7 papers
The Language of Security: How Prompt Syntax Shapes Secure Code Generation in Open LLMs
Matteo Cicalese, Antonio Della Porta, Stefano Lambiase +4
Large Language Models (LLMs) are increasingly used for source code generation despite their outputs often exhibiting security vulnerabilities. Prior work shows that prompt engineer…
Security Concerns in Generative AI Coding Assistants: Insights from Online Discussions on GitHub Copilot
Nicolás E. Díaz Ferreyra, Monika Swetha Gurupathi, Zadia Codabux +2
Generative Artificial Intelligence (GenAI) has become a central component of many development tools (e.g., GitHub Copilot) that support software practitioners across multiple progr…
Reading Between the Code Lines: On the Use of Self-Admitted Technical Debt for Security Analysis
Nicolás E. Díaz Ferreyra, Moritz Mock, Max Kretschmann +4
Static Analysis Tools (SATs) are central to security engineering activities, as they enable early identification of code weaknesses without requiring execution. However, their effe…
A Systematic Literature Review on Automated Exploit and Security Test Generation
Quang-Cuong Bui, Emanuele Iannone, Maria Camporese +7
The exploit or the Proof of Concept of the vulnerability plays an important role in developing superior vulnerability repair techniques, as it can be used as an oracle to verify th…
A Match Made in Heaven? AI-driven Matching of Vulnerabilities and Security Unit Tests
Emanuele Iannone, Quang-Cuong Bui, Riccardo Scandariato
Software vulnerabilities are often detected via taint analysis, penetration testing, or fuzzing. They are also found via unit tests that exercise security-sensitive behavior with s…
Managing Security Evidence in Safety-Critical Organizations
Mazen Mohamad, Jan-Philipp Steghöfer, Eric Knauss +1
With the increasing prevalence of open and connected products, cybersecurity has become a serious issue in safety-critical domains such as the automotive industry. As a result, reg…
What Can Self-Admitted Technical Debt Tell Us About Security? A Mixed-Methods Study
Nicolás E. Díaz Ferreyra, Mojtaba Shahin, Mansooreh Zahedi +2
Self-Admitted Technical Debt (SATD) encompasses a wide array of sub-optimal design and implementation choices reported in software artefacts (e.g., code comments and commit message…