{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T06:56:54Z","timestamp":1782975414268,"version":"3.54.5"},"reference-count":71,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-21-54404,CNS-20-46361"],"award-info":[{"award-number":["CNS-21-54404,CNS-20-46361"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100006785","name":"Google","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100006785","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00121","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"1747-1765","source":"Crossref","is-referenced-by-count":0,"title":["Detecting Privilege Escalation in Polyglot Microservices via Agentic Program Analysis"],"prefix":"10.1109","author":[{"given":"Penghui","family":"Li","sequence":"first","affiliation":[{"name":"Columbia University,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hong Yau","family":"Chong","sequence":"additional","affiliation":[{"name":"Columbia University,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yinzhi","family":"Cao","sequence":"additional","affiliation":[{"name":"Johns Hopkins University,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Junfeng","family":"Yang","sequence":"additional","affiliation":[{"name":"Columbia University,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","author":"Richardson","year":"2025","journal-title":"Microservice architecture"},{"key":"ref2","volume-title":"Monolith to microservices: evolutionary patterns to transform your monolith","author":"Newman","year":"2019"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3287297"},{"key":"ref4","author":"Brigham","year":"2015","journal-title":"What led amazon to its own microservices architecture"},{"key":"ref5","author":"Shoup","year":"2015","journal-title":"Microservice ecosystems of google and ebay"},{"key":"ref6","author":"Services","year":"2025","journal-title":"What are microservices?"},{"key":"ref7","author":"Cloud","year":"2025","journal-title":"Microservices architecture on google cloud"},{"key":"ref8","year":"2025","journal-title":"Mall4Cloud: A microservices-based e-commerce platform"},{"key":"ref9","year":"2024","journal-title":"Crayfish homarus microservice remote code execution vulnerability"},{"key":"ref10","year":"2022","journal-title":"Cisco ultra cloud core - subscriber microservices infrastructure privilege escalation vulnerability"},{"key":"ref11","first-page":"3971","article-title":"Automatic policy generation for inter - service access control of microservices","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Li","year":"2021"},{"key":"ref12","volume-title":"grpc: A high performance, open source universal rpc framework","year":"2025"},{"key":"ref13","author":"Fielding","year":"2000","journal-title":"Representational state transfer (rest)"},{"key":"ref14","year":"2025","journal-title":"Apache kafka: A distributed streaming platform"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660337"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/2048066.2048146"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3614424"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00010"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560589"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00137"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/icse55347.2025.00115"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-18178-8_30"},{"key":"ref23","year":"2025","journal-title":"CodeQL: Discover vulnerabilities across a codebase with queries"},{"key":"ref24","doi-asserted-by":"crossref","DOI":"10.52202\/079017-1601","article-title":"SWE-agent: Agent-computer interfaces enable automated software engineering","volume-title":"The Thirty-eighth Annual Conference on Neural Information Processing Systems","author":"Yang","year":"2024"},{"key":"ref25","article-title":"Openhands: An open platform for AI software developers as generalist agents","volume-title":"The Thirteenth International Conference on Learning Representations","author":"Wang","year":"2025"},{"key":"ref26","article-title":"EnIGMA: Interactive tools substantially assist LM agents in finding security vulnerabilities","volume-title":"Forty-second International Conference on Machine Learning","author":"Abramovich","year":"2025"},{"key":"ref27","year":"2021","journal-title":"GraphQL specification"},{"key":"ref28","volume-title":"RabbitMQ: Messaging that just works","year":"2024"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3715754"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3649828"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"ref32","year":"2025","journal-title":"CodeQL queries"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"ref34","article-title":"Llmsa: A compositional neuro-symbolic approach to compilation-free and customizable static analysis","volume-title":"Proceedings of the 2024 Empirical Methods in Natural Language Processing (EMNLP)","author":"Wang"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP63933.2026.00003"},{"key":"ref36","year":"2025","journal-title":"Light