VUSC: An Extensible Research Platform for Java-Based Static Analysis
This program is tentative and subject to change.
Detecting security vulnerabilities in backend Web applications as well as mobile apps is extremely important. Static analysis for vulnerability analysis has subsequently developed as an important field of research. Researchers need extensible frameworks to avoid starting from scratch with every new research project.
Compared to commercially available scanners, open-source frameworks often only provide basic functionality. This limits the ability of researchers to evaluate novel algorithms. Lacking access to full code scanners, new building blocks are often tested in isolation. In this paper, we present VUSC, a fast, precise and extensible vulnerability scanner for Android and Java bytecode. It features a plugin architecture for commonly used static analyses such as call graph, taint and value analyses, allowing researchers to build upon our work and using VUSC as a reference platform. We show that VUSC achieves a precision of around 90% on benchmarks.
Video: https://youtu.be/o3l_mmmjDeo
Dataset: https://github.com/Fraunhofer-SIT/ASE2025-StaticAnalysisInfrastructure/
This program is tentative and subject to change.
Mon 17 NovDisplayed time zone: Seoul change
15:00 - 18:00 | |||
15:00 3hDemonstration | Towards Context-aware Mobile Privacy Notice: Implementation of A Deployable Contextual Privacy Policies Generator Tool Demonstration Track Haochen Gong Australian National University, Zhen Tao Technical University of Munich, Shidong Pan Columbia University & New York University, Zhenchang Xing CSIRO's Data61, Xiaoyu Sun Australian National University, Australia | ||
15:00 3hDemonstration | Metamorphic Testing of Deep Reinforcement Learning Agents with MDPMORPH Tool Demonstration Track Jiapeng Li Beihang University, Zheng Zheng Beihang University, Yuning Xing University of Auckland, Daixu Ren Beihang University, Steven Cho The University of Auckland, New Zealand, Valerio Terragni University of Auckland Pre-print | ||
15:00 3hDemonstration | FlowStrider: Low-friction Continuous Threat Modeling Tool Demonstration Track Bernd Gruner German Aerospace Center (DLR), Institute of Data Science, Noah Erthel German Aerospace Center (DLR), Clemens-Alexander Brust German Aerospace Center (DLR) Media Attached | ||
15:00 3hDemonstration | ReFuzzer: Feedback-Driven Approach to Enhance Validity of LLM-Generated Test Programs Tool Demonstration Track Iti Shree King's College London, Karine Even-Mendoza King’s College London, Tomasz Radzik King's College London | ||
15:00 3hDemonstration | DESIGNATOR: a Toolset for Automated GAN-enhanced Search-based Testing and Retraining of DNNs in Martian Environments Tool Demonstration Track Pre-print | ||
15:00 3hDemonstration | Chrysalis: A Lightweight Framework for Metamorphic Testing in Python Tool Demonstration Track Jai Parera University of California, Los Angeles, Nathan Huey University of California, Los Angeles, Ben Limpanukorn University of California, Los Angeles, Miryung Kim UCLA and Amazon Web Services | ||
15:00 3hDemonstration | AndroFL: Evolutionary-Driven Fault Localization for Android Apps Tool Demonstration Track Vishal Singh Indian Institute of Technology Kanpur, Ravi Shankar Das Indian Institute of Technology Kanpur, Prajwal H G InMobi, Subhajit Roy IIT Kanpur DOI | ||
15:00 3hDemonstration | XRintTest: An Automated Framework for User Interaction Testing in Extended Reality Applications Tool Demonstration Track Ruizhen Gu University of Sheffield, José Miguel Rojas University of Sheffield, Donghwan Shin University of Sheffield Pre-print | ||
15:00 3hDemonstration | Training-Control-as-Code: Towards a declarative solution to control training Tool Demonstration Track Padmanabha V. Seshadri IBM India Research Lab, Harikrishnan Balagopal IBM India Research Lab, Mehant Kammakomati IBM India Research Lab, Ashok Pon Kumar IBM Research - India, Dushyant Behl IBM Research Media Attached | ||
15:00 3hDemonstration | VUSC: An Extensible Research Platform for Java-Based Static Analysis Tool Demonstration Track | ||
15:00 3hDemonstration | BASHIRI: Learning Failure Oracles from Execution Features Tool Demonstration Track Marius Smytzek CISPA Helmholtz Center for Information Security, Martin Eberlein Humboldt-Universtität zu Berlin, Tural Mammadov CISPA Helmholtz Center for Information Security, Lars Grunske Humboldt-Universität zu Berlin, Andreas Zeller CISPA Helmholtz Center for Information Security | ||
15:00 3hDemonstration | FETT: Fault Injection as an Educational and Training Tool in Cybersecurity Tool Demonstration Track Anaé De Baets University of Namur, Guillaume Nguyen University of Namur, Xavier Devroey University of Namur, Fabian Gilson University of Canterbury Pre-print | ||