52 citations · 90 across the 10 of their papers we have counts for
10 papers
Example-Based Vulnerability Detection and Repair in Java Code
Ying Zhang, Ya Xiao, Md Mahir Asef Kabir +3
The Java libraries JCA and JSSE offer cryptographic APIs to facilitate secure coding. When developers misuse some of the APIs, their code becomes vulnerable to cyber-attacks. To el…
Privacy Guarantees of BLE Contact Tracing: A Case Study on COVIDWISE
Salman Ahmed, Ya Xiao, Taejoong +5
Google and Apple jointly introduced a digital contact tracing technology and an API called "exposure notification," to help health organizations and governments with contact tracin…
Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks
Sharmin Afrose, Ya Xiao, Sazzadur Rahaman +3
Several studies showed that misuses of cryptographic APIs are common in real-world code (e.g., Apache projects and Android apps). There exist several open-sourced and commercial se…
Embedding Code Contexts for Cryptographic API Suggestion:New Methodologies and Comparisons
Ya Xiao, Salman Ahmed, Wenjia Song +3
Despite recent research efforts, the vision of automatic code generation through API recommendation has not been realized. Accuracy and expressiveness challenges of API recommendat…
Data-Driven Vulnerability Detection and Repair in Java Code
Ying Zhang, Mahir Kabir, Ya Xiao +3
Java platform provides various APIs to facilitate secure coding. However, correctly using security APIs is usually challenging for developers who lack cybersecurity training. Prior…
Industrial Experience of Finding Cryptographic Vulnerabilities in Large-scale Codebases
Ya Xiao, Yang Zhao, Nicholas Allen +4
Enterprise environment often screens large-scale (millions of lines of code) codebases with static analysis tools to find bugs and vulnerabilities. Parfait is a static code analysi…
Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities
Yuan Luo, Ya Xiao, Long Cheng +2
Anomaly detection is crucial to ensure the security of cyber-physical systems (CPS). However, due to the increasing complexity of CPSs and more sophisticated attacks, conventional…
Neural Cryptanalysis: Metrics, Methodology, and Applications in CPS Ciphers
Ya Xiao, Qingying Hao, Danfeng +1
Many real-world cyber-physical systems (CPS) use proprietary cipher algorithms. In this work, we describe an easy-to-use black-box security evaluation approach to measure the stren…
Methodologies for Quantifying (Re-)randomization Security and Timing under JIT-ROP
Salman Ahmed, Ya Xiao, Gang Tan +4
Just-in-time return-oriented programming (JIT-ROP) allows one to dynamically discover instruction pages and launch code reuse attacks, effectively bypassing most fine-grained addre…
CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects
Sazzadur Rahaman, Ya Xiao, Sharmin Afrose +6
Cryptographic API misuses, such as exposed secrets, predictable random numbers, and vulnerable certificate verification, seriously threaten software security. The vision of automat…