Publications
Research publications from NKSSecLab.
Full Publication List
Listed in reverse chronological order.
169 publications
- ASE2026ATLAS: Agentic Taxonomy of Large-Scale Software Ecosystems
- ASE2026Benchmarking Automated Security Patch Backporting: How Far Are We?
- ASE2026How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study
- ASE2026Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects
- ASE2026Latent Reuse in Agent Skills: Multi-modal Clone Detection at Ecosystem Scale
- ASE2026One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability
- COMPSAC2026RustDAP: Lightweight Rust Vulnerability Detection Method via LLM-based Data Augmentation and Semantic-Structural Prompting
- FSE2026Break to Adapt: Knowledge-Based Updates of Breaking Dependencies in JavaScript
- FSE2026GadgetHunter: Region-Based Neuro-Symbolic Detection of Java Deserialization Vulnerabilities
- ICSE2026IntelliRadar: A Comprehensive Platform to Pinpoint Malicious Package Information from Cyber Intelligence
- ICSE2026Semantic-Enhanced Automatic Refinement of Architecture Recovery Results Using LLMs
- ICSE2026Towards Understanding and Characterizing Vulnerabilities in Intelligent Connected Vehicles through Real-World Exploits Distinguished Paper Award
- Internetware2026CaVulner: Automated Context-Aware Identification of Vulnerable Versions
- ISSTA2026"You are deceived in the pocket" —— Intrusive Advertisements in Mobile Applications: An Exploratory Study
- ISSTA2026Mind the Gap: An Empirical Study of Synchronization Gaps, Delays, and Missed Opportunities in Software Forks
- JoS2026AIntel-Agent: A Threat Intelligence-Driven Multi-Agent Android Anti-Runtime Analysis Method
- OOPSLA2026Agent-Based Automated Remediation for Vulnerabilities in Maven Projects
- S&P2026Beyond Similarity Scores: Evidence-Based Third-Party Library Detection for C/C++ Binaries
- S&P2026Demystifying and Exploiting ASLR on NVIDIA GPUs Distinguished Paper Award
- SANER2026Scratching the Iceberg: Unveiling the Outdated Third-Party Native Libraries in Android Apps
- SWGeno2026Seeing the Forest: A Taxonomy-Guided Analysis and Improvement of Malicious PyPI Package Detectors
- TIFS2026One Trigger, Multiple Victims: Clean-Label Neighborhood Backdoor Attacks on Graph Neural Networks
- TOSEM2026Mind the Data: A Measurement Study on Public Multi-Source Vulnerability Data
- TSE2026Causality-aware Safety Testing for Autonomous Driving Systems
- TSE2026CCMG: Enhancing Conventional Commit Message Generation with Hierarchical Context
- TSE2026CodeS+: Towards Assessing the Generalization Ability of Code Models Under Distribution Shift
- TSE2026DeepFWI: Identifying Bug-Sensitive Warnings with Multi-Modal Code-Warning Semantics
- USENIX Security2026Cutting the Gordian Knot: Detecting Malicious PyPI Packages via a Knowledge-Mining Framework
- USENIX Security2026Revealing the Dark Side of Smart Accounts: An Empirical Study of EIP-7702 Incurred Risks in Blockchain Ecosystem
- WWW2026Bridging Expert Reasoning and LLM Detection: A Knowledge-Driven Framework for Malicious Packages
- APR2025Towards Unveiling Vulnerability Remediation Tactics from OSS Community
- arXiv2025VFArchē: A Dual-Mode Framework for Locating Vulnerable Functions in Open-Source Software
- ASE2025BinStruct: Binary Structure Recovery Combining Static Analysis and Semantics
- ASE2025Demystifying OpenZeppelin's Own Vulnerabilities and Analyzing Their Propagation in Smart Contracts
- ASE2025DroidNative: A Greedy-Constructed Large-Scale Indexing for Android Native Libraries
- ASE2025FaultSeeker: LLM-Empowered Framework for Blockchain Transaction Fault Localization
- ASE2025GlassWing: A Tailored Static Analysis Approach for Flutter Android Apps
- ASE2025Have We Solved Access Control Vulnerability Detection in Smart Contracts? A Benchmark Study
- ASE2025Learning from the Past: Real-World Exploit Migration for Smart Contract PoC Generation
- ASE2025Vulnerability-Affected Versions Identification: How Far Are We?
