{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T23:00:01Z","timestamp":1773097201814,"version":"3.50.1"},"reference-count":61,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2018,10,31]],"date-time":"2018-10-31T00:00:00Z","timestamp":1540944000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"DFG","award":["AP 206\/4 and AP 206\/6"],"award-info":[{"award-number":["AP 206\/4 and AP 206\/6"]}]},{"name":"Science of Security Lablet","award":["H9823014C0140"],"award-info":[{"award-number":["H9823014C0140"]}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["1318808, 1552944, and 1717022"],"award-info":[{"award-number":["1318808, 1552944, and 1717022"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"U.S. Department of Defense through the Systems Engineering Research Center","award":["H9823008D0171"],"award-info":[{"award-number":["H9823008D0171"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2018,10,31]]},"abstract":"<jats:p>\n            The advent of variability management and generator technology enables users to derive individual system variants from a configurable code base by selecting desired configuration options. This approach gives rise to the generation of possibly billions of variants, which, however, cannot be efficiently analyzed for bugs and other properties with classic analysis techniques. To address this issue, researchers and practitioners have developed sampling heuristics and, recently, variability-aware analysis techniques. While sampling reduces the analysis effort significantly, the information obtained is necessarily incomplete, and it is unknown whether state-of-the-art sampling techniques scale to billions of variants. Variability-aware analysis techniques process the configurable code base directly, exploiting similarities among individual variants with the goal of reducing analysis effort. However, while being promising, so far, variability-aware analysis techniques have been applied mostly only to small academic examples. To learn about the mutual strengths and weaknesses of variability-aware and sample-based static-analysis techniques, we compared the two by means of seven concrete control-flow and data-flow analyses, applied to five real-world subject systems: B\n            <jats:sc>usybox<\/jats:sc>\n            , O\n            <jats:sc>pen<\/jats:sc>\n            SSL, SQL\n            <jats:sc>ite<\/jats:sc>\n            , the x86 L\n            <jats:sc>inux<\/jats:sc>\n            kernel, and\n            <jats:sc>u<\/jats:sc>\n            C\n            <jats:sc>libc<\/jats:sc>\n            . In particular, we compare the efficiency (analysis execution time) of the static analyses and their effectiveness (potential bugs found). Overall, we found that variability-aware analysis outperforms most sample-based static-analysis techniques with respect to efficiency and effectiveness. For example, checking all variants of O\n            <jats:sc>pen<\/jats:sc>\n            SSL with a variability-aware static analysis is faster than checking even only two variants with an analysis that does not exploit similarities among variants.\n          <\/jats:p>","DOI":"10.1145\/3280986","type":"journal-article","created":{"date-parts":[[2018,11,19]],"date-time":"2018-11-19T13:08:27Z","timestamp":1542632907000},"page":"1-33","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":39,"title":["Variability-Aware Static Analysis at Scale"],"prefix":"10.1145","volume":"27","author":[{"given":"Alexander Von","family":"Rhein","sequence":"first","affiliation":[{"name":"CQSE GmbH, Garching, Germany"}]},{"given":"J\u00f6RG","family":"Liebig","sequence":"additional","affiliation":[{"name":"4Soft GmbH, Munich, Germany"}]},{"given":"Andreas","family":"Janker","sequence":"additional","affiliation":[{"name":"Capgemini Deutschland GmbH, Munich, Germany"}]},{"given":"Christian","family":"K\u00e4stner","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3687-2233","authenticated-orcid":false,"given":"Sven","family":"Apel","sequence":"additional","affiliation":[{"name":"University of Passau, Passau, Germany"}]}],"member":"320","published-online":{"date-parts":[[2018,11,16]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/2642937.2642990"},{"key":"e_1_2_1_2_1","doi-asserted-by":"crossref","unstructured":"S. Apel D. Batory C. K\u00e4stner and G. Saake. 2013. Feature-oriented Software Product Lines: Concepts and Implementation. Springer.   S. Apel D. Batory C. K\u00e4stner and G. Saake. 2013. Feature-oriented Software Product Lines: Concepts and Implementation. Springer.","DOI":"10.1007\/978-3-642-37521-7"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-010-0066-8"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2528265.2528267"},{"key":"e_1_2_1_5_1","volume-title":"Proceedings of the International Conference on Software Engineering (ICSE\u201913)","author":"Apel S."},{"key":"e_1_2_1_6_1","volume-title":"Proceedings of the Working Conference on Source Code Management and Manipulation (SCAM\u201902)","author":"Aversano L."},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the International Software Product Line Conference (SPLC\u201910)","author":"Berger T."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1858996.1859010"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2013.34"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491956.2491976"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2162049.2162052"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10703-006-0002-5"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2364527.2364535"},{"key":"e_1_2_1_14_1","unstructured":"E. Clarke O. Grumberg and D. Peled. 