{"id":28,"date":"2014-11-27T15:11:34","date_gmt":"2014-11-27T15:11:34","guid":{"rendered":"http:\/\/sdash.isg.rhul.ac.uk\/?page_id=28"},"modified":"2025-06-26T15:09:33","modified_gmt":"2025-06-26T15:09:33","slug":"publications","status":"publish","type":"page","link":"https:\/\/santanu.uk\/index.php\/publications\/","title":{"rendered":"Publications"},"content":{"rendered":"
<\/a><\/form>\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
\r\n

2025<\/h3>\r\n <\/td>\r\n <\/tr>

31.<\/td> Raffa G; Blasco J; O'Keeffe D; Dash S K<\/span>: CloudFlow: Identifying Security-sensitive Data Flows in Serverless Applications<\/span>. Usenix Security 2025, <\/span>Forthcoming.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
30.<\/td> Butler A; O'Keeffe D; Dash S K<\/span>: Links Between Package Popularity, Criticality, and Security in Software Ecosystems<\/a><\/span>. In: <\/span>IEEE International Conference on Software Analysis, Evolution and Reengineering - Companion (SANER-C), <\/span>pp. 89 - 97, <\/span>2025<\/span>.<\/span> (Type: Inproceedings<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2024<\/h3>\r\n <\/td>\r\n <\/tr>

29.<\/td> Tileria M; Blasco J; Dash S K<\/span>: DocFlow: Extracting Taint Specifications from Software Documentation<\/a><\/span>. In: <\/span>Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering, <\/span>ACM, <\/span>Lisbon, Portugal, <\/span>2024<\/span>.<\/span> (Type: Inproceedings<\/span> | Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
@inproceedings{10.1145\/3597503.3623312,
\r\ntitle = {DocFlow: Extracting Taint Specifications from Software Documentation},
\r\nauthor = {Marcos Tileria and Jorge Blasco and Santanu Kumar Dash},
\r\nurl = {https:\/\/doi.org\/10.1145\/3597503.3623312},
\r\ndoi = {10.1145\/3597503.3623312},
\r\nyear  = {2024},
\r\ndate = {2024-01-01},
\r\nurldate = {2024-01-01},
\r\nbooktitle = {Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering},
\r\npublisher = {ACM},
\r\naddress = {Lisbon, Portugal},
\r\nseries = {ICSE '24},
\r\nabstract = {Security practitioners routinely use static analysis to detect security problems and privacy violations in Android apps. The soundness of these analyses depends on how the platform is modelled and the list of sensitive methods. Collecting these methods often becomes impractical given the number of methods available, the pace at which the Android platform is updated, and the proprietary libraries Google releases on each new version. Despite the constant evolution of the Android platform, app developers cope with all these new features thanks to the documentation that comes with each new Android release. In this work, we take advantage of the rich documentation provided by platforms like Android and propose DocFlow, a framework to generate taint specifications for a platform, directly from its documentation. DocFlow models the semantics of API methods using their documentation to detect sensitive methods (sources and sinks) and assigns them semantic labels. Our approach does not require access to source code, enabling the analysis of proprietary libraries for which the code is unavailable. We evaluate DocFlow using Android platform packages and closed-source Google Play Services libraries. Our results show that our framework detects sensitive methods with high precision, adapts to new API versions, and can be easily extended to detect other method types. Our approach provides evidence that Android documentation encodes rich semantic information to categorise sensitive methods, removing the need to analyse source code or perform feature extraction.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
Security practitioners routinely use static analysis to detect security problems and privacy violations in Android apps. The soundness of these analyses depends on how the platform is modelled and the list of sensitive methods. Collecting these methods often becomes impractical given the number of methods available, the pace at which the Android platform is updated, and the proprietary libraries Google releases on each new version. Despite the constant evolution of the Android platform, app developers cope with all these new features thanks to the documentation that comes with each new Android release. In this work, we take advantage of the rich documentation provided by platforms like Android and propose DocFlow, a framework to generate taint specifications for a platform, directly from its documentation. DocFlow models the semantics of API methods using their documentation to detect sensitive methods (sources and sinks) and assigns them semantic labels. Our approach does not require access to source code, enabling the analysis of proprietary libraries for which the code is unavailable. We evaluate DocFlow using Android platform packages and closed-source Google Play Services libraries. Our results show that our framework detects sensitive methods with high precision, adapts to new API versions, and can be easily extended to detect other method types. Our approach provides evidence that Android documentation encodes rich semantic information to categorise sensitive methods, removing the need to analyse source code or perform feature extraction.<\/div>
Close<\/a><\/p><\/div>
28.<\/td> Tereszkowski-Kaminski M; Dash S K; Suarez-Tangil G<\/span>: A Study of Malicious Source Code Reuse Among GitHub, StackOverflow \r\n and Underground Forums<\/a><\/span>. In: <\/span> Garc\u00eda-Alfaro, Joaqu\u00edn; Kozik, Rafal; Choras, Michal; Katsikas, Sokratis K. (Ed.): Computer Security - ESORICS 2024 - 29th European Symposium on Research \r\n in Computer Security, Bydgoszcz, Poland, September 16-20, 2024, Proceedings, \r\n Part III, <\/span>pp. 45\u201366, <\/span>Springer, <\/span>2024<\/span>.<\/span> (Type: Inproceedings<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
27.<\/td> Petrescu C C; Smith S; Butler A; Dash S K<\/span>: Checking Test Suite Efficacy Through Dual-Channel Techniques<\/a><\/span>. In: <\/span>Testing Software and Systems - 36th IFIP WG 6.1 International \r\n Conference, ICTSS 2024, London, UK, October 30 - November 1, 2024, \r\n Proceedings, <\/span>pp. 275\u2013291, <\/span>Springer, <\/span>2024<\/span>.<\/span> (Type: Inproceedings<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
26.<\/td> Raffa G; Blasco J; O'Keeffe D; Dash S K<\/span>: Towards Inter-Service Data Flow Analysis of Serverless Applications<\/a><\/span>. In: <\/span>2024 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), <\/span>pp. 654-658, <\/span>2024<\/span>.<\/span> (Type: Inproceedings<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2023<\/h3>\r\n <\/td>\r\n <\/tr>

