37 citations · 48 across the 8 of their papers we have counts for
9 papers
One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability
Fangyuan Zhang, Lyuye Zhang, Lingling Fan +6
Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incre…
Evolaris: A Roadmap to Self-Evolving Software Intelligence Management
Chengwei Liu, Wenbo Guo, Yuxin Zhang +4
In recent years, the landscape of software threats has become significantly more dynamic and distributed. Security vulnerabilities are no longer discovered and shared only through…
JC-Finder: Detecting Java Clone-based Third-Party Library by Class-level Tree Analysis
Lida Zhao, Chaofan Li, Yueming Wu +10
While reusing third-party libraries (TPL) facilitates software development, its chaotic management has brought great threats to software maintenance and the unauthorized use of sou…
VFArchē: A Dual-Mode Framework for Locating Vulnerable Functions in Open-Source Software
Lyuye Zhang, Jian Zhang, Kaixuan Li +6
Software Composition Analysis (SCA) has become pivotal in addressing vulnerabilities inherent in software project dependencies. In particular, reachability analysis is increasingly…
Drop the Golden Apples: Identifying Third-Party Reuse by DB-Less Software Composition Analysis
Lyuye Zhang, Chengwei Liu, Jiahui Wu +5
The prevalent use of third-party libraries (TPLs) in modern software development introduces significant security and compliance risks, necessitating the implementation of Software…
PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software
Kaixuan Li, Jian Zhang, Sen Chen +3
Open-source software (OSS) vulnerabilities are increasingly prevalent, emphasizing the importance of security patches. However, in widely used security platforms like NVD, a substa…
Static Application Security Testing (SAST) Tools for Smart Contracts: How Far Are We?
Kaixuan Li, Yue Xue, Sen Chen +6
In recent years, the importance of smart contract security has been heightened by the increasing number of attacks against them. To address this issue, a multitude of static applic…
DeepFWI: Identifying Bug-Sensitive Warnings with Multi-Modal Code-Warning Semantics
Han Liu, Jian Zhang, Cen Zhang +7
Static analysis tools have evolved over time to assist in detecting bugs. However, the excessive false warnings can impede developers' productivity and confidence in the tools. Pre…
EndWatch: A Practical Method for Detecting Non-Termination in Real-World Software
Yao Zhang, Xiaofei Xie, Yi Li +3
Detecting non-termination is crucial for ensuring program correctness and security, such as preventing denial-of-service attacks. While termination analysis has been studied for ma…