{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:44:54Z","timestamp":1791459894750,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":79,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,4,12]],"date-time":"2024-04-12T00:00:00Z","timestamp":1712880000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272400"],"award-info":[{"award-number":["62272400"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,4,12]]},"DOI":"10.1145\/3597503.3639132","type":"proceedings-article","created":{"date-parts":[[2024,4,12]],"date-time":"2024-04-12T16:43:26Z","timestamp":1712940206000},"page":"1-13","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["LibAlchemy: A Two-Layer Persistent Summary Design for Taming Third-Party Libraries in Static Bug-Finding Systems"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4648-3795","authenticated-orcid":false,"given":"Rongxin","family":"Wu","sequence":"first","affiliation":[{"name":"Xiamen Key Laboratory of Intelligent Storage and Computing, School of Informatics, Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-7260-141X","authenticated-orcid":false,"given":"Yuxuan","family":"He","sequence":"additional","affiliation":[{"name":"Xiamen Key Laboratory of Intelligent Storage and Computing, School of Informatics, Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-1961-8438","authenticated-orcid":false,"given":"Jiafeng","family":"Huang","sequence":"additional","affiliation":[{"name":"Xiamen Key Laboratory of Intelligent Storage and Computing, School of Informatics, Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0617-5322","authenticated-orcid":false,"given":"Chengpeng","family":"Wang","sequence":"additional","affiliation":[{"name":"The Hong Kong University of Science and Technology, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4259-3321","authenticated-orcid":false,"given":"Wensheng","family":"Tang","sequence":"additional","affiliation":[{"name":"The Hong Kong University of Science and Technology, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8297-8998","authenticated-orcid":false,"given":"Qingkai","family":"Shi","sequence":"additional","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8174-7277","authenticated-orcid":false,"given":"Xiao","family":"Xiao","sequence":"additional","affiliation":[{"name":"Person, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6417-1034","authenticated-orcid":false,"given":"Charles","family":"Zhang","sequence":"additional","affiliation":[{"name":"The Hong Kong University of Science and Technology, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,4,12]]},"reference":[{"key":"e_1_3_2_1_1_1","first-page":"2013","author":"Web Application Security Project The Open","year":"2013","unstructured":"The Open Web Application Security Project. OWASP Top 10. https:\/\/owasp.org\/www-pdf-archive\/OWASP_Top_10_-_2013.pdf, 2013. [Online; accessed Jul-2023].","journal-title":"OWASP Top 10. https:\/\/owasp.org\/www-pdf-archive\/OWASP_Top_10_-_"},{"key":"e_1_3_2_1_2_1","first-page":"10","author":"Web Application Security Project The Open","year":"2017","unstructured":"The Open Web Application Security Project. OWASP Top 10. https:\/\/owasp.org\/www-project-top-ten\/2017\/Top_10, 2017. [Online; accessed Jul-2023].","journal-title":"OWASP Top 10. https:\/\/owasp.org\/www-project-top-ten\/"},{"key":"e_1_3_2_1_3_1","first-page":"10","author":"Web Application Security Project The Open","year":"2021","unstructured":"The Open Web Application Security Project. OWASP Top 10. https:\/\/owasp.org\/Top10\/, 2021. [Online; accessed 10-Jan-2022].","journal-title":"OWASP Top 10. https:\/\/owasp.org\/Top10\/"},{"key":"e_1_3_2_1_4_1","volume-title":"Black Duck Software Composition Analysis. https:\/\/www.blackducksoftware.com\/","author":"Synopsys Inc.","year":"2022","unstructured":"Synopsys Inc. Black Duck Software Composition Analysis. https:\/\/www.blackducksoftware.com\/, 2022. [Online; accessed 7-Dec-2022]."},{"key":"e_1_3_2_1_5_1","volume-title":"HP Fortify Software Composition Analysis. https:\/\/www.microfocus.com\/en-us\/cyberres\/application-security\/software-composition-analysis","author":"Micro Focus Inc.","year":"2022","unstructured":"Micro Focus Inc. HP Fortify Software Composition Analysis. https:\/\/www.microfocus.com\/en-us\/cyberres\/application-security\/software-composition-analysis, 2022. [Online; accessed 7-Dec-2022]."},{"key":"e_1_3_2_1_6_1","volume-title":"Snyk Software Composition Analysis. https:\/\/snyk.io\/series\/open-source-security\/software-composition-analysis-sca\/","author":"Limited Snyk","year":"2022","unstructured":"Snyk Limited. Snyk Software Composition Analysis. https:\/\/snyk.io\/series\/open-source-security\/software-composition-analysis-sca\/, 2022. [Online; accessed 7-Dec-2022]."