25.<\/td> Petrescu C C; Smith S; Giavrimis R; Dash S K<\/span>: Do Names echo Semantics? A Large-Scale Study of Identifiers used in C++'s Named Casts<\/span>. In: <\/span>Journal of Systems and Software, <\/span>vol. 202, <\/span>iss. C, <\/span>2023<\/span>, (Selected for presentation at 2023 ESEM Journal-First Papers)<\/span>.<\/span> (Type: Journal Article<\/span> | BibTeX<\/a><\/span>)<\/span>
24.<\/td> Raffa G; Al\u00eds J B; O'Keeffe D; Dash S K<\/span>: AWSomePy: A Dataset and Characterization of Serverless Applications<\/a><\/span>. In: <\/span>Proceedings of the 1st Workshop on SErverless Systems, Applications and MEthodologies, SESAME 2023, Rome, Italy, 8 May 2023, <\/span>pp. 50\u201356, <\/span>ACM, <\/span>2023<\/span>.<\/span> (Type: Inproceedings<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2021<\/h3>\r\n <\/td>\r\n <\/tr>

23.<\/td> Giavrimis R; Butler A; Petrescu C C; Basios M; Dash S K<\/span>: Genetic Optimisation of C++ Applications<\/span>. Automated Software Engineering (ASE), Late Breaking Results Track, <\/span>2021<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2020<\/h3>\r\n <\/td>\r\n <\/tr>

