@phdthesis{20521, author = {Gerking, Christopher}, publisher = {Paderborn University}, title = {{Model-Driven Information Flow Security Engineering for Cyber-Physical Systems}}, doi = {10.17619/UNIPB/1-1033}, year = {2020}, } @inproceedings{20510, author = {Benz, Manuel and Krogh Kristensen, Erik and Luo, Linghui and P. Borges Jr., Nataniel and Bodden, Eric and Zeller, Andreas}, booktitle = {International Conference for Software Engineering (ICSE)}, title = {{Heaps'n Leaks: How Heap Snapshots Improve Android Taint Analysis}}, year = {2020}, } @article{20508, author = {Nguyen Quang Do, Lisa and Bodden, Eric}, journal = {IEEE Transactions on Software Engineering}, title = {{Explaining Static Analysis with Rule Graphs}}, year = {2020}, } @inbook{20515, abstract = {Faults in the realization and usage of cyber-physical systems can cause significant security issues. Attackers might exploit vulnerabilities in the physical configurations, control systems, or accessibility through internet connections. For CPS, two challenges are combined: Firstly, discipline-specific security measures should be applied. Secondly, new measures have to be created to cover interdisciplinary impacts. For instance, faulty software configurations in cyber-physical production systems (CPPS) might allow attackers to manipulate the correct control of production processes impacting the quality of end products. From liability and publicity perspective, a worst-case scenario is that such a corrupted product is delivered to a customer. In this context, security-oriented fault-tolerance in Systems Engineering (SE) requires measures to evaluate interdisciplinary system designs with regard to potential scenarios of attacks. The paper at hand contributes a conceptual threat modelling approach to cover potential attack scenarios. The approach can be used to derive both system-level and discipline-specific security solutions. As an application case, issues are focused on which attackers intend to exploit vulnerabilities in a CPPS. The goal is to support systems engineers in verification and validation tasks regarding security-oriented fault-tolerance.}, author = {Gräßler, Iris and Bodden, Eric and Pottebaum, Jens and Geismann, Johannes and Roesmann, Daniel}, booktitle = {Advances in Intelligent Systems and Computing}, isbn = {9783030509354}, issn = {2194-5357}, title = {{Security-Oriented Fault-Tolerance in Systems Engineering: A Conceptual Threat Modelling Approach for Cyber-Physical Production Systems}}, doi = {10.1007/978-3-030-50936-1_121}, year = {2020}, } @techreport{20712, author = {Schubert, Philipp and Bodden, Eric and Hermann, Ben}, title = {{Accelerating Static Call-Graph, Points-to and Data-Flow Analysis Through Persisted Summaries}}, year = {2020}, } @inproceedings{20509, author = {Fischer, Andreas and Janneck, Jonas and Kussmaul, Jörn and Krätzschmar, Nikolas and Kerschbaum, Florian and Bodden, Eric}, booktitle = {2020 IEEE Computer Security Foundations Symposium (CSF)}, title = {{PASAPTO: Policy-aware Security and Performance Trade-off Analysis - Computation on Encrypted Data with Restricted Leakage}}, year = {2020}, } @inproceedings{20511, author = {Fischer, Andreas and Fuhry, Benny and Kerschbaum, Florian and Bodden, Eric}, booktitle = {Privacy Enhancing Technologies Symposium (PETS/PoPETS)}, title = {{Computation on Encrypted Data using Dataflow Authentication}}, year = {2020}, } @inproceedings{20512, author = {Krüger, Stefan and Ali, Karim and Bodden, Eric}, booktitle = {International Symposium on Code Generation and Optimization (CGO)}, pages = {185--198}, title = {{CogniCrypt_GEN - Generating Code for the Secure Usage of Crypto APIs}}, year = {2020}, } @inbook{20891, abstract = {Today, software systems are rarely developed monolithically, but may be composed of numerous individually developed features. Their modularization facilitates independent development and verification. While feature-based strategies to verify features in isolation have existed for years, they cannot address interactions between features. The problem with feature interactions is that they are typically unknown and may involve any subset of the features. Contrary, a family-based verification strategy captures feature interactions, but does not scale well when features evolve frequently. To the best of our knowledge, there currently exists no approach with focus on evolving features that combines both strategies and aims at eliminating their respective drawbacks. To fill this gap, we introduce Fefalution, a feature-family-based verification approach based on abstract contracts