Modular Unification of Unilingual Pointer Analyses to Multilingual FFI-Based Programs
Science of Computer Programming,
Год журнала:
2025,
Номер
unknown, С. 103278 - 103278
Опубликована: Фев. 1, 2025
Язык: Английский
Unveiling security weaknesses in autonomous driving systems: An in-depth empirical study
Information and Software Technology,
Год журнала:
2025,
Номер
unknown, С. 107709 - 107709
Опубликована: Март 1, 2025
Язык: Английский
Property-Based Testing for Cybersecurity: Towards Automated Validation of Security Protocols
Computers,
Год журнала:
2025,
Номер
14(5), С. 179 - 179
Опубликована: Май 6, 2025
The
validation
of
security
protocols
remains
a
complex
and
critical
task
in
the
cybersecurity
landscape,
often
relying
on
labor-intensive
testing
or
formal
verification
techniques
with
limited
scalability.
In
this
paper,
we
explore
property-based
(PBT)
as
powerful
yet
underutilized
methodology
for
automated
protocols.
PBT
enables
generation
large
diverse
input
spaces
guided
by
declarative
properties,
making
it
well-suited
to
uncover
subtle
vulnerabilities
protocol
logic,
state
transitions,
access
control
flows.
We
introduce
principles
demonstrate
its
applicability
through
selected
use
cases
involving
authentication
mechanisms,
cryptographic
APIs,
session
further
discuss
integration
strategies
existing
pipelines
highlight
key
challenges
such
property
specification,
oracle
design,
Finally,
outline
future
research
directions
aimed
at
bridging
gap
between
methods,
goal
advancing
automation
reliability
secure
system
development.
Язык: Английский
Challenges of Multilingual Program Specification and Analysis
Lecture notes in computer science,
Год журнала:
2024,
Номер
unknown, С. 124 - 143
Опубликована: Окт. 29, 2024
Язык: Английский
Analysis of information flow security using software implementing business logic based on stored database program blocks
Russian Technological Journal,
Год журнала:
2024,
Номер
12(2), С. 16 - 27
Опубликована: Апрель 5, 2024
Objectives
.
Verification
of
software
security
is
typically
performed
using
dynamic
and
static
analysis
tools.
The
corresponding
types
do
not
usually
consider
the
business
logic
rely
on
data
access
control
policies.
A
modern
approach
to
resolving
this
problem
implement
language-based
information
flow
control.
Despite
a
large
amount
research,
mechanisms
for
in
are
widely
used
practice.
This
because
they
complex
impose
increased
demands
developers.
aim
work
transfer
from
language
level
formal
verification.
will
enable
functions
controlling
integrity
confidentiality
be
isolated
into
separate
task,
which
can
resolved
by
analysts.
Methods
research
based
general
methods
computer
systems
verification
methods.
algorithm
developed
author
checking
specifications
violations
uses
temporal
actions.
Results
technology
presented
as
step-by-step
specific
tasks,
including
following:
designing
database
(DB)
storing
processing
sensitive
information;
analyzing
dependencies
identifying
relevant
sets
program
blocks
DB;
generating
TLA+
identified
blocks;
labeling
according
global
policy
rules
additional
constraints;
applying
specification
algorithm,
while
providing
recommendations
procedure
also
involves
labeled
data,
order
spread
verified
block
output
values
external
modules.
Conclusions
herein
does
require
developers
include
redundant
annotations
describing
rules.
function
flows
with
reference
predefined
restrictions
moved
stage
development
life
cycle.
Язык: Английский
Learning to Detect and Localize Multilingual Bugs
Proceedings of the ACM on software engineering.,
Год журнала:
2024,
Номер
1(FSE), С. 2190 - 2213
Опубликована: Июль 12, 2024
Increasing
studies
have
shown
bugs
in
multi-language
software
as
a
critical
loophole
modern
quality
assurance,
especially
those
induced
by
language
interactions
(i.e.,
multilingual
bugs).
Yet
existing
tool
support
for
bug
detection/localization
remains
largely
limited
to
single-language
software,
despite
the
long-standing
prevalence
of
systems
various
real-world
domains.
Extant
static/dynamic
analysis
and
deep
learning
(DL)
based
approaches
all
face
major
challenges
addressing
bugs.
In
this
paper,
we
present
xLoc,
DL-based
technique/tool
detecting
localizing
Motivated
results
our
bug-characteristics
study
on
top
locations
bugs,
xLoc
first
learns
general
knowledge
relevant
differentiating
control-flow
structures.
This
is
achieved
pre-training
Transformer
model
with
customized
position
encoding
against
novel
objectives.
Then,
task-specific
task
detection/localization,
through
another
new
scheme
(based
cross-language
API
vicinity)
that
allows
attend
particularly
constructs
bear
most
during
fine-tuning.
We
implemented
Python-C
curated
dataset
3,770
buggy
15,884
non-buggy
samples,
which
enabled
extensive
evaluation
two
state-of-the-art
baselines:
fine-tuned
CodeT5
zero-shot
ChatGPT.
Our
show
94.98%
F1
87.24%@Top-1
accuracy,
are
significantly
(up
162.88%
511.75%)
higher
than
baselines.
Ablation
further
confirmed
significant
contributions
each
design
elements
xLoc.
With
respective
bug-location
characteristics
labeled
datasets
fine-tuning,
may
be
applied
other
combinations
beyond
Python-C.
Язык: Английский
AXA: Cross-Language Analysis through Integration of Single-Language Analyses
Опубликована: Окт. 18, 2024
Язык: Английский
Automated detection of inter-language design smells in multi-language deep learning frameworks
Information and Software Technology,
Год журнала:
2024,
Номер
unknown, С. 107656 - 107656
Опубликована: Дек. 1, 2024
Язык: Английский
Reusing Single-Language Analyses for Static Analysis of Multi-language Programs
Опубликована: Окт. 19, 2023
State-of-the-art
software
is
crafted
in
multiple
programming
languages.
Such
multi-language
challenges
static
analyses:
Since
many
analyses
are
focused
on
analyzing
single-language
programs,
they
inherently
unsound
or
imprecise
cross-language
interaction.
Existing
approaches
that
perform
analysis
not
analysis-
language
independent
and
thus
lack
extensibility
for
new
We
will
develop
an
extensible,
language-,
framework-,
analysis-independent
architecture
to
reuse
existing
software.
Our
hypotheses
that,
our
allows
reusing
improves
precision
soundness
compared
the
state
of
art.
evaluate
with
a
points-to
data
flow
Java,
JavaScript,
C/C++
code
compare
it
against
Язык: Английский