{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,20]],"date-time":"2025-06-20T04:08:56Z","timestamp":1750392536444,"version":"3.41.0"},"reference-count":55,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","funder":[{"name":"National Science Foundation","award":["CCF-2100015"],"award-info":[{"award-number":["CCF-2100015"]}]},{"name":"National Science Foundation","award":["CCF-2100037"],"award-info":[{"award-number":["CCF-2100037"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2025,6,19]]},"abstract":"<jats:p>Dynamic taint tracking is a program analysis that traces the flow of information through a program. In the Java virtual machine (JVM), there are two prominent approaches for dynamic taint tracking: \"shadowing\" and \"mirroring\". Shadowing is able to precisely track information flows, but is also prone to disrupting the semantics of the program under analysis. Mirroring is better able to preserve program semantics, but often inaccurate. The limitations of these approaches are further exacerbated by features introduced in the latest Java versions. In this paper, we propose Galette, an approach for dynamic taint tracking in the JVM that combines aspects of both shadowing and mirroring to provide precise, robust taint tag propagation in modern JVMs. On a benchmark suite of 3,451 synthetic Java programs, we found that Galette was able to propagate taint tags with perfect accuracy while preserving program semantics on all four active long-term support versions of Java. We also found that Galette's runtime and memory overheads were competitive with that of two state-of-the-art dynamic taint tracking systems on a benchmark suite of twenty real-world Java programs.<\/jats:p>","DOI":"10.1145\/3729349","type":"journal-article","created":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T15:15:34Z","timestamp":1750346134000},"page":"1757-1779","source":"Crossref","is-referenced-by-count":0,"title":["Dynamic Taint Tracking for Modern Java Virtual Machines"],"prefix":"10.1145","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4397-1635","authenticated-orcid":false,"given":"Katherine","family":"Hough","sequence":"first","affiliation":[{"name":"Northeastern University, Boston, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1187-9298","authenticated-orcid":false,"given":"Jonathan","family":"Bell","sequence":"additional","affiliation":[{"name":"Northeastern University, Boston, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,6,19]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the 37th IEEE\/ACM International Conference on Automated Software Engineering (ASE \u201922)","author":"Aldrich Mark W.","year":"2023","unstructured":"Mark W. Aldrich, Alexi Turcotte, Matthew Blanco, and Frank Tip. 2023. Augur: Dynamic Taint Analysis for Asynchronous JavaScript. In Proceedings of the 37th IEEE\/ACM International Conference on Automated Software Engineering (ASE \u201922). Association for Computing Machinery, New York, NY, USA. Article 153, 4 pages. isbn:9781450394758 https:\/\/doi.org\/10.1145\/3551349.3559522 10.1145\/3551349.3559522"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1002\/stvr.1486"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the 9th USENIX Conference on Operating Systems Design and Implementation (OSDI \u201910)","author":"Attariyan Mona","year":"2010","unstructured":"Mona Attariyan and Jason Flinn. 2010. Automating Configuration Troubleshooting with Dynamic Information Flow Analysis. In Proceedings of the 9th USENIX Conference on Operating Systems Design and Implementation (OSDI \u201910). USENIX Association, USA. 237\u2013250."},{"key":"e_1_2_1_4_1","volume-title":"Proc. ACM Program. Lang., 1, OOPSLA","author":"Barrett Edd","year":"2017","unstructured":"Edd Barrett, Carl Friedrich Bolz-Tereick, Rebecca Killick, Sarah Mount, and Laurence Tratt. 