{"id":"https://openalex.org/W4409311758","doi":"https://doi.org/10.1145/3720488","title":"Artemis: Toward Accurate Detection of Server-Side Request Forgeries through LLM-Assisted Inter-procedural Path-Sensitive Taint Analysis","display_name":"Artemis: Toward Accurate Detection of Server-Side Request Forgeries through LLM-Assisted Inter-procedural Path-Sensitive Taint Analysis","publication_year":2025,"publication_date":"2025-04-09","ids":{"openalex":"https://openalex.org/W4409311758","doi":"https://doi.org/10.1145/3720488"},"language":"en","primary_location":{"id":"doi:10.1145/3720488","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3720488","pdf_url":null,"source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1145/3720488","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102830064","display_name":"Yuchen Ji","orcid":"https://orcid.org/0000-0002-4828-5338"},"institutions":[{"id":"https://openalex.org/I30809798","display_name":"ShanghaiTech University","ror":"https://ror.org/030bhh786","country_code":"CN","type":"education","lineage":["https://openalex.org/I30809798"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuchen Ji","raw_affiliation_strings":["ShanghaiTech University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-4828-5338","affiliations":[{"raw_affiliation_string":"ShanghaiTech University, Shanghai, China","institution_ids":["https://openalex.org/I30809798"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101885675","display_name":"Ting Dai","orcid":"https://orcid.org/0000-0003-0257-2304"},"institutions":[{"id":"https://openalex.org/I1341412227","display_name":"IBM (United States)","ror":"https://ror.org/05hh8d621","country_code":"US","type":"company","lineage":["https://openalex.org/I1341412227"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ting Dai","raw_affiliation_strings":["IBM Research, Yorktown Heights, USA"],"raw_orcid":"https://orcid.org/0000-0003-0257-2304","affiliations":[{"raw_affiliation_string":"IBM Research, Yorktown Heights, USA","institution_ids":["https://openalex.org/I1341412227"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101904849","display_name":"Zhichao Zhou","orcid":"https://orcid.org/0000-0002-4543-262X"},"institutions":[{"id":"https://openalex.org/I30809798","display_name":"ShanghaiTech University","ror":"https://ror.org/030bhh786","country_code":"CN","type":"education","lineage":["https://openalex.org/I30809798"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhichao Zhou","raw_affiliation_strings":["ShanghaiTech University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-4543-262X","affiliations":[{"raw_affiliation_string":"ShanghaiTech University, Shanghai, China","institution_ids":["https://openalex.org/I30809798"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000449889","display_name":"Yutian Tang","orcid":"https://orcid.org/0000-0001-5677-4564"},"institutions":[{"id":"https://openalex.org/I7882870","display_name":"University of Glasgow","ror":"https://ror.org/00vtgdb53","country_code":"GB","type":"education","lineage":["https://openalex.org/I7882870"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Yutian Tang","raw_affiliation_strings":["University of Glasgow, Glasgow, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0001-5677-4564","affiliations":[{"raw_affiliation_string":"University of Glasgow, Glasgow, United Kingdom","institution_ids":["https://openalex.org/I7882870"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5080326162","display_name":"Jingzhu He","orcid":"https://orcid.org/0009-0005-9448-5022"},"institutions":[{"id":"https://openalex.org/I30809798","display_name":"ShanghaiTech University","ror":"https://ror.org/030bhh786","country_code":"CN","type":"education","lineage":["https://openalex.org/I30809798"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jingzhu He","raw_affiliation_strings":["ShanghaiTech University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0005-9448-5022","affiliations":[{"raw_affiliation_string":"ShanghaiTech University, Shanghai, China","institution_ids":["https://openalex.org/I30809798"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":16.144,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.98792387,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":100},"biblio":{"volume":"9","issue":"OOPSLA1","first_page":"1349","last_page":"1377"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.664730966091156},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6187644600868225},{"id":"https://openalex.org/keywords/side-channel-attack","display_name":"Side channel attack","score":0.5865741968154907},{"id":"https://openalex.org/keywords/server-side","display_name":"Server-side","score":0.5663485527038574},{"id":"https://openalex.org/keywords/client-side","display_name":"Client-side","score":0.5301098823547363},{"id":"https://openalex.org/keywords/path-analysis","display_name":"Path analysis (statistics)","score":0.49292659759521484},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4455999732017517},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.37003573775291443},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.2619648873806},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.12231019139289856},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.06818902492523193}],"concepts":[{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.664730966091156},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6187644600868225},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.5865741968154907},{"id":"https://openalex.org/C14414571","wikidata":"https://www.wikidata.org/wiki/Q519081","display_name":"Server-side","level":2,"score":0.5663485527038574},{"id":"https://openalex.org/C202477664","wikidata":"https://www.wikidata.org/wiki/Q1352449","display_name":"Client-side","level":2,"score":0.5301098823547363},{"id":"https://openalex.org/C82793941","wikidata":"https://www.wikidata.org/wiki/Q1046024","display_name":"Path