{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,11]],"date-time":"2026-06-11T22:56:33Z","timestamp":1781218593701,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":63,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,6,15]],"date-time":"2026-06-15T00:00:00Z","timestamp":1781481600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Beijing Natural Science Foundation","award":["L243010"],"award-info":[{"award-number":["L243010"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,6,15]]},"DOI":"10.1145\/3814943.3816168","type":"proceedings-article","created":{"date-parts":[[2026,6,11]],"date-time":"2026-06-11T22:06:32Z","timestamp":1781215592000},"page":"57-69","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["SymFlow: Event-Chain-Aware Symbolic Execution for Serverless Sensitive Data Flow Detection"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-4610-3427","authenticated-orcid":false,"given":"Yuanpeng","family":"Wang","sequence":"first","affiliation":[{"name":"Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-2490-5671","authenticated-orcid":false,"given":"Zhineng","family":"Zhong","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7138-5030","authenticated-orcid":false,"given":"Zhenkai","family":"Liang","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7558-9137","authenticated-orcid":false,"given":"Ding","family":"Li","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5064-5286","authenticated-orcid":false,"given":"Yao","family":"Guo","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7366-5906","authenticated-orcid":false,"given":"Xiangqun","family":"Chen","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,15]]},"reference":[{"key":"e_1_3_2_1_1_1","first-page":"419","volume-title":"17th USENIX symposium on networked systems design and implementation (NSDI 20)","author":"Agache Alexandru","year":"2020","unstructured":"Alexandru Agache, Marc Brooker, Alexandra Iordache, Anthony Liguori, Rolf Neugebauer, Phil Piwonka, and Diana-Maria Popa. 2020. Firecracker: Lightweight virtualization for serverless applications. In 17th USENIX symposium on networked systems design and implementation (NSDI 20). 419-434."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.47191\/ijcsrr\/v7-i1-23"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3276488"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3552326.3567503"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568293"},{"key":"e_1_3_2_1_6_1","unstructured":"AWS. 2025. Serverless Computing -Amazon Web Services. https: \/\/aws.amazon.com\/serverless\/."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-5026-8_1"},{"key":"e_1_3_2_1_8_1","first-page":"209","volume-title":"OSDI","volume":"8","author":"Cadar Cristian","year":"2008","unstructured":"Cristian Cadar, Daniel Dunbar, Dawson R Engler, et al. 2008. Klee: unassisted and automatic generation of high-coverage tests for complex systems programs.. In OSDI, Vol. 8. 209-224."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-21333-5_39"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.9734\/ajrcos\/2023\/v16i4382"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274736"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380173"},{"key":"e_1_3_2_1_13_1","first-page":"2443","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Datta Pubali","year":"2022","unstructured":"Pubali Datta, Isaac Polinsky, Muhammad Adil Inam, Adam Bates, and William Enck. 2022. ALASTOR: Reconstructing the provenance of serverless intrusions. In 31st USENIX Security Symposium (USENIX Security 22). 2443-2460."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3064176.3064188"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-025-05371-4"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2021.3095466"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-009-0086-1"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.2507\/35th.daaam.proceedings.041"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1186\/s13677-021-00253-7"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598064"},{"key":"e_1_3_2_1_21_1","unstructured":"Sean Heide and Ory Segal. 2019. The 12 Most Critical Risks for Serverless Applications. Cloud Security Alliance Blog. https:\/\/cloudsecurityalliance.org\/blog\/2019\/02\/11\/critical-risksserverless-applications Published 2019-02-11. Accessed 2026-01-13."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1812.03651"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3360575"},{"key":"e_1_3_2_1_24_1","first-page":"4087","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Jegan Deepak Sirone","year":"2023","unstructured":"Deepak Sirone Jegan, Liang Wang, Siddhant Bhagat, and Michael Swift. 2023. Guarding serverless applications with Kalium. In 32nd USENIX Security Symposium (USENIX Security 23). 4087-4104."