2017. Virtual machine warmup blows hot and cold. Proc. ACM Program. Lang., 1, OOPSLA (2017), Article 52, oct, 27 pages. https:\/\/doi.org\/10.1145\/3133876 10.1145\/3133876"},{"key":"e_1_2_1_5_1","volume-title":"Proceedings of the 2014 ACM International Conference on Object Oriented Programming Systems Languages & Applications (OOPSLA \u201914)","author":"Bell Jonathan","year":"2014","unstructured":"Jonathan Bell and Gail Kaiser. 2014. Phosphor: Illuminating Dynamic Data Flow in Commodity Jvms. In Proceedings of the 2014 ACM International Conference on Object Oriented Programming Systems Languages & Applications (OOPSLA \u201914). ACM, New York, NY, USA. 83\u2013101. isbn:978-1-4503-2585-1 https:\/\/doi.org\/10.1145\/2660193.2660212 10.1145\/2660193.2660212"},{"key":"e_1_2_1_6_1","unstructured":"Jonathan Bell and Phosphor Contributors. 2024. Phosphor. https:\/\/central.sonatype.com\/artifact\/edu.gmu.swe.phosphor\/Phosphor"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the 21st Annual ACM SIGPLAN Conference on Object-Oriented Programming Systems, Languages, and Applications (OOPSLA \u201906)","author":"Blackburn Stephen M.","year":"2006","unstructured":"Stephen M. Blackburn, Robin Garner, Chris Hoffmann, Asjad M. Khang, Kathryn S. McKinley, Rotem Bentzur, Amer Diwan, Daniel Feinberg, Daniel Frampton, Samuel Z. Guyer, Martin Hirzel, Antony Hosking, Maria Jump, Han Lee, J. Eliot B. Moss, Aashish Phansalkar, Darko Stefanovi\u0107, Thomas VanDrunen, Daniel von Dincklage, and Ben Wiedermann. 2006. The DaCapo benchmarks: java benchmarking development and analysis. In Proceedings of the 21st Annual ACM SIGPLAN Conference on Object-Oriented Programming Systems, Languages, and Applications (OOPSLA \u201906). Association for Computing Machinery, New York, NY, USA. 169\u2013190. isbn:1595933484 https:\/\/doi.org\/10.1145\/1167473.1167488 10.1145\/1167473.1167488"},{"key":"e_1_2_1_8_1","unstructured":"Pierre Carbonnelle. 2024. PYPL PopularitY of Programming Language Index. https:\/\/pypl.github.io\/PYPL.html"},{"key":"e_1_2_1_9_1","volume-title":"Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007","author":"Chandra D.","year":"2007","unstructured":"D. Chandra and M. Franz. 2007. Fine-Grained Information Flow Analysis and Enforcement in a Java Virtual Machine. In Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007). IEEE Computer Society, 463\u2013475. https:\/\/doi.org\/10.1109\/ACSAC.2007.37 10.1109\/ACSAC.2007.37"},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the 2009 ACM Workshop on Secure Web Services (SWS \u201909)","author":"Chin Erika","year":"2009","unstructured":"Erika Chin and David Wagner. 2009. Efficient Character-Level Taint Tracking for Java. In Proceedings of the 2009 ACM Workshop on Secure Web Services (SWS \u201909). Association for Computing Machinery, New York, NY, USA. 3\u201312. isbn:9781605587899 https:\/\/doi.org\/10.1145\/1655121.1655125 10.1145\/1655121.1655125"},{"key":"e_1_2_1_11_1","volume-title":"Proceedings of the Eighteenth International Symposium on Software Testing and Analysis (ISSTA \u201909)","author":"Clause James","year":"2009","unstructured":"James Clause and Alessandro Orso. 2009. Penumbra: Automatically Identifying Failure-relevant Inputs Using Dynamic Tainting. In Proceedings of the Eighteenth International Symposium on Software Testing and Analysis (ISSTA \u201909). ACM, New York, NY, USA. 249\u2013260. isbn:978-1-60558-338-9 https:\/\/doi.org\/10.1145\/1572272.1572301 10.1145\/1572272.1572301"},{"key":"e_1_2_1_12_1","volume-title":"SpanDex: Secure Password Tracking for Android. In 23rd USENIX Security Symposium (USENIX Security 14)","author":"Cox Landon P.","year":"2014","unstructured":"Landon P. Cox, Peter Gilbert, Geoffrey Lawler, Valentin Pistol, Ali Razeen, Bi Wu, and Sai Cheemalapati. 