11 papers
Semantic-Enhanced Automatic Refinement of Architecture Recovery Results Using LLMs
Yiran Zhang, Chengwei Liu, Yuqiang Sun +5
Understanding the architecture is crucial for effectively maintaining and managing large software systems. However, discrepancies often exist between the designed and implemented a…
Characterizing Trust Boundary Vulnerabilities in TEE Containers: An Empirical Study
Weijie Liu, Hongbo Chen, Shuo Huai +7
Trusted Execution Environments (TEEs) have become a cornerstone of confidential computing, attracting significant attention from academia and industry. To support secure and scalab…
How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study
Wenbo Guo, Zhongwen Chen, Zhengzi Xu +7
The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on…
Cutting the Gordian Knot: Detecting Malicious PyPI Packages via a Knowledge-Mining Framework
Wenbo Guo, Chengwei Liu, Ming Kang +5
The Python Package Index (PyPI) has become a target for malicious actors, yet existing detection tools generate false positive rates of 15-30%, incorrectly flagging one-third of le…
Bridging Expert Reasoning and LLM Detection: A Knowledge-Driven Framework for Malicious Packages
Wenbo Guo, Shiwen Song, Jiaxun Guo +5
Open-source ecosystems such as NPM and PyPI are increasingly targeted by supply chain attacks, yet existing detection methods either depend on fragile handcrafted rules or data-dri…
IntelliRadar: A Comprehensive Platform to Pinpoint Malicious Package Information from Cyber Intelligence
Wenbo Guo, Chengwei Liu, Limin Wang +4
Malicious packages in public registries pose serious threats to software supply chain security. While current software component analysis (SCA) tools rely on databases like OSV and…