Bernhard Scholz

Bernhard helped make rule-based software analysis practical for substantial codebases through Soufflé. The paper documents its use at Oracle Labs for Java security analyses and demonstrates its performance on OpenJDK7. Its open-source, reusable engine gives analysis developers a way to build and customise correctness and vulnerability checks while reducing the infrastructure work needed to run them efficiently.

Bernhard Scholz is Chief Research Officer at Sonic Labs and Professor at the University of Sydney. Alongside collaborators, Bernhard created Soufflé, an open-source framework for static program analysis that bridges programming language theory with practical tools for checking large codebases. Soufflé enables engineers to express analyses in Datalog and translates those specifications into high-performance executable C++ code.

The foundational Soufflé paper, co-authored with Herbert Jordan and Pavle Subotić, reports deployment at Oracle Labs for Java security analyses and demonstrates points-to analysis across the OpenJDK7 library in under a minute. This approach pairs concise analysis rules with execution speeds rivaling bespoke, hand-crafted tools. For software quality, the framework offers a reusable foundation, allowing engineers to craft and customise checks without building a dedicated analysis engine from scratch. Wider research projects explore language implementation, vulnerability detection and formal verification.