2014. SpanDex: Secure Password Tracking for Android. In 23rd USENIX Security Symposium (USENIX Security 14). USENIX Association, San Diego, CA. 481\u2013494. isbn:978-1-931971-15-7 https:\/\/www.usenix.org\/conference\/usenixsecurity14\/technical-sessions\/presentation\/cox"},{"key":"e_1_2_1_13_1","unstructured":"DaCapo Project Contributors. 2023. dacapo-23.11-chopin RELEASE NOTES 2023-11. https:\/\/github.com\/dacapobench\/dacapobench\/blob\/fd292e92f8c40495a6ca05ff3b8a77c6c4265606\/benchmarks\/RELEASE_NOTES.md"},{"key":"e_1_2_1_14_1","unstructured":"DaCapo Project Contributors. 2023. The DaCapo Benchmark Suite (version dacapo-23.11-chopin). https:\/\/github.com\/dacapobench\/dacapobench\/releases\/tag\/v23.11-chopin"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3540250.3549126"},{"key":"e_1_2_1_16_1","volume-title":"TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones. In 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI 10)","author":"Enck William","unstructured":"William Enck, Peter Gilbert, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth. 2010. TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones. In 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI 10). USENIX Association, Vancouver, BC. https:\/\/www.usenix.org\/conference\/osdi10\/taintdroid-information-flow-tracking-system-realtime-privacy-monitoring"},{"key":"e_1_2_1_17_1","first-page":"1","article-title":"The Daikon system for dynamic detection of likely invariants","volume":"69","author":"Ernst Michael D.","year":"2007","unstructured":"Michael D. Ernst, Jeff H. Perkins, Philip J. Guo, Stephen McCamant, Carlos Pacheco, Matthew S. Tschantz, and Chen Xiao. 2007. The Daikon system for dynamic detection of likely invariants. Science of Computer Programming, 69, 1\u20133 (2007), Dec., 35\u201345.","journal-title":"Science of Computer Programming"},{"key":"e_1_2_1_18_1","volume-title":"Dynamic Taint Propagation for Java. In Computer Security Applications Conference, Annual. IEEE Computer Society","author":"Franz M.","year":"2005","unstructured":"M. Franz, D. Chandra, and V. Haldar. 2005. Dynamic Taint Propagation for Java. In Computer Security Applications Conference, Annual. IEEE Computer Society, Los Alamitos, CA, USA. 303\u2013311. issn:1063-9527 https:\/\/doi.org\/10.1109\/CSAC.2005.21 10.1109\/CSAC.2005.21"},{"key":"e_1_2_1_19_1","volume-title":"2009 IEEE 31st International Conference on Software Engineering. 474\u2013484","author":"Ganesh Vijay","year":"2009","unstructured":"Vijay Ganesh, Tim Leek, and Martin Rinard. 2009. Taint-based directed whitebox fuzzing. In 2009 IEEE 31st International Conference on Software Engineering. 474\u2013484. https:\/\/doi.org\/10.1109\/ICSE.2009.5070546 10.1109\/ICSE.2009.5070546"},{"key":"e_1_2_1_20_1","volume-title":"Proceedings of the 22nd Annual ACM SIGPLAN Conference on Object-Oriented Programming Systems, Languages and Applications (OOPSLA \u201907)","author":"Georges Andy","year":"2007","unstructured":"Andy Georges, Dries Buytaert, and Lieven Eeckhout. 2007. Statistically rigorous java performance evaluation. In Proceedings of the 22nd Annual ACM SIGPLAN Conference on Object-Oriented Programming Systems, Languages and Applications (OOPSLA \u201907). Association for Computing Machinery, New York, NY, USA. 57\u201376. isbn:9781595937865 https:\/\/doi.org\/10.1145\/1297027.1297033 10.1145\/1297027.1297033"},{"key":"e_1_2_1_21_1","volume-title":"Proceedings of the 14th ACM SIGSOFT International Symposium on Foundations of Software Engineering (SIGSOFT \u201906\/FSE-14)","author":"Halfond William G. J.","year":"2006","unstructured":"William G. J. Halfond, Alessandro Orso, and Panagiotis Manolios. 