{"id":"https://openalex.org/W4414110655","doi":"https://doi.org/10.1109/access.2025.3608237","title":"Xades: Static Taint Analysis Framework for C#-Based Multilingual Applications","display_name":"Xades: Static Taint Analysis Framework for C#-Based Multilingual Applications","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414110655","doi":"https://doi.org/10.1109/access.2025.3608237"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3608237","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3608237","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3608237","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114819126","display_name":"O Sehwan","orcid":"https://orcid.org/0009-0008-3651-1861"},"institutions":[{"id":"https://openalex.org/I141371507","display_name":"Soongsil University","ror":"https://ror.org/017xnm587","country_code":"KR","type":"education","lineage":["https://openalex.org/I141371507"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"O. Sehwan","raw_affiliation_strings":["School of Software, Soongsil University, Seoul, South Korea","School of Software, Soongsil University, Seoul, Korea"],"raw_orcid":"https://orcid.org/0009-0008-3651-1861","affiliations":[{"raw_affiliation_string":"School of Software, Soongsil University, Seoul, South Korea","institution_ids":["https://openalex.org/I141371507"]},{"raw_affiliation_string":"School of Software, Soongsil University, Seoul, Korea","institution_ids":["https://openalex.org/I141371507"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011859284","display_name":"Minho Kim","orcid":"https://orcid.org/0000-0002-2068-5276"},"institutions":[{"id":"https://openalex.org/I141371507","display_name":"Soongsil University","ror":"https://ror.org/017xnm587","country_code":"KR","type":"education","lineage":["https://openalex.org/I141371507"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Minho Kim","raw_affiliation_strings":["School of Software, Soongsil University, Seoul, South Korea","School of Software, Soongsil University, Seoul, Korea"],"raw_orcid":"https://orcid.org/0000-0002-2068-5276","affiliations":[{"raw_affiliation_string":"School of Software, Soongsil University, Seoul, South Korea","institution_ids":["https://openalex.org/I141371507"]},{"raw_affiliation_string":"School of Software, Soongsil University, Seoul, Korea","institution_ids":["https://openalex.org/I141371507"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082863218","display_name":"Younghoon Ban","orcid":"https://orcid.org/0000-0002-1759-9668"},"institutions":[{"id":"https://openalex.org/I141371507","display_name":"Soongsil University","ror":"https://ror.org/017xnm587","country_code":"KR","type":"education","lineage":["https://openalex.org/I141371507"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Younghoon Ban","raw_affiliation_strings":["School of Software, Soongsil University, Seoul, South Korea","School of Software, Soongsil University, Seoul, Korea"],"raw_orcid":"https://orcid.org/0000-0002-1759-9668","affiliations":[{"raw_affiliation_string":"School of Software, Soongsil University, Seoul, South Korea","institution_ids":["https://openalex.org/I141371507"]},{"raw_affiliation_string":"School of Software, Soongsil University, Seoul, Korea","institution_ids":["https://openalex.org/I141371507"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5060286024","display_name":"Haehyun Cho","orcid":"https://orcid.org/0000-0002-5344-5252"},"institutions":[{"id":"https://openalex.org/I141371507","display_name":"Soongsil University","ror":"https://ror.org/017xnm587","country_code":"KR","type":"education","lineage":["https://openalex.org/I141371507"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Haehyun Cho","raw_affiliation_strings":["School of Software, Soongsil University, Seoul, South Korea","School of Software, Soongsil University, Seoul, Korea"],"raw_orcid":"https://orcid.org/0000-0002-5344-5252","affiliations":[{"raw_affiliation_string":"School of Software, Soongsil University, Seoul, South Korea","institution_ids":["https://openalex.org/I141371507"]},{"raw_affiliation_string":"School of Software, Soongsil University, Seoul, Korea","institution_ids":["https://openalex.org/I141371507"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I141371507"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.12013238,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":null,"first_page":"164952","last_page":"164964"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9890000224113464,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9890000224113464,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9846000075340271,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9449999928474426,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/taint-checking","display_name":"Taint