His research interests are in software engineering and software security, in particular static and dynamic program analysis, mobile security, mining software repositories, and applied machine learning. His research in the area of software engineering won three ACM SIGSOFT Distinguished Paper Awards, and he develops research and educational infrastructures that are widely adopted by other researchers and instructors (e.g., Defects4J and the Major mutation framework).