The behavior of software that uses the Java Reflection API is fundamentally hard to predict
by analyzing code. Only recent static analysis approaches can resolve reflection under …

Today's smartphones are a ubiquitous source of private and confidential data. At the same
time, smartphone users are plagued by carelessly programmed apps that leak important …

You can write a compiler pass extending Soot, as either a BodyTransformer, for a
intraprocedural analysis; or SceneTransformer, for a whole-program analysis. You choose …

How do we know a program does what it claims to do? After clustering Android apps by their
description topics, we identify outliers in each cluster with respect to their API usage. A" …

Many program analyses require statically inferring the possible values of composite types.
However, current approaches either do not account for correlations between object fields or …

It is generally challenging to tell apart malware from benign applications. To make this
decision, human analysts are frequently interested in runtime values: targets of reflective …

Android developers heavily use reflection in their apps for legitimate reasons, but also
significantly for hiding malicious actions. Unfortunately, current state-of-the-art static analysis …

Arbitrary program extension at run time in language-based VMs, eg, Java's dynamic class
loading, comes at a startup cost: high memory footprint and slow warmup. Cloud computing …

A software product line (SPL) encodes a potentially large variety of software products as
variants of some common code base. Up until now, re-using traditional static analyses for …

Static analysis of Android applications can be hindered by the presence of the popular
dynamic code update techniques: dynamic class loading and reflection. Recent Android …