analysis (statistics)","level":2,"score":0.49292659759521484},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4455999732017517},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.37003573775291443},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2619648873806},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.12231019139289856},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.06818902492523193}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3720488","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3720488","pdf_url":null,"source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"},{"id":"pmh:oai:eprints.gla.ac.uk:351607","is_oa":true,"landing_page_url":"http://eprints.gla.ac.uk/view/author/72794.html>","pdf_url":null,"source":{"id":"https://openalex.org/S4210235606","display_name":"ENLIGHTEN (Jurnal Bimbingan dan Konseling Islam)","issn_l":"2622-8912","issn":["2622-8912","2622-8920"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"Conference Proceedings"},{"id":"pmh:oai:arXiv.org:2502.21026","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2502.21026","pdf_url":"https://arxiv.org/pdf/2502.21026","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/3720488","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3720488","pdf_url":null,"source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4223574508","display_name":null,"funder_award_id":"62202306","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":38,"referenced_works":["https://openalex.org/W250432737","https://openalex.org/W1971111941","https://openalex.org/W1971800255","https://openalex.org/W1991074244","https://openalex.org/W2003660285","https://openalex.org/W2086631206","https://openalex.org/W2148211687","https://openalex.org/W2294912735","https://openalex.org/W2297710479","https://openalex.org/W2511418200","https://openalex.org/W2732351623","https://openalex.org/W2752602409","https://openalex.org/W3008757785","https://openalex.org/W3090513121","https://openalex.org/W3156471679","https://openalex.org/W3164306598","https://openalex.org/W3178543220","https://openalex.org/W3187895569","https://openalex.org/W3194926883","https://openalex.org/W3206918860","https://openalex.org/W3207946245","https://openalex.org/W4225999506","https://openalex.org/W4281393540","https://openalex.org/W4288057702","https://openalex.org/W4308410314","https://openalex.org/W4384154608","https://openalex.org/W4384948751","https://openalex.org/W4385080345","https://openalex.org/W4385270157","https://openalex.org/W4385679748","https://openalex.org/W4387321674","https://openalex.org/W4388858891","https://openalex.org/W4396214294","https://openalex.org/W4396757498","https://openalex.org/W4402263908","https://openalex.org/W4402264012","https://openalex.org/W4402264056","https://openalex.org/W4402264500"],"related_works":["https://openalex.org/W3005688497","https://openalex.org/W4302890120","https://openalex.org/W4322735059","https://openalex.org/W4301042531","https://openalex.org/W4403348793","https://openalex.org/W4319448716","https://openalex.org/W4402156186","https://openalex.org/W2993438822","https://openalex.org/W3003811204","https://openalex.org/W1979999931"],"abstract_inverted_index":{"Server-side":[0],"request":[1],"forgery":[2],"(SSRF)":[3],"vulnerabilities":[4,16,49],"are":[5,149],"inevitable":[6],"in":[7,14,17,50],"PHP":[8,18,51,58,127],"web":[9,19,52,128],"applications.":[10,53,129],"Existing":[11],"static":[12,42],"tools":[13],"detecting":[15,47],"applications":[20],"neither":[21],"contain":[22],"SSRF-related":[23],"features":[24],"to":[25,78,111,154],"enhance":[26],"detection":[27],"accuracy":[28],"nor":[29],"consider":[30],"PHP\u2019s":[31],"dynamic":[32],"type":[33],"features.":[34],"In":[35],"this":[36],"paper,":[37],"we":[38],"present":[39],"Artemis,":[40],"a":[41,89,118],"taint":[43,85],"analysis":[44,86],"tool":[45],"for":[46],"SSRF":[48,99],"First,":[54],"Artemis":[55,70,83,104,121,130],"extracts":[56],"both":[57,72],"built-in":[59],"and":[60,66,74,96,122,152,159],"third-party":[61],"functions":[62],"as":[63],"candidate":[64],"source":[65],"sink":[67],"functions.":[68],"Second,":[69],"constructs":[71],"explicit":[73],"implicit":[75],"call":[76],"graphs":[77],"infer":[79],"functions\u2019":[80],"relationships.":[81],"Third,":[82],"performs":[84],"based":[87],"on":[88,125],"set":[90],"of":[91,108,120],"rules":[92],"that":[93],"prevent":[94],"over-tainting":[95],"pauses":[97],"when":[98],"exploitation":[100],"is":[101],"impossible.":[102],"Fourth,":[103],"analyzes":[105],"the":[106,144],"compatibility":[107],"path":[109],"conditions":[110],"prune":[112],"false":[113,141],"positives.":[114,142],"We":[115],"have":[116],"implemented":[117],"prototype":[119],"evaluated":[123],"it":[124],"250":[126],"reports":[131],"207":[132],"true":[133,137],"vulnerable":[134],"paths":[135],"(106":[136],"SSRFs)":[138],"with":[139,156],"15":[140],"Of":[143],"106":[145],"detected":[146],"SSRFs,":[147],"35":[148],"newly":[150],"found":[151],"reported":[153],"developers,":[155],"24":[157],"confirmed":[158],"assigned":[160],"CVE":[161],"IDs.":[162]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}