Software Security Analysis in 2030 and Beyond: A Research Roadmap

Marcel Böhme, Eric Bodden, T. Bultan, Cristian Cadar, Yang Liu, Giuseppe Scanniello. 2024. ACM Transactions on Software Engineering and Methodology.

Read the paper · doi:10.1145/3708533 · arXiv:2409.17844

What this paper does with SQLancer

Two citations, both to a paper by a SQLancer author rather than to SQLancer itself, placing DBMSs among the areas where the technique has been applied successfully and noting metamorphic transformations among the approaches discussed. A roadmap article on software security analysis for the coming decade. It asks what vulnerabilities future systems will have and how to detect them, how to find bugs once the shallow ones are gone, and how to protect systems when not all flaws can be found -- in a setting where code is increasingly co-written by generative AI and dependencies span whole supply chains. Written by claude-opus-5 from the 2 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
162	ManuelRiggerandZhendong Su.2020. TestingDatabase EnginesviaPivoted QuerySynthesis.In 14thUSENIXSymposiumonOperating Systems Designand Implementation (OSDI 20) .USENIX Association, 667–682. https://www.usenix.org/confe...	sqlancer publication · PQS

Every place it refers to SQLancer (2)

2 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	The technique has been appliedwithalotofsuccessinseveralareas,forinstancef oroptimizingcompilersanddatabasemanagement systems (DBMS), where it has found hundreds of critical bugs in matur e compiler and DBMS implementations [ 118,162,197].	citation marker background	2.1 So/f_tware Analysis Techniques page 2
M2	Forinstance,diﬀerentialtestinghasbeenextremelysuccessfulinthecontextof compilertesting[ 197],whilevarioustypesofmetamorphic transformations have beeneﬀective fordatabasemanagemen t systems [ 162].	citation marker background	2.2 Detected Errors page 3

This page is rendered from _data/papers/paper_doi_10_1145_3708533.json, extracted from arxiv. 24 pages, 212 references parsed.