Steven Arzt and Siegfried Rasthofer win Dissertation Award of the Ernst Denert Foundation

Once a year, the Ernst Denert Foundation (by Ernst Denert, one of the founders of sd&m, now Capgemini), sponsor’s the Software Engineering award, which is given out at the SE conference by the Gesellschaft für Informatik. Usually, this award is given out to a single individual for her or his dissertation.

Just this year, the choice was apparently particularly hard to make: two theses really stood out so much that the jury was unable to decide among them. In result, I am more than happy to announce that both my former Ph.D. students Steven Arzt and Siegfried Rasthofer have been chosen to receive the award for 2018. Congratulations Steven and Siegfried! Well done!

You can access their theses here:

Improving Mobile-Malware Investigations with Static and Dynamic Code Analysis Techniques (Siegfried Rashofer)PhD thesis, Technische Universität Darmstadt, 2016. Awarded: Summa cum laude & Fraunhofer IuK Dissertation Award [bib] [pdf]
Static Data Flow Analysis for Android Applications (Steven Arzt)PhD thesis, Technische Universität Darmstadt, 2016. Awarded: Summa cum laude [bib] [pdf]

New paper on Just-in-time Code Analysis

In a collaborative effort with Karim Ali (University of Alberta), Ben Livshits (Imperial College London), Justin Smith and Emerson Murphy-Hill (North Caroline State University), my Ph.D. student Lisa Nguyen and myself have just concluded a new piece of research on Just-in-time (JIT) static code analysis. The approach, which we exemplify with a JIT taint analysis for Android, can be applied to most static analyses and allows those analyses to execute more efficiently in integrated development environments. In particular, the analysis is tuned such that it executes first in code recently edited by the programmer and then searches its way further “outward” from there. As our experiments indicate, this decreases round-trip times for programmers and hence increases their productivity during the fixing of security vulnerabilities.

A preprint of the work, accepted for publication at ISSTA, is now available online, as is our implementation and data set:

Just-in-Time Static Analysis (Lisa Nguyen Quang Do, Karim Ali, Benjamin Livshits, Eric Bodden, Justin Smith, Emerson Murphy-Hill), In International Symposium on Software Testing and Analysis (ISSTA), 2017. (To appear.)

Official inauguration of Fraunhofer IEM

Today we were very happy to host NRW’s minister of science Svenja Schulze and Fraunhofer’s Director of Science Dr. Raoul Klingner for the official inauguration of Fraunhofer IEM. The new institute is the first to be founded within NRW within the past 20 years, and was bootstrapped in just about seven years – a new record in the Fraunhofer Society.

IEEE S&P Paper on Hardening the Java Runtime is now available

Our new S&P paper Hardening Java’s Access Control by Abolishing Implicit Privilege Elevation is now available online. It is a follow-up work to our previous CCS’16 paper An In-Depth Study of More Than Ten Years of Java Exploitation. In this former paper we classified a large number of history Java exploits. In doing so, we found that the largest class of exploits was made possible by shortcuts in Java’s implementation of access control. In the S&P paper we now show that it is possible to go without those shortcuts, without any loss of performance. We also discuss the usability implications that this removal of shortcuts would have.

New Paper “The Soot-based Toolchain For Analyzing Android Apps”

Steven, Siegfried and I have just completed our invited paper for MOBILESoft’17. The paper The Soot-based Toolchain For Analyzing Android Apps summarizes for the first time the Soot-based tool chain for analyzing Android apps that we have built up over the past years. We hope you will enjoy the read!

And if you attend ICSE, maybe consider attending MOBILESoft as well, and you will be able to attend my keynote talk.