{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T01:28:17Z","timestamp":1783128497806,"version":"3.54.6"},"publisher-location":"New York, NY, USA","reference-count":53,"publisher":"ACM","license":[{"start":{"date-parts":[[2019,7,10]],"date-time":"2019-07-10T00:00:00Z","timestamp":1562716800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2019,7,10]]},"DOI":"10.1145\/3293882.3330556","type":"proceedings-article","created":{"date-parts":[[2019,7,11]],"date-time":"2019-07-11T12:13:31Z","timestamp":1562847211000},"page":"181-191","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":17,"title":["Codebase-adaptive detection of security-relevant methods"],"prefix":"10.1145","author":[{"given":"Goran","family":"Piskachev","sequence":"first","affiliation":[{"name":"Fraunhofer IEM, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lisa Nguyen Quang","family":"Do","sequence":"additional","affiliation":[{"name":"University of Paderborn, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Eric","family":"Bodden","sequence":"additional","affiliation":[{"name":"University of Paderborn, Germany \/ Fraunhofer IEM, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,7,10]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Apache. {n. d.}. Abdera. https:\/\/abdera.apache.org\/.  Apache. {n. d.}. Abdera. https:\/\/abdera.apache.org\/."},{"key":"e_1_3_2_1_2_1","unstructured":"Apache. {n. d.}. Apache Commons. https:\/\/commons.apache.org\/.  Apache. {n. d.}. Apache Commons. https:\/\/commons.apache.org\/."},{"key":"e_1_3_2_1_3_1","unstructured":"Apache. {n. d.}. Apache Cordova. https:\/\/cordova.apache.org\/.  Apache. {n. d.}. Apache Cordova. https:\/\/cordova.apache.org\/."},{"key":"e_1_3_2_1_4_1","unstructured":"Apache. {n. d.}. Apache Lucene. http:\/\/lucene.apache.org\/.  Apache. {n. d.}. Apache Lucene. http:\/\/lucene.apache.org\/."},{"key":"e_1_3_2_1_5_1","unstructured":"Apache. {n. d.}. Apache Stratos. http:\/\/stratos.apache.org\/.  Apache. {n. d.}. Apache Stratos. http:\/\/stratos.apache.org\/."},{"key":"e_1_3_2_1_6_1","unstructured":"Apache. {n. d.}. Apache Struts. https:\/\/struts.apache.org\/.  Apache. {n. d.}. Apache Struts. https:\/\/struts.apache.org\/."},{"key":"e_1_3_2_1_7_1","unstructured":"Apache. {n. d.}. Roller. http:\/\/roller.apache.org\/.  Apache. {n. d.}. Roller. http:\/\/roller.apache.org\/."},{"key":"e_1_3_2_1_8_1","unstructured":"Apache. {n. d.}. Tomcat. http:\/\/tomcat.apache.org\/.  Apache. {n. d.}. Tomcat. http:\/\/tomcat.apache.org\/."},{"key":"e_1_3_2_1_9_1","unstructured":"S. Arzt S. Rasthofer and E. Bodden. 2013. SuSi: A Tool for the Fully Automated Classification and Categorization of Android Sources and Sinks (NDSS\u201913).  S. Arzt S. Rasthofer and E. Bodden. 2013. SuSi: A Tool for the Fully Automated Classification and Categorization of Android Sources and Sinks (NDSS\u201913)."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/MOBILESoft.2017.2"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2594291.2594299"},{"key":"e_1_3_2_1_12_1","unstructured":"2594299  2594299"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-C.2017.20"},{"key":"e_1_3_2_1_14_1","unstructured":"Dropwizard. {n. d.}. Dropwizard. https:\/\/www.dropwizard.io\/.  Dropwizard. {n. d.}. Dropwizard. https:\/\/www.dropwizard.io\/."},{"key":"e_1_3_2_1_15_1","volume-title":"Proceedings of the 35th International Conference on Software Engineering (ICSE\u201913)","author":"Dyer R.","unstructured":"R. Dyer , H. A. Nguyen , H. Rajan , and T. N. Nguyen . 2013. Boa: A Language and Infrastructure for Analyzing Ultra-Large-Scale Software Repositories . In Proceedings of the 35th International Conference on Software Engineering (ICSE\u201913) . 422\u2013431. R. Dyer, H. A. Nguyen, H. Rajan, and T. N. Nguyen. 2013. Boa: A Language and Infrastructure for Analyzing Ultra-Large-Scale Software Repositories. In Proceedings of the 35th International Conference on Software Engineering (ICSE\u201913). 422\u2013431."},{"key":"e_1_3_2_1_16_1","unstructured":"Eclipse. {n. d.}. Jetty. https:\/\/www.eclipse.org\/jetty\/.  Eclipse. {n. d.}. Jetty. https:\/\/www.eclipse.org\/jetty\/."