research
Current and past research projects.
The central theme of his research is the design of program analyses, and their application to problems in software quality:
- Static and dynamic analysis: slicing of WebAssembly binaries, abstract reference counting, incremental abstract interpretation, cross-level debugging of static analysers, full-stack and client-side JavaScript instrumentation
- Automated testing: automated resilience testing through fuzzing, concolic testing of event-driven applications, property-based testing, resilience testing of distributed Akka applications
- Software maintenance and evolution: Scala test smell detection, querying object-oriented and aspect-oriented code, change queries, commit decomposition
- Infrastructure as Code: security smell detection in Ansible, the Docker Hub image inheritance network, evolution and security risks of Helm charts, semantic versioning of Ansible Galaxy roles
- Software ecosystems: co-editor of the book Software Ecosystems: Tooling and Analytics, security vulnerabilities in the npm and RubyGems dependency networks, the lifecycle of dormant npm packages, backporting practices in package dependency networks
- Software analytics, artificial intelligence for software engineering: design smell prediction, clustering library usage on StackOverflow, change pattern mining in commits, mining for patterns in Cobol, automated tagging of libraries, search-based tier assignment
- Application security: detecting computation-constraint inconsistencies in zero-knowledge proof programs, ISA security guarantees as universal contracts, WebAssembly information flow analysis, security risks of compiling to WebAssembly
These research interests translate into the projects below:
