Shiyi Wei
University of Texas at Dallas, TX·Computer Science·Early-career
Modern software is so large that serious bugs, including security vulnerabilities, are hard to find. Static analysis tools look for such problems by examining code without running it.
- Fields
Computer Science
Engineering
- Topics
static analysis
program analysis
taint analysis
- Grants
- 1 known grant, through May 2027
What they work on
- Identify hidden relationships among the configuration options of Android taint analysis tools, and present them in a unified, configuration-aware interface that makes tuning easier.
- Improve testing and evaluation of configurable static analysis tools by automatically generating test cases and collecting benchmarks.
- Design a human-in-the-loop process that explores the configuration space and classifies analysis results to reduce manual effort.
- Develop learning-based adaptive analysis that selectively applies analysis algorithms to fine-grained parts of a program, and measure gains by detection of real-world vulnerabilities.
More about the research
These tools offer many configuration options: different algorithms, frameworks and ways of handling tricky language features. Users can tune them to balance precision (few false alarms), soundness (no missed bugs) and speed. But the space of possible settings is so large and confusing that these tools are rarely used in practice. This project aims to make configurable static analysis tools easier to maintain, more correct, more usable and faster.
Why it matters
Better configurable static analysis tools could help developers catch security vulnerabilities and other critical bugs before software ships. Android app users would benefit first, through tools that are easier to tune and more effective at finding real vulnerabilities. The approach could later extend to analysis tools for other programming languages.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Iulian Neamtiu
New Jersey Institute of Technology, NJ·Computer Science
Develop event sensitivity, a program-analysis technique that treats event creation and triggering as first-class objects, so that static analysis can model event-based applications accurately.
Zhijia Zhao
University of California-Riverside, CA·Computer Science
Develop 'event sensitivity', a program-analysis foundation that treats event creation and triggering as first-class objects, so that static analysis can track event-based Android, JavaScript and IoT programs.
Qirun Zhang
Georgia Institute of Technology, GA·Computer Science·Early-career
Characterize what the InterDyck graph abstraction can and cannot express. This is a graph model of programs with matched-edge patterns that represents program meaning for analysis.
The school
University of Texas at Dallas: 16 labs on PI Pages, $182M a year on research, 239 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.