10 papers
Investigating Developer-Reported Software Security Testing Challenges
Md Erfan, Ahmed Ryan, Md Rayhanur Rahman
Software security testing (SST) is essential for identifying vulnerabilities and improving software security, but developers often face practical challenges when selecting tools, c…
Can Open-Weight LLMs Produce Kernel-Verified Coq Proofs? A Pilot Study
Ahmed Ryan, Md Erfan, Akond Ashfaque Ur Rahman +1
Large language models (LLMs) can generate text that resembles a mathematical proof, but resemblance does not establish correctness. A formal proof checker verifies whether each pro…
A Large-Scale Measurement of AI Bill of Materials Completeness in Hugging Face Models
Md Erfan, Ahmed Ryan, Md Rayhanur Rahman
Pretrained machine learning (ML) models help developers build ML-intensive software systems without training models from scratch. However, model repositories often provide incomple…
Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities
Md Erfan, Ahmed Ryan, Md Kamal Hossain Chowdhury +1
Connected and Autonomous Vehicles (CAVs) rely on interconnected software and hardware components, including sensors, Electronic Control Units, in-vehicle infotainment systems, and…
Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation
Abir Ashab Niloy, Ahmed Ryan, Imamul Hossain Rafi +2
Multi-stage cyberattacks span system, network, and browser logs. Detecting them requires correlating events across all three sources. Machine learning methods can learn these cross…
Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reports
Ahmed Ryan, Saad Sakib Noor, Md Erfan +3
Classifying Cyber Threat Intelligence (CTI) using MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) is essential for proactive defense, but historically required…
From Natural Language to Verified Code: Toward AI Assisted Problem-to-Code Generation with Dafny-Based Formal Verification
Md Erfan, Md Kamal Hossain Chowdhury, Ahmed Ryan +1
Large Language Models (LLMs) show promise in automated software engineering, yet their guarantee of correctness is frequently undermined by erroneous or hallucinated code. To enfor…
What Are Adversaries Doing? Automating Tactics, Techniques, and Procedures Extraction: A Systematic Review
Mahzabin Tamanna, Shaswata Mitra, Md Erfan +4
Adversaries continuously evolve their tactics, techniques, and procedures (TTPs) to achieve their objectives while evading detection, requiring defenders to continually update thei…
An Evaluation of Large Language Models for Detection of Malicious Python Packages
Ahmed Ryan, Ibrahim Khalil, Abdullah Al Jahid +4
Modern software development relies on open-source package repositories. Attackers use these to distribute malicious packages. Large Language Models (LLMs) can automatically detect…
Unveiling Malicious Logic: Towards a Statement-Level Taxonomy and Dataset for Securing Python Packages
Ahmed Ryan, Junaid Mansur Ifti, Md Erfan +2
The widespread adoption of open-source ecosystems enables developers to integrate third-party packages, but also exposes them to malicious packages crafted to execute harmful behav…