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","unstructured":"Eric Jonas Johann Schleier-Smith Vikram Sreekanti Chia-Che Tsai Anurag Khandelwal Qifan Pu Vaishaal Shankar Joao Carreira Karl Krauth Neeraja Yadwadkar et al. 2019. Cloud programming simplified: A berkeley view on serverless computing. arXiv preprint arXiv:1902.03383 (2019). doi:10.48550\/arXiv.1902.03383 10.48550\/arXiv.1902.03383","DOI":"10.48550\/arXiv.1902.03383"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/360248.360252"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/940071.940096"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.005.2100335"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3508360"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/CLOUD60044.2023.00068"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1186\/s13677-022-00347-w"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISDFS55398.2022.9800779"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCSW.2017.36"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.56975\/ijrar.v12i3.319048"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1186\/s13677-024-"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-44769-4_2"},{"key":"e_1_3_2_1_37_1","volume-title":"11th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud 19)","author":"Obetz Matthew","year":"2019","unstructured":"Matthew Obetz, Stacy Patterson, and Ana Milanova. 2019. Static call graph construction in AWS lambda serverless applications. In 11th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud 19)."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSC49989.2020.9180214"},{"key":"e_1_3_2_1_39_1","unstructured":"OpenAI. 2025. OpenAI Python Library. https:\/\/github.com\/openai\/ openai-python."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645436"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.63282\/3050-9246.IJETCSIT-V6I1P114"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-19-0296-3_41"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3592533.3592811"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER60148.2024.00072"},{"key":"e_1_3_2_1_45_1","first-page":"1073","volume-title":"34th USENIX Security Symposium (USENIX Security 25)","author":"Raffa Giuseppe","year":"2025","unstructured":"Giuseppe Raffa, Jorge Blasco, Dan O'Keeffe, and Santanu Kumar Dash. 2025. {CloudFlow}: Identifying Security-sensitive Data Flows in Serverless Applications. In 34th USENIX Security Symposium (USENIX Security 25). 1073-1090."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230035"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3623652.3623666"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427665"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3406011"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510611"},{"key":"e_1_3_2_1_51_1","first-page":"6025","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Shevrin Ilia","year":"2023","unstructured":"Ilia Shevrin and Oded Margalit. 2023. Detecting Multi-Step IAM attacks in AWS environments via model checking. In 32nd USENIX Security Symposium (USENIX Security 23). 6025-6042."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23368"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.3850\/9783981537079_0793"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2018.053681358"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/2393596"},{"key":"e_1_3_2_1_56_1","unstructured":"Liang Wang Mengyuan Li Yinqian Zhang Thomas Ristenpart and Michael Swift. 2018. Peeking behind the curtains of serverless platforms. In 2018 USENIX annual technical conference (USENIX ATC 18). 133-146."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20984-0_5"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623213"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/3579643"},{"key":"e_1_3_2_1_60_1","volume-title":"11th Central European Workshop on Services and their Composition (ZEUS).","author":"Winzinger Stefan","year":"2019","unstructured":"Stefan Winzinger. 2019. Towards coverage criteria for serverless applications. In 11th Central European Workshop on Services and their Composition (ZEUS)."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/MiSE.2019.00020"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/SOSE55356.2022.00015"},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.5220\/0013283100003950"}],"event":{"name":"LCTES '26: 27th ACM SIGPLAN\/SIGBED International Conference on Languages, Compilers, and Tools for Embedded Systems","location":"Boulder CO USA","acronym":"LCTES '26","sponsor":["SIGPLAN ACM Special Interest Group on Programming Languages","SIGBED ACM Special Interest Group on Embedded Systems"]},"container-title":["Proceedings of the 27th ACM SIGPLAN\/SIGBED International Conference on Languages, Compilers, and Tools for Embedded Systems"],"original-title":[],"deposited":{"date-parts":[[2026,6,11]],"date-time":"2026-06-11T22:07:09Z","timestamp":1781215629000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3814943.3816168"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,15]]},"references-count":63,"alternative-id":["10.1145\/3814943.3816168","10.1145\/3814943"],"URL":"https:\/\/doi.org\/10.1145\/3814943.3816168","relation":{},"subject":[],"published":{"date-parts":[[2026,6,15]]},"assertion":[{"value":"2026-06-15","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}