checking","score":0.8529000282287598},{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.6556000113487244},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.6053000092506409},{"id":"https://openalex.org/keywords/chaining","display_name":"Chaining","score":0.5874000191688538},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.5684999823570251},{"id":"https://openalex.org/keywords/call-graph","display_name":"Call graph","score":0.5382999777793884},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4253999888896942},{"id":"https://openalex.org/keywords/dynamic-program-analysis","display_name":"Dynamic program analysis","score":0.4194999933242798},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.4000999927520752},{"id":"https://openalex.org/keywords/software-bug","display_name":"Software bug","score":0.36469998955726624}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9034000039100647},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.8529000282287598},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.6556000113487244},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.6053000092506409},{"id":"https://openalex.org/C49020025","wikidata":"https://www.wikidata.org/wiki/Q1059099","display_name":"Chaining","level":2,"score":0.5874000191688538},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5684999823570251},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.5382999777793884},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.48570001125335693},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4253999888896942},{"id":"https://openalex.org/C140006998","wikidata":"https://www.wikidata.org/wiki/Q2499307","display_name":"Dynamic program analysis","level":3,"score":0.4194999933242798},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.400299996137619},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.4000999927520752},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.36469998955726624},{"id":"https://openalex.org/C99613125","wikidata":"https://www.wikidata.org/wiki/Q165194","display_name":"Application programming interface","level":2,"score":0.36160001158714294},{"id":"https://openalex.org/C34165917","wikidata":"https://www.wikidata.org/wiki/Q188267","display_name":"Programming paradigm","level":2,"score":0.3564000129699707},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.34380000829696655},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.34290000796318054},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.33799999952316284},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.3353999853134155},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3334999978542328},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.32659998536109924},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.31779998540878296},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3131999969482422},{"id":"https://openalex.org/C150451098","wikidata":"https://www.wikidata.org/wiki/Q506059","display_name":"SQL injection","level":5,"score":0.31189998984336853},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C88468194","wikidata":"https://www.wikidata.org/wiki/Q1172416","display_name":"Data-flow analysis","level":3,"score":0.2881999909877777},{"id":"https://openalex.org/C2908586218","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java Programming Language","level":3,"score":0.2791999876499176},{"id":"https://openalex.org/C76518257","wikidata":"https://www.wikidata.org/wiki/Q271680","display_name":"Software framework","level":5,"score":0.2775000035762787},{"id":"https://openalex.org/C63000827","wikidata":"https://www.wikidata.org/wiki/Q3080428","display_name":"Software portability","level":2,"score":0.2619999945163727},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.2614000141620636},{"id":"https://openalex.org/C176982825","wikidata":"https://www.wikidata.org/wiki/Q835922","display_name":"Lexical analysis","level":2,"score":0.2578999996185303},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.25380000472068787},{"id":"https://openalex.org/C162319229","wikidata":"https://www.wikidata.org/wiki/Q175263","display_name":"Data