The assessment of information flows is an essential part of analyzing Android apps, and is frequently supported by static taint analysis. Its precision, however, can suffer from the analysis not being able to precisely determine what elements a pointer can (and cannot) point to. Recent advances in static analysis suggest ...

This short paper presents a static analysis for the novel challenge of analyzing Java modules. Since modules have only been recently introduced with Java 9, we point out the impact of modules both from the security and the static code analysis perspective. In particular, we introduce a static analysis that allows developers ...

Dieser Vortrag wurde auf der 35. IEEE/ACM International Conference on Automated Software Engineering (ASE) präsentiert. Unsicher konfigurierte Geräte stellen ein großes Sicherheitsproblem dar. Eine Möglichkeit, dieses Problem zu lösen, sind öffentlich verfügbare und standartisierte Sicherheitskonfigurationsrichtlinien. ...

The article "On the feasibility of automated prediction of bug and non-bug issues" published in Empirical Software Engineering in 2020 considers the application of machine learning for the automated classification of issue types, e.g., for research purposes or as a recommendation system. Issue tracking systems are used ...

To assess the behavior of a program, one needs to understand its inputs---their sources, their structure, and how they lead to individual behavior. But as syntax and semantics of inputs are almost never completely specified, humans and computers constantly have to figure out how to produce a particular behavior. In this ...