- ASEJ2025Exploring the potential of general purpose LLMs in automated software refactoring: An empirical study
- CCS2025ForeDroid: Scenario-Aware Analysis for Android Malware Detection and Explanation
- FSE2025Aligning Core Aspects: Improving Vulnerability Proof-of-Concepts via Cross-Source Insights
- FSE2025Drop the Golden Apples: Identifying Third-Party Reuse by DB-Less Software Composition Analysis
- FSE2025Towards the Versioning of LLM-Agent-Based Software
- FSE2025Why the Proof Fails in Different Versions of Theorem Provers: An Empirical Study of Compatibility Issues in Isabelle
- ICECCS2025Evolaris: A Roadmap to Self-Evolving Software Intelligence Management
- ICPC2025CalmDroid: Core-Set Based Active Learning for Multi-Label Android Malware Detection
- ICSE2025Dissecting Global Search: A Simple yet Effective Method to Boost Individual Discrimination Testing and Repair
- ICSE2025Enhancing OSS Remediation with Patch Backporting
- ICSE2025EP-Detector: Automatic Detection of Error-prone Operation Anomalies in Android Applications
- ICSE2025LLMs Meet Library Evolution: Evaluating Deprecated API Usage in LLM-based Code Completion
- ICSE2025Minimizing Breaking Changes and Redundancy in Mitigating Technical Lag for Java Projects
- ICSE2025Scenario-Driven and Context-Aware Automated Accessibility Testing for Android Apps
- ISSTA2025Doctor: Optimizing Container Rebuild Efficiency by Instruction Re-Orchestration
- ISSTA2025Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management
- ISSTA2025Large Language Model Supply Chain: Open Problems From the Security Perspective
- IST2025Software aging oriented trustworthiness measurement based on weighted Boltzmann entropy
- JoS2025HarmonyFlow: A static analysis framework for HarmonyOS applications based on Ark Panda IR
- JSS2025Characterizing and Detecting Python Version Incompatibilities Caused by Inconsistent Version Specifications
- TOSEM2025Beyond Decision: Android Malware Description Generation through Profiling Malicious Behavior Trajectory
- TSE2025ACFix: Guiding LLMs with Mined Common RBAC Practices for Context-Aware Repair of Access Control Vulnerabilities in Smart Contracts
- TSE2025An Automated Approach to Discovering Software Refactorings by Comparing Successive Versions
- TSE2025Demystifying Rust Unstable Features at Ecosystem Scale: Evolution, Propagation, and Mitigation
- TSE2025FCGHUNTER: Towards Evaluating Robustness of Graph-Based Android Malware Detection
- TSE2025Open Source, Hidden Costs: A Systematic Literature Review on OSS License Management
- TSE2025Towards Secure Code Generation with LLMs: A Study on Common Weakness Enumeration
- WWW2025TensorJSFuzz: Effective Testing of Web-Based Deep Learning Frameworks via Input-Constraint Extraction
- AAAI2024FedMut: Generalized Federated Learning via Stochastic Mutation
- ASE2024A Position-Aware Approach to Decomposing God Classes
- ASE2024The Software Genome Project: Unraveling Software Through Genetic Principles
- FSE2024Static Application Security Testing (SAST) Tools for Smart Contracts: How Far Are We? Distinguished Paper Award
- ICSE2024Demystifying Compiler Unstable Feature Usage and Impacts in the Rust Ecosystem
- ICSE2024Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem
- ICSE2024LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs' Vulnerability Reasoning
- ICSE2024ModuleGuard: Understanding and Detecting Module Conflicts in Python Ecosystem
- ICSE2024Vulnerability Root Cause Function Locating for Java Vulnerabilities
- ISSTA2024Bugs in Pods: Understanding Bugs in Container Runtime Systems
- ISSTA2024PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software
- LCTES2024Unmasking the Lurking: Malicious Behavior Detection for IoT Malware with Multi-label Classification
- SANER2024Catch the Butterfly: Peeking into the Terms and Conflicts among SPDX Licenses
- SCIS2024Deep learning-based software engineering: progress, challenges, and opportunities
