News

Again, this year, our PhD students Anemone Kampkötter and Johannes Düsing are supported by two interns from the US over the summer. They applied through the RISE Germany program of the German Academic Exchange Service (DAAD; German: Deutscher Akademischer Austauschdienst). 

Jared Chiaramonte is an undergraduate student of Computer Science from Arizona State University in Tempe, AZ. During his internship, Jared aims to provide researchers with the tools necessary to easily inspect and study software artifacts. He designs and develops a software library that enables users to traverse software components from the Maven Central Repository, as well as to access metadata and to inspect bytecode. By implementing multiple layers of caching, the library is especially aimed at researchers conducting large-scale empirical studies.

I applied for the Maven Central interface project because I wanted learn more about the computer science research space, and to get experience working with build tools and static analysis projects. While spending time abroad, I have found the public transit and football culture to be the most surprising.

Vivek Sarkar is an undergraduate student of Computer Science from the University of Washington in Seattle, WA. In his three-month research project at TU Dortmund, Vivek is working on an integrated solution that crawls C/C++ packages from the ConanCenter repository and analyzes them with the static analysis framework PhASAR. This enables researchers and software analysts to traverse software artifacts and analyze them for various properties, perform large-scale empirical studies more easily and extend the testing capabilities of new analyses written in PhASAR. 

The reason why I chose this project was because it would give me the opportunity to learn more about static analysis and LLVM, as well as how to plan and organize a relatively large project. On a less technical note, I also wanted to come because I would get to explore and learn about the culture(s) of Germany and the rest of Continental Europe, which I've never been exposed to before. As a whole, I think this internship will help me grow as a person in more than one way, and I'm extremely thankful for the opportunity to work in this lab.

The RISE Germany program offers summer research internships in Germany for undergraduate students from North America, Great Britain, and Ireland. It is offered by the German Academic Exchange Service (DAAD; German: Deutscher Akademischer Austauschdienst). If you want to do your internship with us in Summer 2025, please contact us!

Static call graph generation is a basic building block of static program analysis. Many other analyses are based on the resulting call graph and directly inherit their imprecisions and flaws. Therefore, a most precise and complete call graph should be the aim of this step. However, in practice it's not that easy to evaluate call graph generation results, especially under realistic conditions. 

In our new publication "Total Recall? How Good are Static Call Graphs Really?" just accepted at the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), we construct dynamic baselines that show a realistic call graph for a certain entry point. This allows us to study the quality of static call graph construction. The paper is a collaborative effort with the Software Technology Group from Prof. Mira Mezini at TU Darmstadt. 

The ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) is the leading research symposium on software testing and analysis, bringing together academics, industrial researchers, and practitioners to exchange new ideas, problems, and experience on how to analyze and test software systems. It has a CORE ranking of A. 

The annual conference on Software Engineering of the German Informatics Society is an annual event hosted in a city in Germany, Austria, or Switzerland. It is a "best-of event", meaning that submissions are only considered for presentation if they have been already published at a top-tier conference or major journal in the area of software engineering. It is a great way to catch up with all the great work done in your neighborhood. 

This years, we were invited to present three publications in Linz (Austria). Johannes Düsing presented our work on static program analysis result reuse that was presented first at the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE 2023) in Luxemburg in September. Stefan Winter of LMU Munich presented our work on a data analysis of a decade of publications with lots of insights about research artifacts that was first presented at the ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) 2022 in Singapore. Ben Hermann presented our work on software supply chain stability that was first presented at the IEEE/ACM International Conference on Software Engineering (ICSE) 2023 in Melbourne. 

Ben Hermann was also invited to participate in a panel on Research Software Engineering together with Anna-Lena Lamprecht (Uni Potsdam), Jan Linxweiler (TU Braunschweig), Florian Goth (Uni Würzburg), and Falk Howar (TU Dortmund). In a lively discussion the panel and the audience discussed the details of the emerging field. 

Our student Maximilian Krebs participated in the Student Research Competition with his Bachelor thesis "Predictive, static energy consumption analysis based on
experimentally determined energy models", which he completed last summer. He won the first prize for his thesis in a tough competition against 6 other Bachelor and Master theses. In the laudation, the high level of scientific rigor was emphasized by the Jury as well as the high relevance of his thesis to the field of sustainability in software engineering. Congrats Max! Well done! 
 

September turned out to be a busy travel month for us. After our research visits in Paderborn and Darmstadt we traveled to Luxembourg for the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE 2023). We could present our recent work and form new connections with various international colleagues. 

Anemone Kampkötter presented her Ph.D. project on the handling of unsound programming structures in static program analysis in the doctoral forum. In her work, she aims to defer the final decision in a static program analysis to the execution of the program. This would enable static analysis developers to protect executables even in the case that the program uses dynamic programming language constructs. 

Johannes Düsing presented our paper "Persisting and Reusing Results of Static Program Analyses on a Large Scale" in the Code Change Analysis session at the main conference. In this paper, we propose and present an infrastructure and method to reuse partial or intermediate results from static program analysis much like a software ecosystem. We show that this is not only useful for static program analysis but can also benefit empirical studies on software ecosystems and repositories. It is our first step towards actual ecosystem-scale analysis and a cornerstone of our research strategy. 

The Automated Software Engineering conference series is a long-standing venue maintained by the Association for Computing Machinery's Special Interest Group in Software Engineering (ACM SIGSOFT). It has been ranked as an A* conference (highest possible rank) in CORE ranking since 2021 (ranked A before) and is currently at position 8 in the Google Scholar Metrics for the Software Systems category with an h5-index of 50 and an h5-median of 81. This year's organization provided an exceptional forum for international research with great opportunities to connect to other researchers in an impressive setting - the EU Council uses the same rooms. 

More:
Anemone Kampkötter's talk abstract at the doctoral forum
Johannes Düsing's talk abstract in the main conference
Our news article on Johannes' paper

In our regular interval we met with researcher from the Software Technology Group at Technische Universität Darmstadt. As both our groups are involved in the development of the OPAL framework we have an in-person meeting roughly every six months to catch up with the other groups work. 

OPAL is a highly-configurable static program analysis framework for JVM languages. It supports Java 19 Bytecode and is written entirely in Scala. Client analyses can thus be also written in any JVM-compatible language. 

We had two amazing day in Darmstadt discussing our current and future research ideas as well as ongoing work to improve the OPAL framework. Some great ideas for a version 6 of OPAL were drafted, but we have no release date for this yet. Also, the Darmstadt people and us had a lot of fun exploring the city in perfect weather.

We spent two days in Paderborn at the Heinz-Nixdorf-Institute - the home of the Secure Software Engineering group at Paderborn University. Our goals were to catch up on each others research and to identify new areas to collaborate. Both groups work on static program analysis and software ecosystem security. In ongoing work, we collaborate on the development of the PhASAR platform currently making it ready for Rust. It was a good opportunity to synchronize our activities in this and other areas. 

Johannes Düsing gave a talk on Persisting and Reusing Results of Static Program Analyses on a Large Scale as a sneak preview of his upcoming paper at ASE'23. Ben Hermann presented a part of our groups current research agenda in a talk titled Challenges in Statically Analyzing Complete Software Ecosystems.

The Secure Software Engineering group in Paderborn develops languages, mechnisms, processes, and tools to allow software developers to express security requirements and have effective mechanisms to enforce them. Their expertise in static program analysis is documented by numerous publications on that topic. They are also a group of very nice and welcoming people and we enjoyed our visit with them very much!