{"id":"https://openalex.org/W4394746385","doi":"https://doi.org/10.1145/3597503.3639199","title":"RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains","display_name":"RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains","publication_year":2024,"publication_date":"2024-04-12","ids":{"openalex":"https://openalex.org/W4394746385","doi":"https://doi.org/10.1145/3597503.3639199"},"language":"en","primary_location":{"id":"doi:10.1145/3597503.3639199","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3597503.3639199","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3597503.3639199","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 46th International Conference on Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3597503.3639199","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5095377122","display_name":"Raphael J. Sofaer","orcid":"https://orcid.org/0009-0009-7924-6436"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Raphael J. Sofaer","raw_affiliation_strings":["Columbia University, New York, New York, USA"],"raw_orcid":"https://orcid.org/0009-0009-7924-6436","affiliations":[{"raw_affiliation_string":"Columbia University, New York, New York, USA","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037171444","display_name":"Yaniv David","orcid":"https://orcid.org/0000-0002-1630-7723"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yaniv David","raw_affiliation_strings":["Columbia University, New York, New York, USA"],"raw_orcid":"https://orcid.org/0000-0002-1630-7723","affiliations":[{"raw_affiliation_string":"Columbia University, New York, New York, USA","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077261137","display_name":"Mingqing Kang","orcid":"https://orcid.org/0009-0004-9476-9247"},"institutions":[{"id":"https://openalex.org/I145311948","display_name":"Johns Hopkins University","ror":"https://ror.org/00za53h95","country_code":"US","type":"education","lineage":["https://openalex.org/I145311948"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mingqing Kang","raw_affiliation_strings":["Johns Hopkins University, Baltimore, Maryland, USA"],"raw_orcid":"https://orcid.org/0009-0004-9476-9247","affiliations":[{"raw_affiliation_string":"Johns Hopkins University, Baltimore, Maryland, USA","institution_ids":["https://openalex.org/I145311948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078293044","display_name":"Jianjia Yu","orcid":"https://orcid.org/0009-0000-0051-8385"},"institutions":[{"id":"https://openalex.org/I145311948","display_name":"Johns Hopkins University","ror":"https://ror.org/00za53h95","country_code":"US","type":"education","lineage":["https://openalex.org/I145311948"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jianjia Yu","raw_affiliation_strings":["Johns Hopkins University, Baltimore, Maryland, USA"],"raw_orcid":"https://orcid.org/0009-0000-0051-8385","affiliations":[{"raw_affiliation_string":"Johns Hopkins University, Baltimore, Maryland, USA","institution_ids":["https://openalex.org/I145311948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070605476","display_name":"Yinzhi Cao","orcid":"https://orcid.org/0000-0002-9618-4830"},"institutions":[{"id":"https://openalex.org/I145311948","display_name":"Johns Hopkins University","ror":"https://ror.org/00za53h95","country_code":"US","type":"education","lineage":["https://openalex.org/I145311948"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yinzhi Cao","raw_affiliation_strings":["Johns Hopkins University, Baltimore, Maryland, USA"],"raw_orcid":"https://orcid.org/0000-0002-9618-4830","affiliations":[{"raw_affiliation_string":"Johns Hopkins University, Baltimore, Maryland, USA","institution_ids":["https://openalex.org/I145311948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008303237","display_name":"Junfeng Yang","orcid":"https://orcid.org/0009-0000-2277-6545"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Junfeng Yang","raw_affiliation_strings":["Columbia University, New York, New York, USA"],"raw_orcid":"https://orcid.org/0009-0000-2277-6545","affiliations":[{"raw_affiliation_string":"Columbia University, New York, New York, USA","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5055391594","display_name":"Jason Nieh","orcid":"https://orcid.org/0009-0005-8301-4479"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jason Nieh","raw_affiliation_strings":["Columbia University, New York, New York, USA"],"raw_orcid":"https://orcid.org/0009-0005-8301-4479","affiliations":[{"raw_affiliation_string":"Columbia University, New York, New