Challenges for Static Analysis of Java Reflection - Literature Review and Empirical Study

No abstract is available for this paper.

• Publication year

  2017

• Venue

  International Conference on Software Engineering

• Publication date

  2017-05-20

• Fields of study

  Computer Science

• Identifiers
  DOI 10.1109/ICSE.2017.53
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• StaDynA: Addressing the Problem of Dynamic Code Updates in the Security Analysis of Android Applications"

  2017cited by this paper
• Harvesting Runtime Values in Android Applications That Feature Anti-Analysis Techniques

  2016cited by this paper
• Empirical analysis of the relationship between CC and SLOC in a large corpus of Java methods and C functions

  2016cited by this paper
• A Corpus Of Java Projects Representing The 2012 Ohloh Universe

  2016cited by this paper
• Conducting Research Literature Reviews From The Internet To Paper

  2016cited by this paper
• HornDroid: Practical and Sound Static Analysis of Android Applications by SMT Solving

  2016cited by this paper
• DroidRA: taming reflection to support whole-program analysis of Android apps

  2016cited by this paper
• Variable Feature Usage Patterns in PHP (T)

  2015cited by this paper
• Composite Constant Propagation: Application to Android Inter-Component Communication Analysis

  2015cited by this paper
• Evolution of dynamic feature usage in PHP

  2015cited by this paper
• Static Analysis of Implicit Control Flow: Resolving Java Reflection and Android Intents (T)

  2015cited by this paper
• EdgeMiner: Automatically Detecting Implicit Control Flow Transitions through the Android Framework

  2015cited by this paper
• Pointer Analysis

  2015cited by this paper
• A large-scale study on the usage of Java's concurrent programming constructs

  2015cited by this paper
• Towards an Empirical Analysis of .NET Framework and C# Language Features' Adoption

  2015cited by this paper
• Information Flow Analysis of Android Applications in DroidSafe

  2015cited by this paper
• M3: A general model for code analytics in rascal

  2015cited by this paper
• Droidel: a general approach to Android framework modeling

  2015cited by this paper
• More Sound Static Handling of Java Reflection

  2015cited by this paper
• Effective Soundness-Guided Reflection Analysis

  2015cited by this paper
• AppContext: Differentiating Malicious and Benign Mobile App Behaviors Using Context

  2015cited by this paper
• Tracing dynamic features in python programs

  2014cited by this paper
• Mining billions of AST nodes to study actual and potential usage of Java language features

  2014cited by this paper
• Self-inferencing Reflection Resolution for Java

  2014influential reference
• Generating Test Cases for Programs that Are Coded against Interfaces and Annotations

  2014cited by this paper
• Guidelines for snowballing in systematic literature studies and a replication in software engineering

  2014cited by this paper
• Multi-App Security Analysis with FUSE: Statically Detecting Android App Collusion

  2014cited by this paper
• Collaborative Verification of Information Flow for a High-Assurance App Store

  2014cited by this paper
• Determinacy in static analysis for jQuery

  2014cited by this paper
• Constructing Call Graphs of Scala Programs

  2014cited by this paper
• Type-Based Taint Analysis for Java Web Applications

  2014cited by this paper
• Formalisation and analysis of Dalvik bytecode

  2014cited by this paper
• Averroes: Whole-Program Analysis without the Whole Program

  2013cited by this paper
• Comparing Mobile Privacy Protection through Cross-Platform Applications

  2013cited by this paper
• Logic-based techniques for program analysis and specification synthesis

  2013cited by this paper
• How (and why) developers use the dynamic features of programming languages: the case of smalltalk

  2013cited by this paper
• Diversity in software engineering research

  2013influential reference
• An empirical study of PHP feature usage: a static analysis perspective

  2013influential reference
• Dynamic determinacy analysis

  2013cited by this paper
• Correlation Tracking for Points-To Analysis of JavaScript

  2012cited by this paper
• Adoption and use of Java generics

  2012cited by this paper
• Application-Only Call Graph Construction

  2012cited by this paper
• ScanDal: Static Analyzer for Detecting Privacy Leaks in Android Application

