{"id":"https://openalex.org/W4390933267","doi":"https://doi.org/10.1109/tdsc.2024.3354789","title":"Evaluating C/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools","display_name":"Evaluating C/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools","publication_year":2024,"publication_date":"2024-01-16","ids":{"openalex":"https://openalex.org/W4390933267","doi":"https://doi.org/10.1109/tdsc.2024.3354789"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2024.3354789","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2024.3354789","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101884078","display_name":"Zongjie Li","orcid":"https://orcid.org/0000-0002-9897-4086"},"institutions":[{"id":"https://openalex.org/I200769079","display_name":"Hong Kong University of Science and Technology","ror":"https://ror.org/00q4vv597","country_code":"HK","type":"education","lineage":["https://openalex.org/I200769079"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Zongjie Li","raw_affiliation_strings":["Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"],"raw_orcid":"https://orcid.org/0000-0002-9897-4086","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong","institution_ids":["https://openalex.org/I200769079"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068911323","display_name":"Zhibo Liu","orcid":"https://orcid.org/0000-0002-7872-1129"},"institutions":[{"id":"https://openalex.org/I200769079","display_name":"Hong Kong University of Science and Technology","ror":"https://ror.org/00q4vv597","country_code":"HK","type":"education","lineage":["https://openalex.org/I200769079"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Zhibo Liu","raw_affiliation_strings":["Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"],"raw_orcid":"https://orcid.org/0000-0002-7872-1129","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong","institution_ids":["https://openalex.org/I200769079"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101633456","display_name":"Wai Kin Wong","orcid":"https://orcid.org/0000-0002-2583-0698"},"institutions":[{"id":"https://openalex.org/I200769079","display_name":"Hong Kong University of Science and Technology","ror":"https://ror.org/00q4vv597","country_code":"HK","type":"education","lineage":["https://openalex.org/I200769079"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Wai Kin Wong","raw_affiliation_strings":["Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"],"raw_orcid":"https://orcid.org/0000-0002-2583-0698","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong","institution_ids":["https://openalex.org/I200769079"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101728918","display_name":"Pingchuan Ma","orcid":"https://orcid.org/0000-0001-7680-2817"},"institutions":[{"id":"https://openalex.org/I200769079","display_name":"Hong Kong University of Science and Technology","ror":"https://ror.org/00q4vv597","country_code":"HK","type":"education","lineage":["https://openalex.org/I200769079"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Pingchuan Ma","raw_affiliation_strings":["Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"],"raw_orcid":"https://orcid.org/0000-0001-7680-2817","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong","institution_ids":["https://openalex.org/I200769079"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100328264","display_name":"Shuai Wang","orcid":"https://orcid.org/0000-0002-0866-0308"},"institutions":[{"id":"https://openalex.org/I200769079","display_name":"Hong Kong University of Science and Technology","ror":"https://ror.org/00q4vv597","country_code":"HK","type":"education","lineage":["https://openalex.org/I200769079"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Shuai Wang","raw_affiliation_strings":["Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong"],"raw_orcid":"https://orcid.org/0000-0002-0866-0308","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, HKUST, Clear Water Bay, Hong Kong","institution_ids":["https://openalex.org/I200769079"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I200769079"],"apc_list":null,"apc_paid":null,"fwci":7.8029,"has_fulltext":false,"cited_by_count":21,"citation_normalized_percentile":{"value":0.97746225,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"21","issue":"5","first_page":"4600","last_page":"4618"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7163519263267517},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.6717240214347839},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6313905715942383},{"id":"https://openalex.org/keywords/suite","display_name":"Suite","score":0.5925546884536743},{"id":"https://openalex.org/keywords/false-positives-and-false-negatives","display_name":"False positives and false negatives","score":0.46794572472572327},{"id":"https://openalex.org/keywords/popularity","display_name":"Popularity","score":0.41522833704948425},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2314712107181549},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.17830190062522888}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7163519263267517},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.6717240214347839},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6313905715942383},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.5925546884536743},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.46794572472572327},{"id":"https://openalex.org/C2780586970","wikidata":"https://www.wikidata.org/wiki/Q1357284","display_name":"Popularity","level":2,"score":0.41522833704948425},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2314712107181549},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.17830190062522888},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.0},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tdsc.2024.3354789","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2024.3354789","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},{"id":"pmh:oai:repository.hkust.edu.hk:1783.1-134837","is_oa":false,"landing_page_url":"http://repository.hkust.edu.hk/ir/Record/1783.1-134837","pdf_url":null,"source":{"id":"https://openalex.org/S4306401796","display_name":"Rare & Special e-Zone (The Hong Kong University of Science and Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I200769079","host_organization_name":"Hong