01Explore Roadmap
Cyber Security
Source-level assessment methods for identifying, understanding, and mitigating software vulnerabilities.
SCSA Research Platforms
Software Security Research with Practical Reach
The lab studies source-code vulnerabilities, Android & IoT malware, code clones, software evolution, and testing at scales ranging from individual functions to 324+ billion lines of code.
Core Pillars
Research Domain Roadmaps
02Explore Roadmap
Vulnerability Detection
Scalable techniques and tools that trace vulnerable code through patches, fingerprints, and code similarity.
03Explore Roadmap
Software Testing
Search-based testing, automated test-data generation, regression testing, and test-smell detection.
04Explore Roadmap
Malware Detection
Static and learning-based analysis of Android and cross-architecture malware at source-code level.
05Explore Roadmap
Code Clone Analysis
Large-scale detection of exact, near-miss, and obfuscated code clones across software systems.
06Explore Roadmap
Software Evolution & Reuse
Understanding how code, vulnerabilities, and reusable components propagate between systems.
Research workflow
From source evidence to validated outcomes
Source Artifact Ingestion
Repositories, CVE benchmarks, smart contracts, APKs & patch histories
AST & Semantic Parsing
Control/data flow graphs, clone detection & obfuscation normalization
Vulnerability Engine
Isolating security flaws, malware behaviors & test smells (SQVDT, VCIPR)
Empirical Benchmarking
Precision/recall evaluation, CWE ground truths & patch verification
Publications & Supervised Projects
Q1 journal papers, open-source tools deployment & student supervision
Projects & Tools Directory
Empirical Research Systems & Platforms
Research project · University of Luxembourg & SES (Postdoctoral Research 2021–2023)
Automated Test Data Generation for the ARC System
A model-based approach and tool for generating and validating complex CPS test data using random, search-based, constraint-based, and mutation strategies.
Partners: Software Verification and Validation Lab (SnT), University of Luxembourg, and SES, Luxembourg.
Completed · 2021–2023
Test Smell Detection in the ARC System
Tool-supported detection of poor testing practices in multi-level, BDD-based testing frameworks to improve test definition and maintainability.
Partners: Software Verification and Validation Lab (SnT), University of Luxembourg, and SES, Luxembourg.
Completed · 2021–2022
Log-Based Test Case Slicing
A tool-supported approach for decomposing complex system tests into smaller scenarios while preserving their assertions and reducing regression-test execution cost.
Partners: Software Verification and Validation Lab (SnT), University of Luxembourg.
Completed · 2018–2020
Obfuscated Code Detection in Android Applications
A clone-detection approach for identifying identifier-renaming and string-encryption obfuscation in Android source code, evaluated across obfuscated and non-obfuscated datasets.
Partners: Key Laboratory of Information System Security, School of Software, Tsinghua University.
Completed · 2018–2020
SQVDT — Source Code Vulnerability Detection
A file-level platform built from a fingerprint index of 2,931 vulnerable files and evaluated across 7 TB of C/C++ source code from 152,823 open-source projects.
Partners: Key Laboratory of Information System Security, School of Software, Tsinghua University.
Completed · 2017–2018
VCIPR — Vulnerability Detection at Function Level
A scalable, token-based and language-independent tool for detecting vulnerable and unpatched code fragments at function-level granularity.
Partners: Key Laboratory of Information System Security, School of Software, Tsinghua University.
Completed · 2018–2020
Patch Analysis and Vulnerability Research
A structured benchmark that traces open-source security patches and extracts vulnerable source code at function, file, and component granularity for repeatable security assessment.
Partners: Key Laboratory of Information System Security, School of Software, Tsinghua University.
Completed · 2015–2017
DroidSD — Android Similarity Detection
A source-level clone-detection tool for identifying Type-1, Type-2, and Type-3 clones in a dataset of 30,500 Android applications.
Partners: Key Laboratory of Information System Security, School of Software, Tsinghua University.
Completed · 2015–2017
IBFET — Large-Scale Code Clone Detection
An index-based feature extraction technique evaluated over more than 324 billion lines of code in a Hadoop distributed environment.
Partners: Key Laboratory of Information System Security, School of Software, Tsinghua University.