  2012cited by this paper
• RefaFlex: safer refactorings for reflective Java programs

  2012cited by this paper
• Android permissions demystified

  2011influential reference
• F4F: taint analysis of framework-based web applications

  2011cited by this paper
• Taming reflection: Aiding static analysis in the presence of reflection and custom class loaders

  2011cited by this paper
• The Eval That Men Do - A Large-Scale Study of the Use of Eval in JavaScript Applications

  2011cited by this paper
• Assumption Hierarchy for a CHA Call Graph Construction Algorithm

  2011cited by this paper
• The Qualitas Corpus: A Curated Collection of Java Code for Empirical Studies

  2010cited by this paper
• Soot: a Java bytecode optimization framework

  2010influential reference
• An analysis of the dynamic behavior of JavaScript programs

  2010cited by this paper
• Datalog-Based Program Analysis with BES and RWL

  2010cited by this paper
• Improving static resolution of dynamic class loading in Java using dynamically gathered environment information

  2009cited by this paper
• Evaluating the dynamic behaviour of Python applications

  2009cited by this paper
• Strictly declarative specification of sophisticated points-to analyses

  2009cited by this paper
• Defining Datalog in Rewriting Logic

  2009cited by this paper
• TAJ: effective taint analysis of web applications

  2009cited by this paper
• RASCAL: A Domain Specific Language for Source Code Analysis and Manipulation

  2009cited by this paper
• Evaluating the benefits of context-sensitive points-to analysis using a BDD-based implementation

  2008cited by this paper
• Combining Static and Dynamic Analysis for Automatic Identification of Precise Access-Control Policies

  2007cited by this paper
• Blended analysis for performance understanding of framework-based applications

  2007cited by this paper
• Fast online pointer analysis

  2007cited by this paper
• Improved Static Resolution of Dynamic Class Loading in Java

  2007cited by this paper
• Lessons from applying the systematic literature review process within the software engineering domain

  2007cited by this paper
• A Systematic review of Cross- vs. Within-Company Cost Estimation Studies

  2006cited by this paper
• The DaCapo benchmarks: java benchmarking development and analysis

  2006cited by this paper
• Performing systematic literature reviews in software engineering

  2006influential reference
• Reflection Analysis for Java

  2005influential reference
• Precise Analysis of String Expressions

  2003influential reference
• Scaling Java Points-to Analysis Using SPARK

  2003cited by this paper
• Analyzing the Past to Prepare for the Future: Writing a Literature Review

  2002cited by this paper
• Corpora in Applied Linguistics: Series editors' preface

  2002cited by this paper
• Practical extraction techniques for Java

  2002cited by this paper
• Generating robust parsers using island grammars

  2001cited by this paper
• Practical experience with an application extractor for Java

  1999cited by this paper

• Software Architecture Recovery Augmented With Semantics

  2026cites this paper
• JBomAudit: Assessing the Landscape, Compliance, and Security Implications of Java SBOMs

  2025cites this paper
• Minimizing Breaking Changes and Redundancy in Mitigating Technical Lag for Java Projects

  2025cites this paper
• Towards Supporting Open Source Library Maintainers with Community-Based Analytics

  2025cites this paper
• VulSolver: Vulnerability Detection via LLM-Driven Constraint Solving

  2025cites this paper
• Wolf in Sheep’s Clothing: Shearing the Camouflage of Malicious Java Components in Maven

  2025cites this paper
• Efficient Test Generation for Dynamic Behaviors Leveraging Token-Level Input Commonalities

  2025cites this paper
• The Effect of Pointer Analysis on Semantic Conflict Detection

  2025cites this paper
• Static Analysis of Remote Procedure Call in Java Programs

  2025cites this paper
• Gleipner: A Benchmark for Gadget Chain Detection in Java Deserialization Vulnerabilities

  2025influential citation
• HGAN4VD: Leveraging Heterogeneous Graph Attention Networks for enhanced Vulnerability Detection

