{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T15:12:34Z","timestamp":1784646754228,"version":"3.55.0"},"reference-count":141,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"5","license":[{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"RGC ECS","award":["26206520"],"award-info":[{"award-number":["26206520"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2024,9]]},"DOI":"10.1109\/tdsc.2024.3354789","type":"journal-article","created":{"date-parts":[[2024,1,16]],"date-time":"2024-01-16T18:29:45Z","timestamp":1705429785000},"page":"4600-4618","source":"Crossref","is-referenced-by-count":21,"title":["Evaluating C\/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9897-4086","authenticated-orcid":false,"given":"Zongjie","family":"Li","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7872-1129","authenticated-orcid":false,"given":"Zhibo","family":"Liu","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2583-0698","authenticated-orcid":false,"given":"Wai Kin","family":"Wong","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7680-2817","authenticated-orcid":false,"given":"Pingchuan","family":"Ma","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0866-0308","authenticated-orcid":false,"given":"Shuai","family":"Wang","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"2022 vulnerability statistics report"},{"key":"ref2","article-title":"CodeQL bounty programs","year":"2021"},{"key":"ref3","article-title":"CodeQL C\/C++ CWE coverage","year":"2021"},{"key":"ref4","article-title":"CodeQL C\/C++ dataflow","year":"2021"},{"key":"ref5","article-title":"CodeQL CVE queries","year":"2021"},{"key":"ref6","article-title":"CodeQL false positive fix record","year":"2023"},{"key":"ref7","article-title":"CodeQL false positive issue","year":"2023"},{"key":"ref8","article-title":"CodeQL interprocedural concerns","year":"2023"},{"key":"ref9","article-title":"CodeQL introduction","year":"2022"},{"key":"ref10","article-title":"CodeQL security lab","year":"2022"},{"key":"ref11","article-title":"Common weakness enumeration","year":"2022"},{"key":"ref12","article-title":"Contributing to CodeQL","year":"2022"},{"key":"ref13","article-title":"CVE database","year":"2023"},{"key":"ref14","article-title":"GCJ-dataset","year":"2022"},{"key":"ref15","article-title":"GitHub security apps","year":"2022"},{"key":"ref16","article-title":"honggfuzz","year":"2022"},{"key":"ref17","article-title":"KLEE execution time","year":"2021"},{"key":"ref18","article-title":"Leveraging machine learning to find security vulnerabilities","year":"2021"},{"key":"ref19","article-title":"Mend vulnerability database","year":"2021"},{"key":"ref20","article-title":"OpenConnect introduction","year":"2021"},{"key":"ref21","article-title":"Real dataset information","year":"2021"},{"key":"ref22","article-title":"Semgrep queries","year":"2021"},{"key":"ref23","article-title":"Shiftleft OverflowDB","year":"2021"},{"key":"ref24","article-title":"SonarSource queries","year":"2021"},{"key":"ref25","article-title":"Variant analysis","year":"2021"},{"key":"ref26","article-title":"Variant analysis of web audio callback vulnerabilities in chrome","year":"2021"},{"key":"ref27","article-title":"Website","year":"2023"},{"key":"ref28","article-title":"CodeQL and the static tools logo test","year":"2021"},{"key":"ref29","article-title":"Microsoft open sources CodeQL queries used to hunt for Solorigate activity","year":"2021"},{"key":"ref30","first-page":"19","article-title":"Put in one bug and pop out more: An effective way of bug hunting in Chrome","volume-title":"Proc. Blackhat"},{"key":"ref31","article-title":"Using GitHub code scanning and CodeQL to detect traces of solorigate and other backdoors","year":"2021"},{"key":"ref32","article-title":"AddressSanitizer check failed","year":"2022"},{"key":"ref33","article-title":"CodeQL: CWE coverage for C and C++","year":"2022"},{"key":"ref34","article-title":"SonarQube: CWE coverage for C and C++","year":"2022"},{"key":"ref35","article-title":"code2seq: Generating sequences from structured representations of code","author":"Alon","year":"2018"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3290353"},{"key":"ref37","article-title":"Towards better static analysis security testing methodologies","author":"Aloraini","year":"2020"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2019.110427"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/sp46214.2022.9833582"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3439802"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SYNASC.2017.00035"},{"key":"ref42","article-title":"C and C++ source code analysis tools (open source and commercial)","year":"2021"},{"key":"ref43","first-page":"2:1","article-title":"QL: Object-oriented queries on relational data","volume-title":"Proc. 30th Eur. Conf. Object-Oriented Programm.","author":"Avgustinov"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2004.2"},{"key":"ref45","first-page":"3589","article-title":"Neural code comprehension: A learnable representation of code semantics","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Ben-Nun"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/1646353.1646374"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-45237-7_21"},{"key":"ref48","first-page":"1263","article-title":"Discovering flaws in {Security-Focused}static analysis tools for android using systematic mutation","volume-title":"Proc. USENIX Secur.","author":"Bonett"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10431-7_20"},{"key":"ref50","article-title":"Introducing security testing to developers","author":"Brucker"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453096"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSACW.2011.26"},{"key":"ref53","article-title":"Metamorphic testing: A new approach for generating next test cases","author":"Chen","year":"2020"},{"key":"ref54","article-title":"Coverity talk","author":"Chou","year":"2008"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598050"},{"key":"ref56","first-page":"332","article-title":"What developers want and need from program analysis: An empirical study","volume-title":"Proc. 31st IEEE\/ACM Int. Conf. Automated Softw. Eng.","author":"Christakis"},{"key":"ref57","article-title":"Clang static analyzer","year":"2021"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/512950.512973"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3475716.3475781"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33826-7_16"},{"key":"ref61","article-title":"Browse vulnerabilities by date","year":"2021"},{"key":"ref62","article-title":"CLOC","author":"Danial","year":"2017"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00003"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.15"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3314221.3314640"},{"key":"ref66","article-title":"Cppcheck","year":"2021"},{"key":"ref67","article-title":"Facebook