Eric Bodden

This paper presents the first Systematic Literature Review (SLR) of optimization techniques for static analyses, a fundamental method for detecting vulnerabilities and defects early in software development without executing code. Despite its effectiveness, static analysis faces challenges such as false warnings and high computational demands on large code bases. Prior research has demonstrated that performance can be significantly enhanced through techniques such as staging, sparse analysis, and parallelization. However, a systematic assessment of these techniques, their goals, and their interactions is still lacking, often limiting their broader impact. To map the landscape of static-analysis optimizations, we reviewed 146 research papers published between 2009 and 2025, categorizing them into a methodology-based taxonomy. This paper discusses specific optimization goals and examines the potential benefits of combining techniques from multiple categories. We find that most optimizations primarily target efficiency (time and memory), while few studies aim to improve precision. Most publications propose single techniques, with only a third combining multiple approaches. Optimizations predominantly target pointer analysis, though many are likely more broadly applicable. Other common targets include call-graph construction, taint analysis, and data-flow analyses. While some combinations, such as demand-driven and incremental analysis, have proven effective, others—such as staging and procedure summaries—remain under-explored, indicating significant potential for synergistic optimizations.

Background: Coverage-guided greybox fuzzing (or fuzzing) is one of the successful testing methods that iteratively mutates and generates inputs (or seeds) that can reach more code at runtime and aid in finding software vulnerabilities. The power schedule in a fuzzer determines the level of energy, i.e., how many times the fuzzer shall mutate the current seed. Existing power schedules base a seed's energy allocation on the seed's execution speed, its frequency of selection, and how many other seeds have the same coverage. However, these power schedules are subject to the risk of overallocating or underallocating energy to a seed. Objective: Quantitative finance (quant) addresses a similar challenge, allocating capital assets based on their historical returns and risks, through risk-adjusted performance metrics to maximize returns over time. In this registered report, we use this synergy to conceptually map these two domains and transfer concepts from quant to fuzzing. We map four widely known risk-adjusted performance metrics (profit factor, Sharpe ratio, Calmar ratio, and Martin ratio) to fuzzing power schedules which then include the seed's historical performance (coverage gains) to aid energy allocations. Methods: To evaluate the proposed risk-adjusted power schedules, we use two well-known benchmarks that were developed to support fuzzing evaluations: FuzzBench and MAGMA. Specifically, we evaluate power schedules in terms of reachable coverage, bugfinding capability, and efficient energy allocation. Results: This study, once conducted, will help the field answer the question: Do the concepts adapted from quant to fuzzing help in improving energy allocation and fuzzing performance? This will then lay the foundation for future fuzzing improvements.

On average, 71% of the code in typical Java projects comes from open-source software (OSS) dependencies, making OSS dependencies the dominant component of modern software code bases. This high degree of OSS reliance comes with a considerable security risk of adding known security vulnerabilities to a code base. To remedy this risk, researchers and companies have developed various dependency scanners, which try to identify inclusions of known-to-be-vulnerable OSS dependencies. However, there are still challenges that modern dependency scanners do not overcome, especially when it comes to dependency modifications, such as re-compilations, re-bundlings or re-packagings, which are common in the Java ecosystem. To overcome these challenges, we present Jaralyzer, a bytecode-centric dependency scanner for Java. Jaralyzer does not rely on the metadata or the source code of the included OSS dependencies being available but directly analyzes a dependency’s bytecode. Our evaluation across 56 popular OSS components demonstrates that Jaralyzer outperforms other popular dependency scanners in detecting vulnerabilities within modified dependencies. It is the only scanner capable of identifying vulnerabilities across all the above mentioned types of modifications. But even when applied to unmodified dependencies, Jaralyzer outperforms the current state-of-the-art code-centric scanner Eclipse Steady by detecting 28 more true vulnerabilities and yielding 29 fewer false warnings.

Android apps collecting data from users must comply with legal frameworks to ensure data protection. This requirement has become even more important since the implementation of the General Data Protection Regulation (GDPR) by the European Union in 2018. Moreover, with the proposed Cyber Resilience Act on the horizon, stakeholders will soon need to assess software against even more stringent security and privacy standards. Effective privacy assessments require collaboration among groups with diverse expertise to function effectively as a cohesive unit. This paper presents an interview-based study (N=16) exploring the challenges these experts encounter during privacy assessments and their views on automation as potential support. To ground the discussion, we use Assessor View , a prototype developed for this work that integrates static analysis to extract privacy-relevant information directly from Android Application Packages (APKs), as a research probe. Its design provides dedicated views for both technical and non-technical stakeholders, enabling reflection on how automation can enhance assessment practice. Our study identifies key challenges in conducting privacy assessments, including knowledge and communication gaps between experts, the privacy–innovation trade-off, delayed involvement of privacy professionals, and the lack of source code analysis-based tools. The user study conducted alongside the interviews reveals that the GDPR warnings and guidance provided by Assessor View are valuable to Data Protection Officers and privacy experts, and its design is particularly well suited for these stakeholders. Overall, our findings indicate that Assessor View represents a significant step toward improving communication between legal and technical experts and automating privacy assessments.

Greybox fuzzing is used extensively in research and practice. There are umpteen publications that improve greybox fuzzing. However, to what extent do these improvements affect the internal components or internals of a given fuzzer is not yet understood as the improvements are mostly evaluated using code coverage and bug finding capability. Such an evaluation is insufficient to understand the effect of improvements on the fuzzer internals. Some of the literature visualizes the outcomes of fuzzing to enhance the understanding. However, they only focus on high-level information, and no previous research on visualization has been dedicated to understanding fuzzing internals. To close this gap, we propose the first step toward development of a fuzzing-specific visualization framework: a taxonomy of visualization analysis tasks that fuzzing experts desire to help them understand the fuzzing internals. Our approach involves conducting interviews with fuzzing experts and using qualitative data analysis to systematically extract the task taxonomy from the interview data. We also evaluate the support of existing fuzzing visualization tools through the lens of our taxonomy. In our study, we have conducted 33 interviews with fuzzing practitioners and extracted a taxonomy of 120 visualization analysis tasks. Our evaluation shows that the existing fuzzing visualization tools only provide aids to support 10 of them.

Open-source software (OSS) dependencies are a dominant component of modern software code bases. Using proven and well-tested OSS components lets developers reduce development time and cost while improving quality. However, heavy reliance on open-source software also introduces significant security risks, including the incorporation of known vulnerabilities into the codebase. To mitigate these risks, metadata-based dependency scanners, which are lightweight and fast, and code-centric scanners, which enable the detection of modified dependencies hidden from metadata-based approaches, have been developed. In this paper, we present Unshade, a hybrid approach towards dependency scanning in Java that combines the efficiency of metadata-based scanning with the ability to detect modified dependencies of code-centric approaches. Unshade first augments a Java project's software bill of materials (SBOM) by identifying modified and hidden dependencies via a bytecode-based fingerprinting mechanism. This augmented SBOM is then passed to a metadata-based vulnerability scanner to identify known vulnerabilities in both declared and newly revealed dependencies. Leveraging Unshade's high scalability, we conducted a large-scale study of the 1,808 most popular open-source Java Maven projects on GitHub. The results show that nearly 50% of these projects contain at least one modified, hidden dependency associated with a known vulnerability. On average, each affected project includes more than eight such hidden vulnerable dependencies, all missed by traditional metadata-based scanners. Overall, Unshade identified 7,712 unique CVEs in hidden dependencies that would remain undetected when relying on metadata-based scanning alone.