Mingjie Shen

I am a PhD student in the Elmore Family School of Electrical and Computer Engineering at Purdue University, advised by Prof. Aravind Machiry. Before Purdue, I received my Bachelor’s degree in Computer Science and Technology from Nanjing University.

My research interests span software security, static program analysis, and AI for software engineering, with a focus on making static analysis more effective for large, real-world software systems. I study how static analysis tools are used in practice and why they fall short on large codebases (ISSTA 2025, ICISS 2024). Motivated by these practical challenges, I explore how AI agents can improve the precision, adaptability, and automation of static analysis. My recent work includes using tool-augmented LLM agents to filter false positives from SAST tools (RAID 2026), generating repository-specific CodeQL queries for vulnerability discovery, and learning symbolic program-transformation rules to automate large-scale collateral evolution.

My research has practical impact beyond papers. Applying static analysis to over 250 open-source embedded projects uncovered more than 700 defects, over half of which were confirmed by maintainers. I submitted patches for many of them, and over 100 of those patches have been merged upstream into projects including Apache NuttX, Contiki-NG, Mbed OS, RIOT, and SDL; maintainers fixed further reported bugs themselves.

I am currently looking for full-time positions in industry. If you think I would be a good fit for your team, please get in touch by email.

news

Jul 30, 2026	Our paper “Democratizing False Positives Filtering Through Learning Assisted Reasoning” has been accepted to RAID 2026.
Jul 01, 2025	Our experience paper on applying CodeQL to open-source embedded software, which found 709 defects across 258 projects, appears at ISSTA 2025.

selected publications

RAID

Democratizing False Positives Filtering Through Learning Assisted Reasoning

Mingjie Shen, Sai Ritvik Tanksalkar, Christophe Hauser, and Aravind Machiry

In Proceedings of the 29th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2026), to appear, 2026

Bib PDF

@inproceedings{shen2026democratizing,
  title = {Democratizing False Positives Filtering Through Learning Assisted Reasoning},
  author = {Shen, Mingjie and Tanksalkar, Sai Ritvik and Hauser, Christophe and Machiry, Aravind},
  booktitle = {Proceedings of the 29th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2026), to appear},
  year = {2026},
}

ISSTA
Finding 709 Defects in 258 Projects: An Experience Report on Applying CodeQL to Open-Source Embedded Software (Experience Paper)

Mingjie Shen, Akul Abhilash Pillai, Brian A. Yuan, James C. Davis, and Aravind Machiry

Proc. ACM Softw. Eng., 2025

Abs DOI arXiv Bib

In this experience paper, we report on a large-scale empirical study of Static Application Security Testing (SAST) in Open-Source Embedded Software (EMBOSS) repositories. We apply CodeQL to 258 EMBOSS projects, characterize the defects it reports, and share the lessons learned about using SAST on large real-world embedded codebases.
@article{shen2025codeql, author = {Shen, Mingjie and Pillai, Akul Abhilash and Yuan, Brian A. and Davis, James C. and Machiry, Aravind}, title = {Finding 709 Defects in 258 Projects: An Experience Report on Applying CodeQL to Open-Source Embedded Software (Experience Paper)}, journal = {Proc. {ACM} Softw. Eng.}, volume = {2}, number = {{ISSTA}}, pages = {1077--1100}, year = {2025}, doi = {10.1145/3728923}, }

ICISS

Insights from Running 24 Static Analysis Tools on Open Source Software Repositories

Fabiha Hashmat, Zeyad Alwaleed Aljaali, Mingjie Shen, and Aravind Machiry

In International Conference on Information Systems Security (ICISS 2024), 2024

DOI Bib PDF

@inproceedings{hashmat2024insights,
  author = {Hashmat, Fabiha and Aljaali, Zeyad Alwaleed and Shen, Mingjie and Machiry, Aravind},
  title = {Insights from Running 24 Static Analysis Tools on Open Source Software Repositories},
  booktitle = {International Conference on Information Systems Security (ICISS 2024)},
  series = {Lecture Notes in Computer Science},
  volume = {15416},
  pages = {225--245},
  publisher = {Springer},
  year = {2024},
  doi = {10.1007/978-3-031-80020-7_13},
}

LCTES

Towards Automated Identification of Layering Violations in Embedded Applications (WIP)

Mingjie Shen, James C. Davis, and Aravind Machiry

In Proceedings of the 24th ACM SIGPLAN/SIGBED International Conference on Languages, Compilers, and Tools for Embedded Systems (LCTES 2023), 2023

DOI Bib Code

@inproceedings{shen2023layering,
  author = {Shen, Mingjie and Davis, James C. and Machiry, Aravind},
  editor = {Egger, Bernhard and Lee, Dongyoon},
  title = {Towards Automated Identification of Layering Violations in Embedded
                   Applications {(WIP)}},
  booktitle = {Proceedings of the 24th {ACM} {SIGPLAN/SIGBED} International Conference
                   on Languages, Compilers, and Tools for Embedded Systems ({LCTES} 2023)},
  pages = {143--147},
  publisher = {{ACM}},
  year = {2023},
  doi = {10.1145/3589610.3596271},
}