security & Privacy}, publisher={Institute of Electrical
and Electronics Engineers (IEEE)}, author={Bodden, Eric and Pottebaum, Jens and
Fockel, Markus and Gräßler, Iris}, year={2024}, pages={69–72} }'
chicago: 'Bodden, Eric, Jens Pottebaum, Markus Fockel, and Iris Gräßler. “Evaluating
Security Through Isolation and Defense in Depth.” IEEE Security & Privacy
22, no. 1 (2024): 69–72. https://doi.org/10.1109/msec.2023.3336028.'
ieee: 'E. Bodden, J. Pottebaum, M. Fockel, and I. Gräßler, “Evaluating Security
Through Isolation and Defense in Depth,” IEEE Security & Privacy, vol.
22, no. 1, pp. 69–72, 2024, doi: 10.1109/msec.2023.3336028.'
mla: Bodden, Eric, et al. “Evaluating Security Through Isolation and Defense in
Depth.” IEEE Security & Privacy, vol. 22, no. 1, Institute of Electrical
and Electronics Engineers (IEEE), 2024, pp. 69–72, doi:10.1109/msec.2023.3336028.
short: E. Bodden, J. Pottebaum, M. Fockel, I. Gräßler, IEEE Security & Privacy
22 (2024) 69–72.
date_created: 2024-03-15T20:16:18Z
date_updated: 2026-03-31T02:19:49Z
department:
- _id: '152'
- _id: '76'
- _id: '662'
doi: 10.1109/msec.2023.3336028
intvolume: ' 22'
issue: '1'
keyword:
- Law
- Electrical and Electronic Engineering
- Computer Networks and Communications
language:
- iso: eng
main_file_link:
- url: https://ieeexplore.ieee.org/document/10411721
page: 69-72
publication: IEEE Security & Privacy
publication_identifier:
issn:
- 1540-7993
- 1558-4046
publication_status: published
publisher: Institute of Electrical and Electronics Engineers (IEEE)
quality_controlled: '1'
status: public
title: Evaluating Security Through Isolation and Defense in Depth
type: journal_article
user_id: '405'
volume: 22
year: '2024'
...