1999. Model Checking. The MIT Press.   E. Clarke O. Grumberg and D. Peled. 1999. Model Checking. The MIT Press."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2012.86"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1806799.1806850"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2635868.2635919"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/11561347_28"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1173706.1173738"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1595696.1595733"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2162024.2162030"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/2063239.2063245"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2011.25"},{"key":"e_1_2_1_24_1","volume-title":"Proceedings of the International Conference on Software Maintenance (ICSM\u201900)","author":"Hu Y."},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-015-9360-1"},{"key":"e_1_2_1_26_1","volume-title":"Proceedings of the International Conference on Model Driven Engineering Languages and Systems (MODELS\u201911)","author":"Johansen M."},{"key":"e_1_2_1_27_1","volume-title":"Proceedings of the International Conference on Software Engineering (ICSE\u201913)","author":"Johnson B."},{"key":"e_1_2_1_28_1","unstructured":"C. K\u00e4stner. 2017. Differential testing for variational analyses: Experience from developing KConfigReader. CoRR abs\/1706.09357.  C. K\u00e4stner. 2017. Differential testing for variational analyses: Experience from developing KConfigReader. CoRR abs\/1706.09357."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368088.1368131"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2211616.2211617"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2048066.2048128"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2384616.2384673"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/2377816.2377817"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/512927.512945"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2012.23"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2004.24"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.5555\/872754.873601"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2009.16"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/1806799.1806819"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/1960275.1960299"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491411.2491437"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884793"},{"key":"e_1_2_1_43_1","volume-title":"Proceedings of the European Conference on Object-Oriented Programming (ECOOP\u201915)","volume":"37","author":"Medeiros F."},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2814204.2814206"},{"key":"e_1_2_1_45_1","volume-title":"Proceedings of the International Software Product Line Conference (SPLC\u201909)","author":"Mendon\u00e7a M."},{"key":"e_1_2_1_46_1","volume-title":"Proceedings of the International Conference on Requirements Engineering (RE\u201907)","author":"Metzger A."},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568283"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/1883612.1883618"},{"key":"e_1_2_1_49_1","doi-asserted-by":"crossref","unstructured":"F. Nielson H. Nielson and C. Hankin. 1999. Principles of Program Analysis. Springer.   F. Nielson H. Nielson and C. Hankin. 1999. Principles of Program Analysis. Springer.","DOI":"10.1007\/978-3-662-03811-6"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11219-011-9160-9"},{"key":"e_1_2_1_51_1","unstructured":"R. Seacord. 2008. The CERT C Secure Coding Standard. Pearson.   R. Seacord. 2008. The CERT C Secure Coding Standard. Pearson."},{"key":"e_1_2_1_52_1","unstructured":"S. She and T. Berger. 2010. Formal Semantics of the KConfig Language. Technical Note. Retrieved from http:\/\/gsd.uwaterloo.ca\/sites\/default\/files\/kconfig_semantics.pdf.  S. She and T. Berger. 2010. Formal Semantics of the KConfig Language. Technical Note. Retrieved from http:\/\/gsd.uwaterloo.ca\/sites\/default\/files\/kconfig_semantics.pdf."},{"key":"e_1_2_1_53_1","volume-title":"Proceedings of the International Conference on Software Engineering (ICSE\u201912)","author":"Siegmund N."},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/1966445.1966451"},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/2094091.2094095"},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/1289971.1289989"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/2580950"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.3115\/980491.980564"},{"key":"e_1_2_1_59_1","volume-title":"Proceedings of the International Conference on Software Engineering (ICSE\u201915)","author":"von Rhein A."},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jlamp.2015.06.007"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/2661136.2661143"}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3280986","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3280986","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3280986","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T01:01:51Z","timestamp":1750208511000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3280986"}},"subtitle":["An Empirical Study"],"short-title":[],"issued":{"date-parts":[[2018,10,31]]},"references-count":61,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2018,10,31]]}},"alternative-id":["10.1145\/3280986"],"URL":"https:\/\/doi.org\/10.1145\/3280986","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,10,31]]},"assertion":[{"value":"2017-11-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-09-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-11-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}