{"id":"https://openalex.org/W7115888674","doi":"https://doi.org/10.1145/3779208.3785375","title":"Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Prediction","display_name":"Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Prediction","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7115888674","doi":"https://doi.org/10.1145/3779208.3785375"},"language":null,"primary_location":{"id":"doi:10.1145/3779208.3785375","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785375","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3779208.3785375","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Felix M\u00e4chtle","orcid":"https://orcid.org/0009-0009-2431-0322"},"institutions":[{"id":"https://openalex.org/I9341345","display_name":"University of L\u00fcbeck","ror":"https://ror.org/00t3r8h32","country_code":"DE","type":"education","lineage":["https://openalex.org/I9341345"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Felix M\u00e4chtle","raw_affiliation_strings":["University of Luebeck, L\u00fcbeck, Germany"],"raw_orcid":"https://orcid.org/0009-0009-2431-0322","affiliations":[{"raw_affiliation_string":"University of Luebeck, L\u00fcbeck, Germany","institution_ids":["https://openalex.org/I9341345"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Nils Loose","orcid":"https://orcid.org/0009-0003-6243-1623"},"institutions":[{"id":"https://openalex.org/I9341345","display_name":"University of L\u00fcbeck","ror":"https://ror.org/00t3r8h32","country_code":"DE","type":"education","lineage":["https://openalex.org/I9341345"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Nils Loose","raw_affiliation_strings":["University of Luebeck, L\u00fcbeck, Germany"],"raw_orcid":"https://orcid.org/0009-0003-6243-1623","affiliations":[{"raw_affiliation_string":"University of Luebeck, L\u00fcbeck, Germany","institution_ids":["https://openalex.org/I9341345"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Tim Schulz","orcid":"https://orcid.org/0009-0002-8409-7999"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Tim Schulz","raw_affiliation_strings":["University of Hamburg, Hamburg, Germany"],"raw_orcid":"https://orcid.org/0009-0002-8409-7999","affiliations":[{"raw_affiliation_string":"University of Hamburg, Hamburg, Germany","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Florian Sieck","orcid":"https://orcid.org/0000-0002-1501-0936"},"institutions":[{"id":"https://openalex.org/I9341345","display_name":"University of L\u00fcbeck","ror":"https://ror.org/00t3r8h32","country_code":"DE","type":"education","lineage":["https://openalex.org/I9341345"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Florian Sieck","raw_affiliation_strings":["University of Luebeck, L\u00fcbeck, Germany"],"raw_orcid":"https://orcid.org/0000-0002-1501-0936","affiliations":[{"raw_affiliation_string":"University of Luebeck, L\u00fcbeck, Germany","institution_ids":["https://openalex.org/I9341345"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jan-Niclas Serr","orcid":"https://orcid.org/0009-0001-4624-8592"},"institutions":[{"id":"https://openalex.org/I9341345","display_name":"University of L\u00fcbeck","ror":"https://ror.org/00t3r8h32","country_code":"DE","type":"education","lineage":["https://openalex.org/I9341345"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Jan-Niclas Serr","raw_affiliation_strings":["University of Luebeck, L\u00fcbeck, Germany"],"raw_orcid":"https://orcid.org/0009-0001-4624-8592","affiliations":[{"raw_affiliation_string":"University of Luebeck, L\u00fcbeck, Germany","institution_ids":["https://openalex.org/I9341345"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ralf Moeller","orcid":"https://orcid.org/0000-0002-1174-3323"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Ralf Moeller","raw_affiliation_strings":["University of Hamburg, Hamburg, Germany"],"raw_orcid":"https://orcid.org/0000-0002-1174-3323","affiliations":[{"raw_affiliation_string":"University of Hamburg, Hamburg, Germany","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"last","author":{"id":null,"display_name":"Thomas Eisenbarth","orcid":"https://orcid.org/0000-0003-1116-6973"},"institutions":[{"id":"https://openalex.org/I9341345","display_name":"University of L\u00fcbeck","ror":"https://ror.org/00t3r8h32","country_code":"DE","type":"education","lineage":["https://openalex.org/I9341345"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Thomas Eisenbarth","raw_affiliation_strings":["University of Luebeck, L\u00fcbeck, Germany"],"raw_orcid":"https://orcid.org/0000-0003-1116-6973","affiliations":[{"raw_affiliation_string":"University of Luebeck, L\u00fcbeck, Germany","institution_ids":["https://openalex.org/I9341345"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0227371,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1507","last_page":"1523"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.2870999872684479,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.2870999872684479,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.23430000245571136,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.12300000339746475,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.8155999779701233},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6769999861717224},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.6583999991416931},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.5532000064849854},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5072000026702881},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.4535999894142151},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.3905999958515167},{"id":"https://openalex.org/keywords/program-comprehension","display_name":"Program