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00083"},{"key":"e_1_3_2_1_8_1","first-page":"3037","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Woo Seunghoon","year":"2022","unstructured":"Seunghoon Woo, Hyunji Hong, Eunjin Choi, and Heejo Lee. Movery: A precise approach for modified vulnerable code clone discovery from modified open-source software components. In 31st USENIX Security Symposium (USENIX Security 22), pages 3037--3053, 2022. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/woo."},{"key":"e_1_3_2_1_9_1","first-page":"1165","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Xiao Yang","year":"2020","unstructured":"Yang Xiao, Bihuan Chen, Chendong Yu, Zhengzi Xu, Zimu Yuan, Feng Li, Binghong Liu, Yang Liu, Wei Huo, Wei Zou, et al. Mvp: Detecting vulnerabilities using patch-enhanced vulnerability signatures. In 29th USENIX Security Symposium (USENIX Security 20), pages 1165--1182, 2020. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/xiao."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00150"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.62"},{"key":"e_1_3_2_1_12_1","volume-title":"A potential bug of NPD in opusfile. https:\/\/github.com\/xiph\/opusfile\/issues\/36","year":"2022","unstructured":"GitHub. A potential bug of NPD in opusfile. https:\/\/github.com\/xiph\/opusfile\/issues\/36, 2022. [Online; accessed Jul-2023]."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3150302"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2018.2827384"},{"key":"e_1_3_2_1_15_1","volume-title":"In 39th IEEE Symposium on Security and Privacy, 2018","author":"Gorski Peter Leo","year":"2018","unstructured":"Peter Leo Gorski, Luigi Lo Iacono, Yasemin Acar, Sebastian Moeller, Christian Stransky, and Sascha Fahl. On the effect of security warnings on cryptographic api misuse. In In 39th IEEE Symposium on Security and Privacy, 2018. https:\/\/www.usenix.org\/conference\/soups2018\/presentation\/gorski."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884816"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-19861-8_6"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-03542-0_21"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2676726.2676977"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2837614.2837628"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2048066.2048145"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/2771783.2771803"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2931037.2931044"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382223"},{"key":"e_1_3_2_1_25_1","volume-title":"Watson Research Center. The T. J. Watson Libraries for Analysis (WALA). https:\/\/github.com\/wala\/WALA","author":"IBM","year":"2022","unstructured":"IBM T.J. Watson Research Center. The T. J. Watson Libraries for Analysis (WALA). https:\/\/github.com\/wala\/WALA, 2022. [Online; accessed Nov-2022]."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/2666620.2666631"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2619091"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.4230\/LIPIcs.ECOOP.2021.2"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380390"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133923"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45306-7_3"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1007\/11688839_2"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78791-4_4"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2676726.2676997"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-54434-1_33"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.4230\/LIPIcs.SNAPL.2017.18"},{"key":"e_1_3_2_1_37_1","volume-title":"https:\/\/scan.coverity.com\/","author":"Synopsys Inc. Coverity Scan.","year":"2022","unstructured":"Synopsys Inc. Coverity Scan. https:\/\/scan.coverity.com\/, 2022. [Online; accessed 7-Dec-2022]."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-21690-4_19"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491956.2462188"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/199448.199462"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368088.1368118"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/1993498.1993565"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568243"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491411.2501854"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/32.58766"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3092703.3092705"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-54804-8_9"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/1232420.1232423"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/1040305.1040334"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454086"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3192366.3192418"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250789"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/3563339"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250789"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380425"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"e_1_3_2_1_57_1","volume-title":"dpkg(1). https:\/\/man7.org\/linux\/man-pages\/man1\/dpkg.1.html","author":"Linux","year":"2022","unstructured":"Linux