6 papers
Heimdallr: Characterizing and Detecting LLM-Induced Security Risks in GitHub CI Workflows
Bonan Ruan, Yeqi Fu, Chuqi Zhang +3
GitHub Continuous Integration (CI) workflows increasingly integrate Large Language Models (LLMs) to automate review, triage, content generation, and repository maintenance. This cr…
DevOps-Gym: Benchmarking AI Agents in Software DevOps Cycle
Yuheng Tang, Kaijie Zhu, Bonan Ruan +14
Even though demonstrating extraordinary capabilities in code generation and software issue resolving, AI agents' capabilities in the full software DevOps cycle are still unknown. D…
Propagation-Based Vulnerability Impact Assessment for Software Supply Chains
Bonan Ruan, Zhiwei Lin, Jiahao Liu +3
Identifying the impact scope and scale is critical for software supply chain vulnerability assessment. However, existing studies face substantial limitations. First, prior studies…
When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation
Weibo Zhao, Jiahao Liu, Bonan Ruan +2
Model Context Protocol (MCP) servers enable AI applications to connect to external systems in a plug-and-play manner, but their rapid proliferation also introduces severe security…
A Large-Scale Evolvable Dataset for Model Context Protocol Ecosystem and Security Analysis
Zhiwei Lin, Bonan Ruan, Jiahao Liu +1
The Model Context Protocol (MCP) has recently emerged as a standardized interface for connecting language models with external tools and data. As the ecosystem rapidly expands, the…
Fuzzing the PHP Interpreter via Dataflow Fusion
Yuancheng Jiang, Chuqi Zhang, Bonan Ruan +4
PHP, a dominant scripting language in web development, powers a vast range of websites, from personal blogs to major platforms. While existing research primarily focuses on PHP app…