4 papers
How Reliable Are NVD CWE Labels? A Large-Scale Semantic Audit with Seclometry
Yu Nong, Yao Du, Majid Behravan +1
CWE labels in the National Vulnerability Database (NVD) are widely treated as ground truth for vulnerability search, scanner evaluation, benchmark construction, learning-based secu…
Neuro-Symbolic Proof-of-Vulnerability Generation with Open-Weight Models
Yu Nong, Haipeng Cai
Software vulnerabilities are persistent, but validating them remains difficult: a Proof-of-Vulnerability (PoV) requires a concrete input that triggers the vulnerable behavior, yet…
VulScribeR: Exploring RAG-based Vulnerability Augmentation with LLMs
Seyed Shayan Daneshvar, Yu Nong, Xu Yang +2
Detecting vulnerabilities is vital for software security, yet deep learning-based vulnerability detectors (DLVD) face a data shortage, which limits their effectiveness. Data augmen…
APPATCH: Automated Adaptive Prompting Large Language Models for Real-World Software Vulnerability Patching
Yu Nong, Haoran Yang, Long Cheng +2
Timely and effective vulnerability patching is essential for cybersecurity defense, for which various approaches have been proposed yet still struggle to generate valid and correct…