70 citations · 141 across the 37 of their papers we have counts for
41 papers
Effective Construction of Feature Database of Fingerprinting Functions for Code-Clone SCA
Zhiling Zhu, Tieming Chen, Chengwei Liu +5
In contemporary software development, the extensive adoption of third-party libraries has become standard practice to avoid reinventing the wheel. This trend is particularly eviden…
One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability
Fangyuan Zhang, Lyuye Zhang, Lingling Fan +6
Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incre…
Benchmarking Automated Security Patch Backporting: How Far Are We?
Jincheng Yang, Yulong Fu, Chengwei Liu +5
Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools report success rates above 80% on their respective datasets. However, these eval…
Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects
Lyuye Zhang, Chengwei Liu, Fangyuan Zhang +3
As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly de…
Semantic-Enhanced Automatic Refinement of Architecture Recovery Results Using LLMs
Yiran Zhang, Chengwei Liu, Yuqiang Sun +5
Understanding the architecture is crucial for effectively maintaining and managing large software systems. However, discrepancies often exist between the designed and implemented a…
MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
Wenbo Guo, Wei Zeng, Chengwei Liu +5
AI coding agents such as Claude Code and Gemini CLI increasingly extend themselves with third-party skills: markdown packages bundling natural-language instructions, executable scr…
ATLAS: Agentic Taxonomy of Large-Scale Software Ecosystems
Junyi Lu, Mengyao Lyu, Jiahui Wu +6
The open-source ecosystem on GitHub lacks a systematic hierarchical taxonomy of software repositories. GitHub Topics, the dominant organizational mechanism, is flat, inconsistent,…
How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study
Wenbo Guo, Zhongwen Chen, Zhengzi Xu +7
The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on…
From Docs to Descriptions: Smell-Aware Evaluation of MCP Server Descriptions
Peiran Wang, Ying Li, Yuqiang Sun +3
The Model Context Protocol (MCP) has rapidly become a de facto standard for connecting LLM-based agents with external tools via reusable MCP servers. In practice, however, server s…
LogicScan: An LLM-driven Framework for Detecting Business Logic Vulnerabilities in Smart Contracts
Jiaqi Gao, Zijian Zhang, Yuqiang Sun +5
Business logic vulnerabilities have become one of the most damaging yet least understood classes of smart contract vulnerabilities. Unlike traditional bugs such as reentrancy or ar…
ASTRA: Automated Synthesis of agentic Trajectories and Reinforcement Arenas
Xiaoyu Tian, Haotian Wang, Shuaiting Chen +12
Large language models (LLMs) are increasingly used as tool-augmented agents for multi-step decision making, yet training robust tool-using agents remains challenging. Existing meth…
Cutting the Gordian Knot: Detecting Malicious PyPI Packages via a Knowledge-Mining Framework
Wenbo Guo, Chengwei Liu, Ming Kang +5
The Python Package Index (PyPI) has become a target for malicious actors, yet existing detection tools generate false positive rates of 15-30%, incorrectly flagging one-third of le…
Bridging Expert Reasoning and LLM Detection: A Knowledge-Driven Framework for Malicious Packages
Wenbo Guo, Shiwen Song, Jiaxun Guo +5
Open-source ecosystems such as NPM and PyPI are increasingly targeted by supply chain attacks, yet existing detection methods either depend on fragile handcrafted rules or data-dri…
Evolaris: A Roadmap to Self-Evolving Software Intelligence Management
Chengwei Liu, Wenbo Guo, Yuxin Zhang +4
In recent years, the landscape of software threats has become significantly more dynamic and distributed. Security vulnerabilities are no longer discovered and shared only through…
Vulnerability-Affected Versions Identification: How Far Are We?
Xingchu Chen, Chengwei Liu, Jialun Cao +6
Identifying which software versions are affected by a vulnerability is critical for patching, risk mitigation. Despite a growing body of tools, their real-world effectiveness remai…
Open Source, Hidden Costs: A Systematic Literature Review on OSS License Management
Boyuan Li, Chengwei Liu, Lingling Fan +3
Integrating third-party software components is a common practice in modern software development, offering significant advantages in terms of efficiency and innovation. However, thi…
VFArchē: A Dual-Mode Framework for Locating Vulnerable Functions in Open-Source Software
Lyuye Zhang, Jian Zhang, Kaixuan Li +6
Software Composition Analysis (SCA) has become pivotal in addressing vulnerabilities inherent in software project dependencies. In particular, reachability analysis is increasingly…
Causality-aware Safety Testing for Autonomous Driving Systems
Wenbing Tang, Mingfei Cheng, Renzhi Wang +4
Simulation-based testing is essential for evaluating the safety of Autonomous Driving Systems (ADSs). Comprehensive evaluation requires testing across diverse scenarios that can tr…
Doctor: Optimizing Container Rebuild Efficiency by Instruction Re-Orchestration
Zhiling Zhu, Tieming Chen, Chengwei Liu +4
Containerization has revolutionized software deployment, with Docker leading the way due to its ease of use and consistent runtime environment. As Docker usage grows, optimizing Do…
A Vision for Auto Research with LLM Agents
Chengwei Liu, Chong Wang, Jiayue Cao +16
This paper introduces Agent-Based Auto Research, a structured multi-agent framework designed to automate, coordinate, and optimize the full lifecycle of scientific research. Levera…
A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment
Kun Wang, Guibin Zhang, Zhenhong Zhou +100
The remarkable success of Large Language Models (LLMs) has illuminated a promising pathway toward achieving Artificial General Intelligence for both academic and industrial communi…
Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management
Lyuye Zhang, Jiahui Wu, Chengwei Liu +5
In the rapidly evolving landscape of software development, addressing security vulnerabilities in open-source software (OSS) has become critically important. However, existing rese…
Drop the Golden Apples: Identifying Third-Party Reuse by DB-Less Software Composition Analysis
Lyuye Zhang, Chengwei Liu, Jiahui Wu +5
The prevalent use of third-party libraries (TPLs) in modern software development introduces significant security and compliance risks, necessitating the implementation of Software…
IntelliRadar: A Comprehensive Platform to Pinpoint Malicious Package Information from Cyber Intelligence
Wenbo Guo, Chengwei Liu, Limin Wang +4
Malicious packages in public registries pose serious threats to software supply chain security. While current software component analysis (SCA) tools rely on databases like OSV and…