Album: Program Hardening

Papers

• Causes and Canonicalization of Unreproducible Builds in Java (Aman Sharma, Benoit Baudry and Martin Monperrus), In IEEE Transactions on Software Engineering, 2025. [github]
• Dirty-Waters: Detecting Software Supply Chain Smells (Raphina Liu, Sofia Bobadilla, Benoit Baudry and Martin Monperrus), In Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, Tool track, 2025. [github]
• Galapagos: Automated N-Version Programming with LLMs (Javier Ron, Diogo Gaspar, Javier Cabrera-Arteaga, Benoit Baudry and Martin Monperrus), In ACM Transactions on Software Engineering and Methodology 2025, 2025. [github]
• Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order (Frank Reyes, Federico Bono, Aman Sharma, Benoit Baudry and Martin Monperrus), In Proceedings of ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED), 2025. [github]
• Software Bills of Materials in Maven Central (Yogya Gamage, Nadia Gonzalez Fernandez, Martin Monperrus and Benoit Baudry), In Proceedings of the International Conference on Mining Software Repositories, 2025. [zenodo]
• On-Chain Analysis of Smart Contract Dependency Risks on Ethereum (Monica Jin, Raphina Liu and Martin Monperrus), Technical report 2503.19548, arXiv, 2025.
• The Design Space of Lockfiles Across Package Managers (Yogya Gamage, Deepika Tiwari, Martin Monperrus and Benoit Baudry), Technical report 2505.04834, arXiv, 2025.
• Byam: Fixing Breaking Dependency Updates with Large Language Models (Frank Reyes, May Mahmoud, Federico Bono, Sarah Nadi, Benoit Baudry and Martin Monperrus), Technical report 2505.07522, arXiv, 2025.
• GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement (Carmine Cesarano, Martin Monperrus and Roberto Natella), Technical report 2505.11016, arXiv, 2025.
• Maven-Lockfile: High Integrity Rebuild of Past Java Releases (Larissa Schmid, Elias Lundell, Yogya Gamage, Benoit Baudry and Martin Monperrus), Technical report 2510.00730, arXiv, 2025.
• Classport: Designing Runtime Dependency Introspection for Java (Serena Cofano, Daniel Williams, Aman Sharma and Martin Monperrus), Technical report 2510.20340, arXiv, 2025.
• Software Supply Chain Security of Web3 (Martin Monperrus), Technical report 2511.12274, arXiv, 2025.

• BUMP: A Benchmark of Reproducible Breaking Dependency Updates (Frank Reyes, Yogya Gamage, Gabriel Skoglund, Benoit Baudry and Martin Monperrus), In Proceedings of SANER 2024, 2024. [github]
• GitBug-Actions: Building Reproducible Bug-Fix Benchmarks with GitHub Actions (Nuno Saavedra, André Silva and Martin Monperrus), In Proceedings of ICSE Tool, 2024. [github]
• GoSurf: Identifying Software Supply Chain Attack Vectors in Go (Carmine Cesarano, Vivi Andersson, Roberto Natella and Martin Monperrus), In Proceedings of ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED), 2024. [github]
• WASM-MUTATE: Fast and Effective Binary Diversification for WebAssembly (Javier Cabrera-Arteaga, Nicholas Fitzgerald, Martin Monperrus and Benoit Baudry), In Computers & Security, 2024. [github]
• SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java (Aman Sharma, Martin Wittlinger, Benoit Baudry and Martin Monperrus), Technical report 2407.00246, arXiv, 2024.

• Challenges of Producing Software Bill Of Materials for Java (Musard Balliu, Benoit Baudry, Sofia Bobadilla, Mathias Ekstedt, Martin Monperrus, Javier Ron, Aman Sharma, Gabriel Skoglund, César Soto-Valero and Martin Wittlinger), In IEEE Security & Privacy, 2023. [github]
• Chaos Engineering of Ethereum Blockchain Clients (Long Zhang, Javier Ron, Benoit Baudry and Martin Monperrus), In Distributed Ledger Technologies: Research and Practice, volume 2, 2023. [github]
• Highly Available Blockchain Nodes With N-Version Design (Javier Ron, César Soto-Valero, Long Zhang, Benoit Baudry and Martin Monperrus), In IEEE Transactions on Dependable and Secure Computing, 2023. [github]
• WebAssembly Diversification for Malware Evasion (Javier Cabrera-Arteaga, Martin Monperrus, Tim Toady and Benoit Baudry), In Computers & Security, 2023. [github]

