{"id":"https://openalex.org/W7158045894","doi":"https://doi.org/10.4230/lipics.ecoop.2026.10","title":"Field-Sensitive Over-Tainting Reduction in IFDS Taint Analysis via CFL-Reachability","display_name":"Field-Sensitive Over-Tainting Reduction in IFDS Taint Analysis via CFL-Reachability","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7158045894","doi":"https://doi.org/10.4230/lipics.ecoop.2026.10"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2604.23807","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2604.23807","pdf_url":"https://arxiv.org/pdf/2604.23807","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2604.23807","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Gui, Yujiang","orcid":"https://orcid.org/0009-0006-3999-5203"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Gui, Yujiang","raw_affiliation_strings":["University of New South Wales, Sydney, Australia"],"raw_orcid":"https://orcid.org/0009-0006-3999-5203","affiliations":[{"raw_affiliation_string":"University of New South Wales, Sydney, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Tao, Yonggang","orcid":"https://orcid.org/0009-0006-3669-2047"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Tao, Yonggang","raw_affiliation_strings":["University of New South Wales, Sydney, Australia"],"raw_orcid":"https://orcid.org/0009-0006-3669-2047","affiliations":[{"raw_affiliation_string":"University of New South Wales, Sydney, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5024664385","display_name":"Jingling Xue","orcid":"https://orcid.org/0000-0003-0380-3506"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Xue, Jingling","raw_affiliation_strings":["University of New South Wales, Sydney, Australia"],"raw_orcid":"https://orcid.org/0000-0003-0380-3506","affiliations":[{"raw_affiliation_string":"University of New South Wales, Sydney, Australia","institution_ids":["https://openalex.org/I31746571"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I31746571"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10126","display_name":"Logic, programming, and type systems","score":0.6098999977111816,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10126","display_name":"Logic, programming, and type systems","score":0.6098999977111816,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11737","display_name":"Advanced Materials and Mechanics","score":0.0575999990105629,"subfield":{"id":"https://openalex.org/subfields/2210","display_name":"Mechanical Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10639","display_name":"Advanced Software Engineering Methodologies","score":0.04089999943971634,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.6553000211715698},{"id":"https://openalex.org/keywords/tensor","display_name":"Tensor (intrinsic definition)","score":0.6459000110626221},{"id":"https://openalex.org/keywords/assertion","display_name":"Assertion","score":0.609499990940094},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.6028000116348267},{"id":"https://openalex.org/keywords/mathematical-proof","display_name":"Mathematical proof","score":0.6019999980926514},{"id":"https://openalex.org/keywords/computation","display_name":"Computation","score":0.44369998574256897},{"id":"https://openalex.org/keywords/algebra-over-a-field","display_name":"Algebra over a field","score":0.3930000066757202},{"id":"https://openalex.org/keywords/matrix","display_name":"Matrix (chemical analysis)","score":0.3880000114440918}],"concepts":[{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.6553000211715698},{"id":"https://openalex.org/C155281189","wikidata":"https://www.wikidata.org/wiki/Q3518150","display_name":"Tensor (intrinsic definition)","level":2,"score":0.6459000110626221},{"id":"https://openalex.org/C40422974","wikidata":"https://www.wikidata.org/wiki/Q741248","display_name":"Assertion","level":2,"score":0.609499990940094},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.6028000116348267},{"id":"https://openalex.org/C108710211","wikidata":"https://www.wikidata.org/wiki/Q11538","display_name":"Mathematical