infer","year":"2021"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/IBCAST.2018.8312265"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1016\/bs.adcom.2015.11.003"},{"key":"ref70","article-title":"Evaluation of open source static analysis security testing (SAST) tools for C","author":"Gentsch","year":"2020"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3092566"},{"key":"ref72","article-title":"CodeQL","year":"2021"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2015.08.002"},{"key":"ref74","article-title":"Trail of Bits\u2019 adoption of Semgrep and CodeQL","author":"Guido","year":"2021"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TASE.2019.00-18"},{"key":"ref76","article-title":"Choosing static application testing tools","author":"Hartley","year":"2019"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/3428334"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/MSR52588.2021.00068"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2019.00040"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/3314058.3317295"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.14778\/3407790.3407804"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2019.00020"},{"key":"ref83","article-title":"Evaluating static analysis tools for detecting buffer overflows in C code","author":"Kratkiewicz","year":"2005"},{"key":"ref84","article-title":"How the community powers github advanced security with codeql queries","year":"2021"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.25"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2004.1281665"},{"key":"ref87","first-page":"2613","article-title":"Montage: A neural network language {model-guided}{JavaScript}engine fuzzer","volume-title":"Proc. USENIX Secur. Symp.","author":"Lee"},{"key":"ref88","first-page":"96","article-title":"Query optimization by predicate move-around","volume-title":"Proc. 20th Int. Conf. Very Large Data Bases","author":"Levy"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.33166\/AETiC.2020.03.001"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484587"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534380"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/2644805"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-04272-1_4"},{"key":"ref94","doi-asserted-by":"crossref","DOI":"10.14722\/bar.2019.23090","article-title":"Towards automatically generating a sound and complete dataset for evaluating static analysis tools","volume-title":"Proc. Workshop Binary Anal. Res.","author":"Machiry"},{"key":"ref95","article-title":"Evaluation of static analysis tools for finding vulnerabilities in java and C\/C++ source code","author":"Mahmood","year":"2018"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3497764"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3048202"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/SERE-C.2012.16"},{"key":"ref99","article-title":"Cas static analysis tool study-methodology","author":"Meade","year":"2012"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3473932"},{"key":"ref101","article-title":"Cwe view: Weaknesses in C++","year":"2022"},{"key":"ref102","article-title":"Evaluating the performance of open source static analysis stools","volume":"24","author":"Moerman","year":"2018"},{"key":"ref103","first-page":"919","article-title":"Understanding the reproducibility of crowd-reported security vulnerabilities","volume-title":"Proc. USENIX Secur.","author":"Mu"},{"key":"ref104","article-title":"ikos","year":"2021"},{"key":"ref105","article-title":"Juliet test suite for C\/C++","year":"2021"},{"key":"ref106","article-title":"NIST samate","year":"2022"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2018.2839339"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2018.00139"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2017.24"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468623"},{"key":"ref111","article-title":"TREX: Learning execution semantics from micro-traces for binary similarity","author":"Pei","year":"2020"},{"key":"ref112","article-title":"CVE-2020\u20139967 - Apple macOS 6LowPAN Vulnerability","author":"Plaskett","year":"2020"},{"key":"ref113","article-title":"Semgrep","year":"2021"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1145\/3475716.3475776"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3236084"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2004.1"},{"key":"ref117","first-page":"17","article-title":"Implementation and performance analysis development security operations (DevSecOps) using static analysis and security testing (SAST)","volume-title":"Proc. Int. Appl. Bus. Eng. Conf.","author":"Santoso"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2016.2532875"},{"key":"ref119","first-page":"28","article-title":"AddressSanitizer: A fast address sanity checker","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Serebryany"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468591"},{"key":"ref121","article-title":"How shiftleft achieved the highest SAST score on the OWASP benchmark","year":"2021"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/ISSREW.2015.7392027"},{"key":"ref123","article-title":"Sonarqube","year":"2021"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1002\/9781118027974"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1145\/2892208.2892235"},{"key":"ref126","article-title":"Coverity","year":"2022"},{"key":"ref127","article-title":"Coverity: CWE support","year":"2022"},{"key":"ref128","article-title":"Joern","author":"Team","year":"2021"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1145\/2351676.2351685"},{"key":"ref130","article-title":"Awesome static analysis","author":"Tools","year":"2021"},{"key":"ref131","first-page":"413","article-title":"Arbiter: Bridging the static and dynamic divide in vulnerability discovery on binary programs","volume-title":"Proc. USENIX Secur.","author":"Vadayath"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2008.63"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1007\/11430230_4"},{"key":"ref134","article-title":"An approach to detecting bugs in pattern-based bug detectors","author":"Wang","year":"2021"},{"key":"ref135","article-title":"Mend bolt","year":"2022"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.2307\/3001968"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP.2019.00014"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/SANER53432.2022.00115"},{"key":"ref140","article-title":"American fuzzy lop (AFL)","author":"Zalewski","year":"2021"},{"key":"ref141","article-title":"Weggli","author":"Zero","year":"2021"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/10663874\/10400834.pdf?arnumber=10400834","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,4]],"date-time":"2024-09-04T21:05:03Z","timestamp":1725483903000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10400834\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9]]},"references-count":141,"journal-issue":{"issue":"5"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2024.3354789","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,9]]}}}