135 citations · 153 across the 17 of their papers we have counts for
19 papers
VulContextBench: A Benchmark for Security Context Retrieval in Coding Agents
Yikun Li, Jinfeng Jiang, Yuheng Yieh +6
Vulnerability-detection benchmarks score the verdict an agent reaches, not the evidence it gathered. A model that recalls a CVE from pretraining therefore scores the same as one th…
CoSA: Context-Aware Severity Assessment via Context Analysis with Large Language Models
Jinfeng Jiang, Yikun Li, Chengran Yang +6
Accurate vulnerability severity assessment is essential for prioritizing remediation, yet manually assessing Common Vulnerability Scoring System (CVSS) base metrics remains labor-i…
Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection
Yikun Li, Ting Zhang, Jiakun Liu +9
Real-world vulnerabilities often span multiple functions, yet most learning-based detectors classify each function in isolation: on a sample of real CVEs, we find that 71.7% of vul…
An Execution-Verified Multi-Language Benchmark for Code Semantic Reasoning
Yikun Li, Jinfeng Jiang, Ting Zhang +7
Evaluating whether large language models (LLMs) can recover execution-relevant program structure, rather than only produce code that passes tests, remains an open problem. Existing…
TitanCA: Lessons from Orchestrating LLM Agents to Discover 100+ CVEs
Ting Zhang, Yikun Li, Chengran Yang +15
Software vulnerabilities remain one of the most persistent threats to modern digital infrastructure. While static application security testing (SAST) tools have long served as the…
Revisiting Vulnerability Patch Identification on Data in the Wild
Ivana Clairine Irsan, Ratnadira Widyasari, Ting Zhang +7
Attacks can exploit zero-day or one-day vulnerabilities that are not publicly disclosed. To detect these vulnerabilities, security researchers monitor development activities in ope…
Beyond Function-Level Analysis: Context-Aware Reasoning for Inter-Procedural Vulnerability Detection
Yikun Li, Ting Zhang, Jieke Shi +10
Recent progress in ML and LLMs has improved vulnerability detection, and recent datasets have reduced label noise and unrelated code changes. However, most existing approaches stil…
PenForge: On-the-Fly Expert Agent Construction for Automated Penetration Testing
Huihui Huang, Jieke Shi, Junkai Chen +6
Penetration testing is essential for identifying vulnerabilities in web applications before real adversaries can exploit them. Recent work has explored automating this process with…
Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework
Chengran Yang, Ting Zhang, Jinfeng Jiang +9
Current learning-based Automated Vulnerability Repair (AVR) approaches, while promising, often fail to generalize effectively in real-world scenarios. Our diagnostic analysis revea…
Out of Distribution, Out of Luck: How Well Can LLMs Trained on Vulnerability Datasets Detect Top 25 CWE Weaknesses?
Yikun Li, Ngoc Tan Bui, Ting Zhang +16
Automated vulnerability detection research has made substantial progress, yet its real-world impact remains limited. Prior work found that current vulnerability datasets suffer fro…
Back to the Basics: Rethinking Issue-Commit Linking with LLM-Assisted Retrieval
Huihui Huang, Ratnadira Widyasari, Ting Zhang +8
Issue-commit linking, which connects issues with commits that fix them, is crucial for software maintenance. Existing approaches have shown promise in automatically recovering thes…
Let the Trial Begin: A Mock-Court Approach to Vulnerability Detection using LLM-Based Agents
Ratnadira Widyasari, Martin Weyssow, Ivana Clairine Irsan +6
Detecting vulnerabilities in source code remains a critical yet challenging task, especially when benign and vulnerable functions share significant similarities. In this work, we i…
R2Vul: Learning to Reason about Software Vulnerabilities with Reinforcement Learning and Structured Reasoning Distillation
Martin Weyssow, Chengran Yang, Junkai Chen +12
Large language models (LLMs) have shown promising performance in software vulnerability detection, yet their reasoning capabilities remain unreliable. We propose R2Vul, a method th…
Benchmarking Large Language Models for Multi-Language Software Vulnerability Detection
Ting Zhang, Chengran Yang, Yindu Su +8
Recent advancements in generative AI have led to the widespread adoption of large language models (LLMs) in software engineering, addressing numerous long-standing challenges. Howe…
CleanVul: Automatic Function-Level Vulnerability Detection in Code Commits Using LLM Heuristics
Yikun Li, Ting Zhang, Ratnadira Widyasari +13
Accurate identification of software vulnerabilities is crucial for system integrity. Vulnerability datasets, often derived from the National Vulnerability Database (NVD) or directl…
BugsInPy: A Database of Existing Bugs in Python Programs to Enable Controlled Testing and Debugging Studies
Ratnadira Widyasari, Sheng Qin Sim, Camellia Lok +13
The 2019 edition of Stack Overflow developer survey highlights that, for the first time, Python outperformed Java in terms of popularity. The gap between Python and Java further wi…
ChatGPT, Can You Generate Solutions for my Coding Exercises? An Evaluation on its Effectiveness in an undergraduate Java Programming Course
Eng Lieh Ouh, Benjamin Kok Siew Gan, Kyong Jin Shim +1
In this study, we assess the efficacy of employing the ChatGPT language model to generate solutions for coding exercises within an undergraduate Java programming course. ChatGPT, a…
Are you cloud-certified? Preparing Computing Undergraduates for Cloud Certification with Experiential Learning
Eng Lieh Ouh, Benjamin Kok Siew Gan
Cloud Computing skills have been increasing in demand. Many software engineers are learning these skills and taking cloud certification examinations to be job competitive. Preparin…
ITSS: Interactive Web-Based Authoring and Playback Integrated Environment for Programming Tutorials
Eng Lieh Ouh, Benjamin Kok Siew Gan, David Lo
Video-based programming tutorials are a popular form of tutorial used by authors to guide learners to code. Still, the interactivity of these videos is limited primarily to control…