York, USA","institution_ids":["https://openalex.org/I78577930"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.0808,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.87484125,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8467113971710205},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.6259370446205139},{"id":"https://openalex.org/keywords/javascript","display_name":"JavaScript","score":0.5787853002548218},{"id":"https://openalex.org/keywords/data-flow-analysis","display_name":"Data-flow analysis","score":0.5579196214675903},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4782244861125946},{"id":"https://openalex.org/keywords/data-flow-diagram","display_name":"Data flow diagram","score":0.45382556319236755},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.42688077688217163},{"id":"https://openalex.org/keywords/control-flow-graph","display_name":"Control flow graph","score":0.4199550449848175},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.4176117181777954},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.41521769762039185},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.41388264298439026},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.24977949261665344},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.2357001006603241},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.2229958176612854},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.10788831114768982}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8467113971710205},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.6259370446205139},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.5787853002548218},{"id":"https://openalex.org/C88468194","wikidata":"https://www.wikidata.org/wiki/Q1172416","display_name":"Data-flow analysis","level":3,"score":0.5579196214675903},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4782244861125946},{"id":"https://openalex.org/C489000","wikidata":"https://www.wikidata.org/wiki/Q747385","display_name":"Data flow diagram","level":2,"score":0.45382556319236755},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42688077688217163},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.4199550449848175},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.4176117181777954},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.41521769762039185},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.41388264298439026},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.24977949261665344},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2357001006603241},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.2229958176612854},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.10788831114768982},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3597503.3639199","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3597503.3639199","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3597503.3639199","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 46th International Conference on Software Engineering","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3597503.3639199","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3597503.3639199","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3597503.3639199","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 46th International Conference on Software Engineering","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1037014486","display_name":null,"funder_award_id":"N66001","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"},{"id":"https://openalex.org/G2313217935","display_name":"CAREER: Mining and Exploiting Web Vulnerabilities of Prototype-based Programming Languages via Object Property Graph","funder_award_id":"2046361","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2637607055","display_name":"SaTC: CORE: Medium: Microverification of Information-Flow Security for the Linux Operating System Kernel","funder_award_id":"2052947","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5412059031","display_name":null,"funder_award_id":"N66001-21-C-4018","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"},{"id":"https://openalex.org/G6377866694","display_name":"SaTC: CORE: Medium: Cannot Trust Anything: A Tiny TCB Architecture for Secure Containers","funder_award_id":"2247370","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8677875818","display_name":"FMitF: Track I: Verifying System Software on an Arm Multiprocessor Hardware Model","funder_award_id":"2124080","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8857577330","display_name":"SaTC: CORE: Small: Studying and Measuring the Consequence of Prototype Pollution Vulnerabilities Automatically via Joint Taintflow