Kong University of Science and Technology","host_organization_lineage":["https://openalex.org/I200769079"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.5400000214576721,"id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":86,"referenced_works":["https://openalex.org/W165943180","https://openalex.org/W243537476","https://openalex.org/W1508927144","https://openalex.org/W1541063262","https://openalex.org/W1761184020","https://openalex.org/W1952428424","https://openalex.org/W1981466760","https://openalex.org/W1992114977","https://openalex.org/W2008626182","https://openalex.org/W2019230987","https://openalex.org/W2043100293","https://openalex.org/W2081105932","https://openalex.org/W2140021378","https://openalex.org/W2141736632","https://openalex.org/W2141790816","https://openalex.org/W2145071552","https://openalex.org/W2204102791","https://openalex.org/W2280486853","https://openalex.org/W2297774820","https://openalex.org/W2324595780","https://openalex.org/W2515236103","https://openalex.org/W2748690817","https://openalex.org/W2773017930","https://openalex.org/W2793876926","https://openalex.org/W2809397005","https://openalex.org/W2811327923","https://openalex.org/W2887364112","https://openalex.org/W2898930465","https://openalex.org/W2900761207","https://openalex.org/W2901980656","https://openalex.org/W2926178846","https://openalex.org/W2946241866","https://openalex.org/W2950696312","https://openalex.org/W2953854830","https://openalex.org/W2955355561","https://openalex.org/W2964150020","https://openalex.org/W2976928731","https://openalex.org/W2990141967","https://openalex.org/W2995247483","https://openalex.org/W3006613871","https://openalex.org/W3008797115","https://openalex.org/W3015499098","https://openalex.org/W3016591891","https://openalex.org/W3049001265","https://openalex.org/W3082737479","https://openalex.org/W3082972076","https://openalex.org/W3101488839","https://openalex.org/W3112894679","https://openalex.org/W3116366071","https://openalex.org/W3120693904","https://openalex.org/W3126967000","https://openalex.org/W3133719257","https://openalex.org/W3170526652","https://openalex.org/W3176548231","https://openalex.org/W3182110757","https://openalex.org/W3194771370","https://openalex.org/W3195156628","https://openalex.org/W3196239222","https://openalex.org/W3202451838","https://openalex.org/W3202871865","https://openalex.org/W4242526644","https://openalex.org/W4246166885","https://openalex.org/W4252684946","https://openalex.org/W4281387902","https://openalex.org/W4285490477","https://openalex.org/W4286331360","https://openalex.org/W4286984885","https://openalex.org/W4301430471","https://openalex.org/W4384154448","https://openalex.org/W6609394439","https://openalex.org/W6639560864","https://openalex.org/W6675450584","https://openalex.org/W6725800993","https://openalex.org/W6729167014","https://openalex.org/W6751601040","https://openalex.org/W6752526365","https://openalex.org/W6753073829","https://openalex.org/W6754182100","https://openalex.org/W6754601402","https://openalex.org/W6773001491","https://openalex.org/W6774112282","https://openalex.org/W6781192591","https://openalex.org/W6787643649","https://openalex.org/W6788577223","https://openalex.org/W6803092148","https://openalex.org/W6840762482"],"related_works":["https://openalex.org/W1557094818","https://openalex.org/W2183246718","https://openalex.org/W1973412793","https://openalex.org/W2099261052","https://openalex.org/W4292605373","https://openalex.org/W2951146195","https://openalex.org/W4226316650","https://openalex.org/W3123215897","https://openalex.org/W2153600354","https://openalex.org/W4243739114"],"abstract_inverted_index":{"In":[0],"recent":[1],"years,":[2],"query-based":[3],"static":[4],"application":[5],"security":[6],"testing":[7,173],"(Q-SAST)":[8],"tools":[9],"such":[10],"as":[11],"CodeQL":[12],"have":[13,66],"gained":[14],"popularity":[15],"due":[16],"to":[17,20,77,89,124,157,175,192],"their":[18,49,71,91],"ability":[19],"codify":[21],"vulnerability":[22,72,93,166],"knowledge":[23],"into":[24,51],"SQL-like":[25],"queries":[26],"and":[27,57,111,129,154,180,201,214],"search":[28],"for":[29],"vulnerabilities":[30],"in":[31,44,75,160],"the":[32,36,52,83,143,195],"database":[33],"derived":[34],"from":[35,99,206],"software.":[37],"The":[38],"industry":[39],"has":[40],"made":[41],"considerable":[42],"progress":[43],"building":[45],"Q-SAST":[46,88,128,149],"tools,":[47,150],"facilitating":[48],"integration":[50,54],"continuous":[53],"(CI)":[55],"pipeline,":[56],"sustaining":[58],"an":[59],"active":[60],"community.":[61],"However,":[62],"we":[63,136,168],"do":[64],"not":[65],"a":[67,106,112,171],"systematic":[68],"understanding":[69],"of":[70,87,146,184,187,198,216],"detection":[73],"capability":[74],"comparison":[76],"conventional":[78],"SAST":[79,131],"tools.":[80],"We":[81,103,203],"conduct":[82],"first":[84,104],"in-depth":[85],"study":[86,96,208],"demystify":[90],"C/C++":[92],"detectability.":[94],"Our":[95],"is":[97],"conducted":[98],"three":[100,147],"complementary":[101],"aspects.":[102],"use":[105],"synthetic":[107],"CWE":[108],"test":[109,115],"suite":[110],"real-world":[113],"CVE":[114],"suite,":[116],"totaling":[117],"almost":[118],"30K":[119],"programs":[120],"with":[121],"known":[122],"CWE/CVE,":[123],"assess":[125],"popular":[126,148],"(commercial)":[127],"industry-leading":[130],"(requiring":[132],"no":[133],"queries).":[134],"Then,":[135],"gather":[137],"defect-fixing":[138],"pull":[139],"requests":[140],"(PRs)":[141],"since":[142],"release":[144],"dates":[145],"characterizing":[151],"historically-fixed":[152],"defects":[153],"comparing":[155],"them":[156],"pitfalls":[158],"exposed":[159],"our":[161,207],"CWE/CVE":[162],"study.":[163],"To":[164],"enhance":[165],"detection,":[167],"design":[169],"SAST-MT,":[170],"metamorphic":[172],"framework":[174],"detect":[176],"false":[177,181],"positives":[178],"(FPs)":[179],"negatives":[182],"(FNs)":[183],"Q-SAST.":[185,217],"Findings":[186],"SAST-MT":[188],"can":[189,210],"be":[190],"used":[191],"easily":[193],"expose":[194],"root":[196],"causes":[197],"Q-SAST's":[199],"FPs":[200],"FNs.":[202],"summarize":[204],"lessons":[205],"that":[209],"benefit":[211],"both":[212],"users":[213],"developers":[215]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":13}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}