{"id":"https://openalex.org/W4414539001","doi":"https://doi.org/10.1109/tse.2025.3614304","title":"PHPJoy: A Novel Extended Graph-Based PHP Code Analysis Framework","display_name":"PHPJoy: A Novel Extended Graph-Based PHP Code Analysis Framework","publication_year":2025,"publication_date":"2025-09-26","ids":{"openalex":"https://openalex.org/W4414539001","doi":"https://doi.org/10.1109/tse.2025.3614304"},"language":"en","primary_location":{"id":"doi:10.1109/tse.2025.3614304","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3614304","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053341800","display_name":"Youkun Shi","orcid":"https://orcid.org/0009-0004-0763-4732"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Youkun Shi","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0004-0763-4732","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017552210","display_name":"Yuan Zhang","orcid":"https://orcid.org/0000-0003-0726-9996"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Zhang","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0003-0726-9996","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5105573624","display_name":"Tianhan Luo","orcid":null},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tianhan Luo","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0005-5849-4589","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028747752","display_name":"Guangliang Yang","orcid":"https://orcid.org/0000-0001-7066-0109"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangliang Yang","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-7066-0109","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088114480","display_name":"Shengke Ye","orcid":null},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shengke Ye","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0007-2997-051X","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101187167","display_name":"Chengyu Yang","orcid":null},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chengyu Yang","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0005-2092-3755","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100695518","display_name":"Fengyu Liu","orcid":"https://orcid.org/0009-0009-4680-6513"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fengyu Liu","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0009-4680-6513","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100400376","display_name":"Xiapu Luo","orcid":"https://orcid.org/0000-0002-9082-3208"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Xiapu Luo","raw_affiliation_strings":["Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China"],"raw_orcid":"https://orcid.org/0000-0002-9082-3208","affiliations":[{"raw_affiliation_string":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052437722","display_name":"Min Yang","orcid":"https://orcid.org/0000-0001-9714-5545"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Min Yang","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-9714-5545","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.35800344,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"51","issue":"12","first_page":"3435","last_page":"3451"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10679","display_name":"Service-Oriented Architecture and Web Services","score":0.987500011920929,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10679","display_name":"Service-Oriented Architecture and Web Services","score":0.987500011920929,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12601","display_name":"Web Applications and Data Management","score":0.983299970626831,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9569000005722046,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vetting","display_name":"Vetting","score":0.7246000170707703},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.5709999799728394},{"id":"https://openalex.org/keywords/program-analysis","display_name":"Program analysis","score":0.5139999985694885},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4932999908924103},{"id":"https://openalex.org/keywords/call-graph","display_name":"Call graph","score":0.49219998717308044},{"id":"https://openalex.org/keywords/security-analysis","display_name":"Security analysis","score":0.47429999709129333},{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"Cross-site scripting","score":0.42480000853538513},{"id":"https://openalex.org/keywords/semantic-analysis","display_name":"Semantic analysis (machine learning)","score":0.4049000144004822},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.3822999894618988}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9282000064849854},{"id":"https://openalex.org/C2777230681","wikidata":"https://www.wikidata.org/wiki/Q7923820","display_name":"Vetting","level":2,"score":0.7246000170707703},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.5709999799728394},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.5139999985694885},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4932999908924103},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.49219998717308044},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.47429999709129333},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.43709999322891235},{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.42480000853538513},{"id":"https://openalex.org/C2777946921","wikidata":"https://www.wikidata.org/wiki/Q7449044","display_name":"Semantic analysis (machine