{"id":"https://openalex.org/W2146455667","doi":"https://doi.org/10.1109/52.976940","title":"Improving security using extensible lightweight static analysis","display_name":"Improving security using extensible lightweight static analysis","publication_year":2002,"publication_date":"2002-01-01","ids":{"openalex":"https://openalex.org/W2146455667","doi":"https://doi.org/10.1109/52.976940","mag":"2146455667"},"language":"en","primary_location":{"id":"doi:10.1109/52.976940","doi":"https://doi.org/10.1109/52.976940","is_oa":false,"landing_page_url":"https://doi.org/10.1109/52.976940","pdf_url":null,"source":{"id":"https://openalex.org/S6725529","display_name":"IEEE Software","issn_l":"0740-7459","issn":["0740-7459","1937-4194"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-b","jufo-2","norway-2","poland-100","russia-white-list-1"],"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Software","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5027001546","display_name":"David Evans","orcid":"https://orcid.org/0000-0001-7988-8943","observed_orcids":["https://orcid.org/0000-0001-7988-8943","https://orcid.org/0000-0002-5309-6021"]},"institutions":[{"id":"https://openalex.org/I51556381","display_name":"University of Virginia","ror":"https://ror.org/0153tk833","country_code":"US","type":"education","lineage":["https://openalex.org/I51556381"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"D. Evans","raw_affiliation_strings":["University of Virginia, USA","Dept. of Comput. Sci., Virginia Univ., Charlottesville, VA, USA#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Virginia, USA","institution_ids":["https://openalex.org/I51556381"]},{"raw_affiliation_string":"Dept. of Comput. Sci., Virginia Univ., Charlottesville, VA, USA#TAB#","institution_ids":["https://openalex.org/I51556381"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5037385329","display_name":"David Larochelle","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I51556381","display_name":"University of Virginia","ror":"https://ror.org/0153tk833","country_code":"US","type":"education","lineage":["https://openalex.org/I51556381"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"D. Larochelle","raw_affiliation_strings":["University of Virginia, USA","University of Virginia'"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Virginia, USA","institution_ids":["https://openalex.org/I51556381"]},{"raw_affiliation_string":"University of Virginia'","institution_ids":["https://openalex.org/I51556381"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I51556381"],"apc_list":{"value":2995,"currency":"USD","value_usd":2995},"apc_paid":null,"fwci":26.7582,"has_fulltext":false,"cited_by_count":477,"citation_normalized_percentile":{"value":0.99613586,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":"19","issue":"1","first_page":"42","last_page":"51"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8931000232696533,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8931000232696533,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.055799998342990875,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.03350000083446503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-security","display_name":"software security","score":0.6230000257492065},{"id":"https://openalex.org/keywords/static-analysis","display_name":"static analysis","score":0.8240000009536743},{"id":"https://openalex.org/keywords/security-vulnerabilities","display_name":"security vulnerabilities","score":0.7229999899864197},{"id":"https://openalex.org/keywords/buffer-overflow","display_name":"buffer overflow","score":0.8190000057220459},{"id":"https://openalex.org/keywords/format-string-vulnerabilities","display_name":"format string vulnerabilities","score":0.9929999709129333},{"id":"https://openalex.org/keywords/vulnerability-detection","display_name":"vulnerability detection","score":0.6019999980926514},{"id":"https://openalex.org/keywords/software-development-process","display_name":"software development process","score":0.7580000162124634}],"concepts":[{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.8893548846244812},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7664456367492676},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7381958365440369},{"id":"https://openalex.org/C32833848","wikidata":"https://www.wikidata.org/wiki/Q4115054","display_name":"Extensibility","level":2,"score":0.6785014867782593},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.6699529886245728},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.6601297855377197},{"id":"https://openalex.org/C40842320","wikidata":"https://www.wikidata.org/wiki/Q19423","display_name":"Buffer