Detecting software vulnerabilities is crucial for securing cyberspace. Traditional learning-based vulnerability detection methods rely on training models from scratch or fine-tuning pre-trained models, both of which require large labeled datasets and significant computational resources. However, acquiring well-annotated vulnerability datasets is often impractical due to high verification costs and data scarcity. To address this challenge, we propose an innovative system, RearVul, which Reparameterizes adversarial reprogramming in a low-dimensional subspace for software vulnerability detection. Unlike conventional approaches, RearVul repurposes a pre-trained image classification model using adversarial reprogramming, enabling vulnerability detection with minimal modifications to the model. By learning a universal perturbation applied to program representations, our approach retains the original model’s feature extraction capabilities while adapting it to a new domain. Furthermore, we introduce a low-dimensional reparameterization strategy that decomposes the perturbation into two smaller matrices and optimizes them during training, significantly reducing the number of trainable parameters and computational overhead. Extensive evaluations on publicly available vulnerability datasets demonstrate that RearVul achieves competitive detection accuracy while drastically improving efficiency. Notably, RearVul reduces end-to-end training time to 75min, while maintaining competitive accuracy. In data-limited settings with only 100 training samples, RearVul achieves the best accuracy (65.64%), consistently outperforming recent state-of-the-art baselines and transfer learning via fine-tuning ImageNet backbones. These results highlight its adaptability and effectiveness for real-world software vulnerability detection.

FedPDFGuard is the first federated learning-based system for PDF malware detection. It enables decentralized model training across participants while preserving data privacy. Our evaluation shows that FedPDFGuard achieves detection accuracy comparable to centralized methods, addressing privacy concerns and improving robustness against increasingly sophisticated PDF-based cyberattacks.

Reverse engineering process serves essential functions in software analysis and security auditing and malware detection but requires significant time and effort. Researchers and practitioners now investigate how Artificial Intelligence (AI) technology can automate and improve different reverse engineering procedures. This survey provides an extensive evaluation of recent AI-based reverse engineering techniques which focus on software decompilation and function identification as well as control flow recovery and vulnerability analysis. The paper presents a classification system for existing methods while comparing them through an analysis of their development from traditional rule-based systems to contemporary deep learning frameworks. The research examines fundamental datasets together with field tools and evaluation metrics. This paper establishes a fundamental understanding of AI integration in reverse engineering for software security while discussing future development directions.

This work introduces the concept of software sanitization locality and conducts empirical measurements. We define software sanitization locality as the property wherein the sanitization operation, if present, remains proximate to its protected API. To quantify this property, we have introduced a range of metrics to illustrate the distance between a sanitization operation and its protected API from various perspectives, including both the abstract syntax tree level and the binary level. In an effort to validate the concept of sanitization locality, we have also gathered and labeled a dataset of programs containing security patches to conduct empirical measurements. This dataset encompasses a diverse array of 16 typical vulner-abilities sourced from the Linux kernel codebase. The findings conclusively illustrate that the analyzed samples do exhibit the hypothesized sanitization locality.

We designed an innovative method, namely iBase, which automatically infers the image base address of an ARM32 binary by statistically, structurally, and semantically correlating the absolute and the relative addresses contained in the binary. iBase exploits ARM32's architecture features, and hence it is immune to variances introduced by software development and compilation. In addition, iBase is parameter-free and it requires no manual configuration. We implemented iBase and performed evaluation using 20 ARM32 binaries. Our evaluation results have shown that iBase successfully detects base addresses for all of them and outperforms start-of-the-art tools including Ghidra and Radare2.

Recent Machine Learning–Assisted Software Vulnerability Detection (MLAVD) research has focused on large-scale models with hundreds of millions of parameters powered by expensive attention- or graph-based architectures. Despite increased model capacity, current models have limited accuracy and struggle to generalize to unseen data. Additionally, the computational resources required to train and serve the models further reduce their usefulness. We argue this is caused by a misalignment between how human brains process code and how MLAVD models are designed. In this paper, we study resource-efficient approaches to MLAVD with the goal of maintaining or strengthening generalizability while reducing computational costs such that the model may be run on an economy developer machine. Our contributions are as follows: (1) We perform the first known study of resource-efficient MLAVD, showing such models can be competitive with strong MLAVD baselines; (2) We design Vul-Mixer, a resource-efficient architecture inspired by how the human brain processes code; and, (3) We demonstrate that Vul-Mixer is efficient and effective by maintaining 98.3% of the state-of-the-art generalization ability using only 0.2% of the parameters and 173 MB of memory.

