Sanitizers detect and manifest bugs at runtime by monitoring program executions. A popular application of sanitizers is the integration with fuzzing, improving the quality of fuzzers in detecting bugs. However, due to the large number of repeated executions, this integration significantly reduces fuzzing execution speed and affects fuzzing efficiency. The existing mitigation methods focus on removing redundant sanitizer checks based on static analysis, ignoring the fact that most checks cannot trigger bugs. In this paper, we propose RASOF, a Runtime Adaptive Sanitizer Optimization Framework that optimizes sanitizer instrumentation during fuzzing by removing checks that are unlikely to trigger bugs. The framework operates through four components: compile-time static analysis for assessing check redundancy potential, opaque predicate instrumentation for tracking individual check executions with low additional tracking overhead, simulated annealing algorithms for generating optimization decisions based on runtime statistics, and binary modification for applying changes without recompilation. The experimental results show that RASOF achieves a 7.0% geometric mean execution-throughput improvement over AFL++/ASan while maintaining identical vulnerability detection capabilities. Across the 16 evaluated programs from the UNIFUZZ benchmark, RASOF reduces the average time-to-exposure by 0.5 hours.
In decentralized data circulation, document images such as contracts, certificates, invoices, and administrative records serve as critical data assets exchanged across institutions and platforms. While encryption, access control, and blockchain-based logging can protect data transmission and operation records, they are insufficient to guarantee the content-level integrity of circulated documents. Reliable document circulation, therefore, requires fine-grained forgery auditing that can detect subtle tampering traces under cross-domain variations caused by heterogeneous templates, scanning devices, compression pipelines, and institutional styles. To address this problem, we propose DocVerifier, a token-frequency adaptive framework for trustworthy document integrity auditing. The proposed framework integrates wavelet-based multi-scale feature decoupling with token-level vision-language alignment, enabling the model to preserve character-level forensic evidence while maintaining semantic consistency across domains. Specifically, multilevel Haar wavelet decomposition separates high-frequency manipulation traces from low-frequency style variations, reducing the interference of domain-specific appearances. A Dual-Path Low-Rank Adaptation mechanism adaptively refines content and style representations to suppress cross-domain bias, while a dynamic Attribute Memory Bank captures evolving forgery patterns across different document types through attention-guided prototype learning. By producing both document-level authenticity predictions and fine-grained tampering evidence, DocVerifier provides a content-level auditing component for trustworthy cross-domain data circulation. Extensive experiments on standard document forgery benchmarks demonstrate its effectiveness in detecting subtle text manipulations, especially under complex degradation and domain-shift scenarios. The results confirm that the proposed framework improves the robustness, traceability, and auditability of document authentication in real-world data circulation environments.
Deep Learning (DL) has emerged as a promising means for vulnerability detection due to its ability to automatically derive features from vulnerable code. Unfortunately, current solutions struggle to focus on vulnerability-related parts of vulnerable functions, and tend to exploit spurious correlations for prediction, thus undermining their effectiveness in practice. Moreover, due to the data availability issue, existing vulnerability explainers show inferior performance. In this paper, we propose Lich, a novel DL-based approach, which seamlessly integrates vulnerability detection and explanation into a unified pipeline via LLM-assisted causal graph learning. Specifically, Lich adopts a change-based sample denoising approach to automatically weed out vulnerability-irrelevant code elements in the vulnerable functions without sacrificing the label accuracy. Then, Lich constructs a novel Causality-Aware Graph Attention Network (CA-GAT) with Feature Caching Scheme (FCS) to learn causal vulnerability features while maintaining efficiency. Last, Lich develops a context-enhanced generation module equipped with the hybrid retrieval strategy to deliver human-understandable vulnerability explanations in a training-free manner. Experimental results show that Lich outperforms the state-of-the-art baselines, while offering better explainability.
Static cyber deception deployments can be fingerprinted by capable attackers, diminishing their deception value. This limitation turns the security game into a calculated interaction between the attacker and the defender. In this paper, we present a proactive defense mechanism, namely the Dynamic Bayesian Signaling Hypergame (DBSHG), which leverages signals to manipulate the opponent's decision-making and exploit information asymmetries. We model this asymmetric deception conflict by strictly aligning the defender's action spaces and utility functions with the MITRE Engage framework, prioritizing intelligence collection and persistent engagement over immediate eviction. To capture the attacker's bounded rationality, the game incorporates a Bayesian inference mechanism where the adversary continuously updates their subjective beliefs based on low-level, noisy technical indicators such as latency and jitter. Validated through Gambit's mathematical verification tool, massive Monte Carlo simulations with $10^{8}$ iterations, and empirical testing in an open-source containerized network testbed, our equilibrium signaling strategy effectively keeps the opponent in a zone of optimal ambiguity. The results demonstrate that DBSHG extends the opponent's dwell time from 3 steps in static baselines to 32 steps, successfully confining rational, risk-averse adversaries in an infinite verification loop while leaving production assets untouched.
