Startseite > Fachgruppen > Secure Software Engineering > Lehre > Designing code analyses for large-scale software systems 2 (DECA 2) SS2021

Designing code analyses for large-scale software systems 2 (DECA 2) SS2021


Guest lecture by CQSE on 08.07.2021

Title: Static Security Analysis for ABAP


Security vulnerabilities have been plaguing software systems for ages. They potentially enable attackers to execute their own code, extract confidential, or inject forged information. Unfortunately, most security tools that detect such vulnerabilities have historically focussed on a common set of popular programming languages such as Java, Python, and C/C++. This comes at the disadvantage of more obsure languages that are, however, by no means less affected by security vulnerabilities. One language that has received less attention is ABAP despite it being the main programming language of SAP systems and therefore in worldwide use. In this talk, I will describe the ABAP security analyses developed at CQSE. CQSE's mission is to improve code quality through its software-intelligence platform Teamscale. As part of this mission, CQSE aims to address security concerns and consequently integrated security analyses into Teamscale as well. In the talk, I will give a brief introduction to ABAP as a programming language and its challenges. Subsequently, I will showcase what our ABAP security analysis does and how it works. The analysis is a full-fledged interprocedural taint-flow analysis. I will also discuss the impact the analysis had for our customers. After my talk, there will be time for questions.

Speaker's bio:

Stefan Krüger has received a Ph.D. in software security from Paderborn University in 2020. Their Ph.D. work revolved around the developer-assistant tool for cryptographic APIs CogniCrypt. Since August 2021 Krüger has been working as a Software Engineer at CQSE.

Meet us on Youtube

This course will be available on Youtube! You will find all course videos online here. The exercise sessions will be kept UPB-internal.

Course number and language


The teaching language will be English. Questions in German will be permitted.

Registering and communicating

To attend the course, you have to register in the PAUL system as a participant.

To ask questions, please use the discussion forum in PANDA, so that others can benefit from the answers as well.

If needed, we will also send updates through PANDA circulars.

Important note about the current COVID situation

Please note: to prevent further infections with COVID-19, the German government has put in place a range of contact restrictions. Due to this, this course - as probably every course at UPB - will be entirely conducted online. The university is asking us to prepare for asynchronous teaching, which means that we will be uploading videos and exercises that you will be able to attend to (but have to attend to) at your own time. Further information and all material will be provided on the course's PANDA Page.


Due to the fact that the course will be taught online and asynchronously, there is no dedicated lecture and exercise time slot. This schedule, however, gives a rough indication of which topics will be covered when.


Static code analysis is used to detect bugs and security breaches, and aids compiler optimization. It has been an area of research since the past several decades. This course explains several novel, advanced concepts out of cutting-edge research (such as weighted pushdown systems and demand-driven program analyses) and also introduces some interesting (and recently developed) tools. Most of these concepts are very recent and hence give an excellent overview of what static analysis researchers are currently working on. Example applications are drawn from the area of IT security.

Course structure

Each week, two hours will be dedicated to the lecture, and three hours will be dedicated to concrete exercise classes and programming labs.

In the exercise sessions, you will be able to apply the notions seen during the lecture into more concrete topics, preparing you to present your knowledge (with respect to the final exam).

The goal of the programming labs is to introduce you to recent program analysis tools, and deepen your knowledge and understanding of the notions seen in the lecture and exercise sessions. The lab assignments will mostly be done at home, using the scheduled lab hours to answer questions on the ongoing lab.

If you have questions to the organisation of the course, the topic, the exercises, or the labs, or if you get stuck when solving the exercises or labs, please use the forum in PANDA. We try to answer on a regular basis and as soon as possible.


Graded exercise sheets:

    • During the semester, you will have to hand in six graded exercise sheets.
    • Each sheet has to be handed in through PANDA before 8 am on its due date.
    • Late submissions will not be accepted.
    • Plagiarism will result on a 0 grade for the exercise sheets and will be reported to the department. It can result in severe consequences such as financial fine and expulsion from the university.

    Graded labs:

    • During the semester, you will have to hand in four labs.
    • Each lab has to be handed in through PANDA before 8 am on its due date.
    • Late submissions will not be accepted.
    • Plagiarism will result on a 0 grade for the labs and will be reported to the department. It can result in severe consequences such as financial fine and expulsion from the university.

    Labs are not required for course achievement. However, you will get the following bonus if you submit labs:

    • If you scored 70% or more, you will receive a bonus of 0.3 on your final grade.
    • If you scored 90% or more, you will receive a bonus of 0.7 on your final grade.

    Final exam:

    At the end of the course, you will have the opportunity to register for the written exam based on your exercise sheets grade:

    • If you scored below 50%, you cannot register for the exam.
    • If you scored 50% or more, you can register for the exam.

    The exam will be in a written format, except for students under the old Prüfungsordnung who will need to register for an oral exam.


    The course Designing code analyses for large-scale software systems (DECA) 1 is a required prerequisite. A mature understanding of the Java programming language and object-oriented programming will be helpful.


    Topics covered include:

    • Sparse IFDS
    • Pushdown Systems, WPDS Frameworks
    • Demand-Driven Program Analysis
    • Synchronised Pushdown Systems, Boomerang
    • Introduction to CogniCrypt, FlowDroid
    • Handling Reflection
    • Hybrid Analysis
    • Heapster
    • SWAN/SWAN Assist
    • Improved User Experience

    Throughout the course and the exercise sessions, we will discuss applications to software security.

    Learning outcomes

    After having attended this course, students will have learned…

    • how to make educated design decisions when designing automated code analysis for large-scale software systems,
    • which algorithms have which properties when using them to implement static code-analyses,
    • how to design real–world code analyses for practical problem cases from the area of IT security,
    • which current tools are used for program analysis, what their limitations are and where they can be applied.

    Recommended reading material

    We will not be able to provide a script for this course. We will provide powerpoint slides where available, but will develop some concepts also on the blackboard. Students are highly encouraged to take their own copies during their lecture.

    A lot of the material is also covered in the following books and papers, however, those publications present the material in a more complex manner than in the lectures, which is why they should mostly be used for deeper personal study.