22.<\/td> P\u00e2rtachi P; Dash S K; Allamanis M; Barr E T<\/span>: Flexeme: Untangling Commits Using Lexical Flows<\/a><\/span>. 28th ACM Joint European Software Engineering Conference \r\n and Symposium on the Foundations of Software Engineering, <\/span>ESEC\/FSE '20 <\/span>ACM, <\/span>2020<\/span>.<\/span> (Type: Conference<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
21.<\/td> P\u00e2rtachi P; Dash S K; Treude C; Barr E T<\/span>: POSIT: Simultaneously Tagging Natural and Programming Languages<\/a><\/span>. ICSE '20: 42nd International Conference on Software Engineering, \r\n Seoul, South Korea, 27 June - 19 July, 2020, <\/span>ACM, <\/span>2020<\/span>.<\/span> (Type: Conference<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
20.<\/td> Louis A; Dash S K; Barr E T; Ernst M D; Sutton C<\/span>: Where Should I Comment My Code?: A Dataset and Model for Predicting Locations that need Comments<\/a><\/span>. ICSE-NIER 2020: 42nd International Conference on Software Engineering, \r\n New Ideas and Emerging Results, Seoul, South Korea, 27 June - 19 July, \r\n 2020, <\/span>ACM, <\/span>2020<\/span>.<\/span> (Type: Conference<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
19.<\/td> Casalnuovo C; Barr E T; Dash S K; Devanbu P; Morgan E<\/span>: A Theory of Dual Channel Constraints<\/a><\/span>. 42nd International Conference on Software Engineering, New Ideas and Emerging Results (ICSE-NIER 2020) <\/span>ACM, <\/span>2020<\/span>.<\/span> (Type: Conference<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
18.<\/td> Dash S K; Wu F; Basios M; Li L; Kanthan L<\/span>: Checkers: Multi-modal Darwinian API Optimisation<\/a><\/span>. ICSE '20: 42nd International Conference on Software Engineering, \r\n Workshops, Seoul, Republic of Korea, 27 June - 19 July, 2020, <\/span>ACM, <\/span>2020<\/span>.<\/span> (Type: Workshop<\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2019<\/h3>\r\n <\/td>\r\n <\/tr>

17.<\/td> Louis A; Dash S K; Barr E T; Sutton C<\/span>: Deep Learning to Detect Redundant Method Comments<\/span>. 2019<\/span>.<\/span> (Type: Technical Report<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2018<\/h3>\r\n <\/td>\r\n <\/tr>

16.<\/td> Guillermo Suarez-Tangil P G<\/span>: Anomaly-based exploratory analysis and detection of exploits in android mediaserver<\/span>. In: <\/span>IET Information Security, <\/span>vol. 12, <\/span>iss. 5, <\/span>pp. 404-413(9), <\/span>2018<\/span>.<\/span> (Type: Journal Article<\/span> | BibTeX<\/a><\/span>)<\/span>
15.<\/td> Suarez-Tangil P G S K D G<\/span>: Anomaly-based exploratory analysis and detection of exploits in android mediaserver<\/span>. In: <\/span>IET Information Security, <\/span>vol. 12, <\/span>iss. 5, <\/span>pp. 404-413(9), <\/span>2018<\/span>.<\/span> (Type: Journal Article<\/span> | BibTeX<\/a><\/span>)<\/span>
14.<\/td> Dash S K; Allamanis M; Barr E T<\/span>: RefiNym: Using Names to Refine Types<\/span>. 26th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, <\/span>ESEC\/FSE'18 <\/span>2018<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2017<\/h3>\r\n <\/td>\r\n <\/tr>

13.<\/td> Jordaney R; Sharad K; Dash S K; Wang Z; Papini D; Nouretdinov I; Cavallaro L<\/span>: Transcend: Detecting Concept Drift in Malware Classification Models<\/span>. 26th USENIX Security Symposium (USENIX Security 17), <\/span>USENIX Association, <\/span>2017<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
12.<\/td> Suarez-Tangil G; Dash S K; Ahmadi M; Kinder J; Giacinto G; Cavallaro L<\/span>: DroidSieve: Fast and Accurate Classification of Obfuscated Android Malware<\/span>. Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, <\/span>CODASPY '17 <\/span>2017<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
11.<\/td> Hurier M; Suarez-Tangil G; Dash S K; Bissyand\u00e9 T F; Traon Y L; Klein J; Cavallaro L<\/span>: Euphony: Harmonious Unification of Cacophonous Anti-virus Vendor Labels for Android Malware<\/span>. Proceedings of the 14th International Conference on Mining Software Repositories, <\/span>MSR '17 <\/span>2017<\/span>, (textbf[CORE A])<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2016<\/h3>\r\n <\/td>\r\n <\/tr>

10.<\/td> Dash S K; Suarez-Tangil G; Khan S; Tam K; Ahmadi M; Kinder J; Cavallaro L<\/span>: DroidScribe: Classifying Android Malware Based on Runtime Behavior<\/span>. In: <\/span>Mobile Security Technologies (MoST 2016), <\/span>vol. 7148, <\/span>pp. 1\u201312, <\/span>2016<\/span>.<\/span> (Type: Journal Article<\/span> | BibTeX<\/a><\/span>)<\/span>
9.<\/td> Deo A; Dash S K; Suarez-Tangil G; Vovk V; Cavallaro L<\/span>: Prescience: Probabilistic Guidance on the Retraining Conundrum for Malware Detection<\/span>. In: <\/span>Artificial Intelligence and Security (AISec 2016), <\/span>2016<\/span>.<\/span> (Type: Journal Article<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2015<\/h3>\r\n <\/td>\r\n <\/tr>