2006. Using Positive Tainting and Syntax-aware Evaluation to Counter SQL Injection Attacks. In Proceedings of the 14th ACM SIGSOFT International Symposium on Foundations of Software Engineering (SIGSOFT \u201906\/FSE-14). ACM, New York, NY, USA. 175\u2013185. isbn:1-59593-468-5 https:\/\/doi.org\/10.1145\/1181775.1181797 10.1145\/1181775.1181797"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","unstructured":"Katherine Hough and Jonathan Bell. 2025. Artifact for \"Dynamic Taint Tracking for Modern Java Virtual Machines\". 4 https:\/\/doi.org\/10.6084\/m9.figshare.26880619.v2 10.6084\/m9.figshare.26880619.v2","DOI":"10.6084\/m9.figshare.26880619.v2"},{"key":"e_1_2_1_23_1","volume-title":"Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering (ICSE \u201920)","author":"Hough Katherine","year":"2020","unstructured":"Katherine Hough, Gebrehiwet Welearegai, Christian Hammer, and Jonathan Bell. 2020. Revealing Injection Vulnerabilities by Leveraging Existing Tests. In Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering (ICSE \u201920). Association for Computing Machinery, New York, NY, USA. 284\u2013296. isbn:9781450371216 https:\/\/doi.org\/10.1145\/3377811.3380326 10.1145\/3377811.3380326"},{"key":"e_1_2_1_24_1","volume-title":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE","author":"Huo Chen","year":"2014","unstructured":"Chen Huo and James Clause. 2014. Improving Oracle Quality by Detecting Brittle Assertions and Unused Inputs in Tests. In Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE 2014). ACM, New York, NY, USA. 621\u2013631. isbn:978-1-4503-3056-5 https:\/\/doi.org\/10.1145\/2635868.2635917 10.1145\/2635868.2635917"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2018.2878020"},{"key":"e_1_2_1_26_1","volume-title":"ICSE 2009, Proceedings of the 31st International Conference on Software Engineering","author":"Kie\u017cun Adam","unstructured":"Adam Kie\u017cun, Philip J. Guo, Karthick Jayaraman, and Michael D. Ernst. 2009. Automatic creation of SQL injection and cross-site scripting attacks. In ICSE 2009, Proceedings of the 31st International Conference on Software Engineering. Vancouver, BC, Canada. 199\u2013209."},{"key":"e_1_2_1_27_1","volume-title":"Proceedings of the 44th International Conference on Software Engineering (ICSE \u201922)","author":"Kukucka James","year":"2022","unstructured":"James Kukucka, Lu\u00eds Pina, Paul Ammann, and Jonathan Bell. 2022. CONFETTI: Amplifying Concolic Guidance for Fuzzers. In Proceedings of the 44th International Conference on Software Engineering (ICSE \u201922). Association for Computing Machinery, New York, NY, USA. 438\u2013450. isbn:9781450392211 https:\/\/doi.org\/10.1145\/3510003.3510628 10.1145\/3510003.3510628"},{"key":"e_1_2_1_28_1","unstructured":"Tim Lindholm Frank Yellin Gilad Bracha Alex Buckley and Daniel Smith. 2013. The Java Virtual Machine Specification: Java SE 21 Edition. https:\/\/docs.oracle.com\/javase\/specs\/jvms\/se21\/jvms21.pdf"},{"key":"e_1_2_1_29_1","volume-title":"Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI \u201908)","author":"McCamant Stephen","unstructured":"Stephen McCamant and Michael D. Ernst. 2008. Quantitative Information Flow As Network Flow Capacity. In Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI \u201908). ACM, New York, NY, USA. 193\u2013205. isbn:978-1-59593-860-2 https:\/\/doi.org\/10.1145\/1375581.1375606 10.1145\/1375581.1375606"},{"key":"e_1_2_1_30_1","unstructured":"MirrorTaint Contributors. 2023. MirrorTaint (commit 54fcbfc). https:\/\/github.com\/MirrorTaint\/MirrorTaint"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.entcs.2007.10.010"},{"key":"e_1_2_1_32_1","unstructured":"New Relic Inc.. 2023. 2023 State of the Java Ecosystem. New Relic Inc.. https:\/\/newrelic.com\/sites\/default\/files\/2023-04\/new-relic-2023-state-of-the-java-ecosystem-2023-04-20.pdf"},{"key":"e_1_2_1_33_1","unstructured":"Oracle Corporation. 