17 citations · 31 across the 17 of their papers we have counts for
19 papers
SPIDER4TianoCore: Enhancing Patch-Propagation for the TianoCore UEFI Firmware Development Ecosystem
Laura Baird, Devin Haggitt, Terrance E. Boult +2
We propose and demonstrate SPIDER4TianoCore, a packaged Python command-line tool that provides integration-stage patch-status evidence for the TianoCore/UEFI firmware supply chain.…
An Empirical Study of the TianoCore Community
Nazanin Siavash, Connor Glosner, Ayushi Sharma +4
We investigate the software security and maintenance practices adopted by stakeholders in the TianoCore community and identify opportunities to improve firmware development workflo…
Speed Kills: Exploring Confused Deputy Attacks Through Edge AI Accelerators
Datta Manikanta Sri Hari Danduri, Aravind Kumar Machiry
AI Accelerators (AIAs) are specialized hardware, such as Tensor Processing Units (TPUs), that enable optimal and efficient execution of AI applications and on-device inference. The…
AutoSOUP: Safety-Oriented Unit Proof Generation for Component-level Memory-Safety Verification
Paschal C. Amusuo, Ricardo Calvo, Dharun Anandayuvaraj +5
Memory-safety errors remain a persistent source of zero-day vulnerabilities in low-level software. The problem is especially acute in embedded systems, where hardware protections a…
Reactive Bottom-Up Testing
Siddharth Muralee, Sourag Cherupattamoolayil, James C. Davis +2
Modern computing systems remain rife with software vulnerabilities. Engineers apply many means to detect them, of which dynamic testing is one of the most common and effective. How…
LM-Scout: Analyzing the Security of Language Model Integration in Android Apps
Muhammad Ibrahim, Gűliz Seray Tuncay, Z. Berkay Celik +2
Developers are increasingly integrating Language Models (LMs) into their mobile apps to provide features such as chat-based assistants. To prevent LM misuse, they impose various re…
Do Unit Proofs Work? An Empirical Study of Compositional Bounded Model Checking for Memory Safety Verification
Paschal C. Amusuo, Owen Cochell, Taylor Le Lievre +3
Memory safety defects pose a major threat to software reliability, enabling cyberattacks, outages, and crashes. To mitigate these risks, organizations adopt Compositional Bounded M…
LEMIX: Enabling Testing of Embedded Applications as Linux Applications (Extended Report)
Sai Ritvik Tanksalkar, Siddharth Muralee, Srihari Danduri +4
Dynamic analysis, through rehosting, is an important capability for security assessment in embedded systems software. Existing rehosting techniques aim to provide high-fidelity exe…
Precision Guided Approach to Mitigate Data Poisoning Attacks in Federated Learning
K Naveen Kumar, C Krishna Mohan, Aravind Machiry
Federated Learning (FL) is a collaborative learning paradigm enabling participants to collectively train a shared machine learning model while preserving the privacy of their sensi…
On the effectiveness of Large Language Models for GitHub Workflows
Xinyu Zhang, Siddharth Muralee, Sourag Cherupattamoolayil +1
GitHub workflows or GitHub CI is a popular continuous integration platform that enables developers to automate various software engineering tasks by specifying them as workflows, i…
Rust for Embedded Systems: Current State, Challenges and Open Problems (Extended Report)
Ayushi Sharma, Shashank Sharma, Santiago Torres-Arias +1
Embedded software is used in safety-critical systems such as medical devices and autonomous vehicles, where software defects, including security vulnerabilities, have severe conseq…
ZTD: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies
Paschal C. Amusuo, Kyle A. Robinson, Tanmay Singla +5
Third-party libraries like Log4j accelerate software application development but introduce substantial risk. Vulnerabilities in these libraries have led to Software Supply Chain (S…
Finding 709 Defects in 258 Projects: An Experience Report on Applying CodeQL to Open-Source Embedded Software (Experience Paper) -- Extended Report
Mingjie Shen, Akul Abhilash Pillai, Brian A. Yuan +2
In this experience paper, we report on a large-scale empirical study of Static Application Security Testing (SAST) in Open-Source Embedded Software (EMBOSS) repositories. We collec…
Systematically Detecting Packet Validation Vulnerabilities in Embedded Network Stacks
Paschal C. Amusuo, Ricardo Andrés Calvo Méndez, Zhongwei Xu +2
Embedded Network Stacks (ENS) enable low-resource devices to communicate with the outside world, facilitating the development of the Internet of Things and Cyber-Physical Systems.…
CheckedCBox: Type Directed Program Partitioning with Checked C for Incremental Spatial Memory Safety
Liyi Li, Arunkumar Bhattar, Le Chang +2
Spatial memory safety violation is still a major issue for C programs. Checked-C is a safe dialect of C and extends it with Checked pointer types and annotations that guarantee spa…
Cornucopia: A Framework for Feedback Guided Generation of Binaries
Vidush Singhal, Akul Abhilash Pillai, Charitha Saumya +2
Binary analysis is an important capability required for many security and software engineering applications. Consequently, there are many binary analysis techniques and tools with…
C to Checked C by 3C
Aravind Machiry, John Kastner, Matt McCutchen +3
Owing to the continued use of C (and C++), spatial safety violations (e.g., buffer overflows) still constitute one of today's most dangerous and prevalent security vulnerabilities.…
Toward a Secure Crowdsourced Location Tracking System
Chinmay Garg, Aravind Machiry, Andrea Continella +2
Low-energy Bluetooth devices have become ubiquitous and widely used for different applications. Among these, Bluetooth trackers are becoming popular as they allow users to track th…
Detecting Deceptive Reviews using Generative Adversarial Networks
Hojjat Aghakhani, Aravind Machiry, Shirin Nilizadeh +2
In the past few years, consumer review sites have become the main target of deceptive opinion spam, where fictitious opinions or reviews are deliberately written to sound authentic…