Publications

Abstract

This artifact contains our prototype for incremental construction of artifact version-aware call graphs (avaCGs) of JVM libraries hosted on Maven Central. Alongside we provide all data used in the evaluation of our publication ävaCGs: Version-Aware Call Graphs for Efficient Version-Range Queries", which has been accepted for publication at the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) 2026 in Oakland.All relevant directories contain a separate README file describing the steps necessary to reproduce our findings. In case of acceptance, we will update this entry to reflect the actual publication authors.

Abstract

This is the official release of the MAven Research INterface (MARIN) v2.0.0. Major new features include: Whole-Library analysis, which invokes an analysis callback for entire libraries Iterator implementations that provide the same information enrichment functionalities as analyses, but do not require users to inherit from an abstract base class Redesign of CLI parameter names and syntax, shorthand names for each parameter Configuration Builders to programmatically build MARIN configuration objects Basic support for semantic versioning Built-In utilities to obtain OPAL project instances for an artifact's JAR file Replace Akka (licensing restrictions) with Apache Pekko Update OPAL dependency to 7.0.0 You can include this release in your Maven project by adding the following dependency: eu.sse-labs marin 2.0.0

Abstract

This artifact holds a pipeline that captures a dynamic callgraph for a JVM program and a given set of inputs (input corpus). This dynamic callgraph can then be used as a baseline to compute precision and recall of a defined set of static callgraphs. To achieve a good quality of the dynamic baseline, the pipeline provides different techniques for creating a suitable input corpus. These are: Base Seed Corpus: Pre-existing input corpora found online, without any modification Seed Corpus: Manual additions to the Base Seed Corpus derived from inspecting the coverage values. Fuzzing: A coverage-guided fuzzer (Jazzer) generates program inputs from scratch Fuzzing Seed: Jazzer generates new inputs using the Seed Corpus as a starting point. This is the combination of all aforementioned techniques, which we found to be best suited for good quality dynamic callgraphs. The pipeline evaluates precision and recall for the following fixed set of static callgraphs: OPAL: CHA, RTA, 0-CFA WALA: CHA, RTA, 0-CFA Soot: CHA Doop: 0-CFA Numerical values for precision and recall are computed for every static callgraph and every project. We further include scripts that visualize those values for our set of four programs. The artifact consists of three archives: total_recall_paper_supplementary.zip: Holds supplementary material for our paper, including proofs for bounds to precision and recall, as well as additional visualizations. total_recall_artifact.zip: Holds the implementation of our pipeline and most of the data generated for our evaluation. A detailed description on how to use this artifact can be found in the enclosed README.md file. total_recall_artifact_supplementary.zip: Holds supplementary data for our artifact. This may be helpful if you do not have access to the computing resources required to compute static callgraphs. Installation instructions can be found in the enclosed README.md file.

Abstract

Due to the lack of established real-world benchmark suites for static taint analyses of Android applications, evaluations of these analyses are often restricted and hard to compare. Even in evaluations that do use real-world apps, details about the ground truth in those apps are rarely documented, which makes it difficult to compare and reproduce the results. To push Android taint analysis research forward, this paper thus recommends criteria for constructing real-world benchmark suites for this specific domain, and presents TaintBench, the first real-world malware benchmark suite with documented taint flows. TaintBench benchmark apps include taint flows with complex structures, and addresses static challenges that are commonly agreed on by the community. Together with the TaintBench suite, we introduce the TaintBench framework, whose goal is to simplify real-world benchmarking of Android taint analyses. First, a usability test shows that the framework improves experts' performance and perceived usability when documenting and inspecting taint flows. Second, experiments using TaintBench reveal new insights for the taint analysis tools Amandroid and FlowDroid: (i) They are less effective on real-world malware apps than on synthetic benchmark apps. (ii) Predefined lists of sources and sinks heavily impact the tools' accuracy. (iii) Surprisingly, up-to-date versions of both tools are less accurate than their predecessors.

Abstract

We have to face a simple, yet, disturbing fact: current computing is inherently insecure. The systems we develop and maintain have outgrown our capacity to prove them secure in every instance. Moreover, we became increasingly dependent on these systems. From small firmware running in cars and household appliances to smart phones and large-scale banking systems, software systems permeate our every day life. We rely on the safety and security of these systems, yet, we encounter threats to these properties every day. Therefore, systems have be secure by construction and not by maintenance. The principles to achieve this are well known. The Principle of Least Privilege has been published in 1975, yet, software systems do not generally apply it. We argue that new, lightweight methods based on sound theory have to be put forward so that developers can efficiently check that their software is secure in their domain context. In this thesis, we present three analysis techniques that help programmers develop more secure software by informing them about the current state of unsafe operation usage, extensive capability use in third-party components, and suspicious dead software paths that point to programming errors that could lead to insecurity. These three analyses inspect the full stack of a Java program from the application code over library and base-library code down to the native code level. If programmers use the information provided by the analyses, they are able to reduce the attack surface of their applications and provide more safe and secure systems to their users. Furthermore, we contribute two concepts for automated isolation. While the first concept reduces the attack surface by slicing third-party components to their necessary parts, the second concept is more fundamental and aims at achieving a fine-grained privilege separation. We believe that the software engineering discipline needs more research on these language-based approaches that tackle the problem of software security at its root cause: defective implementation. Using formal methods to construct these tools is necessary, yet, software developers cannot be overburdened with new requirements to their work process. Automated tools need to derive security properties from program code by them- selves with as little input required from the programmer as possible. By these means software can be developed reliably secure in an efficient fashion.