  2025cites this paper
• Sleeping Giants - Activating Dormant Java Deserialization Gadget Chains through Stealthy Code Changes

  2025influential citation
• Empirical Analysis of Security Vulnerabilities in Open Source Software Using Static Analysis Tools

  2025cites this paper
• MALintent: Coverage Guided Intent Fuzzing Framework for Android

  2025cites this paper
• WeBridge: Synthesizing Stored Procedures for Large-Scale Real-World Web Applications

  2024cites this paper
• Viscount: A Direct Method Call Coverage Tool for Java

  2024cites this paper
• AXA: Cross-Language Analysis through Integration of Single-Language Analyses

  2024cites this paper
• Microservice Decomposition Techniques: An Independent Tool Comparison

  2024cites this paper
• Finding Cuts in Static Analysis Graphs to Debloat Software

  2024cites this paper
• Unimocg: Modular Call-Graph Algorithms for Consistent Handling of Language Features

  2024cites this paper
• Tarsis: An effective automata‐based abstract domain for string analysis

  2024cites this paper
• Assessing Reflection Usage with Mutation Testing Augmented Analysis

  2024cites this paper
• Software Architecture Reconstruction for Microservice Systems Using Static Analysis via GraalVM Native Image

  2024cites this paper
• SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java

  2024cites this paper
• Scaling Type-Based Points-to Analysis with Saturation

  2024cites this paper
• Worst-Case Convergence Time of ML Algorithms via Extreme Value Theory

  2024cites this paper
• Automatic Policy Synthesis and Enforcement for Protecting Untrusted Deserialization

  2024cites this paper
• On the Anatomy of Real-World R Code for Static Analysis

  2024cites this paper
• Object Specialization to Partially Reduce Polymorphism of Attributes

  2023cites this paper
• Automatic Specialization of Third-Party Java Dependencies

  2023cites this paper
• Detecting vulnerable software functions via text and dependency features

  2023cites this paper
• Behind the Intent of Extract Method Refactoring: A Systematic Literature Review

  2023cites this paper
• Sound Call Graph Construction for Java Object Deserialization

  2023cites this paper
• Lifting On-Demand Analysis to Higher-Order Languages

  2023cites this paper
• A method to web application taint analysis by computing data dependency

  2023cites this paper
• WHIP: Improving Static Vulnerability Detection in Web Application by Forcing tools to Collaborate

  2023cites this paper
• A Java Testing Framework Without Reflection

  2023cites this paper
• Dependency Facade: The Coupling and Conflicts between Android Framework and Its Customization

  2023cites this paper
• A Reevaluation of Why Crypto-detectors Fail: A Systematic Revaluation of Cryptographic Misuse Detection Techniques

  2023cites this paper
• A systematic literature review on source code similarity measurement and clone detection: techniques, applications, and challenges

  2023cites this paper
• On the Security Blind Spots of Software Composition Analysis

  2023cites this paper
• Seneca: Taint-Based Call Graph Construction for Java Object Deserialization

  2023cites this paper
• A Systematic Literature Review on the Code Smells Datasets and Validation Mechanisms

  2023cites this paper
• Evaluating the Impact of Possible Dependencies on Architecture-Level Maintainability

  2023cites this paper
• Leveraging Practitioners’ Feedback to Improve a Security Linter

  2022cites this paper
• Survey of Approaches for Postprocessing of Static Analysis Alarms

  2022cites this paper
• XDebloat: Towards Automated Feature-Oriented App Debloating

  2022cites this paper
• A Taxonomy of HTML5 Canvas Bugs

  2022cites this paper
• Reflekt: a Library for Compile-Time Reflection in Kotlin

  2022influential citation
• Opinion Mining for Software Development: A Systematic Literature Review

  2022cites this paper
• Lupa: A Framework for Large Scale Analysis of the Programming Language Usage

  2022cites this paper
• Testability Tarpits: the Impact of Code Patterns on the Security Testing of Web Applications

  2022cites this paper
• A Study of Single Statement Bugs Involving Dynamic Language Features

