6 papers
Emerging Challenges in Threat Modeling for GenAI-Augmented Systems: A View from the Trenches
Nicolás E. Díaz Ferreyra, Manish Mahesh Kumar, Nohemí Villarreal +3
Threat modeling remains a central task in secure software engineering, as it enables the identification of security issues from system architectures. As Generative Artificial Intel…
Reading Between the Code Lines: On the Use of Self-Admitted Technical Debt for Security Analysis
Nicolás E. Díaz Ferreyra, Moritz Mock, Max Kretschmann +4
Static Analysis Tools (SATs) are central to security engineering activities, as they enable early identification of code weaknesses without requiring execution. However, their effe…
MADE-WIC: Multiple Annotated Datasets for Exploring Weaknesses In Code
Moritz Mock, Jorge Melegati, Max Kretschmann +2
In this paper, we present MADE-WIC, a large dataset of functions and their comments with multiple annotations for technical debt and code weaknesses leveraging different state-of-t…
Prompting Techniques for Secure Code Generation: A Systematic Investigation
Catherine Tony, Nicolás E. Díaz Ferreyra, Markus Mutas +2
Large Language Models (LLMs) are gaining momentum in software development with prompt-driven programming enabling developers to create code from natural language (NL) instructions.…
What Can Self-Admitted Technical Debt Tell Us About Security? A Mixed-Methods Study
Nicolás E. Díaz Ferreyra, Mojtaba Shahin, Mansooreh Zahedi +2
Self-Admitted Technical Debt (SATD) encompasses a wide array of sub-optimal design and implementation choices reported in software artefacts (e.g., code comments and commit message…
How Dataflow Diagrams Impact Software Security Analysis: an Empirical Experiment
Simon Schneider, Nicolás E. Díaz Ferreyra, Pierre-Jean Quéval +3
Models of software systems are used throughout the software development lifecycle. Dataflow diagrams (DFDs), in particular, are well-established resources for security analysis. Ma…