| 2024 | ICSE | Synthesis of Allowlists for Runtime Protection against SQLi. | Kostyantyn Vorobyov, Franois Gauthier, Padmanabhan Krishnan |
| 2022 | ACSSC | Clustered Graph Federated Personalized Learning. | Franois Gauthier, Vinay Chakravarthi Gogineni, Stefan Werner, Yih-Fang Huang, Anthony Kuh |
| 2022 | COMPSAC | Synthesis of Java Deserialisation Filters from Examples. | Kostyantyn Vorobyov, Franois Gauthier, Sora Bae, Padmanabhan Krishnan, Rebecca O'Donoghue |
| 2022 | ECOOP | Experience: Model-Based, Feedback-Driven, Greybox Web Fuzzing with BackREST. | Franois Gauthier, Behnaz Hassanshahi, Benjamin Selwyn-Smith, Trong Nhan Mai, Max Schlter, Micah Williams |
| 2022 | ICSE | Runtime Prevention of Deserialization Attacks. | Franois Gauthier, Sora Bae |
| 2020 | ACSSC | Privacy-Preserving Distributed Learning with Nonsmooth Objective Functions. | Franois Gauthier, Cristiano Gratton, Naveen K. D. Venkategowda, Stefan Werner |
| 2020 | ICSE | Trade-offs in managing risk and technical debt in industrial research labs: an experience report. | Franois Gauthier, Alexander Jordan, Padmanabhan Krishnan, Behnaz Hassanshahi, Jrn Guy S, Sora Bae, Hyunjun Lee |
| 2019 | CCS | Unacceptable Behavior: Robust PDF Malware Detection Using Abstract Interpretation. | Alexander Jordan, Franois Gauthier, Behnaz Hassanshahi, David Zhao |
| 2018 | ISSTA | AFFOGATO: runtime detection of injection attacks for Node.js. | Franois Gauthier, Behnaz Hassanshahi, Alexander Jordan |
| 2017 | TACAS | Combining String Abstract Domains for JavaScript Analysis: An Evaluation. | Roberto Amadini, Alexander Jordan, Graeme Gange, Franois Gauthier, Peter Schachte, Harald Sndergaard, Peter J. Stuckey, Chenyi Zhang |
| 2016 | CCS | JSPChecker: Static Detection of Context-Sensitive Cross-Site Scripting Flaws in Legacy Web Applications. | Antonn Steinhauser, Franois Gauthier |
| 2013 | ACSAC | Uncovering access control weaknesses and flaws with security-discordant software clones. | Franois Gauthier, Thierry Lavoie, Ettore Merlo |
| 2013 | ICSE | Semantic smells and errors in access control models: a case study in PHP. | Franois Gauthier, Ettore Merlo |
| 2012 | SIGMOD | Targeted genetic test SQL generation for the DB2 database. | Dominic Letarte, Franois Gauthier, Ettore Merlo, Nattavut Sutyanyong, Calisto Zuzarte |
| 2012 | SCAM | Alias-Aware Propagation of Simple Pattern-Based Properties in PHP Applications. | Franois Gauthier, Ettore Merlo |
| 2011 | ICST | Security Model Evolution of PHP Web Applications. | Dominic Letarte, Franois Gauthier, Ettore Merlo |
| 2011 | PST | Extraction and comprehension of moodle's access control model: A case study. | Franois Gauthier, Dominic Letarte, Thierry Lavoie, Ettore Merlo |