proof","level":2,"score":0.6019999980926514},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5748999714851379},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.5453000068664551},{"id":"https://openalex.org/C45374587","wikidata":"https://www.wikidata.org/wiki/Q12525525","display_name":"Computation","level":2,"score":0.44369998574256897},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.42739999294281006},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4198000133037567},{"id":"https://openalex.org/C136119220","wikidata":"https://www.wikidata.org/wiki/Q1000660","display_name":"Algebra over a field","level":2,"score":0.3930000066757202},{"id":"https://openalex.org/C106487976","wikidata":"https://www.wikidata.org/wiki/Q685816","display_name":"Matrix (chemical analysis)","level":2,"score":0.3880000114440918},{"id":"https://openalex.org/C189950617","wikidata":"https://www.wikidata.org/wiki/Q937228","display_name":"Property (philosophy)","level":2,"score":0.3869999945163727},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.36469998955726624},{"id":"https://openalex.org/C2777299769","wikidata":"https://www.wikidata.org/wiki/Q3707858","display_name":"Type (biology)","level":2,"score":0.36059999465942383},{"id":"https://openalex.org/C39920170","wikidata":"https://www.wikidata.org/wiki/Q693083","display_name":"Soundness","level":2,"score":0.3490999937057495},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3409000039100647},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.3382999897003174},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3357999920845032},{"id":"https://openalex.org/C90952326","wikidata":"https://www.wikidata.org/wiki/Q3650511","display_name":"Tensor calculus","level":4,"score":0.2741999924182892},{"id":"https://openalex.org/C2778023678","wikidata":"https://www.wikidata.org/wiki/Q554403","display_name":"Duality (order theory)","level":2,"score":0.2669000029563904},{"id":"https://openalex.org/C2777686260","wikidata":"https://www.wikidata.org/wiki/Q144037","display_name":"Calculus (dental)","level":2,"score":0.2624000012874603},{"id":"https://openalex.org/C166077713","wikidata":"https://www.wikidata.org/wiki/Q1758924","display_name":"Tensor field","level":3,"score":0.25380000472068787},{"id":"https://openalex.org/C82029504","wikidata":"https://www.wikidata.org/wiki/Q4373882","display_name":"Sequential consistency","level":4,"score":0.2526000142097473}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:oai:arXiv.org:2604.23807","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2604.23807","pdf_url":"https://arxiv.org/pdf/2604.23807","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:doi:10.4230/lipics.ecoop.2026.10","is_oa":true,"landing_page_url":"https://f-droid.org","pdf_url":"http://usenix.org/publications/library/proceedings/sec05/tech/full_papers/livshits/livshits.pdf","source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"ConferencePaper"},{"id":"doi:10.4230/lipics.ecoop.2026.10","is_oa":true,"landing_page_url":"https://doi.org/10.4230/lipics.ecoop.2026.10","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"ConferencePaper"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2604.23807","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2604.23807","pdf_url":"https://arxiv.org/pdf/2604.23807","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"display_name":"Quality Education","score":0.715844988822937,"id":"https://metadata.un.org/sdg/4"}],"awards":[{"id":"https://openalex.org/G2585958342","display_name":"\u96f7\u653e\u96fb\u306e\u89e3\u660e\u3068\u4eba\u4f53\u304a\u3088\u3073\u96fb\u6c17\u8a2d\u5099\u3078\u306e\u96f7\u707d\u9632\u6b62\u306e\u7814\u7a76","funder_award_id":"90014","funder_id":"https://openalex.org/F4320334764","funder_display_name":"Japan Society for the Promotion of Science"},{"id":"https://openalex.org/G7207367929","display_name":"Research on software contracts for highly interoperable software