International Static Analysis Symposium

International Static Analysis Symposium
Name	International Static Analysis Symposium
Status	Active
Discipline	Static analysis
First	1994
Organizer	Association for Computing Machinery ACM SIGSOFT IEEE Computer Society
Frequency	Annual
Country	International

Contents

International Static Analysis Symposium is an annual academic conference that focuses on static program analysis, program verification, and software security methods, bringing together researchers from Carnegie Mellon University, Massachusetts Institute of Technology, Stanford University, University of California, Berkeley and University of Cambridge. Leading authors from Microsoft Research, Google Research, IBM Research, Bell Labs and ETH Zurich regularly present results alongside contributors from INRIA, Max Planck Institute for Software Systems, Tsinghua University, Peking University and Tokyo Institute of Technology. The symposium interfaces with adjacent venues such as PLDI, POPL, CCS, ICSE, and FSE while influencing tools and standards at Linux Foundation, OWASP, and ISO committees.

History

The symposium traces origins to workshops and meetings involving Michael Hicks, Alex Aiken, Patrick Cousot, Gordon Plotkin, John Reynolds, and institutions like Bell Labs and SRI International that fostered early work on abstract interpretation, type systems, and model checking. Early iterations aligned with programs at European Joint Conferences on Theory and Practice of Software (ETAPS), ACM SIGPLAN events, and collaborations among INRIA, University of Oxford, École Polytechnique, and Technical University of Munich. Over time, the symposium expanded through partnerships with ACM SIGSOFT, IEEE Computer Society, USENIX, ACM SIGARCH and regional organizers from Asia-Pacific Software Engineering Conference and IEEE Pacific Rim International Symposium on Dependable Computing.

The symposium covers static techniques including abstract interpretation, data-flow analysis, type theory, model checking, symbolic execution, and taint analysis, with application domains spanning operating systems (as in Linux kernel), web browsers (as in Google Chrome), cryptographic protocols (as in TLS), and embedded systems (as in ARM architecture). Research often references toolchains such as LLVM, GCC, Clang, Frama-C, Infer, SPARK, and Coq to validate techniques, and engages with case studies from Microsoft Windows, Android, iOS, and OpenSSL incident analyses. Topics intersect with standards and compliance efforts at ISO/IEC JTC 1, NIST, CERT/CC, and CVE reporting.

Typical formats include peer-reviewed paper sessions, keynote talks by figures from Google Research, Microsoft Research, Amazon Web Services, and Apple Inc., poster sessions, tool demonstrations, and tutorials led by faculty from University of Illinois Urbana-Champaign, Princeton University, Cornell University, Harvard University, and Yale University. The program committee is drawn from members of ACM, IEEE, IFIP, ACM SIGSOFT, and research labs such as Nokia Bell Labs and Siemens Research. Workshops and co-located events have included collaborations with ESEC/FSE, SOSP, OSDI, NDSS, and Usenix Security Symposium to broaden practitioner participation and industry engagement.

Accepted papers are published in proceedings indexed by ACM Digital Library, IEEE Xplore, and archived alongside records in bibliographic services like DBLP, Google Scholar, and ACM Guide to Computing Literature. Artifacts, source code, and supplemental evaluations are archived in repositories maintained by Zenodo, GitHub, and institutional archives at Carnegie Mellon University and University of Cambridge. The symposium has produced influential volumes and special issues in journals such as ACM Transactions on Programming Languages and Systems, IEEE Transactions on Software Engineering, Journal of the ACM, Formal Methods in System Design, and Science of Computer Programming.

Best paper awards and artifact evaluation recognitions are presented, with awardees often affiliated with Stanford University, ETH Zurich, University of Toronto, McGill University, and Imperial College London. Contributions are sometimes recognized by later honors from ACM SIGSOFT, IEEE Technical Committee on Software Engineering, Royal Society, and national academies including the National Academy of Engineering and Royal Academy of Engineering. Notable recipients have progressed to receive fellowships at ACM, IEEE, Royal Society and prizes such as the Turing Award, Gödel Prize, and discipline-specific awards from EPSRC and NSF.

Seminal presentations have introduced techniques later adopted by industrial tools such as Coverity, Facebook Infer, KLEE, SMT-LIB, and Z3, influencing projects at NASA, JPL, European Space Agency, Toyota Research Institute, and Bosch. Papers and demos have shaped security incident responses involving Heartbleed, Spectre, and Meltdown mitigations, and contributed to programming language design discussions for Rust, Go, Haskell, OCaml, and Scala. The symposium's community continues to drive advances cited in policy and standards work by NIST, ENISA, ITU, and industry consortia like Cloud Security Alliance and OpenSSF.