19 citations · 49 across the 20 of their papers we have counts for
19 papers · 1 filter
One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability
Fangyuan Zhang, Lyuye Zhang, Lingling Fan +6
Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incre…
Benchmarking Automated Security Patch Backporting: How Far Are We?
Jincheng Yang, Yulong Fu, Chengwei Liu +5
Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools report success rates above 80% on their respective datasets. However, these eval…
Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects
Lyuye Zhang, Chengwei Liu, Fangyuan Zhang +3
As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly de…
Latent Reuse in Agent Skills: Multi-modal Clone Detection at Ecosystem Scale
Jiaying Zhu, Lyuye Zhang, Wenbo Guo +1
An agent skill is a reusable package for extending an LLM agent, typically a SKILL.md file that combines YAML metadata, natural-language instructions, and executable code. Public r…
Minimizing Breaking Changes and Redundancy in Mitigating Technical Lag for Java Projects
Rui Lu, Lyuye Zhang, Kaixuan Li +2
Re-using open-source software (OSS) can avoid reinventing the wheel, but failing to keep it up-to-date can lead to missing new features and persistent bugs or vulnerabilities that…
Real-World Usability of Vulnerability Proof-of-Concepts: A Comprehensive Study
Wenjing Dang, Kaixuan Li, Sen Chen +3
The Proof-of-Concept (PoC) for a vulnerability is crucial in validating its existence, mitigating false positives, and illustrating the severity of the security threat it poses. Ho…
A Systematic Study on Generating Web Vulnerability Proof-of-Concepts Using Large Language Models
Mengyao Zhao, Kaixuan Li, Lyuye Zhang +4
Recent advances in Large Language Models (LLMs) have brought remarkable progress in code understanding and reasoning, creating new opportunities and raising new concerns for softwa…
A Taxonomy of Prompt Defects in LLM Systems
Haoye Tian, Chong Wang, BoYang Yang +2
Large Language Models (LLMs) have become key components of modern software, with prompts acting as their de-facto programming interface. However, prompt design remains largely empi…
JC-Finder: Detecting Java Clone-based Third-Party Library by Class-level Tree Analysis
Lida Zhao, Chaofan Li, Yueming Wu +10
While reusing third-party libraries (TPL) facilitates software development, its chaotic management has brought great threats to software maintenance and the unauthorized use of sou…
VFArchē: A Dual-Mode Framework for Locating Vulnerable Functions in Open-Source Software
Lyuye Zhang, Jian Zhang, Kaixuan Li +6
Software Composition Analysis (SCA) has become pivotal in addressing vulnerabilities inherent in software project dependencies. In particular, reachability analysis is increasingly…
Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management
Lyuye Zhang, Jiahui Wu, Chengwei Liu +5
In the rapidly evolving landscape of software development, addressing security vulnerabilities in open-source software (OSS) has become critically important. However, existing rese…
Drop the Golden Apples: Identifying Third-Party Reuse by DB-Less Software Composition Analysis
Lyuye Zhang, Chengwei Liu, Jiahui Wu +5
The prevalent use of third-party libraries (TPLs) in modern software development introduces significant security and compliance risks, necessitating the implementation of Software…
Detecting Essence Code Clones via Information Theoretic Analysis
Lida Zhao, Shihan Dou, Yutao Hu +8
Code cloning, a widespread practice in software development, involves replicating code fragments to save time but often at the expense of software maintainability and quality. In t…
LLMs Meet Library Evolution: Evaluating Deprecated API Usage in LLM-based Code Completion
Chong Wang, Kaifeng Huang, Jian Zhang +4
Large language models (LLMs), pre-trained or fine-tuned on large code corpora, have shown effectiveness in generating code completions. However, in LLM-based code completion, LLMs…
ACFIX: Guiding LLMs with Mined Common RBAC Practices for Context-Aware Repair of Access Control Vulnerabilities in Smart Contracts
Lyuye Zhang, Kaixuan Li, Kairan Sun +4
Smart contracts are susceptible to various security issues, among which access control (AC) vulnerabilities are particularly critical. While existing research has proposed multiple…
Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem
Jinchang Hu, Lyuye Zhang, Chengwei Liu +3
Open-source software (OSS) greatly facilitates program development for developers. However, the high number of vulnerabilities in open-source software is a major concern, including…
Mitigating Persistence of Open-Source Vulnerabilities in Maven Ecosystem
Lyuye Zhang, Chengwei Liu, Sen Chen +5
Vulnerabilities from third-party libraries (TPLs) have been unveiled to threaten the Maven ecosystem. Despite patches being released promptly after vulnerabilities are disclosed, t…
Compatible Remediation on Vulnerabilities from Third-Party Libraries for Java Projects
Lyuye Zhang, Chengwei Liu, Zhengzi Xu +5
With the increasing disclosure of vulnerabilities in open-source software, software composition analysis (SCA) has been widely applied to reveal third-party libraries and the assoc…
Has My Release Disobeyed Semantic Versioning? Static Detection Based on Semantic Differencing
Lyuye Zhang, Chengwei Liu, Zhengzi Xu +4
To enhance the compatibility in the version control of Java Third-party Libraries (TPLs), Maven adopts Semantic Versioning (SemVer) to standardize the underlying meaning of version…