8.<\/td> Dash S K<\/span>: Adaptive Constraint Solving for Information Flow Analysis<\/span>. University of Hertfordshire, <\/span>2015<\/span>.<\/span> (Type: PhD Thesis<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2013<\/h3>\r\n <\/td>\r\n <\/tr>

7.<\/td> Dash S K; Scholz S; Christianson B<\/span>: Modular design of data-parallel graph algorithms<\/span>. High Performance Computing and Simulation (HPCS), 2013 International Conference on, <\/span>IEEE <\/span>2013<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
6.<\/td> Dash S K; Scholz S; Herhut S; Christianson B<\/span>: A scalable approach to computing representative lowest common ancestor in directed acyclic graphs<\/span>. In: <\/span>Theoretical Computer Science, <\/span>vol. 513, <\/span>pp. 25\u201337, <\/span>2013<\/span>, (textbf[CORE A])<\/span>.<\/span> (Type: Journal Article<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2010<\/h3>\r\n <\/td>\r\n <\/tr>

5.<\/td> Dash S K; Srikanthan T<\/span>: Instruction cache tuning for embedded multitasking applications<\/span>. In: <\/span>IET computers & digital techniques, <\/span>vol. 4, <\/span>no. 6, <\/span>pp. 439\u2013457, <\/span>2010<\/span>.<\/span> (Type: Journal Article<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2009<\/h3>\r\n <\/td>\r\n <\/tr>

4.<\/td> Dash S K<\/span>: Profile driven schemes for energy-sensitive cache hierarchy<\/span>. Nanyang Technological University, <\/span>2009<\/span>.<\/span> (Type: Masters Thesis<\/span> | BibTeX<\/a><\/span>)<\/span>
3.<\/td> Dash S K; Srikanthan T<\/span>: Instruction Cache Tuning for Embedded Multitasking Applications<\/span>. IEEE\/IFIP International Symposium on Rapid System Prototyping, <\/span>IEEE <\/span>2009<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
2.<\/td> Dash S K; Srikanthan T<\/span>: Modeling RTOS Components for Instruction Cache Hit Rate Estimation<\/span>. 2009 IEEE International Symposium on Circuits and Systems, <\/span>IEEE <\/span>2009<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
\r\n

2008<\/h3>\r\n <\/td>\r\n <\/tr>

1.<\/td> Dash S K; Srikanthan T<\/span>: Rapid estimation of instruction cache hit rates using loop profiling<\/span>. 2008 International Conference on Application-Specific Systems, Architectures and Processors, <\/span>IEEE <\/span>2008<\/span>.<\/span> (Type: Conference<\/span> | BibTeX<\/a><\/span>)<\/span>
@conference{dash2008rapid,
\r\ntitle = {Rapid estimation of instruction cache hit rates using loop profiling},
\r\nauthor = {Santanu Kumar Dash and Thambipillai Srikanthan},
\r\nyear  = {2008},
\r\ndate = {2008-01-01},
\r\nurldate = {2008-01-01},
\r\nbooktitle = {2008 International Conference on Application-Specific Systems, Architectures and Processors},
\r\npages = {263--268},
\r\norganization = {IEEE},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {conference}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div><\/td><\/tr><\/table><\/div>\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"class_list":["post-28","page","type-page","status-publish","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/santanu.uk\/index.php\/wp-json\/wp\/v2\/pages\/28","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/santanu.uk\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/santanu.uk\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/santanu.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/santanu.uk\/index.php\/wp-json\/wp\/v2\/comments?post=28"}],"version-history":[{"count":26,"href":"https:\/\/santanu.uk\/index.php\/wp-json\/wp\/v2\/pages\/28\/revisions"}],"predecessor-version":[{"id":377,"href":"https:\/\/santanu.uk\/index.php\/wp-json\/wp\/v2\/pages\/28\/revisions\/377"}],"wp:attachment":[{"href":"https:\/\/santanu.uk\/index.php\/wp-json\/wp\/v2\/media?parent=28"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}