comprehension","score":0.3828999996185303}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8266000151634216},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.8155999779701233},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6769999861717224},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.6583999991416931},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.593500018119812},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.5532000064849854},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5139999985694885},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5072000026702881},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4535999894142151},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42739999294281006},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.3905999958515167},{"id":"https://openalex.org/C2777561058","wikidata":"https://www.wikidata.org/wiki/Q2652119","display_name":"Program comprehension","level":4,"score":0.3828999996185303},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.37130001187324524},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.3693000078201294},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.32429999113082886},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.3188999891281128},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.29660001397132874},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.29249998927116394},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.2851000130176544},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.27090001106262207},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.26840001344680786},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.2590000033378601},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.2583000063896179},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.2542000114917755}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3779208.3785375","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785375","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2504.13676","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2504.13676","pdf_url":"https://arxiv.org/pdf/2504.13676","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/3779208.3785375","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785375","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"As":[0,121],"the":[1,11,18,80,112,116,119,136,156,182],"number":[2,19],"of":[3,20,84,158,185],"web":[4],"applications":[5,148],"and":[6,54,70,211],"API":[7],"endpoints":[8],"exposed":[9],"to":[10,14,34,118,153,177,206],"Internet":[12],"continues":[13],"grow,":[15],"so":[16],"does":[17],"exploitable":[21],"vulnerabilities.":[22],"Manually":[23],"identifying":[24],"such":[25,189],"vulnerabilities":[26,215],"is":[27,67],"tedious.":[28],"Meanwhile,":[29],"static":[30,187],"security":[31],"scanners":[32,188],"tend":[33],"produce":[35],"many":[36],"false":[37],"positives.":[38],"While":[39],"machine":[40,85,167],"learning-based":[41],"approaches":[42],"are":[43,57],"promising,":[44],"they":[45],"typically":[46],"perform":[47,170],"well":[48],"only":[49],"in":[50,216],"scenarios":[51],"where":[52],"training":[53],"test":[55],"data":[56],"closely":[58],"related.":[59],"A":[60],"key":[61],"challenge":[62],"for":[63,123],"ML-based":[64,159],"vulnerability":[65,160],"detection":[66,137,183],"providing":[68],"suitable":[69],"concise":[71],"code":[72,81,98,102,179],"context,":[73,133],"as":[74,190],"excessively":[75],"long":[76],"contexts":[77],"negatively":[78],"affect":[79],"comprehension":[82],"capabilities":[83,184],"learning":[86,168],"models,":[87,125],"particularly":[88],"smaller":[89],"ones.":[90],"This":[91],"work":[92],"introduces":[93],"Trace":[94,108,126,174],"Gadgets,":[95],"a":[96,129,142,198],"novel":[97],"representation":[99],"that":[100,114,165],"minimizes":[101],"context":[103],"by":[104,193],"removing":[105],"non-related":[106],"code.":[107],"Gadgets":[109,127,175],"precisely":[110],"capture":[111],"statements":[113],"cover":[115],"path":[117],"vulnerability.":[120],"input":[122],"ML":[124],"provide":[128],"minimal":[130],"but":[131],"complete":[132],"thereby":[134],"improving":[135],"performance.":[138],"Moreover,":[139],"we":[140,209],"collect":[141],"large-scale":[143],"dataset":[144],"generated":[145],"from":[146],"real-world":[147,207],"with":[149],"manually":[150],"curated":[151],"labels":[152],"further":[154],"improve":[155],"performance":[157],"detectors.":[161],"Our":[162],"results":[163],"show":[164],"state-of-the-art":[166],"models":[169],"best":[171],"when":[172],"using":[173],"compared":[176],"previous":[178],"representations,":[180],"surpassing":[181],"industry-standard":[186],"GitHub's":[191],"CodeQL":[192],"at":[194],"least":[195],"4%":[196],"on":[197],"fully":[199],"unseen":[200],"dataset.":[201],"By":[202],"applying":[203],"our":[204],"framework":[205],"applications,":[208],"identify":[210],"report":[212],"previously":[213],"unknown":[214],"widely":[217],"deployed":[218],"software.":[219]},"counts_by_year":[],"updated_date":"2026-08-08T01:25:22.217667","created_date":"2025-12-19T00:00:00"}