27 citations · 66 across the 15 of their papers we have counts for
16 papers
A Large-Scale Exploit Instrumentation Study of AI/ML Supply Chain Attacks in Hugging Face Models
Beatrice Casey, Joanna C. S. Santos, Mehdi Mirakhorli
The development of machine learning (ML) techniques has led to ample opportunities for developers to develop and deploy their own models. Hugging Face serves as an open source plat…
Lessons from the Use of Natural Language Inference (NLI) in Requirements Engineering Tasks
Mohamad Fazelnia, Viktoria Koscinski, Spencer Herzog +1
We investigate the use of Natural Language Inference (NLI) in automating requirements engineering tasks. In particular, we focus on three tasks: requirements classification, identi…
IPSynth: Interprocedural Program Synthesis for Software Security Implementation
Ali Shokri, Ibrahim Jameel Mujhid, Mehdi Mirakhorli
To implement important quality attributes of software such as architectural security tactics, developers incorporate API of software frameworks, as building blocks, to avoid re-inv…
A Landscape Study of Open Source and Proprietary Tools for Software Bill of Materials (SBOM)
Mehdi Mirakhorli, Derek Garcia, Schuyler Dillon +5
Modern software applications heavily rely on diverse third-party components, libraries, and frameworks sourced from various vendors and open source repositories, presenting a compl…
Seneca: Taint-Based Call Graph Construction for Java Object Deserialization
Joanna C. S. Santos, Mehdi Mirakhorli, Ali Shokri
Object serialization and deserialization are widely used for storing and preserving objects in files, memory, or database as well as for transporting them across machines, enabling…
A Novel Approach to Identify Security Controls in Source Code
Ahmet Okutan, Ali Shokri, Viktoria Koscinski +2
Secure by Design has become the mainstream development approach ensuring that software systems are not vulnerable to cyberattacks. Architectural security controls need to be carefu…
Supporting AI/ML Security Workers through an Adversarial Techniques, Tools, and Common Knowledge (AI/ML ATT&CK) Framework
Mohamad Fazelnia, Ahmet Okutan, Mehdi Mirakhorli
This paper focuses on supporting AI/ML Security Workers -- professionals involved in the development and deployment of secure AI-enabled software systems. It presents AI/ML Adversa…
Attacks, Defenses, And Tools: A Framework To Facilitate Robust AI/ML Systems
Mohamad Fazelnia, Igor Khokhlov, Mehdi Mirakhorli
Software systems are increasingly relying on Artificial Intelligence (AI) and Machine Learning (ML) components. The emerging popularity of AI techniques in various application doma…
A Grounded Theory Based Approach to Characterize Software Attack Surfaces
Sara Moshtari, Ahmet Okutan, Mehdi Mirakhorli
The notion of Attack Surface refers to the critical points on the boundary of a software system which are accessible from outside or contain valuable content for attackers. The abi…
DepRes: A Tool for Resolving Fully Qualified Names and Their Dependencies
Ali Shokri, Mehdi Mirakhorli
Reusing code snippets shared by other programmers on Q&A forums (e.g., StackOverflow) is a common practice followed by software developers. However, lack of sufficient information…
ArCode: A Tool for Supporting Comprehension andImplementation of Architectural Concerns
Ali Shokri, Mehdi Mirakhorli
Integrated development environments (IDE) play an important role in supporting developers during program comprehension and completion. Many of these supportive features focus on lo…
ArCode: Facilitating the Use of Application Frameworks to Implement Tactics and Patterns
Ali Shokri, Joanna C. S. Santos, Mehdi Mirakhorli
Software designers and developers are increasingly relying on application frameworks as first-class design concepts. They instantiate the services that frameworks provide to implem…
Did You Remember to Test Your Tokens?
Danielle Gonzalez, Michael Rath, Mehdi Mirakhorli
Authentication is a critical security feature for confirming the identity of a system's users, typically implemented with help from frameworks like Spring Security. It is a complex…
Automated Characterization of Software Vulnerabilities
Danielle Gonzalez, Holly Hastings, Mehdi Mirakhorli
Preventing vulnerability exploits is a critical software maintenance task, and software engineers often rely on Common Vulnerability and Exposure (CVEs) reports for information abo…
A Fine-Grained Approach for Automated Conversion of JUnit Assertions to English
Danielle Gonzalez, Suzanne Prentice, Mehdi Mirakhorli
Converting source or unit test code to English has been shown to improve the maintainability, understandability, and analysis of software and tests. Code summarizers identify impor…
A Large-Scale Study on the Usage of Testing Patterns that Address Maintainability Attributes (Patterns for Ease of Modification, Diagnoses, and Comprehension)
Danielle Gonzalez, Joanna C. S. Santos, Andrew Popovich +2
Test case maintainability is an important concern, especially in open source and distributed development environments where projects typically have high contributor turnover with v…