{"id":"https://openalex.org/W7125984919","doi":"https://doi.org/10.1109/ase63991.2025.00247","title":"Mockingbird: Efficient Excessive Data Exposures Detection via Dynamic Code Instrumentation","display_name":"Mockingbird: Efficient Excessive Data Exposures Detection via Dynamic Code Instrumentation","publication_year":2025,"publication_date":"2025-11-16","ids":{"openalex":"https://openalex.org/W7125984919","doi":"https://doi.org/10.1109/ase63991.2025.00247"},"language":null,"primary_location":{"id":"doi:10.1109/ase63991.2025.00247","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ase63991.2025.00247","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114078598","display_name":"Chenxiao Xia","orcid":null},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chenxiao Xia","raw_affiliation_strings":["Beijing Institute of Technology,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Institute of Technology,Beijing,China","institution_ids":["https://openalex.org/I125839683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059581768","display_name":"Jiazheng Sun","orcid":"https://orcid.org/0009-0009-2107-1100"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiazheng Sun","raw_affiliation_strings":["Fudan University,Shanghai,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fudan University,Shanghai,China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124096636","display_name":"Jun Zheng","orcid":null},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jun Zheng","raw_affiliation_strings":["Beijing Institute of Technology,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Institute of Technology,Beijing,China","institution_ids":["https://openalex.org/I125839683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121677402","display_name":"Yu-An Tan","orcid":null},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu-an Tan","raw_affiliation_strings":["Beijing Institute of Technology,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Institute of Technology,Beijing,China","institution_ids":["https://openalex.org/I125839683"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5023628856","display_name":"Hongyi Su","orcid":"https://orcid.org/0000-0002-8376-393X"},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongyi Su","raw_affiliation_strings":["Beijing Institute of Technology,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Institute of Technology,Beijing,China","institution_ids":["https://openalex.org/I125839683"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.66193092,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"3009","last_page":"3020"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.4113999903202057,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.4113999903202057,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.22089999914169312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.2175000011920929,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/javascript","display_name":"JavaScript","score":0.5884000062942505},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.5781999826431274},{"id":"https://openalex.org/keywords/rendering","display_name":"Rendering (computer graphics)","score":0.5138999819755554},{"id":"https://openalex.org/keywords/precision-and-recall","display_name":"Precision and recall","score":0.4397999942302704},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.42480000853538513},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.42419999837875366},{"id":"https://openalex.org/keywords/taint-checking","display_name":"Taint checking","score":0.39730000495910645},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.3896999955177307}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7664999961853027},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.5884000062942505},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.5781999826431274},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.527899980545044},{"id":"https://openalex.org/C205711294","wikidata":"https://www.wikidata.org/wiki/Q176953","display_name":"Rendering (computer graphics)","level":2,"score":0.5138999819755554},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.44110000133514404},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.4397999942302704},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.42480000853538513},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.42419999837875366},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.39730000495910645},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3896999955177307},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.38580000400543213},{"id":"https://openalex.org/C118530786","wikidata":"https://www.wikidata.org/wiki/Q1134732","display_name":"Instrumentation (computer