overflow","level":2,"score":0.6273962259292603},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6086492538452148},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.6038463115692139},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.5589792728424072},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.5275815725326538},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5217947959899902},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.5184637904167175},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.4830628037452698},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.46965518593788147},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.41076067090034485},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.30804041028022766},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.2485484480857849},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.23987916111946106},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.208237886428833},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1948544979095459},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.12300190329551697},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.10338267683982849},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/52.976940","doi":"https://doi.org/10.1109/52.976940","is_oa":false,"landing_page_url":"https://doi.org/10.1109/52.976940","pdf_url":null,"source":{"id":"https://openalex.org/S6725529","display_name":"IEEE Software","issn_l":"0740-7459","issn":["0740-7459","1937-4194"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-b","jufo-2","norway-2","poland-100","russia-white-list-1"],"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Software","raw_type":"journal-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.23.8576","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.23.8576","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.virginia.edu/evans/pubs/ieeesoftware.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.76.6317","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.76.6317","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.virginia.edu/evans/pubs/ieeesoftware-revised.pdf","raw_type":"text"},{"id":"pmh:oai:bibcyt.ucla.edu.ve:T070300003928/6","doi":null,"is_oa":false,"landing_page_url":"http://bibcyt.ucla.edu.ve/cgi-win/be_alex.exe?Acceso=T070300003928/6&Nombrebd=Bciucla","pdf_url":null,"source":{"id":"https://openalex.org/S7407064187","display_name":"UCLA - Biblioteca de Ciencias y Tecnologia Felix Morales Bueno","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I19325673","host_organization_name":"Universidad Centroccidental Lisandro Alvarado","host_organization_lineage":["https://openalex.org/I19325673"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W24839522","https://openalex.org/W111098712","https://openalex.org/W1546149892","https://openalex.org/W1552618981","https://openalex.org/W1565113942","https://openalex.org/W1579850852","https://openalex.org/W1592152511","https://openalex.org/W1655226010","https://openalex.org/W2007181618","https://openalex.org/W2055084740","https://openalex.org/W2070869623","https://openalex.org/W2103318645","https://openalex.org/W2120138937","https://openalex.org/W2137689716","https://openalex.org/W2137952932","https://openalex.org/W2150277819","https://openalex.org/W2402789968","https://openalex.org/W3150785826"],"related_works":["https://openalex.org/W7096001112","https://openalex.org/W2380031640","https://openalex.org/W2393442563","https://openalex.org/W2008934824","https://openalex.org/W2765300646","https://openalex.org/W7131116372","https://openalex.org/W1649260624","https://openalex.org/W2066375924","https://openalex.org/W2098465784","https://openalex.org/W1983248291"],"abstract_inverted_index":{"Most":[0],"security":[1,33,68],"attacks":[2],"exploit":[3],"instances":[4],"of":[5,8,17],"well-known":[6],"classes":[7],"implementation":[9],"flaws.":[10],"Developers":[11],"could":[12],"detect":[13,66],"and":[14,73],"eliminate":[15],"many":[16],"these":[18,25],"flaws":[19],"before":[20],"deploying":[21],"the":[22,32,50],"software,":[23],"yet":[24],"problems":[26],"persist":[27],"with":[28],"disturbing":[29],"frequency-not":[30],"because":[31,40],"community":[34],"doesn't":[35],"sufficiently":[36],"understand":[37],"them":[38,44],"but":[39],"techniques":[41],"for":[42],"preventing":[43],"have":[45],"not":[46],"been":[47],"integrated":[48],"into":[49],"software":[51],"development":[52],"process.":[53],"This":[54],"article":[55],"describes":[56],"an":[57],"extensible":[58],"tool":[59],"that":[60],"uses":[61],"lightweight":[62],"static":[63],"analysis":[64],"to":[65],"common":[67],"vulnerabilities":[69],"(including":[70],"buffer":[71],"overflows":[72],"format":[74],"string":[75],"vulnerabilities).":[76]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":12},{"year":2022,"cited_by_count":9},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":24},{"year":2019,"cited_by_count":20},{"year":2018,"cited_by_count":22},{"year":2017,"cited_by_count":13},{"year":2016,"cited_by_count":15},{"year":2015,"cited_by_count":20},{"year":2014,"cited_by_count":17},{"year":2013,"cited_by_count":19},{"year":2012,"cited_by_count":27}],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2016-06-24T00:00:00"}