  2022cites this paper
• Cross-Language Plagiarism Detection: Methods, Tools, and Challenges: A Systematic Review

  2022cites this paper
• An Investigation into the Prevalence of Reflection Techniques in Distributed Microsoft .Net NuGet Artefacts

  2022cites this paper
• Device-centric Federated Analytics At Ease

  2022cites this paper
• F2DC: Android malware classification based on raw traffic and neural networks

  2022cites this paper
• Studying and Leveraging API Usage Patterns

  2022cites this paper
• Detecting Missing-Permission-Check Vulnerabilities in Distributed Cloud Systems

  2022cites this paper
• Jasmine: A Static Analysis Framework for Spring Core Technologies

  2022cites this paper
• Removing dependencies from large software projects: are you really sure?

  2022cites this paper
• A Taxonomy of Testable HTML5 Canvas Issues

  2022cites this paper
• Quantitative estimation of side-channel leaks with neural networks

  2021cites this paper
• Developer-Friendly Test Cases: Detection and Removal of Unnecessary Casts

  2021cites this paper
• Serialization-aware call graph construction

  2021cites this paper
• DEFInit: An Analysis of Exposed Android Init Routines

  2021cites this paper
• Grey Literature in Software Engineering: A Critical Review

  2021cites this paper
• QFuzz: quantitative fuzzing for side channels

  2021influential citation
• A longitudinal analysis of bloated Java dependencies

  2021cites this paper
• Systematic literature review of empirical studies on mental representations of programs

  2020cites this paper
• Deep Static Modeling of invokedynamic

  2020cites this paper
• Detection, assessment and mitigation of vulnerabilities in open source dependencies

  2020cites this paper
• Coverage-Based Debloating for Java Bytecode

  2020cites this paper
• Opinion mining for software development

  2020cites this paper
• Automated regression unit test generation for program merges

  2020cites this paper
• Runtime analysis of Android apps based on their behaviour

  2020cites this paper
• DINA: Detecting Hidden Android Inter-App Communication in Dynamic Loaded Code

  2020cites this paper
• Reverse Engineering UML Sequence Diagrams for Program Comprehension Activities

  2020cites this paper
• A Memory Usage Comparison Between Jitana and Soot A Memory Usage Comparison Between Jitana and Soot

  2020cites this paper
• Salsa: static analysis of serialization features

  2020cites this paper
• A systematic literature review of cross-domain model consistency checking by model management tools

  2020cites this paper
• How Android Developers Handle Evolution-induced API Compatibility Issues: A Large-scale Study

  2020cites this paper
• Automatic Support for Multi-Domain Model Management

  2020cites this paper
• C-3PR: A Bot for Fixing Static Analysis Violations via Pull Requests

  2020cites this paper
• JShrink: in-depth investigation into debloating modern Java applications

  2020influential citation
• On the Recall of Static Call Graph Construction in Practice

  2020cites this paper
• Trace-based Debloat for Java Bytecode

  2020cites this paper
• A comprehensive study of bloated dependencies in the Maven ecosystem

  2020cites this paper
• A Simple Model for Reasoning about Limits on Coupling in Object-Oriented Software

  2020cites this paper
• Static Code Analysis of Multilanguage Software Systems

  2019cites this paper
• Model Management Tools for Models of Different Domains: A Systematic Literature Review

  2019cites this paper
• Detecting Vulnerable Android Inter-App Communication in Dynamically Loaded Code

  2019cites this paper
• Rascal, 10 Years Later

  2019cites this paper
• How software engineering research aligns with design science: a review

  2019cites this paper
• When and how java developers give up static type safety

  2019cites this paper
• Hybrid Taint Flow Analysis in Scala

  2019cites this paper
• Reflection-aware static regression test selection

  2019cites this paper
• Casting about in the dark: an empirical study of cast operations in Java programs

  2019cites this paper
• Initialize once, start fast: application initialization at build time

  2019cites this paper
• Java reflection API: revealing the dark side of the mirror

  2019influential citation