This paper introduces UQuery, a novel framework designed for agile security analysis of server-side web applications. UQuery employs a dependency graph, an innovative program representation that concurrently models data and control dependencies. This graph model facilitates efficient data- and control-flow analyses by converting them into intuitive graph queries. Currently, UQuery includes two security applications: one for detecting unrestricted file upload vulnerabilities and another for identifying information leakage through exploitable race conditions. It has detected vulnerabilities in 16 applications, resulting in the discovery of 6 previously unreported CVEs.

Many intelligent sensing systems rely heavily on automatic analysis tools to extract high level information from the raw videos or images captured by cameras. In particular, deep-learning-based computer vision solutions have shown promising results in analysis tasks ranging from image segmentation to object detection and recognition. In practical systems, image distortions due to factors such as noise and blur may degrade the accuracy of these analysis tools. This paper proposes a no-reference image quality assessment model for predicting the quality of images from the perspective of three major computer vision tasks: image segmentation, image classification, and object detection. A data set is constructed that considers distortions including noise, blur, and bad lighting, which commonly occur during the image acquisition process in diverse applications. Three widely used deep-learning-based algorithms are considered to label the quality of the images in the dataset. A set of light-weight features are extracted to characterize the structure of the content in an image. Based on the data set and the extracted features, a classification model is built to predict the quality of images used in computer vision tasks. Experimental results show that the proposed model offers more accurate predictions than common image quality measures such as BRISQUE, NIQE, and PIQE.

Website fingerprinting (WFP) could infer which websites a user is accessing via an encrypted proxy by passively inspecting the traffic characteristics of accessing different websites between the user and the proxy. Designing WFP attacks is crucial for understanding potential vulnerabilities of encrypted proxies, which guides the design of defensive measures against WFP. In this paper, we design a novel WFP attack against (popular) encrypted proxies that relay connections between the user and the proxy individually (e.g., Shadowsocks, V2Ray), and accordingly implement lightweight countermeasures to effectively defend against the attack. The attack features flow-context-aware and is both accurate and immediately deployable, because it fully considers the obstacle (dubbed training-testing asymmetry) that fundamentally limits the practicability of WFP and addresses the obstacle with built-in spatial-temporal flow correlation mechanism. We implement the countermeasure as middleboxes installed on both the client and server sides of encrypted proxies, without altering any existing infrastructures for compatibility. The middleboxes can obfuscate a website's flow regularities across different visits. Large-scale experiments in real-world scenarios demonstrate that the WFP attack can generally achieve a detection rate above 98.8% with a false positive rate below 0.2%. The countermeasure forces the attack's false positive rate to be above 0.2 and true positive rate to be below 0.9 with just five persistent TCP connections while introducing very limited bandwidth overhead (e.g., 0.49%) and almost-zero additional network latency.

In this paper, we consider how the ability to learn Code Execution Tasks affects a model’s accuracy on software vulnerability detection (SVD) benchmark datasets. We initially find that models can achieve near state-of-the-art accuracy on SVD benchmarks regardless of their ability to learn Code Execution Tasks. However, these models fail to generalize well across SVD benchmarks. The results indicate a bias in the datasets that allows models to predict non-SVD signals. Under the theory that different collection methods will reduce biases, we investigate combining the SVD datasets. When trained on combined datasets, SVD accuracy is reduced but correlation with Code Execution Task accuracy improves. Our contributions are (1) using a reversed curriculum learning to evaluate model capabilities, (2) demonstrating the criticality of code execution understanding to machine learning–assisted software vulnerability detection, (3) evidence that improved diversity of SVD datasets will lead to improved accuracy and generalizability, (4) and benchmarks of recent models across multiple SVD datasets.

The rapid evolution of cyber threats raises the inevitability of the advancement of innovative and effective approaches in cybersecurity. There are numerous cyber threats; among these threats, malicious code, including viruses, worms, and sophisticated malware, poses significant risks to digital systems. The existing threat detection methods often rely on signature-based techniques and need help to keep pace with the dynamic and evolving characteristics of malware. Large language models (LLMs) such as GPT-4, renowned for their ability to perform natural language processing, offer a promising alternative for enhancing malicious code detection. This research paper proposes a novel approach using large language models (LLMs) to detect unwanted malicious code in Java source code, leveraging the Mixtral architecture. The Mixtral model is trained on a diverse dataset of benign and malicious Java code, enabling it to learn complex patterns and characteristics of malicious code. Experimental results validate the efficiency of the proposed in identifying malicious code, outperforming existing static analysis tools.

