@inproceedings{66614,
  abstract     = {{Modern software development reuses code by importing libraries as dependencies. Software projects typically include an average of 36 dependencies, with 80% being transitive, meaning they are dependencies of dependencies. Recent research indicates that only 24.9% of these dependencies are required at runtime, and even within those, many program constructs remain unused, adding unnecessary code to the project. This has led to the development of debloating tools that remove unnecessary dependencies and program constructs while balancing precision by eliminating unused constructs and soundness by preserving all required constructs. To systematically evaluate this trade-off, we developed Deblometer, a micro-benchmark consisting of 59 test cases designed to assess support for various Java language features in debloating tools. Each test case includes a manually curated ground truth specifying necessary and bloated classes, methods, and fields, enabling precise measurement of soundness and precision. Using Deblometer, we evaluated three popular Java debloating tools: Deptrim, JShrink, and ProGuard. Our evaluation reveals that all tools remove required program constructs, which results in changed semantics or execution crashes. In particular, the dynamic class loading feature introduces unsoundness in all evaluated tools. Our comparison shows that Deptrim retains more bloated constructs, while ProGuard removes more required constructs. JShrink’s soundness is significantly affected by limited support for annotations, which leads to corrupted debloated artifacts. These soundness issues highlight the need to improve debloating tools to ensure stable and reliable debloated software.}},
  author       = {{Klauke, Jonas and Ohlmer, Tom and Schott, Stefan and Ponta, Serena Elisa and Fischer, Wolfram and Bodden, Eric}},
  booktitle    = {{Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses}},
  location     = {{Taipei}},
  publisher    = {{ACM}},
  title        = {{{A Soundness and Precision Benchmark for Java Debloating Tools}}},
  doi          = {{10.1145/3733827.3765530}},
  year         = {{2026}},
}

@inbook{53942,
  abstract     = {{<jats:title>Abstract</jats:title><jats:p>Since its inception two decades ago, <jats:sc>Soot</jats:sc> has become one of the most widely used open-source static analysis frameworks. Over time it has been extended with the contributions of countless researchers. Yet, at the same time, the requirements for <jats:sc>Soot</jats:sc> have changed over the years and become increasingly at odds with some of the major design decisions that underlie it. In this work, we thus present <jats:sc>SootUp</jats:sc>, a complete reimplementation of <jats:sc>Soot</jats:sc> that seeks to fulfill these requirements with a novel design, while at the same time keeping elements that <jats:sc>Soot</jats:sc> users have grown accustomed to.</jats:p>}},
  author       = {{Karakaya, Kadiray and Schott, Stefan and Klauke, Jonas and Bodden, Eric and Schmidt, Markus and Luo, Linghui and He, Dongjie}},
  booktitle    = {{Tools and Algorithms for the Construction and Analysis of Systems}},
  isbn         = {{9783031572456}},
  issn         = {{0302-9743}},
  publisher    = {{Springer Nature Switzerland}},
  title        = {{{SootUp: A Redesign of the Soot Static Analysis Framework}}},
  doi          = {{10.1007/978-3-031-57246-3_13}},
  year         = {{2024}},
}

@inproceedings{57550,
  author       = {{Schott, Stefan and Ponta, Serena Elisa and Fischer, Wolfram and Klauke, Jonas and Bodden, Eric}},
  booktitle    = {{38th European Conference on Object-Oriented Programming (ECOOP 2024)}},
  location     = {{Vienna}},
  title        = {{{Java Bytecode Normalization for Code Similarity Analysis}}},
  doi          = {{10.4230/LIPIcs.ECOOP.2024.37}},
  year         = {{2024}},
}

@inproceedings{58716,
  author       = {{Schott, Stefan and Fischer, Wolfram and Ponta, Serena Elisa and Klauke, Jonas and Bodden, Eric}},
  booktitle    = {{2024 IEEE International Conference on Software Maintenance and Evolution (ICSME)}},
  publisher    = {{IEEE}},
  title        = {{{Compilation of Commit Changes Within Java Source Code Repositories}}},
  doi          = {{10.1109/icsme58944.2024.00038}},
  year         = {{2024}},
}

@inproceedings{35426,
  author       = {{Richter, Cedric and Haltermann, Jan Frederik and Jakobs, Marie-Christine and Pauck, Felix and Schott, Stefan and Wehrheim, Heike}},
  booktitle    = {{37th IEEE/ACM International Conference on Automated Software Engineering}},
  publisher    = {{ACM}},
  title        = {{{Are Neural Bug Detectors Comparable to Software Developers on Variable Misuse Bugs?}}},
  doi          = {{10.1145/3551349.3561156}},
  year         = {{2023}},
}

@inproceedings{36848,
  author       = {{Schott, Stefan and Pauck, Felix}},
  booktitle    = {{2022 IEEE 22nd International Working Conference on Source Code Analysis and Manipulation (SCAM)}},
  publisher    = {{IEEE}},
  title        = {{{Benchmark Fuzzing for Android Taint Analyses}}},
  doi          = {{10.1109/scam55253.2022.00007}},
  year         = {{2023}},
}

@misc{22304,
  author       = {{Schott, Stefan}},
  title        = {{{Android App Analysis Benchmark Case Generation}}},
  year         = {{2021}},
}