![](bg8.png)
what?” vulnerability discovery and management pro-
cesses in the wild. In Sixteenth Symposium on Usable
Privacy and Security (SOUPS) 2020, pages 319–339.
Antal, G., Heged
˝
us, P., T
´
oth, Z., Ferenc, R., and Gyim
´
othy,
T. (2018). Static JavaScript Call Graphs: a Compara-
tive Study. In Proceedings of the 18th IEEE Interna-
tional Working Conference on Source Code Analysis
and Manipulation. IEEE.
Anwar, A., Abusnaina, A., Chen, S., Li, F., and Mo-
haisen, D. (2020). Cleaning the NVD: Comprehen-
sive quality assessment, improvements, and analyses.
arXiv:2006.15074.
Dashevskyi, S., Brucker, A. D., and Massacci, F. (2019).
A screening test for disclosed vulnerabilities in foss
components. IEEE Transactions on Software Engi-
neering, 45(10):945–966.
Dean, J., Grove, D., and Chambers, C. (1995). Optimiza-
tion of object-oriented programs using static class hi-
erarchy analysis. In European Conference on Object-
Oriented Programming, pages 77–101. Springer.
Ekman, T. and Hedin, G. (2007). The JastAdd extensi-
ble java compiler. In Proceedings of the 22nd An-
nual ACM SIGPLAN Conference on Object-Oriented
Programming, Systems, Languages, and Applications,
pages 1–18.
H
¨
ost, M., S
¨
onnerup, J., Hell, M., and Olsson, T. (2018).
Industrial practices in security vulnerability manage-
ment for iot systems–an interview study. In Proceed-
ings of the International Conference on Software En-
gineering Research and Practice (SERP), pages 61–
67.
Ko, Y., Lee, H., Dolby, J., and Ryu, S. (2015). Practi-
cally tunable static analysis framework for large-scale
javascript applications (T). In 30th IEEE/ACM In-
ternational Conference on Automated Software Engi-
neering (ASE), pages 541–551. IEEE.
Li, Y., Tan, T., and Xue, J. (2019). Understanding and
analyzing java reflection. ACM Trans. Softw. Eng.
Methodol., 28(2):7:1–7:50.
Livshits, B., Sridharan, M., Smaragdakis, Y., Lhot
´
ak, O.,
Amaral, J. N., Chang, B.-Y. E., Guyer, S. Z., Khed-
ker, U. P., Møller, A., and Vardoulakis, D. (2015). In
defense of soundiness: A manifesto. Commun. ACM,
58(2):44–46.
McCarthy, J. (1960). Recursive functions of symbolic ex-
pressions and their computation by machine, part i.
Communications of the ACM, 3(4):184–195.
NIST (2011). Common Platform Enumeration: Naming
Specification, Version 2.3, NIST Interagency Report
7695.
NIST (2021). National vulnerability database.
https://nvd.nist.gov/.
Plate, H., Ponta, S. E., and Sabetta, A. (2015). Impact as-
sessment for vulnerabilities in open-source software
libraries. In 2015 IEEE International Conference on
Software Maintenance and Evolution (ICSME), pages
411–420.
Ponta, S. E., Plate, H., and Sabetta, A. (2018). Be-
yond metadata: Code-centric and usage-based anal-
ysis of known vulnerabilities in open-source software.
In 2018 IEEE International Conference on Software
Maintenance and Evolution (ICSME).
Ryder, B. G. (1979). Constructing the call graph of a pro-
gram. IEEE Transactions on Software Engineering,
SE-5(3):216–226.
Smaragdakis, Y., Balatsouras, G., Kastrinis, G., and
Bravenboer, M. (2015). More sound static handling of
java reflection. In Feng, X. and Park, S., editors, Pro-
gramming Languages and Systems, pages 485–503,
Cham. Springer International Publishing.
Sui, L., Dietrich, J., Tahir, A., and Fourtounis, G. (2020).
On the recall of static call graph construction in prac-
tice. In 2020 IEEE/ACM 42nd International Confer-
ence on Software Engineering (ICSE), pages 1049–
1060. IEEE.
Synopsys (2020). Open source security and risk analysis
report. Online.
The MITRE Corporation (2021). Common Vulnerabilities
and Exposures.
Vall
´
ee-Rai, R., Co, P., Gagnon, E., Hendren, L. J., Lam,
P., and Sundaresan, V. (1999). Soot - a Java byte-
code optimization framework. In Proceedings of the
1999 Conference of the Centre for Advanced Studies
on Collaborative Research, CASCON ’99.
W
˚
areus, E. and Hell, M. (2020). Automated cpe labeling
of cve summaries with machine learning. In Inter-
national Conference on Detection of Intrusions and
Malware, and Vulnerability Assessment, pages 3–22.
Springer.
Xavier, L., Brito, A., Hora, A., and Valente, M. T.
(2017). Historical and impact analysis of api break-
ing changes: A large-scale study. In 2017 IEEE 24th
International Conference on Software Analysis, Evo-
lution and Reengineering (SANER), pages 138–147.
IEEE.
Xie, T. and Notkin, D. (2002). An empirical study of java
dynamic call graph extractors. University of Washing-
ton CSE Technical Report 02-12, 3.
SECRYPT 2021 - 18th International Conference on Security and Cryptography
530