Deep learning has proven to be promising for traffic finger-printing that explores features of packet timing and sizes. Although well-known for automatic feature extraction, it is faced with a gap between the heterogeneousness of the traffic (i.e., raw packet timing and sizes) and the homogeneousness of the required input (i.e., input-specific). To address this gap, we design an input-agnostic hierarchical deep learning framework for traffic fingerprinting that can hierarchically abstract comprehensive heterogeneous traffic features into homogeneous vectors seamlessly digestible by existing neural networks for further classification. The extensive evaluation demonstrates that our framework, with just one paradigm, not only supports heterogeneous traffic input but also achieves better or comparable performance compared to state-of-the-art methods across a wide range of traffic fingerprinting tasks.

Open Charge Point Protocol (OCPP) 1.6 is widely used in the electric vehicle (EV) charging industry to communicate between Charging System Management Services (CSMSs) and Electric Vehicle Supply Equipment (EVSE). Unlike OCPP 2.0.1, OCPP 1.6 uses unencrypted websocket communications to exchange information between EVSE devices and an on-premise or cloud-based CSMS. In this work, we demonstrate two machine-in-the-middle attacks on OCPP sessions to terminate charging sessions and gain root access to the EVSE equipment via remote code execution. Second, we demonstrate a malicious firmware update with a code injection payload to compromise an EVSE. Lastly, we demonstrate two methods to prevent availability of the EVSE or CSMS. One of these, originally reported by SaiFlow, prevents traffic to legitimate EVSE equipment using a DoS-like attack on CSMSs by repeatedly connecting and authenticating several CPs with the same identities as the legitimate CP. These vulnerabilities were demonstrated with proof-of-concept exploits in a virtualized Cyber Range at Wright State University and/or with a 350 kW Direct Current Fast Charger at Idaho National Laboratory. The team found that OCPP 1.6 could be protected from these attacks by adding secure shell tunnels to the protocol, if upgrading to OCPP 2.0.1 was not an option.

Online social networks (OSN) have started to integrate financial capabilities such as the usage of virtual currency. In OSNs with such capabilities, user accounts can also be used as financial accounts to manage virtual currency. Attackers are highly motivated to compromise user accounts and engage them in transactions to "steal" virtual currency. Such attacks represent a real and ongoing threat against a massive number of users in global social networks such as Tencent QQ. Aiming to address this emerging security concern, we have proposed an effective system, namely VC-Guard, to detect transactions that are likely initiated by attackers (i.e., suspicious transactions). Our system features the design and integration of multi-faceted features of each transaction. We have performed extensive experiments based on real-world data collected from Tencent QQ, a global leading OSN that has a virtual-currency-enabled ecosystem. Experimental results have demonstrated that our system has accomplished a high detection rate of 98.76% at a very low false positive rate of 1.24%.

The identification of underground formation lithology is fundamental in reservoir characterization during petroleum exploration. With the increasing availability and diversity of well-logging data, automated interpretation of well-logging data is in great demand for more efficient and reliable decision making for geologists and geophysicists. This study benchmarked the performances of an array of machine learning models, from linear and nonlinear individual classifiers to ensemble methods, on the task of lithology identification. Cross-validation and Bayesian optimization were utilized to optimize the hyperparameters of different models and performances were evaluated based on the metrics of accuracy—the area under the receiver operating characteristic curve (AUC), precision, recall, and F1-score. The dataset of the study consists of well-logging data acquired from the Baikouquan formation in the Mahu Sag of the Junggar Basin, China, including 4156 labeled data points with 9 well-logging variables. Results exhibit that ensemble methods (XGBoost and RF) outperform the other two categories of machine learning methods by a material margin. Within the ensemble methods, XGBoost has the best performance, achieving an overall accuracy of 0.882 and AUC of 0.947 in classifying mudstone, sandstone, and sandy conglomerate. Among the three lithology classes, sandy conglomerate, as in the potential reservoirs in the study area, can be best distinguished with accuracy of 97%, precision of 0.888, and recall of 0.969, suggesting the XGBoost model as a strong candidate machine learning model for more efficient and accurate lithology identification and reservoir quantification for geologists.