- TrustCom2024Behavior Speaks Louder: Rethinking Malware Analysis Beyond Family Classification
- TSE2024A Comprehensive Study on Static Application Security Testing (SAST) Tools for Android
- TSE2024Does the Vulnerability Threaten Our Projects? Automated Vulnerable API Detection for Third-Party Libraries
- USENIX Security2024Using My Functions Should Follow My Checks: Understanding and Detecting Insecure OpenZeppelin Code in Smart Contracts
- ASE2023An Empirical Study of Malicious Code In PyPI Ecosystem
- ASE2023Aster: Automatic Speech Recognition System Accessibility Testing for Stutterers
- ASE2023Automated Software Entity Matching Between Successive Versions
- ASE2023EndWatch: A Practical Method for Detecting Non-Termination in Real-World Software Distinguished Paper Award
- ASE2023Mitigating Persistence of Open-Source Vulnerabilities in Maven Ecosystem
- ASE2023Scene-Driven Exploration and GUI Modeling for Android Apps
- ASE2023Who is the Real Hero? Measuring Developer Contribution via Multi-dimensional Data Integration
- ESEC/FSE2023Automated and Context-Aware Repair of Color-Related Accessibility Issues for Android Apps
- ESEC/FSE2023Comparison and Evaluation on Static Application Security Testing (SAST) Tools for Java
- ESEC/FSE2023Deep Learning Based Feature Envy Detection Boosted by Real-World Examples
- FSE2023Demystifying the Composition and Code Reuse in Solidity Smart Contracts
- FSE2023Software Architecture Recovery with Information Fusion
- FSE2023Software Composition Analysis for Vulnerability Detection: An Empirical Study on Java Projects
- ICSE2023A Web-Based Tool for Using Storyboard of Android Apps
- ICSE2023Compatibility Issue Detection for Android Apps Based on Path-Sensitive Semantic Analysis
- ICSE2023Compatible Remediation on Vulnerabilities from Third-Party Libraries for Java Projects Distinguished Paper Award
- ICSE2023OSSFP: Precise and Scalable C/C++ Third-Party Library Detection using Fingerprinting Functions
- ISSTA2023A Comprehensive Study on Quality Assurance Tools for Java
- ISSTA2023LiResolver: License Incompatibility Resolution for Open Source Software
- JoS2023Survey on Trustworthiness Measurement for Artificial Intelligence Systems
- TDSC2023Ambush from All Sides: Understanding Security Threats in Open-Source Software CI/CD Pipelines
- ASE2022AUSERA: Automated Security Vulnerability Detection for Android Apps
- ASE2022Has My Release Disobeyed Semantic Versioning? Static Detection Based On Semantic Differencing Distinguished Paper Award
- ASE2022Has My Release Disobeyed Semantic Versioning? Static Detection Based on Semantic Differencing for Java Distinguished Paper Award
- ASE2022Towards Understanding the Faults of JavaScript-Based Deep Learning Systems
- ASE2022Towards Understanding Third-party Library Dependency in C/C++ Ecosystem
- COMPSAC2022Can Deep Learning Models Learn the Vulnerable Patterns for Vulnerability Detection
- FSE2022Large-Scale Analysis of Non-Termination Bugs in Real-World OSS Projects
- ICSE2022Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem
- SCIS2022ArgusDroid: Detecting Android Malware Variants by Mining Permission-API Knowledge Graph
- SEKE2022Adaptive Prior-Knowledge-Assisted Function Naming Based on Multi-level Information Explorer
- TDSC2022AS2T: Arbitrary Source-To-Target Adversarial Attack on Speaker Recognition Systems
- TDSC2022Multi-label Classification for Android Malware Based on Active Learning
- TDSC2022Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition
- TOSEM2022LiDetector: License Incompatibility Detection for Open Source Software
- TSE2022Automatically Distilling Storyboard with Rich Features for Android Apps
- TSE2022Demystifying Performance Regressions in String Solvers
- APSEC2021IconChecker: Anomaly Detection of Icon-Behaviors for Android Apps
- COMPSAC2021Key Aspects Augmentation of Vulnerability Description based on Multiple Security Databases
