JLiSA: the Java Frontend of the Library for Static Analysis (Competition Contribution)
JLiSA is the Java frontend of LiSA, an analysis engine based on abstract interpretation that works on an extensible control flow graph representation. JLiSA translates Java programs into LiSA's internal CFG, provides semantics for parts of the Java standard library, and includes checkers to verify assertions and detect uncaught exceptions. This paper presents our first participation in SV-COMP in the Java category, where we achieved 3rd place.
paper →Inference of Access Policies through Static Analysis
We present a static analysis approach to automatically infer access control policies for distributed systems. The analysis reconstructs communication architectures from source code, detecting policy violations and sensitive data flows without requiring manual policy specification.
paper →Automating ROS2 Security Policies Extraction through Static Analysis
We propose a static analysis technique to automatically extract least-privilege security policies for ROS2 robotic systems. The approach analyzes ROS2 node source code to infer communication patterns and generate minimal access control policies, addressing OWASP security concerns in cyber-physical systems.
paper →Sound Static Analysis for Microservices: Utopia? A Preliminary Experience with LiSA
We explore the challenges of applying sound static analysis to microservice architectures using the LiSA framework. We present a preliminary experience analysing communication patterns, data flows, and policy violations across service boundaries, highlighting the fundamental tension between soundness and scalability.
paper →