{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,10]],"date-time":"2026-10-10T03:21:53Z","timestamp":1791602513963,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":71,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T00:00:00Z","timestamp":1726012800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Australian Research Council","award":["DE23010047, DE23010047"],"award-info":[{"award-number":["DE23010047, DE23010047"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,9,11]]},"DOI":"10.1145\/3650212.3680313","type":"proceedings-article","created":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T07:44:25Z","timestamp":1726040665000},"page":"691-703","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":50,"title":["An Empirical Study of Static Analysis Tools for Secure Code Review"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9814-3514","authenticated-orcid":false,"given":"Wachiraphan","family":"Charoenwet","sequence":"first","affiliation":[{"name":"The University of Melbourne, Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6328-8839","authenticated-orcid":false,"given":"Patanamon","family":"Thongtanunam","sequence":"additional","affiliation":[{"name":"The University of Melbourne, Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9871-3695","authenticated-orcid":false,"given":"Van-Thuan","family":"Pham","sequence":"additional","affiliation":[{"name":"The University of Melbourne, Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6919-2149","authenticated-orcid":false,"given":"Christoph","family":"Treude","sequence":"additional","affiliation":[{"name":"Singapore Management University, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,9,11]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"[n. d.]. About comparing branches in pull requests - GitHub Docs. https:\/\/docs.github.com\/en\/pull-requests\/collaborating-with-pull-requests\/proposing-changes-to-your-work-with-pull-requests\/about-comparing-branches-in-pull-requests\/"},{"key":"e_1_3_2_1_2_1","unstructured":"[n. d.]. CTR51-CPP. Use valid references pointers and iterators to reference elements of a container - SEI CERT C++ Coding Standard - Confluence. https:\/\/wiki.sei.cmu.edu\/confluence\/display\/cplusplus\/CTR51-CPP.+Use+valid+references"},{"key":"e_1_3_2_1_3_1","unstructured":"[n. d.]. CVE | Overview. https:\/\/www.cve.org\/About\/Overview"},{"key":"e_1_3_2_1_4_1","unstructured":"2015. NVD - CVE-2015-8895. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-8895"},{"key":"e_1_3_2_1_5_1","unstructured":"2015. NVD - CVE-2015-9059. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-9059"},{"key":"e_1_3_2_1_6_1","unstructured":"2017. NVD - CVE-2017-12997. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-12997"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"2017. NVD - CVE-2017-13040. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-13040","DOI":"10.5465\/AMBPP.2017.13040abstract"},{"key":"e_1_3_2_1_8_1","unstructured":"2017. NVD - CVE-2017-13083. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-13083"},{"key":"e_1_3_2_1_9_1","unstructured":"2018. NVD - CVE-2018-17294. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-17294"},{"key":"e_1_3_2_1_10_1","unstructured":"2018. NVD - CVE-2018-7186. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-7186"},{"key":"e_1_3_2_1_11_1","unstructured":"2018. NVD - CVE-2018-7485. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-7485"},{"key":"e_1_3_2_1_12_1","unstructured":"2020. NVD - CVE-2020-5260. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-5260"},{"key":"e_1_3_2_1_13_1","unstructured":"2021. Standard LGTM queries for C\/C++. https:\/\/github.com\/github\/codeql\/blob\/main\/cpp\/ql\/src\/codeql-suites\/cpp-lgtm.qls"},{"key":"e_1_3_2_1_14_1","unstructured":"2022. Clang-Tidy Checkers. https:\/\/releases.llvm.org\/13.0.1\/tools\/clang\/tools\/extra\/docs\/clang-tidy\/checks\/list.html"},{"key":"e_1_3_2_1_15_1","unstructured":"2023. CWE - CWE-457: Use of Uninitialized Variable (4.12). https:\/\/cwe.mitre.org\/data\/definitions\/457.html"},{"key":"e_1_3_2_1_16_1","unstructured":"2023. CWE - CWE-664: Improper Control of a Resource Through its Lifetime (4.12). https:\/\/cwe.mitre.org\/data\/definitions\/664.html"},{"key":"e_1_3_2_1_17_1","unstructured":"2023. CWE - CWE-699: Software Development (4.12). https:\/\/cwe.mitre.org\/data\/definitions\/699.html"},{"key":"e_1_3_2_1_18_1","unstructured":"2023. CWE - CWE-825: Expired Pointer Dereference (4.12). https:\/\/cwe.mitre.org\/data\/definitions\/825.html"},{"key":"e_1_3_2_1_19_1","unstructured":"2023. Flawfinder. https:\/\/dwheeler.com\/flawfinder\/"},{"key":"e_1_3_2_1_20_1","unstructured":"2023. Infer Static Analyzer. https:\/\/fbinfer.com\/"},{"key":"e_1_3_2_1_21_1","unstructured":"2023. Source Code Security Analyzers - NIST. https:\/\/www.nist.gov\/itl\/ssd\/software-quality-group\/source-code-security-analyzers"},{"key":"e_1_3_2_1_22_1","unstructured":"2024. Clang Checkers. https:\/\/clang.llvm.org\/docs\/analyzer\/checkers.html"},{"key":"e_1_3_2_1_23_1","unstructured":"2024. CodeChecker. https:\/\/codechecker.readthedocs.io\/en\/latest\/"},{"key":"e_1_3_2_1_24_1","unstructured":"2024. CodeQL. https:\/\/codeql.github.com\/"},{"key":"e_1_3_2_1_25_1","unstructured":"2024. Cppcheck - A tool for static C\/C++ code analysis. https:\/\/cppcheck.sourceforge.io\/"},{"key":"e_1_3_2_1_26_1","unstructured":"2024. Infer - Issue types. https:\/\/fbinfer.com\/docs\/all-issue-types\/"},{"key":"e_1_3_2_1_27_1","unstructured":"2024. terryyin\/lizard: A simple code complexity analyser without caring about the C\/C++ header files or Java imports supports most of the popular languages. https:\/\/github.com\/terryyin\/lizard"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2017.77"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.JSS.2019.110427"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2013.6606642"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2597073.2597082"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2016.105"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3540250.3549135"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00054"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","unstructured":"Wachiraphan Charoenwet Patanamon Thongtanunam Van-Thuan Pham and Christoph Treude. 2024. An Extensible Automated Benchmarking Framework for Static Analysis Tool Evaluation Using Open-Source Code Commits. 10.5281\/zenodo.10259921","DOI":"10.5281\/zenodo.10259921"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","unstructured":"Wachiraphan Charoenwet Patanamon Thongtanunam Van-Thuan Pham and Christoph Treude. 2024. Dataset for An Empirical Study of Static Analysis Tools for Secure Code Review. 10.5281\/zenodo.12653656","DOI":"10.5281\/zenodo.12653656"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970347"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2016.30"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/996821.996823"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.INFSOF.2015.08.002"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2018.00009"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3428334"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/1414004.1414013"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER53432.2022.00121"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3140868"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2012.123"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3528432"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616262"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534380"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2008.71"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-022-10232-4"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3473932"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2016.25"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534374"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/EDCC.2017.16"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2015.7081826"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.INFSOF.2009.04.013"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491411"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00049"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.76"},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/VLHCC.2017.8103456"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1145\/1082983.1083147"},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.2507\/31ST.DAAAM.PROCEEDINGS.078"},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/3127005.3127014"},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1145\/2351676.2351685"},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","unstructured":"Alexander Trautsch Steffen Herbold and Jens Grabowski. 2023. Are automated static analysis tools worth it? An investigation into relative warning density and external software quality on the example of Apache open source projects. Empirical Software Engineering 28 3 (6 2023) 1\u201321. issn:15737616 10.1007\/S10664-023-10301-2","DOI":"10.1007\/S10664-023-10301-2"},{"key":"e_1_3_2_1_67_1","volume-title":"Java, C++, Objective-C, C#, PHP, Visual Basic, Python, Perl, and Ruby. Journal of Technology Research","author":"Turner Stephen","year":"2014","unstructured":"Stephen Turner. 2014. Security vulnerabilities of the top ten programming languages: C, Java, C++, Objective-C, C#, PHP, Visual Basic, Python, Perl, and Ruby. Journal of Technology Research (2014), 1\u201316. http:\/\/gauss.ececs.uc.edu\/Courses\/c6056\/pdf\/131731.pdf"},{"key":"e_1_3_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-019-09750-5"},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2307.12488"},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2020.3023177"},{"key":"e_1_3_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2022.3150238"}],"event":{"name":"ISSTA '24: 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis","location":"Vienna Austria","acronym":"ISSTA '24","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","AITO"]},"container-title":["Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3650212.3680313","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3650212.3680313","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T18:50:07Z","timestamp":1750272607000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3650212.3680313"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,11]]},"references-count":71,"alternative-id":["10.1145\/3650212.3680313","10.1145\/3650212"],"URL":"https:\/\/doi.org\/10.1145\/3650212.3680313","relation":{},"subject":[],"published":{"date-parts":[[2024,9,11]]},"assertion":[{"value":"2024-09-11","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}