7 citations · 11 across the 10 of their papers we have counts for
12 papers
No Snake Oil: Verifying Python Package Builds
Jens Dietrich, Spencer Sun, Tim W. White +1
Python has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index (PyPI). This creates a need to anal…
On the Variability of Source Code in Maven Package Rebuilds
Jens Dietrich, Behnaz Hassanshahi
Rebuilding packages from open source is a common practice to improve the security of software supply chains, and is now done at an industrial scale. The basic principle is to acqui…
AgentHub: A Registry for Discoverable, Verifiable, and Reproducible AI Agents
Erik Pautsch, Tanmay Singla, Parv Kumar +6
LLM-based agents are rapidly proliferating, yet the infrastructure for discovering, evaluating, and governing them remains fragmented compared to mature ecosystems like software pa…
Unlocking Reproducibility: Automating re-Build Process for Open-Source Software
Behnaz Hassanshahi, Trong Nhan Mai, Benjamin Selwyn Smith +1
Software ecosystems like Maven Central play a crucial role in modern software supply chains by providing repositories for libraries and build plugins. However, the separation betwe…
DALEQ -- Explainable Equivalence for Java Bytecode
Jens Dietrich, Behnaz Hassanshahi
The security of software builds has attracted increased attention in recent years in response to incidents like solarwinds and xz. Now, several companies including Oracle and Googl…
Practical Type-Based Taint Checking and Inference (Extended Version)
Nima Karimipour, Kanak Das, Manu Sridharan +1
Many important security properties can be formulated in terms of flows of tainted data, and improved taint analysis tools to prevent such flows are of critical need. Most existing…
Levels of Binary Equivalence for the Comparison of Binaries from Alternative Builds
Jens Dietrich, Tim White, Behnaz Hassanshahi +1
In response to challenges in software supply chain security, several organisations have created infrastructures to independently build commodity open source projects and release th…
Automatic Root Cause Quantification for Missing Edges in JavaScript Call Graphs (Extended Version)
Madhurima Chakraborty, Renzo Olivares, Manu Sridharan +1
Building sound and precise static call graphs for real-world JavaScript applications poses an enormous challenge, due to many hard-to-analyze language features. Further, the relati…
BackREST: A Model-Based Feedback-Driven Greybox Fuzzer for Web Applications
François Gauthier, Behnaz Hassanshahi, Benjamin Selwyn-Smith +3
Following the advent of the American Fuzzy Lop (AFL), fuzzing had a surge in popularity, and modern day fuzzers range from simple blackbox random input generators to complex whiteb…
Coding Practices and Recommendations of Spring Security for Enterprise Applications
Mazharul Islam, Sazzadur Rahaman, Na Meng +4
Spring security is tremendously popular among practitioners for its ease of use to secure enterprise applications. In this paper, we study the application framework misconfiguratio…
Gelato: Feedback-driven and Guided Security Analysis of Client-side Web Applications
Behnaz Hassanshahi, Hyunjun Lee, Paddy Krishnan +1
Even though a lot of effort has been invested in analyzing client-side web applications during the past decade, the existing tools often fail to deal with the complexity of modern…
SAFE-PDF: Robust Detection of JavaScript PDF Malware Using Abstract Interpretation
Alexander Jordan, François Gauthier, Behnaz Hassanshahi +1
The popularity of the PDF format and the rich JavaScript environment that PDF viewers offer make PDF documents an attractive attack vector for malware developers. PDF documents pre…