47 citations · 56 across the 21 of their papers we have counts for
22 papers
VulContextBench: A Benchmark for Security Context Retrieval in Coding Agents
Yikun Li, Jinfeng Jiang, Yuheng Yieh +6
Vulnerability-detection benchmarks score the verdict an agent reaches, not the evidence it gathered. A model that recalls a CVE from pretraining therefore scores the same as one th…
CoSA: Context-Aware Severity Assessment via Context Analysis with Large Language Models
Jinfeng Jiang, Yikun Li, Chengran Yang +6
Accurate vulnerability severity assessment is essential for prioritizing remediation, yet manually assessing Common Vulnerability Scoring System (CVSS) base metrics remains labor-i…
Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection
Yikun Li, Ting Zhang, Jiakun Liu +9
Real-world vulnerabilities often span multiple functions, yet most learning-based detectors classify each function in isolation: on a sample of real CVEs, we find that 71.7% of vul…
An Execution-Verified Multi-Language Benchmark for Code Semantic Reasoning
Yikun Li, Jinfeng Jiang, Ting Zhang +7
Evaluating whether large language models (LLMs) can recover execution-relevant program structure, rather than only produce code that passes tests, remains an open problem. Existing…
TitanCA: Lessons from Orchestrating LLM Agents to Discover 100+ CVEs
Ting Zhang, Yikun Li, Chengran Yang +15
Software vulnerabilities remain one of the most persistent threats to modern digital infrastructure. While static application security testing (SAST) tools have long served as the…
Revisiting Vulnerability Patch Identification on Data in the Wild
Ivana Clairine Irsan, Ratnadira Widyasari, Ting Zhang +7
Attacks can exploit zero-day or one-day vulnerabilities that are not publicly disclosed. To detect these vulnerabilities, security researchers monitor development activities in ope…
Beyond Function-Level Analysis: Context-Aware Reasoning for Inter-Procedural Vulnerability Detection
Yikun Li, Ting Zhang, Jieke Shi +10
Recent progress in ML and LLMs has improved vulnerability detection, and recent datasets have reduced label noise and unrelated code changes. However, most existing approaches stil…
PenForge: On-the-Fly Expert Agent Construction for Automated Penetration Testing
Huihui Huang, Jieke Shi, Junkai Chen +6
Penetration testing is essential for identifying vulnerabilities in web applications before real adversaries can exploit them. Recent work has explored automating this process with…
GenSIaC: Toward Security-Aware Infrastructure-as-Code Generation with Large Language Models
Yikun Li, Matteo Grella, Daniel Nahmias +5
In recent years, Infrastructure as Code (IaC) has emerged as a critical approach for managing and provisioning IT infrastructure through code and automation. IaC enables organizati…
Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework
Chengran Yang, Ting Zhang, Jinfeng Jiang +9
Current learning-based Automated Vulnerability Repair (AVR) approaches, while promising, often fail to generalize effectively in real-world scenarios. Our diagnostic analysis revea…
PatchSeeker: Mapping NVD Records to their Vulnerability-fixing Commits with LLM Generated Commits and Embeddings
Huu Hung Nguyen, Anh Tuan Nguyen, Thanh Le-Cong +8
Software vulnerabilities pose serious risks to modern software ecosystems. While the National Vulnerability Database (NVD) is the authoritative source for cataloging these vulnerab…
SecureVibeBench: Benchmarking Secure Vibe Coding of AI Agents via Reconstructing Vulnerability-Introducing Scenarios
Junkai Chen, Huihui Huang, Yunbo Lyu +10
Large language model-powered code agents are rapidly transforming software engineering, yet the security risks of their generated code have become a critical concern. Existing benc…
Out of Distribution, Out of Luck: How Well Can LLMs Trained on Vulnerability Datasets Detect Top 25 CWE Weaknesses?
Yikun Li, Ngoc Tan Bui, Ting Zhang +16
Automated vulnerability detection research has made substantial progress, yet its real-world impact remains limited. Prior work found that current vulnerability datasets suffer fro…
R2Vul: Learning to Reason about Software Vulnerabilities with Reinforcement Learning and Structured Reasoning Distillation
Martin Weyssow, Chengran Yang, Junkai Chen +12
Large language models (LLMs) have shown promising performance in software vulnerability detection, yet their reasoning capabilities remain unreliable. We propose R2Vul, a method th…
Benchmarking Large Language Models for Multi-Language Software Vulnerability Detection
Ting Zhang, Chengran Yang, Yindu Su +8
Recent advancements in generative AI have led to the widespread adoption of large language models (LLMs) in software engineering, addressing numerous long-standing challenges. Howe…
CleanVul: Automatic Function-Level Vulnerability Detection in Code Commits Using LLM Heuristics
Yikun Li, Ting Zhang, Ratnadira Widyasari +13
Accurate identification of software vulnerabilities is crucial for system integrity. Vulnerability datasets, often derived from the National Vulnerability Database (NVD) or directl…
Text Tells the Cost: Predicting and Analyzing Repayment Effort of Self-Admitted Technical Debt
Yikun Li, Mohamed Soliman, Paris Avgeriou +2
Technical debt refers to the consequences of sub-optimal decisions made during software development that prioritize short-term benefits over long-term maintainability. Self-Admitte…
DebtViz: A Tool for Identifying, Measuring, Visualizing, and Monitoring Self-Admitted Technical Debt
Yikun Li, Mohamed Soliman, Paris Avgeriou +1
Technical debt, specifically Self-Admitted Technical Debt (SATD), remains a significant challenge for software developers and managers due to its potential to adversely affect long…
Automatically Identifying Relations Between Self-Admitted Technical Debt Across Different Sources
Yikun Li, Mohamed Soliman, Paris Avgeriou
Self-Admitted Technical Debt or SATD can be found in various sources, such as source code comments, commit messages, issue tracking systems, and pull requests. Previous research ha…
Self-Admitted Technical Debt in the Embedded Systems Industry: An Exploratory Case Study
Yikun Li, Mohamed Soliman, Paris Avgeriou +1
Technical debt denotes shortcuts taken during software development, mostly for the sake of expedience. When such shortcuts are admitted explicitly by developers (e.g., writing a TO…
Automatic Identification of Self-Admitted Technical Debt from Four Different Sources
Yikun Li, Mohamed Soliman, Paris Avgeriou
Technical debt refers to taking shortcuts to achieve short-term goals while sacrificing the long-term maintainability and evolvability of software systems. A large part of technica…
Identification and Remediation of Self-Admitted Technical Debt in Issue Trackers
Yikun Li, Mohamed Soliman, Paris Avgeriou
Technical debt refers to taking shortcuts to achieve short-term goals, which might negatively influence software maintenance in the long-term. There is increasing attention on tech…