70 citations · 141 across the 37 of their papers we have counts for
13 papers · 1 filter
Effective Construction of Feature Database of Fingerprinting Functions for Code-Clone SCA
Zhiling Zhu, Tieming Chen, Chengwei Liu +5
In contemporary software development, the extensive adoption of third-party libraries has become standard practice to avoid reinventing the wheel. This trend is particularly eviden…
One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability
Fangyuan Zhang, Lyuye Zhang, Lingling Fan +6
Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incre…
Benchmarking Automated Security Patch Backporting: How Far Are We?
Jincheng Yang, Yulong Fu, Chengwei Liu +5
Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools report success rates above 80% on their respective datasets. However, these eval…
Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects
Lyuye Zhang, Chengwei Liu, Fangyuan Zhang +3
As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly de…
Semantic-Enhanced Automatic Refinement of Architecture Recovery Results Using LLMs
Yiran Zhang, Chengwei Liu, Yuqiang Sun +5
Understanding the architecture is crucial for effectively maintaining and managing large software systems. However, discrepancies often exist between the designed and implemented a…
MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
Wenbo Guo, Wei Zeng, Chengwei Liu +5
AI coding agents such as Claude Code and Gemini CLI increasingly extend themselves with third-party skills: markdown packages bundling natural-language instructions, executable scr…
ATLAS: Agentic Taxonomy of Large-Scale Software Ecosystems
Junyi Lu, Mengyao Lyu, Jiahui Wu +6
The open-source ecosystem on GitHub lacks a systematic hierarchical taxonomy of software repositories. GitHub Topics, the dominant organizational mechanism, is flat, inconsistent,…
How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study
Wenbo Guo, Zhongwen Chen, Zhengzi Xu +7
The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on…
From Docs to Descriptions: Smell-Aware Evaluation of MCP Server Descriptions
Peiran Wang, Ying Li, Yuqiang Sun +3
The Model Context Protocol (MCP) has rapidly become a de facto standard for connecting LLM-based agents with external tools via reusable MCP servers. In practice, however, server s…
LogicScan: An LLM-driven Framework for Detecting Business Logic Vulnerabilities in Smart Contracts
Jiaqi Gao, Zijian Zhang, Yuqiang Sun +5
Business logic vulnerabilities have become one of the most damaging yet least understood classes of smart contract vulnerabilities. Unlike traditional bugs such as reentrancy or ar…
ASTRA: Automated Synthesis of agentic Trajectories and Reinforcement Arenas
Xiaoyu Tian, Haotian Wang, Shuaiting Chen +12
Large language models (LLMs) are increasingly used as tool-augmented agents for multi-step decision making, yet training robust tool-using agents remains challenging. Existing meth…
Cutting the Gordian Knot: Detecting Malicious PyPI Packages via a Knowledge-Mining Framework
Wenbo Guo, Chengwei Liu, Ming Kang +5
The Python Package Index (PyPI) has become a target for malicious actors, yet existing detection tools generate false positive rates of 15-30%, incorrectly flagging one-third of le…
Bridging Expert Reasoning and LLM Detection: A Knowledge-Driven Framework for Malicious Packages
Wenbo Guo, Shiwen Song, Jiaxun Guo +5
Open-source ecosystems such as NPM and PyPI are increasingly targeted by supply chain attacks, yet existing detection methods either depend on fragile handcrafted rules or data-dri…