2023. Java Platform Standard Edition & Java Development Kit: Version 11 API Specification. https:\/\/docs.oracle.com\/en\/java\/javase\/11\/docs\/api\/index.html"},{"key":"e_1_2_1_34_1","unstructured":"Oracle Corporation. 2023. Java Platform Standard Edition & Java Development Kit: Version 21 API Specification. https:\/\/docs.oracle.com\/en\/java\/javase\/21\/docs\/api\/index.html"},{"key":"e_1_2_1_35_1","unstructured":"Oracle Corporation. 2023. JDK Releases. https:\/\/www.java.com\/releases\/"},{"key":"e_1_2_1_36_1","unstructured":"Oracle Corporation. 2024. Java Native Interface: Introduction. https:\/\/docs.oracle.com\/en\/java\/javase\/21\/docs\/specs\/jni\/intro.html"},{"key":"e_1_2_1_37_1","unstructured":"Oracle Corporation. 2024. jlink Tool Reference. https:\/\/docs.oracle.com\/en\/java\/javase\/11\/tools\/jlink.html"},{"key":"e_1_2_1_38_1","unstructured":"Oracle Corporation. 2024. JSR 292: Supporting Dynamically Typed Languages on the Java Platform. https:\/\/jcp.org\/en\/jsr\/detail?id=292"},{"key":"e_1_2_1_39_1","unstructured":"Oracle Corporation. 2024. JSR 376: Java Platform Module System. https:\/\/www.jcp.org\/en\/jsr\/detail?id=376"},{"key":"e_1_2_1_40_1","volume-title":"MirrorTaint: Practical Non-intrusive Dynamic Taint Tracking for JVM-based Microservice Systems. In 2023 IEEE\/ACM 45th International Conference on Software Engineering (ICSE). 2514\u20132526","author":"Ouyang Yicheng","year":"2023","unstructured":"Yicheng Ouyang, Kailai Shao, Kunqiu Chen, Ruobing Shen, Chao Chen, Mingze Xu, Yuqun Zhang, and Lingming Zhang. 2023. MirrorTaint: Practical Non-intrusive Dynamic Taint Tracking for JVM-based Microservice Systems. In 2023 IEEE\/ACM 45th International Conference on Software Engineering (ICSE). 2514\u20132526. https:\/\/doi.org\/10.1109\/ICSE48619.2023.00210 10.1109\/ICSE48619.2023.00210"},{"key":"e_1_2_1_41_1","unstructured":"OW2 Consortium. 2024. ASM (version 9.6). https:\/\/asm.ow2.io\/"},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC\/FSE","author":"Pauck Felix","year":"2018","unstructured":"Felix Pauck, Eric Bodden, and Heike Wehrheim. 2018. Do Android Taint Analysis Tools Keep Their Promises? In Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC\/FSE 2018). ACM, New York, NY, USA. 331\u2013341. isbn:978-1-4503-5573-5 https:\/\/doi.org\/10.1145\/3236024.3236029 10.1145\/3236024.3236029"},{"key":"e_1_2_1_43_1","volume-title":"Comprehensive Java Metadata Tracking for Attack Detection and Repair. In 2020 50th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN). 39\u201351","author":"Perkins Jeff","year":"2020","unstructured":"Jeff Perkins, Jordan Eikenberry, Allessandro Coglio, and Martin Rinard. 2020. Comprehensive Java Metadata Tracking for Attack Detection and Repair. In 2020 50th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN). 39\u201351. https:\/\/doi.org\/10.1109\/DSN48063.2020.00024 10.1109\/DSN48063.2020.00024"},{"key":"e_1_2_1_44_1","unstructured":"Phosphor Contributors. 2018. Phosphor Issue #62. https:\/\/github.com\/gmu-swe\/phosphor\/issues\/62"},{"key":"e_1_2_1_45_1","volume-title":"Proceedings of the 39th Annual IEEE\/ACM International Symposium on Microarchitecture (MICRO 39)","author":"Qin Feng","year":"2006","unstructured":"Feng Qin, Cheng Wang, Zhenmin Li, Ho-seop Kim, Yuanyuan Zhou, and Youfeng Wu. 2006. LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks. In Proceedings of the 39th Annual IEEE\/ACM International Symposium on Microarchitecture (MICRO 39). IEEE Computer Society, USA. 135\u2013148. isbn:0769527329 https:\/\/doi.org\/10.1109\/MICRO.2006.29 10.1109\/MICRO.2006.29"},{"key":"e_1_2_1_46_1","volume-title":"VUzzer: Application-aware Evolutionary Fuzzing. In 24th Annual Network and Distributed System Security Symposium, NDSS. The Internet Society, USA. https:\/\/doi.org\/10","author":"Rawat Sanjay","year":"2017","unstructured":"Sanjay Rawat, Vivek