{"id":"https://openalex.org/W3186381920","doi":"https://doi.org/10.1142/s0218194021500303","title":"Static Privacy Analysis by Flow Reconstruction of Tainted Data","display_name":"Static Privacy Analysis by Flow Reconstruction of Tainted Data","publication_year":2021,"publication_date":"2021-07-01","ids":{"openalex":"https://openalex.org/W3186381920","doi":"https://doi.org/10.1142/s0218194021500303","mag":"3186381920"},"language":"en","primary_location":{"is_oa":false,"landing_page_url":"https://doi.org/10.1142/s0218194021500303","pdf_url":null,"source":{"id":"https://openalex.org/S131442419","display_name":"International Journal of Software Engineering and Knowledge Engineering","issn_l":"0218-1940","issn":["0218-1940","1793-6403"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319815","host_organization_name":"World Scientific","host_organization_lineage":["https://openalex.org/P4310319815"],"host_organization_lineage_names":["World Scientific"],"type":"journal"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false},"type":"article","type_crossref":"journal-article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5070919681","display_name":"Pietro Ferrara","orcid":"https://orcid.org/0000-0002-4678-933X"},"institutions":[{"id":"https://openalex.org/I149461666","display_name":"Ca' Foscari University of Venice","ror":"https://ror.org/04yzxz566","country_code":"IT","type":"education","lineage":["https://openalex.org/I149461666"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Pietro Ferrara","raw_affiliation_strings":["Universit\u00e0 Ca\u2019 Foscari di Venezia, Italy"],"affiliations":[{"raw_affiliation_string":"Universit\u00e0 Ca\u2019 Foscari di Venezia, Italy","institution_ids":["https://openalex.org/I149461666"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022121180","display_name":"Luca Olivieri","orcid":"https://orcid.org/0000-0001-8074-8980"},"institutions":[{"id":"https://openalex.org/I119439378","display_name":"University of Verona","ror":"https://ror.org/039bp8j42","country_code":"IT","type":"education","lineage":["https://openalex.org/I119439378"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Luca Olivieri","raw_affiliation_strings":["JuliaSoft SRL, Italy","Universit\u00e0 di Verona, Italy"],"affiliations":[{"raw_affiliation_string":"Universit\u00e0 di Verona, Italy","institution_ids":["https://openalex.org/I119439378"]},{"raw_affiliation_string":"JuliaSoft SRL, Italy","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5051480560","display_name":"Fausto Spoto","orcid":"https://orcid.org/0000-0003-2973-0384"},"institutions":[{"id":"https://openalex.org/I119439378","display_name":"University of Verona","ror":"https://ror.org/039bp8j42","country_code":"IT","type":"education","lineage":["https://openalex.org/I119439378"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Fausto Spoto","raw_affiliation_strings":["Universit\u00e0 di Verona, Italy"],"affiliations":[{"raw_affiliation_string":"Universit\u00e0 di Verona, Italy","institution_ids":["https://openalex.org/I119439378"]}]}],"institution_assertions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.693,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":{"value":0.569688,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":78,"max":81},"biblio":{"volume":"31","issue":"07","first_page":"973","last_page":"1016"},"is_retracted":false,"is_paratext":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9999,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.998,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backflow","display_name":"Backflow","score":0.7301012},{"id":"https://openalex.org/keywords/taint-checking","display_name":"Taint checking","score":0.7048086},{"id":"https://openalex.org/keywords/data-flow-analysis","display_name":"Data-flow analysis","score":0.48573238},{"id":"https://openalex.org/keywords/sql-injection","display_name":"SQL Injection","score":0.43430245},{"id":"https://openalex.org/keywords/information-sensitivity","display_name":"Information sensitivity","score":0.43173417},{"id":"https://openalex.org/keywords/serialization","display_name":"Serialization","score":0.4260683}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7899171},{"id":"https://openalex.org/C120168410","wikidata":"https://www.wikidata.org/wiki/Q4839622","display_name":"Backflow","level":3,"score":0.7301012},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.7048086},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.5561863},{"id":"https://openalex.org/C489000","wikidata":"https://www.wikidata.org/wiki/Q747385","display_name":"Data flow diagram","level":2,"score":0.4934632},{"id":"https://openalex.org/C88468194","wikidata":"https://www.wikidata.org/wiki/Q1172416","display_name":"Data-flow analysis","level":3,"score":0.48573238},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4447548},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.44057974},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.4346912},{"id":"https://openalex.org/C150451098","wikidata":"https://www.wikidata.org/wiki/Q506059","display_name":"SQL injection","level":5,"score":0.43430245},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.43173417},{"id":"https://openalex.org/C52723943","wikidata":"https://www.wikidata.org/wiki/Q1127410","display_name":"Serialization","level":2,"score":0.4260683},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.41112888},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.25932547},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.16797224},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.11531356},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.11514673},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C97854310","wikidata":"https://www.wikidata.org/wiki/Q19541","display_name":"Search engine","level":2,"score":0.0},{"id":"https://openalex.org/C194222762","wikidata":"https://www.wikidata.org/wiki/Q114486","display_name":"Query