Reading Cloud: A microservices-based reading application"},{"key":"ref37","year":"2025","journal-title":"PiggyMetrics: Microservice architecture with spring boot, spring cloud and docker"},{"key":"ref38","year":"2025","journal-title":"Pitstop: A sample application based on a garage management system for pitstop - a fictitious garage"},{"key":"ref39","year":"2025","journal-title":"SiteWhere: An industrial strength open-source application enablement platform for the internet of things (iot)"},{"key":"ref40","year":"2025","journal-title":"SuperMarket: A project that simulates a real-world supermarket or retail store billing experience"},{"key":"ref41","year":"2025","journal-title":"Food Delivery (.NET): A practical food delivery microservices, built with. net 8, masstransit, domain-driven design, cqrs, and more"},{"key":"ref42","year":"2025","journal-title":"Online Boutique: Sample cloud-first application with 10 microservices showcasing kubernetes, istio, and grpc"},{"key":"ref43","year":"2025","journal-title":"Booking Microservices: A practical microservices with the latest technologies and architectures like vertical slice architecture, event sourcing, cqrs, ddd, grpc, and. net 9"},{"key":"ref44","year":"2025","journal-title":"Go Micro Services: An example of microservices in go using grpc"},{"key":"ref45","year":"2025","journal-title":"JBone: A microservice platform based on spring cloud"},{"key":"ref46","year":"2025","journal-title":"Train Ticket: A benchmark microservice system"},{"key":"ref47","year":"2025","journal-title":"AspnetRun E-Shop: Microservices on. net platforms used asp.net web api, docker, rabbitmq, masstransit, grpc, yarp api gateway, and more"},{"key":"ref48","year":"2025","journal-title":"Cinema Microservice: A nodejs microservice for a cinema booking system"},{"key":"ref49","year":"2025","journal-title":"TODO App: An example microservice app written in different languages (go, java, nodejs, python, vuejs)"},{"key":"ref50","year":"2025","journal-title":"eShopOnAbp: Reference microservice solution built with the abp framework and. net"},{"key":"ref51","year":"2025","journal-title":"Spring Boot Basics Demo: Basic architecture framework to create complete microservices using spring boot and spring cloud"},{"key":"ref52","year":"2025","journal-title":"Magda: A federated, open-source data catalog for all your big data and small data"},{"key":"ref53","year":"2025","journal-title":"Genie: Distributed big data orchestration service"},{"key":"ref54","author":"Delimitrou","year":"2025","journal-title":"DeathStarBench: An open-source benchmark suite for cloud microservices"},{"key":"ref55","year":"2025","journal-title":"Mall-Swarm: Microservices e-commerce system based on spring cloud"},{"key":"ref56","year":"2025","journal-title":"Common vulnerabilities and exposures (cve)"},{"key":"ref57","volume-title":"National vulnerability database","year":"2025"},{"key":"ref58","year":"2025","journal-title":"newbee-mall: A distributed e-commerce system developed with Spring Boot and Vue"},{"key":"ref59","year":"2025","journal-title":"ZLT Platform: A microservices platform based on spring cloud"},{"key":"ref60","year":"2025","journal-title":"Armeria: Your go-to microservice framework for any situation, from the creator of Netty et al"},{"key":"ref61","year":"2025","journal-title":"Spring Cloud Data Flow: A cloud-native orchestration service for composable microservice applications on modern runtimes"},{"key":"ref62","year":"2025","journal-title":"Cve-2023\u201338493 detail"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354244"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP66354.2025.00036"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179317"},{"key":"ref66","year":"2025","journal-title":"newbee-mall: A distributed e-commerce system developed with Spring Boot and Vue"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3485517"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3417059"},{"key":"ref69","article-title":"Repoaudit: An autonomous 11m-agent for repository-level code auditing","volume-title":"Proceedings of the 42nd International Conference on Machine Learning","author":"Guo","year":"2025"},{"key":"ref70","article-title":"Llm-assisted static analysis for detecting security vulnerabilities","volume-title":"Proceedings of the 13th International Conference on Learning Representations (ICLR)","author":"Li"},{"key":"ref71","first-page":"489","article-title":"LLMxCPG: Context-Aware vulnerability detection through code property GraphGuided large language models","volume-title":"34th USENIX Security Symposium (USENIX Security 25)","author":"Lekssays","year":"2025"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573425.pdf?arnumber=11573425","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:25:28Z","timestamp":1782969928000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573425\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":71,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00121","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}