Analysis","funder_award_id":"2154404","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320307894","display_name":"Accenture","ror":"https://ror.org/013g16z83"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4394746385.pdf","grobid_xml":"https://content.openalex.org/works/W4394746385.grobid-xml"},"referenced_works_count":47,"referenced_works":["https://openalex.org/W202191487","https://openalex.org/W1966862293","https://openalex.org/W1987647365","https://openalex.org/W2027479906","https://openalex.org/W2027625187","https://openalex.org/W2043100293","https://openalex.org/W2059456764","https://openalex.org/W2080298145","https://openalex.org/W2094568767","https://openalex.org/W2125357166","https://openalex.org/W2138788987","https://openalex.org/W2274071363","https://openalex.org/W2377819450","https://openalex.org/W2405517096","https://openalex.org/W2735438339","https://openalex.org/W2740130372","https://openalex.org/W2763994238","https://openalex.org/W2793857960","https://openalex.org/W2795030435","https://openalex.org/W2885626945","https://openalex.org/W2901936332","https://openalex.org/W2967904600","https://openalex.org/W2970044827","https://openalex.org/W2970323597","https://openalex.org/W3046453918","https://openalex.org/W3047791216","https://openalex.org/W3092347617","https://openalex.org/W3114916308","https://openalex.org/W3117175757","https://openalex.org/W3138230581","https://openalex.org/W3147673361","https://openalex.org/W3155249046","https://openalex.org/W3155666085","https://openalex.org/W3165028596","https://openalex.org/W3180903877","https://openalex.org/W3187895569","https://openalex.org/W3194926883","https://openalex.org/W3196199748","https://openalex.org/W3204945378","https://openalex.org/W4226416841","https://openalex.org/W4247387602","https://openalex.org/W4255632703","https://openalex.org/W4280570174","https://openalex.org/W4308562555","https://openalex.org/W4312903035","https://openalex.org/W4385080345","https://openalex.org/W4385208592"],"related_works":["https://openalex.org/W2151163382","https://openalex.org/W4256382613","https://openalex.org/W59945861","https://openalex.org/W1484884871","https://openalex.org/W1551967076","https://openalex.org/W1549956274","https://openalex.org/W2084443973","https://openalex.org/W94523631","https://openalex.org/W2052160877","https://openalex.org/W2081768685"],"abstract_inverted_index":{"Rogue":[0],"updates,":[1],"an":[2,54,64,80],"important":[3],"type":[4],"of":[5,67,138,163],"software":[6],"supply-chain":[7],"attack":[8],"in":[9,75,105,119,126,192],"which":[10,101],"attackers":[11],"conceal":[12],"malicious":[13,207],"code":[14,74],"inside":[15],"updates":[16,40,172,195],"to":[17,25,41,51,95,134,150,201,205],"benign":[18,177],"software,":[19],"are":[20,109],"a":[21,35,46,57,76,98,106,111,123,127,136],"growing":[22],"problem":[23],"due":[24],"their":[26],"stealth":[27],"and":[28,32,173,183,196],"effectiveness.":[29],"We":[30,158],"design":[31],"implement":[33],"RogueOne,":[34],"system":[36,128],"for":[37],"detecting":[38,170,193],"rogue":[39,171,194],"JavaScript":[42],"packages.":[43,208],"RogueOne":[44,91,130,160,179],"uses":[45,131],"novel":[47,99],"differential":[48],"data-flow":[49,82,145],"analysis":[50],"capture":[52],"how":[53],"update":[55],"changes":[56],"package's":[58],"interactions":[59,154],"with":[60,155],"external":[61,156],"APIs.":[62,157],"Using":[63],"efficient":[65],"form":[66],"abstract":[68],"interpretation":[69],"that":[70,86],"can":[71,184],"exclude":[72],"unchanged":[73],"package,":[77,122],"it":[78],"constructs":[79],"object":[81],"relationship":[83],"graph":[84],"(ODRG)":[85],"tracks":[87],"data-flows":[88,139],"among":[89],"objects.":[90],"then":[92],"maps":[93],"objects":[94],"trust":[96,103,112,141],"domains,":[97],"abstraction":[100],"summarizes":[102],"relationships":[104],"package.":[107],"Objects":[108],"assigned":[110],"domain":[113],"based":[114],"on":[115,161],"whether":[116],"they":[117],"originate":[118],"the":[120,132],"target":[121],"dependency,":[124],"or":[125],"API.":[129],"ODRG":[133],"build":[135],"set":[137],"across":[140,147],"domains.":[142],"It":[143],"compares":[144],"sets":[146],"package":[148],"versions":[149],"detect":[151,206],"untrustworthy":[152],"new":[153],"evaluated":[159],"hundreds":[162],"npm":[164],"packages,":[165],"demonstrating":[166],"its":[167],"effectiveness":[168],"at":[169],"distinguishing":[174],"them":[175],"from":[176],"ones.":[178],"achieves":[180],"high":[181],"accuracy":[182],"be":[185],"more":[186],"than":[187],"seven":[188],"times":[189],"as":[190],"effective":[191],"avoiding":[197],"false":[198],"positives":[199],"compared":[200],"other":[202],"systems":[203],"built":[204]},"counts_by_year":[{"year":2025,"cited_by_count":4}],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2025-10-10T00:00:00"}