JNICodejail: native code isolation for Java programs. - Behnaz Hassanshahi; Roland H. C. Yap (PPPJ, 2013)

Web-to-Application Injection Attacks on Android: Characterization and Detection. - Behnaz Hassanshahi; Yaoqi Jia; Roland H. C. Yap; Prateek Saxena; Zhenkai Liang (ESORICS (2), 2015)

Android Database Attacks Revisited. - Behnaz Hassanshahi; Roland H. C. Yap (AsiaCCS, 2017)

An efficient tunable selective points-to analysis for large codebases. - Behnaz Hassanshahi; Raghavendra Kagalavadi Ramesh; Padmanabhan Krishnan; Bernhard Scholz; Yi Lu 003 (SOAP@PLDI, 2017)

RoppDroid: Robust permission re-delegation prevention in Android inter-component communication. - Ting Dai; Xiaolei Li; Behnaz Hassanshahi; Roland H. C. Yap; Zhenkai Liang (Comput. Secur., 2017)

AFFOGATO: runtime detection of injection attacks for Node.js. - François Gauthier 001; Behnaz Hassanshahi; Alexander Jordan (ISSTA/ECOOP Workshops, 2018)

SAFE-PDF: Robust Detection of JavaScript PDF Malware Using Abstract Interpretation. - Alexander Jordan; François Gauthier 001; Behnaz Hassanshahi; David Zhao 001 (CoRR, 2018)

Unacceptable Behavior: Robust PDF Malware Detection Using Abstract Interpretation. - Alexander Jordan; François Gauthier 001; Behnaz Hassanshahi; David Zhao 001 (PLAS@CCS, 2019)

Nodest: feedback-driven static analysis of Node.js applications. - Benjamin Barslev Nielsen; Behnaz Hassanshahi; François Gauthier 001 (ESEC/SIGSOFT FSE, 2019)

Trade-offs in managing risk and technical debt in industrial research labs: an experience report. - François Gauthier 001; Alexander Jordan; Padmanabhan Krishnan; Behnaz Hassanshahi; Jörn Guy Süß; Sora Bae; Hyunjun Lee (TechDebt@ICSE, 2020)

Coding Practices and Recommendations of Spring Security for Enterprise Applications. - Mazharul Islam; Sazzadur Rahaman; Na Meng 001; Behnaz Hassanshahi; Padmanabhan Krishnan; Danfeng Daphne Yao (SecDev, 2020)

Gelato: Feedback-driven and Guided Security Analysis of Client-side Web Applications. - Behnaz Hassanshahi; Hyunjun Lee; Paddy Krishnan; Jörn Guy Süß (CoRR, 2020)

MoScan: a model-based vulnerability scanner for web single sign-on services. - Hanlin Wei; Behnaz Hassanshahi; Guangdong Bai; Padmanabhan Krishnan; Kostyantyn Vorobyov (ISSTA, 2021)

BackREST: A Model-Based Feedback-Driven Greybox Fuzzer for Web Applications. - François Gauthier 001; Behnaz Hassanshahi; Benjamin Selwyn-Smith; Trong Nhan Mai; Max Schlüter; Micah Williams (CoRR, 2021)

Automatic Root Cause Quantification for Missing Edges in JavaScript Call Graphs. - Madhurima Chakraborty; Renzo Olivares; Manu Sridharan; Behnaz Hassanshahi (ECOOP, 2022)

Experience: Model-Based, Feedback-Driven, Greybox Web Fuzzing with BackREST. - François Gauthier 001; Behnaz Hassanshahi; Benjamin Selwyn-Smith; Trong Nhan Mai; Max Schlüter; Micah Williams (ECOOP, 2022)

Gelato: Feedback-driven and Guided Security Analysis of Client-side Web Applications. - Behnaz Hassanshahi; Hyunjun Lee; Paddy Krishnan (SANER, 2022)

Automatic Root Cause Quantification for Missing Edges in JavaScript Call Graphs (Extended Version). - Madhurima Chakraborty; Renzo Olivares; Manu Sridharan; Behnaz Hassanshahi (CoRR, 2022)

Automatic Root Cause Quantification for Missing Edges in JavaScript Call Graphs (Artifact). - Madhurima Chakraborty; Renzo Olivares; Manu Sridharan; Behnaz Hassanshahi (Dagstuhl Artifacts Ser., 2022)

Macaron: A Logic-based Framework for Software Supply Chain Security Assurance. - Behnaz Hassanshahi; Trong Nhan Mai; Alistair Michael; Benjamin Selwyn-Smith; Sophie Bates; Padmanabhan Krishnan (SCORED@CCS, 2023)

The role of program analysis in security vulnerability detection: Then and now. - Cristina Cifuentes; François Gauthier 001; Behnaz Hassanshahi; Padmanabhan Krishnan; Davin McCall (Comput. Secur., 2023)

BinEq - A Benchmark of Compiled Java Programs to Assess Alternative Builds. - Jens Dietrich 001; Tim White; Mohammad Mahdi Abdollahpour; Elliott Wen; Behnaz Hassanshahi (SCORED@CCS, 2024)

Levels of Binary Equivalence for the Comparison of Binaries from Alternative Builds. - Jens Dietrich 001; Tim White; Behnaz Hassanshahi; Paddy Krishnan (CoRR, 2024)

Practical Type-Based Taint Checking and Inference. - Nima Karimipour; Kanak Das; Manu Sridharan; Behnaz Hassanshahi (ECOOP, 2025)

Detecting Python Malware in the Software Supply Chain with Program Analysis. - Ridwan Shariffdeen; Behnaz Hassanshahi; Martin Mirchev; Ali El Husseini; Abhik Roychoudhury (SEIP@ICSE, 2025)

Towards Cross-Build Differential Testing. - Jens Dietrich 001; Tim White; Valerio Terragni; Behnaz Hassanshahi (ICST, 2025)

Practical Type-Based Taint Checking and Inference (Artifact). - Nima Karimipour; Kanak Das; Manu Sridharan; Behnaz Hassanshahi (Dagstuhl Artifacts Ser., 2025)

Practical Type-Based Taint Checking and Inference (Extended Version). - Nima Karimipour; Kanak Das; Manu Sridharan; Behnaz Hassanshahi (CoRR, 2025)

DALEQ - Explainable Equivalence for Java Bytecode. - Jens Dietrich 001; Behnaz Hassanshahi (CoRR, 2025)