• Multi-Variant Execution at the Edge (Javier Cabrera-Arteaga, Pierre Laperdrix, Martin Monperrus and Benoit Baudry), In Proceedings of the 9th ACM Workshop on Moving Target Defense, 2022. [github]
• The Multibillion Dollar Software Supply Chain of Ethereum (César Soto-Valero, Martin Monperrus and Benoit Baudry), In IEEE Computer, 2022. [github]

• Maximizing Error Injection Realism for Chaos Engineering with System Calls (Long Zhang, Brice Morin, Benoit Baudry and Martin Monperrus), In IEEE Transactions on Dependable and Secure Computing, 2021. [Phoebe on github]
• Observability and Chaos Engineering on System Calls for Containerized Applications in Docker (Jesper Simonsson, Long Zhang, Brice Morin, Benoit Baudry and Martin Monperrus), In Future Generation Computer Systems, 2021. [github]

• A Chaos Engineering System for Live Analysis and Falsification of Exception-handling in the JVM (Long Zhang, Brice Morin, Philipp Haller, Benoit Baudry and Martin Monperrus), In IEEE Transactions on Software Engineering, 2019. [ChaosMachine on github]
• Fully Automated HTML and JavaScript Rewriting for Constructing a Self-healing Web Proxy (journal version) (Thomas Durieux, Youssef Hamadi and Martin Monperrus), In Journal of Software Testing, Verification and Reliability, Wiley, volume 30, 2019. [github]
• TripleAgent: Monitoring, Perturbation and Failure-obliviousness for Automated Resilience Improvement in Java Applications (Long Zhang and Martin Monperrus), In Proceedings of the IEEE International Symposium on Software Reliability Engineering, 2019. [github]
• Automatic Observability for Dockerized Java Applications (Long Zhang, Deepika Tiwari, Brice Morin, Benoit Baudry and Martin Monperrus), Technical report 1912.06914, arXiv, 2019.

• Exhaustive Exploration of the Failure-oblivious Computing Search Space (Thomas Durieux, Youssef Hamadi, Zhongxing Yu, Benoit Baudry and Martin Monperrus), In Proceedings of the International Conference on Software Testing, Verification and Validation (ICST), 2018. [github]
• Fully Automated HTML and Javascript Rewriting for Constructing a Self-healing Web Proxy (Thomas Durieux, Youssef Hamadi and Martin Monperrus), In Proceedings of ISSRE, 2018. [Bikiniproxy github]

• App Store 2.0: From Crowdsourced Information to Actionable Feedback in Mobile Ecosystems (María Gómez, Bram Adams, Walid Maalej, Martin Monperrus and Romain Rouvoy), In IEEE Software, Institute of Electrical and Electronics Engineers, volume 34, 2017.
• Correctness Attraction: A Study of Stability of Software Behavior Under Runtime Perturbation (Benjamin Danglot, Philippe Preux, Benoit Baudry and Martin Monperrus), In Empirical Software Engineering, 2017. [data on github]
• Principles of Antifragile Software (Martin Monperrus), In Companion to the first International Conference on the Art, Science and Engineering of Programming, 2017.
• Production-Driven Patch Generation (Thomas Durieux, Youssef Hamadi and Martin Monperrus), In Proceedings of the 39th International Conference on Software Engineering: New Ideas and Emerging Results Track, 2017.

• BanditRepair: Speculative Exploration of Runtime Patches (Thomas Durieux, Youssef Hamadi and Martin Monperrus), Technical report 1603.07631, arXiv, 2016.

• Exception Handling Analysis and Transformation Using Fault Injection: Study of Resilience Against Unanticipated Exceptions (Benoit Cornu, Lionel Seinturier and Martin Monperrus), In Information and Software Technology, Elsevier, volume 57, 2015.
• When App Stores Listen to the Crowd to Fight Bugs in the Wild (Maria Gomez, Matias Martinez, Martin Monperrus and Romain Rouvoy), In Proceedings of the 37th International Conference on Software Engineering (ICSE), track on New Ideas and Emerging Results (NIER), IEEE, 2015.

• Empirical Investigation of the Web Browser Attack Surface under Cross-Site Scripting: an Urgent Need for Systematic Security Regression Testing (Erwan Abgrall, Sylvain Gombault, Yves Le Traon and Martin Monperrus), In International Conference on Software Testing, Verification and Validation Workshops, 2014.
• Analysis and Exploitation of Natural Software Diversity: The Case of API Usages (Diego Mendez, Benoit Baudry and Martin Monperrus), Technical report hal-01095501, Inria, 2014.

• Automatically Securing Permission-Based Software by Reducing the Attack Surface: An Application to Android (Alexandre Bartel, Jacques Klein, Yves Le Traon and Martin Monperrus), In IEEE/ACM International Conference On Automated Software Engineering, 2012.

Other publications by Martin Monperrus