structure","level":2,"score":0.25189998745918274}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2025.3608237","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3608237","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:f77398f1486549628c6f7dbbf3389c82","is_oa":true,"landing_page_url":"https://doaj.org/article/f77398f1486549628c6f7dbbf3389c82","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 164952-164964 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3608237","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3608237","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320335489","display_name":"Institute for Information and Communications Technology Promotion","ror":"https://ror.org/01g0hqq23"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W2007857904","https://openalex.org/W2041276426","https://openalex.org/W2294658973","https://openalex.org/W2470899015","https://openalex.org/W2477316223","https://openalex.org/W2533311740","https://openalex.org/W2545238856","https://openalex.org/W2557385690","https://openalex.org/W2583329118","https://openalex.org/W2737936389","https://openalex.org/W2759716508","https://openalex.org/W2789660410","https://openalex.org/W2803054784","https://openalex.org/W2890190663","https://openalex.org/W2890664869","https://openalex.org/W2910697903","https://openalex.org/W2997474689","https://openalex.org/W4244726870","https://openalex.org/W4245027182","https://openalex.org/W4284673343","https://openalex.org/W4400980674"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2060629665","https://openalex.org/W2029684113","https://openalex.org/W3154138117","https://openalex.org/W999383042","https://openalex.org/W3144105599","https://openalex.org/W2063408151","https://openalex.org/W2893160992"],"abstract_inverted_index":{"The":[0],"C#":[1,30,117,140,175,218],"development":[2],"ecosystem,":[3],"centered":[4],"around":[5],"the":[6,40,76,101,167,171,174],".NET":[7],"Framework,":[8],"underpins":[9],"various":[10],"platforms":[11,20],"for":[12,64,92,100],"mobile,":[13],"desktop,":[14],"and":[15,73,147,183,203,219],"web":[16],"application":[17],"development.":[18],"These":[19],"support":[21],"multilingual":[22,43,80,94],"development,":[23],"enabling":[24],"developers":[25],"to":[26,106,150,189],"incorporate":[27],"not":[28],"only":[29],"but":[31],"also":[32],"a":[33,54,86,126,152,179,194,207],"variety":[34],"of":[35,42,57,115,173,228],"subsidiary":[36],"programming":[37,50,122],"languages.":[38],"With":[39],"rise":[41],"applications,":[44,95],"ensuring":[45],"secure":[46],"interaction":[47],"between":[48,217],"different":[49],"languages":[51,123],"has":[52],"become":[53],"critical":[55],"aspect":[56],"software":[58],"security.":[59],"However,":[60],"prior":[61],"analysis":[62,89,165,172,181],"approaches":[63],"Android":[65,231],"applications":[66,81,192,232],"have":[67],"primarily":[68],"focused":[69],"on":[70,200],"Java,":[71],"Python,":[72],"C,":[74],"leaving":[75],"risks":[77],"in":[78,142,221],"C#-based":[79,93],"largely":[82],"unaddressed.":[83],"We":[84,197],"propose":[85],"static":[87],"taint":[88,164,180],"approach":[90],"tailored":[91],"along":[96],"with":[97,120,166,215],"an":[98,113],"implementation":[99],"Xamarin":[102],"platform,":[103],"named":[104],"Xades,":[105],"detect":[107],"sensitive":[108,163,234],"data":[109,213],"leaks.":[110],"Xades":[111,138,177,199,209],"offers":[112],"overview":[114],"how":[116],"code":[118,141],"interfaces":[119],"other":[121],"by":[124],"constructing":[125],"comprehensive":[127],"call":[128,154,168],"graph":[129],"that":[130],"captures":[131],"cross-language":[132],"method":[133,148],"invocations.":[134],"To":[135],"ensure":[136],"accuracy,":[137],"analyzes":[139],"detail,":[143],"addressing":[144],"accessor":[145],"methods":[146],"chaining":[149],"produce":[151],"precise":[153],"graph.":[155,169],"It,":[156,223],"then,":[157],"performs":[158],"context-,":[159],"flow-,":[160],"field-,":[161],"object-":[162],"Following":[170],"codebase,":[176],"produces":[178],"summary":[182],"translates":[184],"it":[185],"into":[186],"Jimple":[187],"IR,":[188],"analyze":[190],"Xamarin.Android":[191],"through":[193],"modified":[195],"FlowDroid.":[196],"evaluated":[198],"our":[201],"benchmarks":[202],"real-world":[204,230],"apps.":[205],"As":[206],"result,":[208],"successfully":[210],"detected":[211,225],"all":[212],"leaks":[214],"interactions":[216],"Java":[220],"benchmarks.":[222],"also,":[224],"395":[226],"out":[227],"6,087":[229],"leak":[233],"data.":[235]},"counts_by_year":[],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}