Jain, Ashish Kumar, Lucian Cojocar, Cristiano Giuffrida, and Herbert Bos. 2017. VUzzer: Application-aware Evolutionary Fuzzing. In 24th Annual Network and Distributed System Security Symposium, NDSS. The Internet Society, USA. https:\/\/doi.org\/10.14722\/ndss.2017.23404 10.14722\/ndss.2017.23404"},{"key":"e_1_2_1_47_1","unstructured":"John Rose. 2013. Method handle invocation. https:\/\/wiki.openjdk.org\/display\/HotSpot\/Method+handle+invocation"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2002.806121"},{"key":"e_1_2_1_49_1","volume-title":"Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (CCS \u201913)","author":"Son Sooel","year":"2013","unstructured":"Sooel Son, Kathryn S. McKinley, and Vitaly Shmatikov. 2013. Diglossia: detecting code injection attacks with precision and efficiency. In Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (CCS \u201913). Association for Computing Machinery, New York, NY, USA. 1181\u20131192. isbn:9781450324779 https:\/\/doi.org\/10.1145\/2508859.2516696 10.1145\/2508859.2516696"},{"key":"e_1_2_1_50_1","volume-title":"TIOBE Index for","author":"TIOBE","year":"2024","unstructured":"TIOBE Software BV. 2024. TIOBE Index for January 2024. https:\/\/www.tiobe.com\/tiobe-index\/"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10247-x"},{"key":"e_1_2_1_52_1","first-page":"101","article-title":"A Critique and Improvement of the \"CL\" Common Language Effect Size Statistics of McGraw and Wong","volume":"25","author":"Vargha Andr\u00e1s","year":"2000","unstructured":"Andr\u00e1s Vargha and Harold D. Delaney. 2000. A Critique and Improvement of the \"CL\" Common Language Effect Size Statistics of McGraw and Wong. Journal of Educational and Behavioral Statistics, 25, 2 (2000), 101\u2013132. issn:10769986, 19351054 http:\/\/www.jstor.org\/stable\/1165329","journal-title":"Journal of Educational and Behavioral Statistics"},{"key":"e_1_2_1_53_1","volume-title":"2021 IEEE\/ACM 43rd International Conference on Software Engineering (ICSE). 1072\u20131084","author":"Velez Miguel","year":"2021","unstructured":"Miguel Velez, Pooyan Jamshidi, Norbert Siegmund, Sven Apel, and Christian K\u00e4stner. 2021. White-Box Analysis over Machine Learning: Modeling Performance of Configurable Systems. In 2021 IEEE\/ACM 43rd International Conference on Software Engineering (ICSE). 1072\u20131084. https:\/\/doi.org\/10.1109\/ICSE43902.2021.00100 10.1109\/ICSE43902.2021.00100"},{"key":"e_1_2_1_54_1","volume-title":"DisTA: Generic Dynamic Taint Tracking for Java-Based Distributed Systems. In 2022 52nd Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN). 547\u2013558","author":"Wang Dong","year":"2022","unstructured":"Dong Wang, Yu Gao, Wensheng Dou, and Jun Wei. 2022. DisTA: Generic Dynamic Taint Tracking for Java-Based Distributed Systems. In 2022 52nd Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN). 547\u2013558. https:\/\/doi.org\/10.1109\/DSN53405.2022.00060 10.1109\/DSN53405.2022.00060"},{"key":"e_1_2_1_55_1","volume-title":"TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection. In 2010 IEEE Symposium on Security and Privacy. 497\u2013512","author":"Wang T.","unstructured":"T. Wang, T. Wei, G. Gu, and W. Zou. 2010. TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection. In 2010 IEEE Symposium on Security and Privacy. 497\u2013512."}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3729349","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T15:31:12Z","timestamp":1750347072000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3729349"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,19]]},"references-count":55,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2025,6,19]]}},"alternative-id":["10.1145\/3729349"],"URL":"https:\/\/doi.org\/10.1145\/3729349","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,19]]}}}