Welcome to Plume Discussions!

[DavidBakerEffendi]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[DavidBakerEffendi]

Hi all! I've noticed that there has been more and more involvement from the greater community so I'd thought I'd introduce myself and explain where Plume fits into my work. I'm a post-graduate student at Stellenbosch University with my research shifting on applications of graph technology on static analysis.

A lot of my work is based on using CPGs as this was a proven application to efficiently serialize and analyze programs on graph databases. My current focus language is Java, specifically JVM bytecode, which is where Plume comes in. Plume uses Soot to produce CPGs from JVM bytecode and I am now working with @fabsx00 to integrate Plume as the open-source frontend for Joern.

I aim to complete my PhD which will mean that Plume will be actively maintained for at least the next 3 years.

[popthink]

Hi. I'm glad to meet you and your work. Recently, I experienced Graph Databases, JanusGraph and Neo4j, for building Provenance Graph. To make such experience more useful, I've researched the binary analysis with Graph datbase and Gremlin-DSL. And then I read the thesis @fabsx00 written.

[popthink]

Well, my friend still has a question about my direction, applying the graph database on binary analysis (for malware).
I'm trying to show him what it is.

[DavidBakerEffendi]

Nice to meet you too @popthink. Ah, I see that's very cool. So far OverflowDB has been really good at being the back-end storage for program analysis. Part of why I'm building Plume is to see how feasible remote graph databases are but it still seems that the network overhead is affecting the performance too much. A lot of my current week is looking at improving performance and then I will jump back onto correctness.

So far the results for incremental code analysis seem promising and soon Plume + Joern might find its place into vulnerability analysis on CI/CD.