by Example","level":4,"score":0.0},{"id":"https://openalex.org/C201289731","wikidata":"https://www.wikidata.org/wiki/Q1172599","display_name":"Inlet","level":2,"score":0.0},{"id":"https://openalex.org/C164120249","wikidata":"https://www.wikidata.org/wiki/Q995982","display_name":"Web search query","level":3,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"is_oa":false,"landing_page_url":"https://doi.org/10.1142/s0218194021500303","pdf_url":null,"source":{"id":"https://openalex.org/S131442419","display_name":"International Journal of Software Engineering and Knowledge Engineering","issn_l":"0218-1940","issn":["0218-1940","1793-6403"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319815","host_organization_name":"World Scientific","host_organization_lineage":["https://openalex.org/P4310319815"],"host_organization_lineage_names":["World Scientific"],"type":"journal"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false}],"best_oa_location":null,"sustainable_development_goals":[],"grants":[],"datasets":[],"versions":[],"referenced_works_count":44,"referenced_works":["https://openalex.org/W124941384","https://openalex.org/W1553894716","https://openalex.org/W1557561422","https://openalex.org/W1574640530","https://openalex.org/W1613776191","https://openalex.org/W1889892273","https://openalex.org/W1899538528","https://openalex.org/W1972796262","https://openalex.org/W2000194923","https://openalex.org/W2014764321","https://openalex.org/W2017025011","https://openalex.org/W2017971446","https://openalex.org/W2030224590","https://openalex.org/W2043100293","https://openalex.org/W2046699259","https://openalex.org/W2060692877","https://openalex.org/W2067872353","https://openalex.org/W2089745089","https://openalex.org/W2097151854","https://openalex.org/W2102440514","https://openalex.org/W2119966192","https://openalex.org/W2122049982","https://openalex.org/W2124153277","https://openalex.org/W2125357166","https://openalex.org/W2129278597","https://openalex.org/W2140495200","https://openalex.org/W2152225177","https://openalex.org/W2158126684","https://openalex.org/W2170478581","https://openalex.org/W2252814105","https://openalex.org/W2263666543","https://openalex.org/W2478602967","https://openalex.org/W2514492901","https://openalex.org/W2544992706","https://openalex.org/W2777297765","https://openalex.org/W2803054784","https://openalex.org/W2853432192","https://openalex.org/W2955471678","https://openalex.org/W2964175311","https://openalex.org/W3033893897","https://openalex.org/W3100198463","https://openalex.org/W3102697810","https://openalex.org/W4244726870","https://openalex.org/W4245027182"],"related_works":["https://openalex.org/W4289243647","https://openalex.org/W32572471","https://openalex.org/W3014609151","https://openalex.org/W2900659796","https://openalex.org/W2766465278","https://openalex.org/W2389279987","https://openalex.org/W2383361534","https://openalex.org/W2184634743","https://openalex.org/W2117353399","https://openalex.org/W2009176194"],"abstract_inverted_index":{"Software":[0],"security":[1],"vulnerabilities":[2,48],"and":[3,34,176,179,183,190,220],"leakages":[4,57],"of":[5,10,58,81,90,125,153,160,205,210,233],"private":[6,106],"information":[7,98,107,130],"are":[8],"two":[9],"the":[11,79,88,100,113,203,211,231],"main":[12],"issues":[13],"in":[14,45,141,167],"modern":[15],"software":[16],"systems.":[17],"Several":[18],"different":[19,184],"approaches,":[20],"ranging":[21],"from":[22,78],"design":[23],"techniques":[24],"to":[25,31,55,133,137,148,157,181,186,201,217,226],"run-time":[26],"monitoring,":[27],"have":[28],"been":[29,42,62,165],"applied":[30,180,225],"prevent,":[32],"detect":[33,56,187],"isolate":[35],"such":[36,103,142,229],"vulnerabilities.":[37],"Static":[38],"taint":[39,84,135],"analysis":[40,85,136],"has":[41,61,164],"particularly":[43],"successful":[44],"detecting":[46],"injection":[47],"at":[49],"compile":[50],"time.":[51],"However,":[52],"its":[53],"extension":[54],"sensitive":[59,118,154,234],"data":[60,104,155,207,235,241],"only":[63],"partially":[64],"investigated.":[65],"In":[66],"this":[67],"paper,":[68],"we":[69],"introduce":[70],"BackFlow,":[71],"a":[72,82,117,143,240],"backward":[73],"flow":[74,89,101,204],"reconstructor":[75],"that,":[76],"starting":[77],"results":[80,195],"generic":[83],"engine,":[86],"reconstructs":[87],"tainted":[91,206],"data.":[92],"If":[93],"successful,":[94],"BackFlow":[95,163,198],"provides":[96],"full":[97],"about":[99],"that":[102,197],"(e.g.":[105,120],"or":[108,123,237],"user":[109],"input)":[110],"traversed":[111],"inside":[112],"program":[114],"before":[115],"reaching":[116],"point":[119],"Internet":[121],"communication":[122,161],"execution":[124],"an":[126],"SQL":[127],"query).":[128],"Such":[129],"is":[131,146,199],"needed":[132],"extend":[134],"privacy":[138,191,227],"analyses,":[139],"since":[140],"scenario":[144],"it":[145,214,221],"important":[147],"know":[149],"which":[150],"exact":[151],"type":[152,159],"flows":[156],"what":[158],"channels.":[162],"implemented":[166],"Julia":[168],"(an":[169],"industrial":[170,218],"static":[171],"analyzer":[172],"for":[173,208],"Java,":[174],"Android":[175],".NET":[177],"programs),":[178],"WebGoat":[182],"benchmarks":[185],"both":[188],"injections":[189],"issues.":[192],"The":[193],"experimental":[194],"prove":[196],"able":[200],"reconstruct":[202],"most":[209],"true":[212],"positives,":[213],"scales":[215],"up":[216],"applications,":[219],"can":[222],"be":[223],"effectively":[224],"analysis,":[228],"as":[230],"detection":[232],"leaks":[236],"compliance":[238],"with":[239],"regulation.":[242]},"cited_by_api_url":"https://api.openalex.org/works?filter=cites:W3186381920","counts_by_year":[{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":1}],"updated_date":"2025-01-05T20:36:34.009479","created_date":"2021-08-02"}