5 papers
A Comprehensive Evaluation of Code Language Models for Security Patch Detection
Nils Loose, Joseph Bienhüls, Joseph Bienhüls +4
Automated detection of vulnerability-fixing commits (\vfcs) is critical for timely security patch deployment, as advisory databases lag patch releases by a median of 25 days and ma…
Coverage-Guided Multi-Agent Harness Generation for Java Library Fuzzing
Nils Loose, Nico Winkel, Kristoffer Hempel +3
Coverage-guided fuzzing has proven effective for software testing, but targeting library code requires specialized fuzz harnesses that translate fuzzer-generated inputs into valid…
Beyond Accuracy: Characterizing Code Comprehension Capabilities in (Large) Language Models
Felix Mächtle, Jan-Niclas Serr, Nils Loose +1
Large Language Models (LLMs) are increasingly integrated into software engineering workflows, yet current benchmarks provide only coarse performance summaries that obscure the dive…
Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Prediction
Felix Mächtle, Nils Loose, Tim Schulz +4
As the number of web applications and API endpoints exposed to the Internet continues to grow, so does the number of exploitable vulnerabilities. Manually identifying such vulnerab…
OCEAN: Open-World Contrastive Authorship Identification
Felix Mächtle, Jan-Niclas Serr, Nils Loose +2
In an era where cyberattacks increasingly target the software supply chain, the ability to accurately attribute code authorship in binary files is critical to improving cybersecuri…