{"id":"https://openalex.org/W7166830301","doi":"https://doi.org/10.1145/3805773.3805994","title":"CFIghter: Automated Control-Flow Integrity Enablement and Evaluation for Legacy C/C++ Systems","display_name":"CFIghter: Automated Control-Flow Integrity Enablement and Evaluation for Legacy C/C++ Systems","publication_year":2026,"publication_date":"2026-06-30","ids":{"openalex":"https://openalex.org/W7166830301","doi":"https://doi.org/10.1145/3805773.3805994"},"language":null,"primary_location":{"id":"doi:10.1145/3805773.3805994","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805773.3805994","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Secure Development Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3805773.3805994","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5091965804","display_name":"Sabine Houy","orcid":"https://orcid.org/0000-0002-7679-0796"},"institutions":[{"id":"https://openalex.org/I90267481","display_name":"Ume\u00e5 University","ror":"https://ror.org/05kb8h459","country_code":"SE","type":"education","lineage":["https://openalex.org/I90267481"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Sabine Houy","raw_affiliation_strings":["Ume\u00e5 University, Ume\u00e5, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-7679-0796","affiliations":[{"raw_affiliation_string":"Ume\u00e5 University, Ume\u00e5, Sweden","institution_ids":["https://openalex.org/I90267481"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5099127829","display_name":"Bruno Kreyssig","orcid":"https://orcid.org/0009-0004-2456-895X"},"institutions":[{"id":"https://openalex.org/I90267481","display_name":"Ume\u00e5 University","ror":"https://ror.org/05kb8h459","country_code":"SE","type":"education","lineage":["https://openalex.org/I90267481"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Bruno Kreyssig","raw_affiliation_strings":["Ume\u00e5 University, Ume\u00e5, Sweden"],"raw_orcid":"https://orcid.org/0009-0004-2456-895X","affiliations":[{"raw_affiliation_string":"Ume\u00e5 University, Ume\u00e5, Sweden","institution_ids":["https://openalex.org/I90267481"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5019300625","display_name":"Alexandre Bartel","orcid":"https://orcid.org/0000-0003-1383-0372"},"institutions":[{"id":"https://openalex.org/I90267481","display_name":"Ume\u00e5 University","ror":"https://ror.org/05kb8h459","country_code":"SE","type":"education","lineage":["https://openalex.org/I90267481"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Alexandre Bartel","raw_affiliation_strings":["Ume\u00e5 University, Ume\u00e5, Sweden"],"raw_orcid":"https://orcid.org/0000-0003-1383-0372","affiliations":[{"raw_affiliation_string":"Ume\u00e5 University, Ume\u00e5, Sweden","institution_ids":["https://openalex.org/I90267481"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I90267481"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"30","last_page":"43"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9101999998092651,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9101999998092651,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.014999999664723873,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.014399999752640724,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/enforcement","display_name":"Enforcement","score":0.6486999988555908},{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.593999981880188},{"id":"https://openalex.org/keywords/codebase","display_name":"Codebase","score":0.5088000297546387},{"id":"https://openalex.org/keywords/visibility","display_name":"Visibility","score":0.4747999906539917},{"id":"https://openalex.org/keywords/unintended-consequences","display_name":"Unintended consequences","score":0.4316999912261963},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4284000098705292},{"id":"https://openalex.org/keywords/automation","display_name":"Automation","score":0.3937999904155731}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.685699999332428},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.6486999988555908},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.593999981880188},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.5174999833106995},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.5088000297546387},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.4747999906539917},{"id":"https://openalex.org/C2776889888","wikidata":"https://www.wikidata.org/wiki/Q1135789","display_name":"Unintended consequences","level":2,"score":0.4316999912261963},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4284000098705292},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.3937999904155731},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39340001344680786},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.3626999855041504},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.3434999883174896},{"id":"https://openalex.org/C197129107","wikidata":"https://www.wikidata.org/wiki/Q1921621","display_name":"Merge (version control)","level":2,"score":0.3370000123977661},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.31709998846054077},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.31029999256134033},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.28220000863075256},{"id":"https://openalex.org/C23725684","wikidata":"https://www.wikidata.org/wiki/Q616377","display_name":"Maintenance engineering","level":2,"score":0.2736000120639801},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.26190000772476196},{"id":"https://openalex.org/C105446022","wikidata":"https://www.wikidata.org/wiki/Q445962","display_name":"Legacy system","level":3,"score":0.2542000114917755}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3805773.3805994","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805773.3805994","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Secure Development Conference","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3805773.3805994","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805773.3805994","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Secure Development Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.600163459777832}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":36,"referenced_works":["https://openalex.org/W1963947298","https://openalex.org/W1969338270","https://openalex.org/W1990465482","https://openalex.org/W1993736952","https://openalex.org/W2001978806","https://openalex.org/W2022292029","https://openalex.org/W2029643891","https://openalex.org/W2072102701","https://openalex.org/W2080313875","https://openalex.org/W2086839628","https://openalex.org/W2128171167","https://openalex.org/W2159059513","https://openalex.org/W2170224888","https://openalex.org/W2213021386","https://openalex.org/W2258876169","https://openalex.org/W2295234910","https://openalex.org/W2516933175","https://openalex.org/W2534135179","https://openalex.org/W2603630878","https://openalex.org/W2606228508","https://openalex.org/W2765192396","https://openalex.org/W2898326323","https://openalex.org/W2899759798","https://openalex.org/W2945027685","https://openalex.org/W2978627403","https://openalex.org/W3015291177","https://openalex.org/W3106633543","https://openalex.org/W3194771370","https://openalex.org/W4234020632","https://openalex.org/W4312657088","https://openalex.org/W4387321647","https://openalex.org/W4403919587","https://openalex.org/W4404002942","https://openalex.org/W4404861109","https://openalex.org/W4409591380","https://openalex.org/W4416178199"],"related_works":[],"abstract_inverted_index":{"Compiler-based":[0],"Control-Flow":[1],"Integrity":[2],"(CFI)":[3],"offers":[4],"strong":[5],"forward-edge":[6],"protection":[7],"but":[8],"remains":[9],"challenging":[10],"to":[11,18,71],"deploy":[12],"in":[13,40,109,171],"large":[14],"C/C++":[15],"software":[16],"due":[17],"visibility":[19,150],"mismatches,":[20],"type":[21],"inconsistencies,":[22],"and":[23,46,64,101,152],"unintended":[24,48,106],"behavioral":[25],"failures.":[26],"We":[27,88],"present":[28],"CFIghter,":[29],"the":[30,53,67,110,135,138],"first":[31],"fully":[32],"automated":[33,162],"system":[34],"that":[35,161],"enables":[36],"strict,":[37],"type-based":[38,132],"CFI":[39,72,107,133,168],"real-world":[41],"projects":[42],"by":[43,52],"detecting,":[44],"classifying,":[45],"repairing":[47],"policy":[49],"violations":[50,108],"exposed":[51],"test":[54],"suite.":[55],"CFIghter":[56,90,129],"integrates":[57],"whole-program":[58],"analysis":[59],"with":[60],"guided":[61],"runtime":[62],"monitoring":[63],"iteratively":[65],"applies":[66],"minimal":[68],"necessary":[69],"adjustments":[70,151],"enforcement":[73,118,154],"only":[74,146],"where":[75,156],"required,":[76],"stopping":[77],"once":[78],"all":[79,97,127],"tests":[80],"pass":[81],"or":[82],"remaining":[83],"failures":[84],"are":[85],"deemed":[86],"unresolvable.":[87],"evaluate":[89],"on":[91,147],"four":[92],"GNU":[93],"projects.":[94],"It":[95],"resolves":[96],"visibility-related":[98],"build":[99],"errors":[100],"automatically":[102,148],"repairs":[103],"95.8%":[104],"of":[105,122,137],"large,":[111],"multi-library":[112],"util-linux":[113],"codebase,":[114],"while":[115],"retaining":[116],"strict":[117,131,166],"at":[119],"over":[120],"89%":[121],"indirect":[123],"control-flow":[124],"sites.":[125],"Across":[126],"subjects,":[128],"preserves":[130],"for":[134],"majority":[136],"codebase":[139],"without":[140],"requiring":[141],"manual":[142],"source-code":[143],"changes,":[144],"relying":[145],"generated":[149],"localized":[153],"scopes":[155],"necessary.":[157],"These":[158],"results":[159],"show":[160],"compatibility":[163],"repair":[164],"makes":[165],"compiler":[167],"practically":[169],"deployable":[170],"mature,":[172],"modular":[173],"C":[174],"software.":[175]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-07-02T00:00:00"}