modules","funder_award_id":"20H00582","funder_id":"https://openalex.org/F4320334764","funder_display_name":"Japan Society for the Promotion of Science"}],"funders":[{"id":"https://openalex.org/F4320308427","display_name":"American Mathematical Society","ror":"https://ror.org/05vy1kj95"},{"id":"https://openalex.org/F4320334763","display_name":"Leibniz-Gemeinschaft","ror":"https://ror.org/01n6r0e97"},{"id":"https://openalex.org/F4320334764","display_name":"Japan Society for the Promotion of Science","ror":"https://ror.org/00hhkn466"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7158045894.pdf","grobid_xml":"https://content.openalex.org/works/W7158045894.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"IFDS":[0,99,265],"taint":[1,100,156,170,214,266],"analysis":[2,74,237],"is":[3,25,42,105],"inherently":[4],"context-":[5],"and":[6,78,158,161,192,244,274],"flow-sensitive,":[7],"allowing":[8],"precise":[9],"encoding":[10],"of":[11,21,45,64,110,129,207,242,251],"field":[12,65,108,130,181],"sensitivity":[13],"in":[14,23,82,98,264,271],"access-path":[15],"generation.":[16],"However,":[17],"preserving":[18],"this":[19,87],"level":[20],"precision":[22,194,275],"practice":[24],"difficult,":[26],"leading":[27],"to":[28,144,176],"over-tainting":[29,97,263],"-":[30],"marking":[31],"more":[32],"data":[33,153],"facts":[34],"as":[35,61],"tainted":[36,113],"than":[37],"necessary.":[38],"The":[39,102],"root":[40],"cause":[41],"the":[43,54,107,164,186,231,256],"undecidability":[44],"solving":[46,138],"two":[47],"context-free":[48],"language":[49],"reachability":[50],"(CFL-reachability)":[51],"problems":[52],"along":[53],"same":[55],"dataflow":[56],"path,":[57],"which":[58],"forces":[59],"k-limiting":[60,191],"an":[62,240,249],"over-approximation":[63],"sensitivity.":[66],"Consequently,":[67],"spurious":[68,187],"access":[69,114,178],"paths":[70,179,188],"are":[71,183],"introduced,":[72],"increasing":[73],"time,":[75],"memory":[76],"usage,":[77],"false":[79,246],"positives,":[80],"especially":[81],"large-scale":[83],"applications.":[84],"To":[85],"address":[86],"challenge,":[88],"we":[89],"present":[90],"TnFix,":[91],"a":[92,120,139,146,199,205,226],"CFL-reachability-based":[93],"technique":[94],"for":[95,213,261,276],"mitigating":[96],"analysis.":[101],"key":[103],"insight":[104],"that":[106,125,151,221],"sequence":[109],"any":[111],"candidate":[112],"path":[115],"can":[116],"be":[117],"checked":[118],"by":[119,136,190,239,248],"deterministic":[121],"finite":[122],"automaton":[123],"(DFA)":[124],"accepts":[126],"feasible":[127],"sequences":[128,182],"accesses.":[131],"TnFix":[132,172,216,253],"builds":[133],"these":[134,174],"DFAs":[135,175],"first":[137,257],"lightweight":[140],"field-sensitive":[141],"CFL-reachability":[142],"problem":[143],"construct":[145],"Field":[147],"Points-to":[148],"Graph":[149],"(FPG)":[150],"integrates":[152],"flows":[154],"from":[155],"sources":[157],"library":[159],"summaries,":[160],"then":[162],"converting":[163],"FPG":[165],"into":[166],"per-object":[167],"DFAs.":[168],"During":[169],"analysis,":[171,215,267],"queries":[173],"prune":[177],"whose":[180],"rejected,":[184],"eliminating":[185],"introduced":[189],"improving":[193],"without":[195],"sacrificing":[196],"scalability.":[197],"In":[198],"comparative":[200],"evaluation":[201],"against":[202],"FlowDroid":[203,222],"on":[204],"set":[206],"36":[208],"widely":[209],"used":[210],"Android":[211],"apps":[212,220],"successfully":[217],"analyzes":[218],"7":[219],"cannot":[223],"complete":[224],"within":[225],"three-hour":[227],"time":[228],"budget.":[229],"For":[230],"remaining":[232],"29":[233],"apps,":[234],"it":[235],"improves":[236],"speed":[238],"average":[241,250],"2.5\u00d7":[243],"reduces":[245],"positives":[247],"12.2%.":[252],"thus":[254],"establishes":[255],"CFL-based":[258],"optimization":[259],"framework":[260],"reducing":[262],"delivering":[268],"substantial":[269],"gains":[270],"both":[272],"efficiency":[273],"practical":[277],"use.":[278]},"counts_by_year":[],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2026-04-30T00:00:00"}