20 citations · 36 across the 9 of their papers we have counts for
7 papers · 1 filter
Persistent Human Feedback, LLMs, and Static Analyzers for Secure Code Generation and Vulnerability Detection
Ehsan Firouzi, Mohammad Ghafari
Existing literature heavily relies on static analysis tools to evaluate LLMs for secure code generation and vulnerability detection. We reviewed 1,080 LLM-generated code samples, b…
Can Developers rely on LLMs for Secure IaC Development?
Ehsan Firouzi, Shardul Bhatt, Mohammad Ghafari
We investigated the capabilities of GPT-4o and Gemini 2.0 Flash for secure Infrastructure as Code (IaC) development. For security smell detection, on the Stack Overflow dataset, wh…
Security Bug Report Prediction Within and Across Projects: A Comparative Study of BERT and Random Forest
Farnaz Soltaniani, Mohammad Ghafari, Mohammed Sayagh
Early detection of security bug reports (SBRs) is crucial for preventing vulnerabilities and ensuring system reliability. While machine learning models have been developed for SBR…
ChatGPT's Potential in Cryptography Misuse Detection: A Comparative Analysis with Static Analysis Tools
Ehsan Firouzi, Mohammad Ghafari, Mike Ebrahimi
The correct adoption of cryptography APIs is challenging for mainstream developers, often resulting in widespread API misuse. Meanwhile, cryptography misuse detectors have demonstr…
From Struggle to Simplicity with a Usable and Secure API for Encryption in Java
Ehsan Firouzi, Ammar Mansuri, Mohammad Ghafari +1
Cryptography misuses are prevalent in the wild. Crypto APIs are hard to use for developers, and static analysis tools do not detect every misuse. We developed SafEncrypt, an API th…
Time to Separate from StackOverflow and Match with ChatGPT for Encryption
Ehsan Firouzi, Mohammad Ghafari
Cryptography is known as a challenging topic for developers. We studied StackOverflow posts to identify the problems that developers encounter when using Java Cryptography Architec…