8 papers
The Data Problem in Software Vulnerability Analysis: Artifacts, Quality, and Consumption
Yu Nong, Yao Du, Tianxiang Xu +1
Learning- and LLM-based software vulnerability analysis is only as trustworthy as the data it is trained and evaluated on, yet that data is rarely examined as a first-class object.…
A Comprehensive Study of Native Code Bugs in Python Applications
Haoran Yang, Haipeng Cai
The impact of Python applications has been evidenced by their widespread presence in some of the most impactful software domains, such as machine learning frameworks and scientific…
POLYFLOW: A Neuro-Symbolic Framework for Static Cross-Language Information Flow Analysis
Haoran Yang, Zhixuan Zhong, Jiawei Guo +1
Modern software systems are commonly constructed in multiple, interacting programming languages. This construction leads to additional, often stealthy vulnerabilities buried in com…
How Reliable Are NVD CWE Labels? A Large-Scale Semantic Audit with Seclometry
Yu Nong, Yao Du, Majid Behravan +1
CWE labels in the National Vulnerability Database (NVD) are widely treated as ground truth for vulnerability search, scanner evaluation, benchmark construction, learning-based secu…
Dissecting Software Graphs: Structural Insights for Driver-Guided Fuzzing
Baihong Chen, Hua Ming, Weifeng Pan +3
Many software systems expose multiple execution modes through command-line options, subcommands, and configuration flags. For such programs, fuzzing depends on both mutated inputs…
Neuro-Symbolic Proof-of-Vulnerability Generation with Open-Weight Models
Yu Nong, Haipeng Cai
Software vulnerabilities are persistent, but validating them remains difficult: a Proof-of-Vulnerability (PoV) requires a concrete input that triggers the vulnerable behavior, yet…