},{"key":"e_1_3_2_1_17_1","unstructured":"Eclipse. {n. d.}. Smarthome. https:\/\/www.eclipse.org\/smarthome\/.  Eclipse. {n. d.}. Smarthome. https:\/\/www.eclipse.org\/smarthome\/."},{"key":"e_1_3_2_1_18_1","volume-title":"d.}. EMBL-EBI home page. https:\/\/www.ebi.ac.uk\/. Online","author":"European Bioinformatics Institute (EMBL-EBI). {n.","year":"2018","unstructured":"European Bioinformatics Institute (EMBL-EBI). {n. d.}. EMBL-EBI home page. https:\/\/www.ebi.ac.uk\/. Online ; accessed 10 December 2018 . European Bioinformatics Institute (EMBL-EBI). {n. d.}. EMBL-EBI home page. https:\/\/www.ebi.ac.uk\/. Online; accessed 10 December 2018."},{"key":"e_1_3_2_1_19_1","unstructured":"Common Weakness Enumeration. {n. d.}. 2011 CWE\/SANS Top 25 Most Dangerous Software Errors. http:\/\/cwe.mitre.org\/top25\/.  Common Weakness Enumeration. {n. d.}. 2011 CWE\/SANS Top 25 Most Dangerous Software Errors. http:\/\/cwe.mitre.org\/top25\/."},{"key":"e_1_3_2_1_20_1","unstructured":"Common Weakness Enumeration. {n. d.}. CWE-287: Improper Authentication. http:\/\/cwe.mitre.org\/data\/definitions\/287.html.  Common Weakness Enumeration. {n. d.}. CWE-287: Improper Authentication. http:\/\/cwe.mitre.org\/data\/definitions\/287.html."},{"key":"e_1_3_2_1_21_1","unstructured":"Common Weakness Enumeration. {n. d.}. CWE-359: Exposure of Private Information (\u2019Privacy Violation\u2019). https:\/\/cwe.mitre.org\/data\/definitions\/359.html.  Common Weakness Enumeration. {n. d.}. CWE-359: Exposure of Private Information (\u2019Privacy Violation\u2019). https:\/\/cwe.mitre.org\/data\/definitions\/359.html."},{"key":"e_1_3_2_1_22_1","volume-title":"d.}","year":"2017","unstructured":"Common Weakness Enumeration. {n. d.} . CWE CATEGORY : OWASP Top Ten 2017 Category A1 - Injection . https:\/\/cwe.mitre.org\/data\/definitions\/1027.html. Common Weakness Enumeration. {n. d.}. CWE CATEGORY: OWASP Top Ten 2017 Category A1 - Injection. https:\/\/cwe.mitre.org\/data\/definitions\/1027.html."},{"key":"e_1_3_2_1_23_1","unstructured":"Common Weakness Enumeration. {n. d.}. CWE home page. http:\/\/cwe.mitre.org\/. Online; accessed 27 September 2018.  Common Weakness Enumeration. {n. d.}. CWE home page. http:\/\/cwe.mitre.org\/. Online; accessed 27 September 2018."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2013.6671303"},{"key":"e_1_3_2_1_25_1","unstructured":"Google. {n. d.}. Android API 4.2. https:\/\/developer.android.com\/about\/versions\/ android-4.2.  Google. {n. d.}. Android API 4.2. https:\/\/developer.android.com\/about\/versions\/ android-4.2."},{"key":"e_1_3_2_1_26_1","unstructured":"Google. {n. d.}. Google Auth Java. https:\/\/github.com\/googleapis\/google-authlibrary-java.  Google. {n. d.}. Google Auth Java. https:\/\/github.com\/googleapis\/google-authlibrary-java."},{"key":"e_1_3_2_1_27_1","unstructured":"GWT. {n. d.}. GWT. http:\/\/www.gwtproject.org\/.  GWT. {n. d.}. GWT. http:\/\/www.gwtproject.org\/."},{"key":"e_1_3_2_1_28_1","volume-title":"Proceedings of the 2018 IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM) (SCAM \u201918)","author":"Harman M.","unstructured":"M. Harman and P. O\u2019Hearn . 2018. From Start-ups to Scale-ups: Opportunities and Open Problems for Static and Dynamic Program Analysis . In Proceedings of the 2018 IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM) (SCAM \u201918) . IEEE. M. Harman and P. O\u2019Hearn. 2018. From Start-ups to Scale-ups: Opportunities and Open Problems for Static and Dynamic Program Analysis. In Proceedings of the 2018 IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM) (SCAM \u201918). IEEE."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2009.45"},{"key":"e_1_3_2_1_30_1","volume-title":"37th Annual Hawaii International Conference on System Sciences, 2004. Proceedings of the. 10 pp.\u2013.","author":"Heffley J.","unstructured":"J. Heffley and P. Meunier . 2004. Can source code auditing software identify common vulnerabilities and be used to evaluate software security? . In 37th Annual Hawaii International Conference on System Sciences, 2004. Proceedings of the. 10 pp.