{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,23]],"date-time":"2026-08-23T14:50:20Z","timestamp":1787496620980,"version":"build-2736575974"},"reference-count":45,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2021YFB3100500"],"award-info":[{"award-number":["2021YFB3100500"]}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["62202484"],"award-info":[{"award-number":["62202484"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3592537","type":"journal-article","created":{"date-parts":[[2025,7,24]],"date-time":"2025-07-24T17:54:21Z","timestamp":1753379661000},"page":"7748-7763","source":"Crossref","is-referenced-by-count":5,"title":["Yama: Precise Opcode-Based Data Flow Analysis for Detecting PHP Applications Vulnerabilities"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5024-1679","authenticated-orcid":false,"given":"Jiazhen","family":"Zhao","sequence":"first","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5241-0157","authenticated-orcid":false,"given":"Kailong","family":"Zhu","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8524-0139","authenticated-orcid":false,"given":"Lu","family":"Yu","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7615-9585","authenticated-orcid":false,"given":"Hui","family":"Huang","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8502-9907","authenticated-orcid":false,"given":"Yuliang","family":"Lu","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Web Server Survey","year":"2024"},{"key":"ref2","volume-title":"Usage Statistics of Server-side Programming Languages for Websites","year":"2020"},{"key":"ref3","volume-title":"Exploit Database Statistics","year":"2024"},{"key":"ref4","volume-title":"Top Cybersecurity Statistics for 2024","year":"2023"},{"key":"ref5","volume-title":"How Many Cyber Attacks Occur Each Day?","author":"Howarth","year":"2024"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00022"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179317"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24169"},{"key":"ref9","first-page":"6097","article-title":"Sqirl: Grey-box detection of sql injection vulnerabilities using reinforcement learning","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Al Wahaibi"},{"key":"ref10","first-page":"377","article-title":"NAVEX: Precise and scalable exploit generation for dynamic web applications","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Secur.)","author":"Alhuzali"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645530"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598116"},{"key":"ref13","first-page":"6983","article-title":"Argus: A framework for staged static taint analysis of Github workflows and actions","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Muralee"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1016\/j.jksuci.2023.01.009"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.14"},{"key":"ref16","volume-title":"Wap","year":"2018"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559391"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23262"},{"key":"ref19","volume-title":"Progpilot\u2014A Static Analyzer for Security Purposes","year":"2023"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.29"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2015.16"},{"key":"ref22","first-page":"6079","article-title":"WHIP: Improving static vulnerability detection in web application by forcing tools to collaborate","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Al-Kassar"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-51482-1_10"},{"key":"ref24","volume-title":"Variable Variables","year":"2024"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/2483760.2483786"},{"key":"ref26","volume-title":"Php 7 Virtual Machine","year":"2017"},{"key":"ref27","volume-title":"Static Program Analysis","year":"2023"},{"key":"ref28","volume-title":"Yama","year":"2024"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2019.00064"},{"key":"ref30","volume-title":"Compilers Principles, Techniques & Tools","author":"Alfred","year":"2007"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-45099-3_9"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2015.72"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.scico.2018.10.004"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450002"},{"key":"ref35","volume-title":"Php Tokens","year":"2025"},{"key":"ref36","volume-title":"Vulcan Logic Dumper","year":"2021"},{"key":"ref37","volume-title":"Php Scalar","year":"2024"},{"key":"ref38","volume-title":"Php Include","year":"2024"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24150"},{"key":"ref40","volume-title":"Psalm\u2014A Php Static Analysis Tool for Finding Errors and Security Vulnerabilities in Php Applications","year":"2024"},{"key":"ref41","volume-title":"Php-ast","year":"2023"},{"key":"ref42","volume-title":"Phpjoern","year":"2020"},{"key":"ref43","volume-title":"Navex-fixed","year":"2020"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88418-5_8"},{"key":"ref45","first-page":"4765","article-title":"Atropos: Effective fuzzing of web applications for server-side vulnerabilities","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"G\u00fcler"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11095739.pdf?arnumber=11095739","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T04:43:49Z","timestamp":1754023429000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11095739\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":45,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3592537","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}