11 papers · ranked by Valyu relevance
Vasilis Vouvoutsis, Constantinos Patsakis, Fran Casino
Malware research primarily studies the results, the methods, and the impact. Even from an offensive security perspective, what is examined is the method, not the development strategy of the offender. This study investigates the behavioral signatures and coding patterns embedded in the malware source code. By analyzing…
Dávid Kószó, Tamás Aladics, Rudolf Ferenć, Péter Hegedűs
Static Code Analysis (SCA) tools, while invaluable for identifying potential coding problems, functional bugs, or vulnerabilities, often generate an overwhelming number of warnings, many of which are non-actionable. This overload of alerts leads to "alert fatigue", a phenomenon where developers become desensitized to…
Shadmaan Hye, Matthew LeGendre, Katherine E. Isaacs
In applications where efficiency is critical, developers may examine their compiled binaries, seeking to understand how the compiler transformed their source code and what performance implications that transformation may have. This analysis is challenging due to the vast number of disassembled binary instructions and…
Kobra Khanmohammadi, Pooria Roy, Raphael Khoury, Abdelwahab Hamou-Lhadj + 1 more
LLM models are increasingly used to generate code, but the quality and security of this code are often uncertain. Several recent studies have raised alarm bells, indicating that such AI-generated code may be particularly vulnerable to cyberattacks. However, most of these studies rely on code that is generated…
Jean-Charles Noirot Ferrand, Kyle Domico, Yohan Beugin, Patrick McDaniel
Open-source software (OSS) pipelines rely on automated static analysis tools to prevent the introduction of vulnerabilities in code. However, there is limited understanding of the efficacy of these tools across the OSS ecosystem over time. In this paper, we introduce a novel method to evaluate static application…
Yunkun Wang, Yue Zhang, Guochang Li, Zhi + 5 more
Large Language Models (LLMs) frequently generate buggy code with complex logic errors that are challenging to diagnose. While existing LLM-based self-repair approaches conduct intensive static semantic analysis or reply on superficial execution logs, they miss the in-depth runtime behaviors that often expose bug root…
Amirmohammad Nazari, Sadra Sabouri, Wang Bill Zhu, Robin Jia + 2 more
Many software development tasks, such as implementing features and fixing bugs, begin with developers posing questions about a codebase. However, answering questions about codebases that span millions of lines of code across thousands of files is non-trivial. Standard tools like grep cannot answer questions requiring…
Pietro Braione, Giovanni Denaro, Luca Gugliemo, Elson Kurian + 2 more
Context. Since the eighties, the combination of program analysis techniques has been increasingly recognized as a promising approach to overcome the limitations of standalone methods. While individual techniques, based on either static or dynamic analysis, address important challenges in software dependability, their…
Michael Pradel, Cristian Cadar, Islem Bouzenia
Numerous software analysis tools exist today, yet applying them to diverse open-source projects remains challenging due to environment setup, dependency resolution, and tool configuration. LLM-based agents offer a potential solution, yet no prior work has systematically studied their effectiveness on the specific task…
Elijah Zolduoarrati, Sherlock A. Licorish, Nigel Stanger
Developers frequently reuse Stack Overflow code snippets, yet the quality of these snippets remains unevenly understood, particularly across programming languages and geographic contexts. This study investigates code quality in Stack Overflow answers from contributors located in the United States, focusing on SQL…
Yoann Marquer, Domenico Bianculli, Lionel C. Briand
Python is one of the most popular programming languages; as such, projects written in Python involve an increasing number of diverse security vulnerabilities. However, existing state-of-the-art analysis tools for Python only support a few vulnerability types. Hence, there is a need to detect a large variety of…