6 papers
Discovery or Memorization? A Faithful Benchmark for Real-World Business-Logic Vulnerability Discovery
Rui Yang, Yichao Xu, Zhuohao Zhang +4
The rapid advancement of cybersecurity agents in vulnerability discovery has increased the need for benchmarks that evaluate their capabilities accurately. However, synthetic bench…
SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
Rui Yang, Junjie Xu, Zhengyu Liu +4
Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating failures that local checks may…
Same Request, Different Boundary: Evaluating Cybersecurity Assistance across Conversational Contexts
Rui Yang, Yang Hong, Yichao Xu +3
Cybersecurity assistance is dual use, requiring decisions about when to answer, limit, or refuse a request. Prior work studies refusal evaluation and conversational jailbreaking, b…
Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing
Jianjia Yu, Zhengyu Liu, Ziyang Li +2
Electron is a popular framework for building cross-platform desktop applications using web technologies. Such applications consist of multiple processes with different privilege le…
Mystra: Declarative Dynamic Taint Analysis via Shadow Virtual Machine
Zhuohao Zhang, Junkun Liu, Rui Yang +2
Dynamic taint analysis (DTA) for interpreted languages like JavaScript and Python requires three capabilities: observing host-runtime operations, maintaining parallel taint states,…
The First Early Evidence of the Use of Browser Fingerprinting for Online Tracking
Zengrui Liu, Jimmy Dani, Yinzhi Cao +2
While advertising has become commonplace in today's online interactions, there is a notable dearth of research investigating the extent to which browser fingerprinting is harnessed…