- COMPSAC2021Predicting Entity Relations across Different Security Databases by Using Graph Attention Network
- FCS2021VenomAttack: Automated and Adaptive Activity Hijacking in Android
- ICSE2021ATVHUNTER: Reliable Version Detection of Third-Party Libraries for Vulnerability Identification in Android Applications Distinguished Paper Award
- IEEE S&P2021Who is Real Bob? Adversarial Attacks on Speaker Recognition Systems
- IJIS2021Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers
- ISSRE2021Peeking into the Gray Area of Mobile World: An Empirical Study of Unlabeled Android Apps
- SCIS2021Towards Characterizing Bug Fixes through Dependency-Level Changes
- TASE2021Inferring Loop Invariants for Multi-Path Loops
- TDSC2021GUI-Squatting Attack: Automated Generation of Android Phishing Apps
- TITS2021DeepSuite: A Test Suite Optimizer for Autonomous Vehicles
- TOSEM2021Detecting and Augmenting Missing Key Aspects in Vulnerability Descriptions
- TSE2021Accessible or Not? An Empirical Investigation of Android App Accessibility
- TSE2021Research on Third-Party Libraries in Android Apps: A Systematic Literature Review
- TSE2021Research on Third-Party Libraries in Android Apps: A Taxonomy and Systematic Literature Review
- ASE2020Automated Third-party Library Detection for Android Applications: Are We There Yet?
- ICECCS2020SeqMobile: An Efficient Sequence-Based Malware Detection System Using RNN on Mobile Devices
- ICSE2020An Empirical Assessment of Security Risks of Global Android Banking Apps
- ISSRE2020An Empirical Evaluation of GDPR Compliance Violations in Android mHealth Apps
- SANER2020CORE: Automating Review Recommendation for Code Changes
- TIFS2020A Performance-Sensitive Malware Detection System Using Deep Learning on Mobile Devices
- TOSEM2020Why an Android App is Classified as Malware? Towards Malware Classification Interpretation
- TR2020An Approach to Generate the Traceability Between Restricted Natural Language Requirements and AADL Models,
- TSE2020ATOM: Commit Message Generation Based on Abstract Syntax Tree and Hybrid Ranking
- TSE2020Why My App Crashes? Understanding and Benchmarking Framework-specific Exceptions of Android apps
- USENIX Security2020iOS, Your OS, Everybody's OS: Vetting and Analyzing Network Services of iOS Applications
- ASE2019An Empirical Study towards Characterizing Deep Learning Development and Deployment across Different Frameworks and Platforms
- ICECCS2019MobiDroid: A Performance-Sensitive Malware Detection System on Mobile Platform
- ICSE2019A Large-scale Empirical Study on Industrial Fake Apps
- ICSE2019StoryDroid: Automated Generation of Storyboard for Android Apps
- SANER2019Automated Cross-Platform GUI Code Generation for Mobile Apps
- SANER2019How Can We Craft Large-Scale Mobile Malware? An Automated Poisoning Attack
- ASE2018Efficiently Manifesting Asynchronous Programming Errors in Android Apps
- ESEC/FSE2018Are Mobile Banking Apps Secure? What Can be Improved?
- ICSE2018Large-Scale Analysis of Framework-Specific Exceptions in Android Apps Distinguished Paper Award
- JoS2018Approach for generating AADL model based on restricted natural language requirement template,
- MEMOCODE2018Hierarchical Behavior Annex: Towards an AADL Functional Specification Extension,
- NASAC2018AUSERA: Large-Scale Automated Security Risk Assessment of Global Mobile Banking Apps
- COSE2017Automated Poisoning Attacks and Defenses in Malware Detection System: An Adversarial Machine Learning Approach
- APSEC2016Model-Based Continuous Verification
- ASIACCS2016StormDroid: A Streaminglized Machine Learning-Based System for Detecting Android Malware
- CCS2016Accuracy vs. Time Cost: Detecting Android Malware through Pareto Ensemble Pruning
- CCS2016POSTER: Accuracy vs. Time Cost: Detecting Android Malware through Pareto Ensemble Pruning
- MobiCom2016Towards Adversarial Detection of Mobile Malware
No publications match the selected filters.