8 papers
How Reliable Are NVD CWE Labels? A Large-Scale Semantic Audit with Seclometry
Yu Nong, Yao Du, Majid Behravan +1
CWE labels in the National Vulnerability Database (NVD) are widely treated as ground truth for vulnerability search, scanner evaluation, benchmark construction, learning-based secu…
Dissecting Software Graphs: Structural Insights for Driver-Guided Fuzzing
Baihong Chen, Hua Ming, Weifeng Pan +3
Many software systems expose multiple execution modes through command-line options, subcommands, and configuration flags. For such programs, fuzzing depends on both mutated inputs…
Neuro-Symbolic Proof-of-Vulnerability Generation with Open-Weight Models
Yu Nong, Haipeng Cai
Software vulnerabilities are persistent, but validating them remains difficult: a Proof-of-Vulnerability (PoV) requires a concrete input that triggers the vulnerable behavior, yet…
System Prompt Poisoning: Persistent Attacks on Large Language Models Beyond User Injection
Zongze Li, Jiawei Guo, Haipeng Cai
Large language models (LLMs) have gained widespread adoption across diverse applications due to their impressive generative capabilities. Their plug-and-play nature enables both de…
VulScribeR: Exploring RAG-based Vulnerability Augmentation with LLMs
Seyed Shayan Daneshvar, Yu Nong, Xu Yang +2
Detecting vulnerabilities is vital for software security, yet deep learning-based vulnerability detectors (DLVD) face a data shortage, which limits their effectiveness. Data augmen…
From LLMs to LLM-based Agents for Software Engineering: A Survey of Current, Challenges and Future
Haolin Jin, Linghan Huang, Haipeng Cai +3
With the rise of large language models (LLMs), researchers are increasingly exploring their applications in var ious vertical domains, such as software engineering. LLMs have achie…