Demo Data from SIGIR 2026 / reviewers in the wild / expert
Matthew Pruett
dblp:265/5563
· DBLP profile ↗
4ranked-venue papers
0as first author
4since 2021 · last 2023
—ORCID · none
Domains — the database's venue-derived domains; a paper can count in several
Security and privacy · 3 · 3 since 2021Software engineering, systems software and programming languages · 1 · 1 since 2021
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Network and information security
4 papers |
Systems and software security · 87% Malware analysis · 13% | |
| Software engineering, system software, and programming languages
3 papers |
Program analysis · 60% Compilers and program optimization · 20% Debugging and program repair · 20% |
Topics — the 10 heaviest of 12, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Systems and software security
vulnerability discovery |
1.2 | 2 | 2023 | VulChecker: Graph-based Vulnerability Localization in Source Code · USENIX Security Symposium 2023 ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems · USENIX Security Symposium 2021 |
Systems and software security › vulnerability discovery
vulnerability localization |
0.7 | 1 | 2023 | VulChecker: Graph-based Vulnerability Localization in Source Code · USENIX Security Symposium 2023 |
Program analysis
graph-based analysis |
0.7 | 1 | 2023 | VulChecker: Graph-based Vulnerability Localization in Source Code · USENIX Security Symposium 2023 |
Program analysis
static analysis |
0.7 | 1 | 2023 | VulChecker: Graph-based Vulnerability Localization in Source Code · USENIX Security Symposium 2023 |
Systems and software security › exploitation
code reuse attack |
0.5 | 1 | 2021 | Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets · Proc. ACM Program. Lang. 2021 |
Systems and software security › exploitation › code reuse attack
return-oriented programming |
0.5 | 1 | 2021 | Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets · Proc. ACM Program. Lang. 2021 |
Systems and software security › vulnerability analysis
root cause analysis |
0.5 | 1 | 2021 | ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems · USENIX Security Symposium 2021 |
Compilers and program optimization
compiler optimization |
0.5 | 1 | 2021 | Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets · Proc. ACM Program. Lang. 2021 |
Debugging and program repair
fault localization |
0.5 | 1 | 2021 | ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems · USENIX Security Symposium 2021 |
Program analysis
binary analysis |
0.1 | 1 | 2021 | Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets · Proc. ACM Program. Lang. 2021 |
Methods — techniques the papers use, named apart from their topics
program dependence graph · 1.3graph neural network · 1.3symbolic execution · 1.0differential binary analysis · 1.0binary recompilation · 1.0memory image analysis · 0.5machine learning · 0.5
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2023 | VulChecker: Graph-based Vulnerability Localization in Source Code
Yisroel Mirsky, George Macon, Michael D. Brown, Carter Yagemann, Matthew Pruett, Evan Downing, J. Sukarno Mertoguno, Wenke Lee |
USENIX Security Symposium | 5 |
| 2021 | Forecasting Malware Capabilities From Cyber Attack Memory Images
Omar Alrawi, Moses Ike, Matthew Pruett, Ranjita Pai Kasturi, Srimanta Barua, Taleb Hirani, Brennan Hill, Brendan Saltaformaggio |
USENIX Security Symposium | 3 |
| 2021 | ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems
Carter Yagemann, Matthew Pruett, Simon P. Chung, Kennon Bittick, Brendan Saltaformaggio, Wenke Lee |
USENIX Security Symposium | 2 |
| 2021 | Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget setsabstractDespite extensive testing and correctness certification of their functional semantics, a number of compiler optimizations have been shown to violate security guarantees implemented in source code. While prior work has shed light on how such optimizations may introduce semantic security weaknesses into programs, there remains a significant knowledge gap concerning the impacts of compiler optimizations on non-semantic properties with security implications. In particular, little is currently known about how code generation and optimization decisions made by the compiler affect the availability and utility of reusable code segments called gadgets required for implementing code reuse attack methods such as return-oriented programming. In this paper, we bridge this gap through a study of the impacts of compiler optimization on code reuse gadget sets. We analyze and compare 1,187 variants of 20 different benchmark programs built with two production compilers (GCC and Clang) to determine how their optimization behaviors affect the code reuse gadget sets present in program variants with respect to both quantitative and qualitative metrics. Our study exposes an important and unexpected problem; compiler optimizations introduce new gadgets at a high rate and produce code containing gadget sets that are generally more useful to an attacker than those in unoptimized code. Using differential binary analysis, we identify several undesirable behaviors at the root of this phenomenon. In turn, we propose and evaluate several strategies to mitigate these behaviors. In particular, we show that post-production binary recompilation can effectively mitigate these behaviors with negligible performance impacts, resulting in optimized code with significantly smaller and less useful gadget sets. Michael D. Brown, Matthew Pruett, Robert Bigelow, Girish Mururu, Santosh Pande |
Proc. ACM Program. Lang. | 2 |