RESEARCH
IEEE Symposium on Security and Privacy · Test of Time Award 2024
The Code Property Graph
In 2014, our CEO Fabian Yamaguchi, together with Nico Golde, Daniel Arp, and Konrad Rieck, introduced the code property graph: a representation of a program that combines its syntax, control flow, and data flow in a single graph that can be queried to find vulnerabilities. Ten years later, the paper received the Test of Time Award of the IEEE Symposium on Security and Privacy, which recognizes work with a lasting impact on security research.
The code property graph is the foundation of the open-source code analysis platform Joern, which Fabian leads, and of many modern code analysis tools. It is also the foundation of our own work: we use it in every security assessment and build custom static analysis on it.
Publications and Talks
Papers and talks by people who work at Whirly Labs, including work from before they joined, published under the companies, universities, and groups they were with at the time.
| YEAR | DESCRIPTION | RESOURCES |
|---|---|---|
| 2025 | Exploiting Arbitrary Class Loading on the JVM (BSides Joburg'25) | SLIDES VIDEO |
| 2025 | Scalable Language Agnostic Taint Tracking Using Explicit Data Dependencies (SOAP'25) | PAPER |
| 2025 | Privacy Analysis of Consumer Hardware Devices: Strategies, Pitfalls and Opportunities to Build Privacy Respecting Hardware (IEEE ISOPE'25) | PAPER |
| 2024 | Attacking Pipelines: Large Scale Exploitation of Workflow Files (BSides Cape Town'24) | SLIDES |
| 2023 | Learning Type Inference for Enhanced Dataflow Analysis (ESORICS'23) | SLIDES PAPER BLOG |
| 2023 | Everything is (still) broken (Threat'23) | SLIDES |
| 2023 | Forging Chains - the Java Blacksmith (BSides Cape Town'23) | SLIDES VIDEO |
| 2023 | Building an Automated Machine for Discovering Privacy Violations at Scale (USENIX Enigma'23) | VIDEO |
| 2023 | Discovering Sensitive Data Flows (Black Hat Webcast) | WEBCAST |
| 2022 | Testability Tarpits: the Impact of Code Patterns on the Security Testing of Web Applications (NDSS'22) | PAPER |
| 2021 | Ghidra2CPG: From Graph Queries to Vulnerabilities in Binary Code (No Hat 2021) | SLIDES |
| 2021 | AppSec Fundamentals for Modern DevOps (USENIX LISA'21) | SLIDES VIDEO |
| 2021 | DIY Static Code Analyzer: Building Your Own Security Tools with Joern (NorthSec 2021 Workshop) | VIDEO |
| 2021 | Finding Stranger Things in Code (RSA Conference 2021 Lab) | SESSION |
| 2020 | Finding Stranger Things in Code (SCALE 18x Workshop) | WORKSHOP |
| 2018 | When Coding Style Survives Compilation: De-anonymizing Programmers from Executable Binaries (NDSS'18) | PAPER |
| 2017 | Efficient and Flexible Discovery of PHP Application Vulnerabilities (IEEE EuroS&P'17) | PAPER |
| 2016 | Twice the Bits, Twice the Trouble: Vulnerabilities Induced by Migrating to 64-Bit Platforms (CCS'16) | PAPER |
| 2015 | Pattern-Based Vulnerability Discovery (PhD Thesis, University of Göttingen) | THESIS |
| 2015 | Automatic Inference of Search Patterns for Taint-Style Vulnerabilities (IEEE S&P'15) | PAPER |
| 2014 | Mining for Bugs with Graph Database Queries (31C3) | VIDEO |
| 2014 | Modeling and Discovering Vulnerabilities with Code Property Graphs (IEEE S&P'14) | PAPER |
| 2013 | Chucky: Exposing Missing Checks in Source Code for Vulnerability Discovery (CCS'13) | PAPER |
| 2011 | Vulnerability Extrapolation: Give Me More Bugs Like That, Please? (Black Hat USA 2011) | SLIDES THESIS |
| 2009 | cat /proc/sys/net/ipv4/f*ckups (26C3) | SLIDES VIDEO |
| 2009 | TCP/IP Orphaned Connections Vulnerability in Windows XP and Vista (Security Advisory) | ADVISORY |
| 2008 | New Ideas for Old Practices: Port Scanning Improved (DEF CON 16) | SLIDES |
| 2007 | Port Scanning Improved (24C3) | VIDEO |