一句话：提出可扩展的 Java/Android 字节码漏洞扫描器 VUSC，以插件架构集成调用图、污点与值分析，基准精度约 90%。
针对后端 Web 应用与移动应用中安全漏洞检测这一重要任务，静态漏洞分析已成为研究热点，但研究者常需从零搭建工具，而现有开源框架功能有限、难以完整评估新算法，导致新分析模块往往只能孤立测试。本文提出 VUSC，一个面向 Android 与 Java 字节码的快速、精确且可扩展的漏洞扫描器。VUSC 采用插件化架构，内置调用图分析、污点分析和值分析等常用静态分析构件，研究者可在此基础上构建新分析，并将 VUSC 作为参考平台。作者在基准测试上评估 VUSC，显示其精度约为 90%，并公开了演示视频与数据集以支持复现与后续研究。
Detecting security vulnerabilities in backend Web applications as well as mobile apps is extremely important. Static analysis for vulnerability analysis has subsequently developed as an important field of research. Researchers need extensible frameworks to avoid starting from scratch with every new research project. Compared to commercially available scanners, open-source frameworks often only provide basic functionality. This limits the ability of researchers to evaluate novel algorithms. Lacking access to full code scanners, new building blocks are often tested in isolation. In this paper, we present VUSC, a fast, precise and extensible vulnerability scanner for Android and Java bytecode. It features a plugin architecture for commonly used static analyses such as call graph, taint and value analyses, allowing researchers to build upon our work and using VUSC as a reference platform. We show that VUSC achieves a precision of around 90% on benchmarks. Video: https://youtu.be/QpXs9hv5zGc, Dataset: https://github.com/Fraunhofer-SIT/ASE2025-StaticAnalysisInfrastructure/
DOI 原文 ·
@inproceedings{paperbot9199,
title = {VUSC: An Extensible Research Platform for Java-Based Static Analysis},
author = {Marc Miltenberger and Steven Arzt},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00354}
}