# Analyzing and Discovering Spatial Algorithm Complexity Vulnerabilities in Recursion
## 5 Evaluation
### Result and Analysis
#### 5.2.2 RQ2: Superiority  
The superiority of our method and tool is primarily demonstrated through comparison with other tools. We have chosen the most representative research achievements in recent years, and compared them from various perspectives, including applicability scenarios and range, types of vulnerabilities that can be analyzed, supported data types, and the effort required for exploitation stage. This comparison is conducted to analyze the advanced nature of the tool we propose. It is noteworthy that in our experimental process, most tools opted not to be open-source. The DARPA Space and Time Analysis for Cybersecurity (STAC) program dataset, which has been commonly used for results evaluation in many studies, also can no longer be found in an officially public way. The specific details are as follows, as shown in Table 3.  
Compared to the most advanced tools recently proposed in the field, the type of vulnerabilities we focus on is more targeted towards current weak points, specifically spatial ACV. Our approach starts with bytecode analysis, eliminating the need to access the source code, thus offering a broader applicability. Our method is static, which brings it closer to the essence of vulnerability occurrence than other hybrid or dynamic methods. Due to the precision of our proposed model, our results can almost certainly detect all spatial algorithmic complexity vulnerabilities that meet our criteria without false positive. For payload generation, we employ a manually assisted approach, leveraging an understanding of the call chain to rapidly construct payloads, supporting both basic and complex data types. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Entry Method** & **Tool** & **Result** & **Test Case** & **Time** & **Memory** \\ \hline org.json.XML.toJSONObject & our tool & org.json.XML.toJSONObject -> & & - & 1.2 s & 68 Mb \\  & oss-fuzz & org.json.XML.parse -> org.json.XML.parse & & 658,300,271 & 74 h & 1598 Mb \\ org.json.JSONObject.\(\cdot\)init\textgreater{} & our tool & org.json.JSONObject.\(\cdot\)init\textgreater{} & - & 1.1 s & 54 Mb \\  & oss-fuzz & - & 10,667,353 & 2 h & 1571 Mb \\ jettison.json.JSONObject.\(\cdot\)init\textgreater{} & our tool & jettison.json.JSONObject.\(\cdot\)init\textgreater{} & - & 0.9 s & 42 Mb \\  & oss-fuzz & - & 13,323,686 & 2 h & 930 Mb \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The comparison experiment between our tool and _oss-fuzz_. Note that in this table, _jettison.json.JSONObject.\(\cdot\)init\textgreater{}_ is used to represent _org.codetaus.jettitison.json.JSONObject.\(\cdot\)init\textgreater{}_ due to space constraints. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Tool** & **Vul Type** & **Analytical** & **Approach** & **Results of Static** & **Payload Generation** & **Data Type** \\ \hline Our tool & Space ACV & Bytecode & Static & vulnerable path & Call-chain guided & Basic \& Complex \\ Acquirer & Time ACV & Source code & Hybrid & Potential loop & Symbolic execution & Basic \\ DISCOVER & Loop related & code & Static & View of loop & Fully manual & - \\ Badger & Space \& Time & & & & \\ AVC & & & & & & \\ HotFuzz & Mainly Time & & & & & \\ ACV & & & & & & \\ Revealer & Time ACV & Source code & Hybrid & Potential & Dynamic & Basic \\ SlowFuzz & Time ACV & Resource & & & \\ Usage Info & Dynamic & - & Dynamic & Basic \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The comparison between our tool and state-of-the-art tools in the related field. We also conducted experiments to compare the performance of our tool with _oss-fuzz_. As shown in Table 2, our tool can complete the analysis from a method entry within several seconds, while _oss-fuzz_ requires hours to complete the testing for merely one method (for method XML.toJSONObject of _org.json_, the test was still not completed after 74 h, so we set a two-hour testing duration for the other two methods).