Write a Blog >>
ICSE 2022
Sun 8 - Fri 27 May 2022
Tue 10 May 2022 04:00 - 04:05 at ICSE room 3-even hours - Apps and Security Chair(s): Alessio Ferrari
Wed 11 May 2022 20:05 - 20:10 at ICSE room 2-even hours - Software Security 5 Chair(s): Nancy Mead

Running on top of blockchain systems, smart contracts enable developers to build decentralized applications with rich functionalities. Many of the contracts are financial-related, which makes code audit rather important. Quantities of static analysis tools have been developed to automate the audit process, but not all of them take account of two special features of smart contracts: (1) The internal variables in contracts persist between executions; (2) The external variables, like time and assets, are constrained by real-world factors. Since these features bring implicit constraints on contract variables, they significantly affect the performance of static analysis tools, such as causing errors in reachability analysis and resulting in false positives, etc. Although a few recent works discussed these features, little is known about their impact on the wildly used tools. In this paper, we conduct a systematic study on such constraints from three aspects. First, we summarize the implicit constraints due to the special features of smart contracts. Second, we evaluate the impact of such constraints on the state-of-the-art static tools used in smart contract audits. The tools we select include both the industrial and academic ones. The experiment results show that six out of seven tools, including the latest verifiers, will be obviously affected by such constraints. Third, we propose a simple but effective method named ConSym to recognize such constraints. It can be easily integrated into existing symbolic execution based solutions to improve their performance. We integrate ConSym into OSIRIS and evaluate it with real-world contracts. The result shows that ConSym can filter out 96% of false positives reported by OSIRIS and achieve 3 times fewer false negatives than OSIRIS.

Tue 10 May

Displayed time zone: Eastern Time (US & Canada) change

04:00 - 05:00
04:00
5m
Talk
An Empirical Study on Implicit Constraints in Smart Contract Static Analysis
SEIP - Software Engineering in Practice
Tingting Yin Tsinghua University, China, Chao Zhang Tsinghua University, Yuandong Ni Institute for Network Science and Cyberspace of Tsinghua University, Yixiong Wu Institute for Network Science and Cyberspace of Tsinghua University, Taiyu Wong Department of Computer Science and Technology, Tsinghua University, Xiapu Luo Hong Kong Polytechnic University, Zheming Li Tsinghua University, Yu Guo SECBIT labs
Pre-print Media Attached
04:05
5m
Talk
Automated Detection of Password Leakage from Public GitHub RepositoriesNominated for Distinguished Paper
Technical Track
Runhan Feng Shanghai Jiao Tong University, Ziyang Yan Shanghai Jiao Tong University, Shiyan Peng Shanghai Jiao Tong University, Yuanyuan Zhang Shanghai Jiao Tong University
Pre-print Media Attached
04:10
5m
Talk
Log-based Anomaly Detection with Deep Learning: How Far Are We
Technical Track
Van-Hoang Le The University of Newcastle, Hongyu Zhang University of Newcastle
DOI Pre-print
04:15
5m
Talk
RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation
Technical Track
Zhen Li University of Texas at San Antonio, Guenevere (Qian) Chen University of Texas at San Antonio, Chen Chen University of Central Florida, Yayi Zou Northeastern University, Shouhuai Xu University of Colorado Colorado Springs
Pre-print Media Attached
04:20
5m
Talk
Where is Your App Frustrating Users?
Technical Track
Yawen Wang Institute of Software, Chinese Academy of Sciences, Junjie Wang Institute of Software at Chinese Academy of Sciences, Hongyu Zhang University of Newcastle, Xuran Ming Institute of Software, Chinese Academy of Sciences, Lin Shi ISCAS, Qing Wang Institute of Software at Chinese Academy of Sciences
DOI Pre-print Media Attached
04:25
5m
Talk
Towards Automatically Repairing Compatibility Issues in Published Android Apps
Technical Track
Yanjie Zhao Monash University, Li Li Monash University, Kui Liu Nanjing University of Aeronautics and Astronautics, China, John Grundy Monash University
Pre-print Media Attached

Wed 11 May

Displayed time zone: Eastern Time (US & Canada) change

20:00 - 21:00
20:00
5m
Talk
Deep Learning based Vulnerability Detection: Are We There Yet?
Journal-First Papers
Saikat Chakraborty Columbia University, Rahul Krishna IBM Research, Yangruibo Ding Columbia University, Baishakhi Ray Columbia University
Link to publication DOI Media Attached
20:05
5m
Talk
An Empirical Study on Implicit Constraints in Smart Contract Static Analysis
SEIP - Software Engineering in Practice
Tingting Yin Tsinghua University, China, Chao Zhang Tsinghua University, Yuandong Ni Institute for Network Science and Cyberspace of Tsinghua University, Yixiong Wu Institute for Network Science and Cyberspace of Tsinghua University, Taiyu Wong Department of Computer Science and Technology, Tsinghua University, Xiapu Luo Hong Kong Polytechnic University, Zheming Li Tsinghua University, Yu Guo SECBIT labs
Pre-print Media Attached
20:10
5m
Talk
RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation
Technical Track
Zhen Li University of Texas at San Antonio, Guenevere (Qian) Chen University of Texas at San Antonio, Chen Chen University of Central Florida, Yayi Zou Northeastern University, Shouhuai Xu University of Colorado Colorado Springs
Pre-print Media Attached
20:15
5m
Talk
ReMoS: Reducing Defect Inheritance in Transfer Learning via Relevant Model Slicing
Technical Track
Ziqi Zhang Peking University, Yuanchun Li Microsoft Research, Jindong Wang Microsoft Research, Bingyan Liu Peking University, Ding Li Peking University, Xiangqun Chen Peking University, Yao Guo Peking University, Yunxin Liu Tsinghua University
Pre-print Media Attached
20:20
5m
Talk
Modx: Binary Level Partial Imported Third-Party Library Detection through Program Modularization and Semantic Matching
Technical Track
Can Yang Institute of Information Engineering, University of Chinese Academy of Sciences, Zhengzi Xu Nanyang Technological University, Hongxu Chen Huawei Technologies Co., Ltd., Yang Liu Nanyang Technological University, Xiaorui Gong Institute of Information Engineering, Chinese Academy of Science, Baoxu Liu Institute of Information Engineering, Chinese Academy of Sciences
Pre-print Media Attached
20:25
5m
Talk
Large-scale Security Measurements on the Android Firmware Ecosystem
Technical Track
Qinsheng Hou Shandong University; Qi An Xin Group Corp., Wenrui Diao Shandong University, Yanhao Wang Qi An Xin Group Corp., Xiaofeng Liu Shandong University, Song Liu Qi An Xin Group Corp., Lingyun Ying Qi An Xin Group Corp., Shanqing Guo Shandong University, Yuanzhi Li Qi An Xin Group Corp., Meining Nie Qi An Xin Group Corp., Haixin Duan Institute for Network Science and Cyberspace, Tsinghua University; Qi An Xin Group Corp.
Pre-print Media Attached

Information for Participants
Tue 10 May 2022 04:00 - 05:00 at ICSE room 3-even hours - Apps and Security Chair(s): Alessio Ferrari
Info for room ICSE room 3-even hours:

Click here to go to the room on Midspace

Wed 11 May 2022 20:00 - 21:00 at ICSE room 2-even hours - Software Security 5 Chair(s): Nancy Mead
Info for room ICSE room 2-even hours:

Click here to go to the room on Midspace