\u2013. J. Heffley and P. Meunier. 2004. Can source code auditing software identify common vulnerabilities and be used to evaluate software security?. In 37th Annual Hawaii International Conference on System Sciences, 2004. Proceedings of the. 10 pp.\u2013."},{"key":"e_1_3_2_1_31_1","unstructured":"European Bioinformatics Institute. {n. d.}. Gene Expression Atlas. https:\/\/github. com\/gxa\/gxa.  European Bioinformatics Institute. {n. d.}. Gene Expression Atlas. https:\/\/github. com\/gxa\/gxa."},{"key":"e_1_3_2_1_32_1","unstructured":"Spark Java. {n. d.}. Spark. http:\/\/sparkjava.com\/.  Spark Java. {n. d.}. Spark. http:\/\/sparkjava.com\/."},{"key":"e_1_3_2_1_33_1","volume-title":"d.}. IntelliJ home page. https:\/\/www.jetbrains.com\/idea\/. Online","year":"2018","unstructured":"JetBrains. {n. d.}. IntelliJ home page. https:\/\/www.jetbrains.com\/idea\/. Online ; accessed 17 October 2018 . JetBrains. {n. d.}. IntelliJ home page. https:\/\/www.jetbrains.com\/idea\/. Online; accessed 17 October 2018."},{"key":"e_1_3_2_1_34_1","unstructured":"JGuard. {n. d.}. JGuard. http:\/\/jguard.net\/.  JGuard. {n. d.}. JGuard. http:\/\/jguard.net\/."},{"key":"e_1_3_2_1_35_1","unstructured":"jsoup. {n. d.}. jsoup. https:\/\/jsoup.org\/.  jsoup. {n. d.}. jsoup. https:\/\/jsoup.org\/."},{"key":"e_1_3_2_1_36_1","volume-title":"Cetus Users and Compiler Infrastructure Workshop (CETUS","author":"Lam P.","year":"2011","unstructured":"P. Lam , E. Bodden , O. Lhot\u00e1k , and L. Hendren . 2011. The Soot framework for Java program analysis: a retrospective . In Cetus Users and Compiler Infrastructure Workshop (CETUS 2011 ). P. Lam, E. Bodden, O. Lhot\u00e1k, and L. Hendren. 2011. The Soot framework for Java program analysis: a retrospective. In Cetus Users and Compiler Infrastructure Workshop (CETUS 2011)."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.2307\/2529310"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/1543135.1542485"},{"key":"e_1_3_2_1_39_1","volume-title":"2012 34th International Conference on Software Engineering (ICSE). 397\u2013407","author":"Lo D.","unstructured":"Lucia, D. Lo , L. Jiang , and A. Budi . 2012. Active refinement of clone anomaly reports . In 2012 34th International Conference on Software Engineering (ICSE). 397\u2013407 . Lucia, D. Lo, L. Jiang, and A. Budi. 2012. Active refinement of clone anomaly reports. In 2012 34th International Conference on Software Engineering (ICSE). 397\u2013407."},{"key":"e_1_3_2_1_40_1","volume-title":"Proceedings of the 32Nd IEEE\/ACM International Conference on Automated Software Engineering (ASE","author":"Mathis B.","year":"2017","unstructured":"B. Mathis , V. Avdiienko , E. O. Soremekun , M. B\u00f6hme , and A. Zeller . 2017. Detecting Information Flow by Mutating Input Data . In Proceedings of the 32Nd IEEE\/ACM International Conference on Automated Software Engineering (ASE 2017 ). IEEE Press, Piscataway, NJ, USA, 263\u2013273. http:\/\/dl.acm.org\/citation.cfm? id=3155562.3155598 B. Mathis, V. Avdiienko, E. O. Soremekun, M. B\u00f6hme, and A. Zeller. 2017. Detecting Information Flow by Mutating Input Data. In Proceedings of the 32Nd IEEE\/ACM International Conference on Automated Software Engineering (ASE 2017). IEEE Press, Piscataway, NJ, USA, 263\u2013273. http:\/\/dl.acm.org\/citation.cfm? id=3155562.3155598"},{"key":"e_1_3_2_1_41_1","volume-title":"2018 IEEE Symposium on Security and Privacy (SP). 756\u2013769","author":"Mendoza A.","unstructured":"A. Mendoza and G. Gu . 2018. Mobile Application Web API Reconnaissance: Web-to-Mobile Inconsistencies amp; Vulnerabilities . In 2018 IEEE Symposium on Security and Privacy (SP). 756\u2013769 . A. Mendoza and G. Gu. 2018. Mobile Application Web API Reconnaissance: Web-to-Mobile Inconsistencies amp; Vulnerabilities. In 2018 IEEE Symposium on Security and Privacy (SP). 756\u2013769."},{"key":"e_1_3_2_1_42_1","unstructured":"OWASP. {n. d.}. WebGoat. https:\/\/github.com\/WebGoat\/WebGoat.  OWASP. {n. d.}. WebGoat. https:\/\/github.com\/WebGoat\/WebGoat."},{"key":"e_1_3_2_1_43_1","unstructured":"Open Web Application Security Project. {n. d.