Unrestricted file upload vulnerabilities enable attackers to upload malicious scripts to a web server for later execution. We have built a system, namely UFuzzer, to effectively and automatically detect such vulnerabilities in PHP-based server-side web programs. Different from existing detection methods that use either static program analysis or fuzzing, UFuzzer integrates both (i.e., static-fuzzing co-analysis). Specifically, it leverages static program analysis to generate executable code templates that compactly and effectively summarize the vulnerability-relevant semantics of a server-side web application. UFuzzer then "fuzzes" these templates in a local, native PHP runtime environment for vulnerability detection. Compared to static-analysis-based methods, UFuzzer preserves the semantics of an analyzed program more effectively, resulting in higher detection performance. Different from fuzzing-based methods, UFuzzer exercises each generated code template locally, thereby reducing the analysis overhead and meanwhile eliminating the need of operating web services. Experiments using real-world data have demonstrated that UFuzzer outperforms existing methods in either efficiency, or accuracy, or both. In addition, it has detected 31 unknown vulnerable PHP scripts including 5 CVEs.

Website fingerprinting (WFP) could infer which websites a user is accessing via an encrypted proxy by passively inspecting the traffic between the user and the proxy. The key to WFP is designing a classifier capable of distinguishing traffic characteristics of accessing different websites. However, when deployed in real-life networks, a well-trained classifier may face a significant obstacle of training-testing asymmetry, which fundamentally limits its practicability. Specifically, although pure traffic samples can be collected in a controlled (clean) testbed for training, the classifier may fail to extract such pure traffic samples as its input from raw complicated traffic for testing. In this paper, we are interested in encrypted proxies that relay connections between the user and the proxy individually (e.g., Shadowsocks), and design a context-aware system using built-in spatial-temporal flow correlation to address the obstacle. Extensive experiments demonstrate that our system does not only enable WFP against a popular type of encrypted proxies practical, but also achieves better performance than ideally training/testing pure samples.

A web shell is a server-side script uploaded by an attacker to enable persistent access on a compromised machine. Detecting web shells is therefore of significant importance. In this paper, we present a novel system named ShellBreaker to detect web shells written in PHP, one of the leading languages used for server-side script development. ShellBreaker performs detection by correlating syntactical and semantic features that systematically characterize web shells through three aspects including (i) their communication with external users/attackers, (ii) their adaption to the run-time environment, and (iii) their usage of sensitive operations. We have evaluated ShellBreaker using real-world, PHP-based web shells and benign PHP scripts. Experimental results have demonstrated that ShellBreaker can achieve a high detection rate of 91.7% at a low false positive rate of 1%.

A web shell is a server-side script uploaded by an attacker to enable persistent access on a compromised machine. Detecting web shells is therefore of significant importance. In this paper, we present a novel system named ShellBreaker to detect web shells written in PHP, one of the leading languages used for server-side script development. ShellBreaker performs detection by correlating syntactical and semantic features that systematically characterize web shells through three aspects including (i) their communication with external users/attackers, (ii) their adaption to the run-time environment, and (iii) their usage of sensitive operations. We have evaluated ShellBreaker using real-world, PHP-based web shells and benign PHP scripts. Experimental results have demonstrated that ShellBreaker can achieve a high detection rate of 91.7% at a low false positive rate of 1%.

Among the most important reasons why people communicate with each other is to share and support each other through emotional problems, yet most online social systems are uncomfortable or unsafe spaces for this purpose. This has led to the development of online emotional support systems, where users needing to speak to someone can anonymously connect to a crowd of trained listeners for a one-on-one conversation. Toward understanding the qualities of this emerging type of online social system, this article examines the users, conversations, and activities performed across 7 Cups, a massive, vibrant emotional support system with a community of listeners ready to help those with any number of emotional issues. The study makes intriguing insights along the worldwide adoption of the service, the need of its users to seek support from many others, a power-law effect of listener popularity, that users have a penchant to connecting to others along common interests and that a core periphery-like structure emerges among conversation networks, and identifies qualities of the system that drive user engagement and retention. We further study the words and actions of misbehaving users who have been reported on or blocked, and build a machine learning classifier able to anticipate their undesirable actions with reasonable accuracy and very low false positive rate. The qualities recovered gave insight into the user dynamics and communication structure of an online emotional support service, the features that drive engagement, and a means of identifying misbehaving users automatically.