programming)","level":2,"score":0.37290000915527344},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.3564000129699707},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.3402999937534332},{"id":"https://openalex.org/C197298091","wikidata":"https://www.wikidata.org/wiki/Q5318963","display_name":"Dynamic data","level":2,"score":0.32580000162124634},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.2919999957084656},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.2888999879360199},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.2831999957561493},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.27459999918937683},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.2685000002384186},{"id":"https://openalex.org/C4641261","wikidata":"https://www.wikidata.org/wiki/Q11681085","display_name":"Face detection","level":4,"score":0.26350000500679016},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.2619999945163727},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.25839999318122864},{"id":"https://openalex.org/C92446256","wikidata":"https://www.wikidata.org/wiki/Q3306762","display_name":"Data validation","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ase63991.2025.00247","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ase63991.2025.00247","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.551837682723999,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320337504","display_name":"Research and Development","ror":"https://ror.org/027s68j25"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W202191487","https://openalex.org/W1826514372","https://openalex.org/W1966862293","https://openalex.org/W1969883639","https://openalex.org/W1987647365","https://openalex.org/W2069307783","https://openalex.org/W2146717998","https://openalex.org/W2149801502","https://openalex.org/W2734542274","https://openalex.org/W2746644282","https://openalex.org/W2758513221","https://openalex.org/W2797835509","https://openalex.org/W2899752583","https://openalex.org/W4239047800","https://openalex.org/W4283332017","https://openalex.org/W4384948751","https://openalex.org/W4386574347","https://openalex.org/W4391558767","https://openalex.org/W4396757560","https://openalex.org/W4399851459","https://openalex.org/W4410088814"],"related_works":[],"abstract_inverted_index":{"Excessive":[0],"Data":[1],"Exposure":[2],"(EDE),":[3],"where":[4],"an":[5,59,92,161],"API":[6,93],"returns":[7],"redundant":[8],"data":[9,87],"to":[10,82,95,113,156],"the":[11,73,85,96,115,130,157],"client":[12,97],"beyond":[13],"what":[14],"is":[15,89,202],"required":[16],"for":[17,32,77,134],"its":[18],"functionality,":[19,104],"has":[20],"become":[21],"a":[22,65,118,189],"pervasive":[23],"and":[24,37,50,127,178,197],"severe":[25],"security":[26],"threat.":[27],"However,":[28],"automated":[29,60],"detection":[30,61,172],"techniques":[31],"such":[33,105],"vulnerabilities":[34],"remain":[35],"underdeveloped,":[36],"existing":[38],"methods,":[39],"particularly":[40],"black-box":[41],"fuzzing,":[42],"face":[43],"significant":[44],"bottlenecks":[45],"in":[46,121],"terms":[47],"of":[48,117,165,192],"accuracy":[49],"efficiency.":[51,198],"To":[52],"address":[53],"these":[54],"challenges,":[55],"we":[56,124],"propose":[57],"Mockingbird,":[58],"tool":[62,71],"based":[63],"on":[64,144,151],"statically-assisted":[66],"dynamic":[67,79],"analysis":[68],"approach.":[69],"The":[70,199],"leverages":[72],"JavaScript":[74],"Proxy":[75],"mechanism":[76],"efficient":[78],"taint":[80],"tracking":[81],"precisely":[83],"identify":[84],"dangling":[86],"that":[88],"transmitted":[90],"from":[91],"response":[94],"but":[98],"never":[99],"consumed":[100],"by":[101,174],"any":[102],"expected":[103],"as":[106],"UI":[107],"rendering":[108],"or":[109],"state":[110],"management.":[111],"Furthermore,":[112],"tackle":[114],"lack":[116],"standardized":[119],"benchmark":[120,133],"this":[122],"domain,":[123],"have":[125],"constructed":[126],"open-sourced":[128],"EDEBench,":[129],"first":[131],"persistent":[132],"EDE":[135],"evaluation,":[136],"comprising":[137],"8":[138],"popular":[139],"open-source":[140],"web":[141],"projects":[142],"built":[143],"diverse":[145],"modern":[146],"technology":[147],"stacks.":[148],"Experimental":[149],"evaluation":[150],"EDEBench":[152],"shows":[153],"that,":[154],"compared":[155],"state-of-the-art,":[158],"Mockingbird":[159],"achieves":[160],"average":[162],"F1-score":[163],"improvement":[164],"24.1%":[166],"(Precision":[167],"+15.8%,":[168],"Recall":[169],"+32.8%),":[170],"enhances":[171],"speed":[173],"nearly":[175],"20":[176],"times,":[177],"demonstrates":[179],"broad":[180],"applicability":[181],"across":[182],"all":[183],"tested":[184],"frameworks.":[185],"These":[186],"results":[187],"provide":[188],"clear":[190],"illustration":[191],"our":[193],"tool\u2019s":[194],"accuracy,":[195],"applicability,":[196],"source":[200],"code":[201],"available":[203],"at":[204],"https://github.com/NeoSunJZ/Mockingbird-JS.":[205]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2026-01-29T00:00:00"}