7 papers
ARQ: Agentic CodeQL Query Refinement for C/C++ Vulnerability Detection
Chunyi Wang, Yunfei Ke, Junfeng Yang +2
Static analyzers have been widely adopted for vulnerability detection in C/C++ programs. Query-based static analyzers (e.g., CodeQL) encode vulnerable code patterns in detection qu…
Symbolon: Symbolic Execution by Learning Code Transformation
Jie Zhu, Penghui Li, Zhongxuan Li +4
Symbolic execution is a powerful program analysis technique with broad applications, such as vulnerability detection, security testing, and malware analysis. However, this techniqu…
Detecting Privilege Escalation in Polyglot Microservices via Agentic Program Analysis
Penghui Li, Hong Yau Chong, Yinzhi Cao +1
Microservices are widely adopted in modern cloud systems due to their scalability and fault tolerance. However, microservice architectures introduce significant complexity in privi…
Reasoning under Vision: Understanding Visual-Spatial Cognition in Vision-Language Models for CAPTCHA
Python Song, Luke Tenyi Chang, Yun-Yun Tsai +2
CAPTCHA, originally designed to distinguish humans from robots, has evolved into a real-world benchmark for assessing the spatial reasoning capabilities of vision-language models.…
PickleBall: Secure Deserialization of Pickle-based Machine Learning Models (Extended Report)
Andreas D. Kellas, Neophytos Christou, Wenxin Jiang +6
Machine learning model repositories such as the Hugging Face Model Hub facilitate model exchanges. However, bad actors can deliver malware through compromised models. Existing defe…
Explainer-guided Targeted Adversarial Attacks against Binary Code Similarity Detection Models
Mingjie Chen, Tiancheng Zhu, Mingxue Zhang +4
Binary code similarity detection (BCSD) serves as a fundamental technique for various software engineering tasks, e.g., vulnerability detection and classification. Attacks against…
Neuro-symbolic Static Analysis with LLM-generated Vulnerability Patterns
Penghui Li, Songchen Yao, Josef Sarfati Korich +4
In this work, we present MoCQ, a neuro-symbolic static analysis framework that leverages large language models (LLMs) to automatically generate vulnerability detection patterns. Th…