}. OWASP Top 10 Most Critical Web Application Security Risks. https:\/\/www.owasp.org\/index.php\/Category: OWASP_Top_Ten_Project.  Open Web Application Security Project. {n. d.}. OWASP Top 10 Most Critical Web Application Security Risks. https:\/\/www.owasp.org\/index.php\/Category: OWASP_Top_Ten_Project."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3188720"},{"key":"e_1_3_2_1_45_1","volume-title":"2018 IEEE 18th International Working Conference on Source Code Analysis and Manipulation (SCAM). 103\u2013112","author":"Sas D.","unstructured":"D. Sas , M. Bessi , and F. A. Fontana . 2018. {Research Paper} Automatic Detection of Sources and Sinks in Arbitrary Java Libraries . In 2018 IEEE 18th International Working Conference on Source Code Analysis and Manipulation (SCAM). 103\u2013112 . D. Sas, M. Bessi, and F. A. Fontana. 2018. {Research Paper} Automatic Detection of Sources and Sinks in Arbitrary Java Libraries. In 2018 IEEE 18th International Working Conference on Source Code Analysis and Manipulation (SCAM). 103\u2013112."},{"key":"e_1_3_2_1_46_1","unstructured":"Java Spring. {n. d.}. Java Spring. https:\/\/spring.io\/.  Java Spring. {n. d.}. Java Spring. https:\/\/spring.io\/."},{"key":"e_1_3_2_1_47_1","series-title":"Series B (Methodological)","volume-title":"Cross-validatory choice and assessment of statistical predictions. Journal of the royal statistical society","author":"Stone M.","year":"1974","unstructured":"M. Stone . 1974. Cross-validatory choice and assessment of statistical predictions. Journal of the royal statistical society . Series B (Methodological) ( 1974 ), 111\u2013147. M. Stone. 1974. Cross-validatory choice and assessment of statistical predictions. Journal of the royal statistical society. Series B (Methodological) (1974), 111\u2013147."},{"key":"e_1_3_2_1_48_1","unstructured":"Pebble Templates. {n. d.}. Pebble. https:\/\/pebbletemplates.io\/.  Pebble Templates. {n. d.}. Pebble. https:\/\/pebbletemplates.io\/."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3173574.3173836"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3122822"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660339"},{"key":"e_1_3_2_1_52_1","volume-title":"{n. d.}. SWAN and SWAN Assist github repository. https:\/\/github.com\/secure-software-engineering\/swan. Online","author":"Paderborn University and Fraunhofer IEM","year":"2018","unstructured":"Paderborn University and Fraunhofer IEM . {n. d.}. SWAN and SWAN Assist github repository. https:\/\/github.com\/secure-software-engineering\/swan. Online ; published 03 November 2018 . Paderborn University and Fraunhofer IEM. {n. d.}. SWAN and SWAN Assist github repository. https:\/\/github.com\/secure-software-engineering\/swan. Online; published 03 November 2018."},{"key":"e_1_3_2_1_53_1","volume-title":"Soot Framework: Is It Feasible?. In CC. 18\u201334.","author":"Vall\u00e9e-Rai R.","year":"2000","unstructured":"R. Vall\u00e9e-Rai , E. Gagnon , L. J. Hendren , P. Lam , P. Pominville , and V. Sundaresan . 2000 . Optimizing Java Bytecode Using the Soot Framework: Is It Feasible?. In CC. 18\u201334. R. Vall\u00e9e-Rai, E. Gagnon, L. J. Hendren, P. Lam, P. Pominville, and V. Sundaresan. 2000. Optimizing Java Bytecode Using the Soot Framework: Is It Feasible?. In CC. 18\u201334."}],"event":{"name":"ISSTA '19: 28th ACM SIGSOFT International Symposium on Software Testing and Analysis","location":"Beijing China","acronym":"ISSTA '19","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3293882.3330556","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3293882.3330556","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T00:43:50Z","timestamp":1750207430000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3293882.3330556"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,7,10]]},"references-count":53,"alternative-id":["10.1145\/3293882.3330556","10.1145\/3293882"],"URL":"https:\/\/doi.org\/10.1145\/3293882.3330556","relation":{},"subject":[],"published":{"date-parts":[[2019,7,10]]},"assertion":[{"value":"2019-07-10","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}