learning)","level":2,"score":0.4049000144004822},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.3822999894618988},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.36910000443458557},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.36010000109672546},{"id":"https://openalex.org/C510870499","wikidata":"https://www.wikidata.org/wiki/Q47607","display_name":"SQL","level":2,"score":0.35420000553131104},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.3538999855518341},{"id":"https://openalex.org/C106937863","wikidata":"https://www.wikidata.org/wiki/Q7236518","display_name":"Power graph analysis","level":3,"score":0.3352999985218048},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.32659998536109924},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.31220000982284546},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.3050000071525574},{"id":"https://openalex.org/C150451098","wikidata":"https://www.wikidata.org/wiki/Q506059","display_name":"SQL injection","level":5,"score":0.302700012922287},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.2939000129699707},{"id":"https://openalex.org/C110893760","wikidata":"https://www.wikidata.org/wiki/Q3115590","display_name":"Named graph","level":5,"score":0.29019999504089355},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.28760001063346863},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.2800999879837036},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.27639999985694885},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.2736999988555908},{"id":"https://openalex.org/C204806902","wikidata":"https://www.wikidata.org/wiki/Q2333581","display_name":"Semantic security","level":5,"score":0.27219998836517334},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.27160000801086426},{"id":"https://openalex.org/C65620979","wikidata":"https://www.wikidata.org/wiki/Q7661176","display_name":"Symbolic data analysis","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.2556999921798706}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tse.2025.3614304","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3614304","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W1563577331","https://openalex.org/W1983142587","https://openalex.org/W1992114977","https://openalex.org/W2002079460","https://openalex.org/W2008158744","https://openalex.org/W2085925880","https://openalex.org/W2086631206","https://openalex.org/W2151152024","https://openalex.org/W2156744022","https://openalex.org/W2732351623","https://openalex.org/W2742956140","https://openalex.org/W2781491433","https://openalex.org/W2951005127","https://openalex.org/W3000442951","https://openalex.org/W3097608674","https://openalex.org/W3136874603","https://openalex.org/W3194926883","https://openalex.org/W4224323202","https://openalex.org/W4225999506","https://openalex.org/W4308410314","https://openalex.org/W4313563416","https://openalex.org/W4385080397","https://openalex.org/W4396757498","https://openalex.org/W4405601433"],"related_works":[],"abstract_inverted_index":{"Nowadays,":[0],"the":[1,100,104,126,130,137,197,207,224,228],"PHP":[2,25,42,67,106,177],"language":[3,17],"is":[4,211],"widely":[5,54],"used":[6],"in":[7,61,223],"web":[8],"development.":[9],"Owing":[10],"to":[11,29,196],"PHP\u2019s":[12],"inherent":[13],"flexibility":[14],"and":[15,22,36,45,65,97,108,122,159,164],"dynamic":[16,66],"features":[18],"(e.g.,":[19,74],"cross-module":[20,120],"dependencies":[21],"runtime":[23,208],"polymorphism),":[24],"applications":[26],"are":[27],"prone":[28],"various":[30,144],"security":[31,46,110,145,221],"vulnerabilities,":[32],"such":[33],"as":[34],"XSS":[35],"SQL":[37],"injection.":[38],"As":[39],"an":[40],"effective":[41],"semantic":[43,101,132,139,188],"understanding":[44],"vetting":[47],"technique,":[48],"static":[49],"program":[50,89,107,117],"analysis":[51,90,118,121,199,203,209],"has":[52],"been":[53],"applied.":[55],"However,":[56],"prior":[57],"work":[58],"faced":[59],"difficulties":[60],"dealing":[62],"with":[63],"diverse":[64],"features,":[68],"which":[69,156,226],"caused":[70],"serious":[71],"false":[72],"negatives":[73],"call":[75],"target":[76,105],"missing).":[77],"<p":[78,169],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[79,170],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">In":[80],"this":[81],"paper,":[82],"we":[83],"propose":[84],"a":[85,150,165],"novel":[86],"extended":[87,131],"graph-based":[88,138],"approach,":[91],"called":[92],"<monospace>PHPJoy</monospace>,":[93],"that":[94,182,206],"can":[95,184],"effectively":[96,185],"universally":[98,142],"learn":[99],"landscape":[102],"of":[103,128,230],"conduct":[109],"validations.":[111],"Specifically,":[112],"<monospace>PHPJoy</monospace>":[113,141,173,183,216],"first":[114],"performs":[115],"fine-grained":[116],"(i.e.,":[119],"field-level":[123],"analysis)":[124],"for":[125],"purpose":[127],"learning":[129],"graphs.":[133],"Then,":[134],"based":[135],"on":[136,174],"information,":[140],"models":[143],"issues":[146],"by":[147,192,213],"efficiently":[148],"utilizing":[149],"new":[151],"security-oriented":[152],"graph":[153,161,189],"query":[154,162],"framework,":[155],"provides":[157],"rich":[158],"easy-to-use":[160],"APIs":[163],"high-performance":[166],"cache-and-prefetch":[167],"strategy.":[168],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">We":[171],"evaluate":[172],"333":[175],"popular":[176],"programs.":[178],"The":[179],"results":[180],"show":[181],"discover":[186],"269,901,982":[187],"edges,":[190],"improving":[191],"23.76%":[193],"when":[194],"compared":[195],"existing":[198],"tools.":[200],"Our":[201],"further":[202],"also":[204],"shows":[205],"overhead":[210],"reduced":[212],"76.54%.":[214],"Furthermore,":[215],"successfully":[217],"hunts":[218],"53":[219],"zero-day":[220],"vulnerabilities":[222],"wild,":[225],"verifies":[227],"practicality":[229],"<monospace>PHPJoy</monospace>.":[231]},"counts_by_year":[],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}