manual page. dpkg(1). https:\/\/man7.org\/linux\/man-pages\/man1\/dpkg.1.html, 2022. [Online; accessed 12-Dec-2022]."},{"key":"e_1_3_2_1_58_1","unstructured":"Yum. Yum v3.4.3 documentation. http:\/\/yum.baseurl.org\/api\/yum\/ 2022. [Online; accessed 12-Dec-2022]."},{"key":"e_1_3_2_1_59_1","volume-title":"https:\/\/github.com\/ash1852\/fusion-scan.github.io?tab=readme-ov-file","author":"Alchemy All","year":"2022","unstructured":"All bug reports by libAlchemy. https:\/\/github.com\/ash1852\/fusion-scan.github.io?tab=readme-ov-file, 2022."},{"key":"e_1_3_2_1_60_1","volume-title":"https:\/\/scan.coverity.com\/projects","author":"Scan Coverity","year":"2022","unstructured":"Synopsys. Coverity Scan. https:\/\/scan.coverity.com\/projects, 2022. [Online; accessed Jul-2023]."},{"key":"e_1_3_2_1_61_1","volume-title":"https:\/\/gitlab.freedesktop.org\/xorg\/lib\/libxi\/-\/issues\/14","author":"Xi Bug","year":"2022","unstructured":"Bug report denied by libXi. https:\/\/gitlab.freedesktop.org\/xorg\/lib\/libxi\/-\/issues\/14, 2022."},{"key":"e_1_3_2_1_62_1","volume-title":"https:\/\/github.com\/transmission\/transmission\/issues\/3706","author":"Bug","year":"2022","unstructured":"Bug report denied by transmisson. https:\/\/github.com\/transmission\/transmission\/issues\/3706, 2022."},{"key":"e_1_3_2_1_63_1","unstructured":"Bug report denied by MariaDB. https:\/\/jira.mariadb.org\/browse\/MDEV-29891?filter=-2."},{"key":"e_1_3_2_1_64_1","first-page":"2010","volume-title":"The smt-libv2 language and tools: A tutorial. Language c","author":"Cok David R","year":"2011","unstructured":"David R Cok et al. The smt-libv2 language and tools: A tutorial. Language c, pages 2010--2011, 2011. https:\/\/smtlib.github.io\/jSMTLIB\/SMTLIBTutorial.pdf."},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1145\/24039.24041"},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1145\/77606.77608"},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2003.1238031"},{"key":"e_1_3_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1145\/302405.302675"},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.54"},{"key":"e_1_3_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1145\/2892208.2892235"},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/2555670.2466483"},{"key":"e_1_3_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1145\/2338965.2336784"},{"key":"e_1_3_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594299"},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.75"},{"key":"e_1_3_2_1_76_1","first-page":"213","volume-title":"ICAI","author":"Luk\u00e1cs D\u00e1niel","year":"2020","unstructured":"D\u00e1niel Luk\u00e1cs, Gergely Pongr\u00e1cz, and M\u00e1t\u00e9 Tejfel. Are graph databases fast enough for static p4 code analysis? In ICAI, pages 213--223, 2020. https:\/\/ceur-ws.org\/Vol-2650\/paper22.pdf."},{"key":"e_1_3_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1145\/3093337.3037744"},{"key":"e_1_3_2_1_78_1","doi-asserted-by":"publisher","DOI":"10.1145\/3302424.3303972"},{"key":"e_1_3_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454085"}],"event":{"name":"ICSE '24: IEEE\/ACM 46th International Conference on Software Engineering","location":"Lisbon Portugal","acronym":"ICSE '24","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","IEEE CS","Faculty of Engineering of University of Porto"]},"container-title":["Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3597503.3639132","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3597503.3639132","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T22:49:12Z","timestamp":1750286952000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3597503.3639132"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,12]]},"references-count":79,"alternative-id":["10.1145\/3597503.3639132","10.1145\/3597503"],"URL":"https:\/\/doi.org\/10.1145\/3597503.3639132","relation":{},"subject":[],"published":{"date-parts":[[2024,4,12]]},"assertion":[{"value":"2024-04-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}