to verify evolving features and their interactions. Fefalution builds partial proofs for each evolving feature and then reuses the resulting partial proofs in verifying feature interactions, yielding a full verification of the complete software system. Moreover, to investigate whether a combination of both strategies is fruitful, we present the first empirical study for the verification of evolving features implemented by means of feature-oriented programming and by comparing Fefalution with another five family-based approaches varying in a set of optimizations. Our results indicate that partial proofs based on abstract contracts exhibit huge reuse potential, but also come with a substantial overhead for smaller evolution scenarios. }, author = {Knüppel, Alexander and Krüger, Stefan and Thüm, Thomas and Bubel, Richard and Krieter, Sebastian and Bodden, Eric and Schaefer, Ina}, booktitle = {Lecture Notes in Computer Science}, isbn = {9783030643539}, issn = {0302-9743}, title = {{Using Abstract Contracts for Verifying Evolving Features and Their Interactions}}, doi = {10.1007/978-3-030-64354-6_5}, year = {2020}, } @inproceedings{7626, author = {Schubert, Philipp and Hermann, Ben and Bodden, Eric}, booktitle = {Proceedings of the 25th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2019), Held as Part of the European Joint Conferences on Theory and Practice of Software (ETAPS 2019)}, location = {Prague, Czech Republic}, pages = {393--410}, title = {{PhASAR: An Inter-Procedural Static Analysis Framework for C/C++}}, doi = {10.1007/978-3-030-17465-1_22}, volume = {II}, year = {2019}, } @inproceedings{20532, author = {Piskachev, Goran and Nguyen Quang Do, Lisa and Johnson, Oshando and Bodden, Eric}, booktitle = {IEEE/ACM International Conference on Automated Software Engineering (ASE 2019), Tool Demo Track}, title = {{SWAN_ASSIST: Semi-Automated Detection of Code-Specific, Security-Relevant Methods}}, year = {2019}, } @inproceedings{20525, author = {Stockmann, Lars and Laux, Sven and Bodden, Eric}, booktitle = {2019 IEEE International Conference on Software Architecture Companion (ICSA-C)}, pages = {77--84}, title = {{Architectural Runtime Verification}}, doi = {10.1109/ICSA-C.2019.00021}, year = {2019}, } @techreport{20537, author = {Piskachev, Goran and Nguyen, Lisa and Bodden, Eric}, title = {{Codebase-Adaptive Detection of Security-Relevant Methods}}, year = {2019}, } @article{14896, author = {Dann, Andreas and Hermann, Ben and Bodden, Eric}, issn = {0098-5589}, journal = {IEEE Transactions on Software Engineering}, pages = {1--1}, title = {{ModGuard: Identifying Integrity &Confidentiality Violations in Java Modules}}, doi = {10.1109/tse.2019.2931331}, year = {2019}, } @article{20533, author = {Krüger, Stefan and Späth, Johannes and Ali, Karim and Bodden, Eric and Mezini, Mira}, issn = {2326-3881}, journal = {IEEE Transactions on Software Engineering}, keyword = {Java, Encryption, Static analysis, Tools, Ciphers, Semantics, cryptography, domain-specific language, static analysis}, pages = {1--1}, title = {{CrySL: An Extensible Approach to Validating the Correct Usage of Cryptographic APIs}}, doi = {10.1109/TSE.2019.2948910}, year = {2019}, } @inproceedings{20538, author = {Albert Gorski Iii, Sigmund and Andow, Benjamin and Nadkarni, Adwait and Manandhar, Sunil and Enck, William and Bodden, Eric and Bartel, Alexandre}, booktitle = {ACM Conference on Data and Application Security and Privacy (CODASPY 2019)}, keyword = {ITSECWEBSITE, CROSSING}, title = {{ACMiner: Extraction and Analysis of Authorization Checks in Android's Middleware}}, year = {2019}, } @inproceedings{20759, author = {Gerking, Christopher and Schubert, David}, booktitle = {International Conference on Software Architecture (ICSA 2019)}, title = {{Component-Based Refinement and Verification of Information-Flow Security Policies for Cyber-Physical Microservice Architectures}}, year = {2019}, } @inproceedings{14897, author = {Dann, Andreas and Hermann, Ben and Bodden, Eric}, booktitle = {Proceedings of the 8th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis - SOAP 2019}, isbn = {9781450367202}, title = {{SootDiff: bytecode comparison across different Java compilers}}, doi = {10.1145/3315568.3329966}, year = {2019}, } @misc{7628, author = {Selbach, Nils}, publisher = {Universität Paderborn}, title = {{Modeling Crypto API usages in OpenSSL's EVP library}}, year = {2019}, } @phdthesis{20522, author = {Holzinger, Philipp}, publisher = {Universität Paderborn}, title = {{A Systematic Analysis and Hardening of the Java Security Architecture}}, year = {2019}, }