Abstract:Since its inception, the Java programming language has been in a process of constant development and evolution. As new language features and programming paradigms continuously emerge, Java’s expressiveness and execution efficiency are steadily improving, driving progress in the whole software ecosystem. To ensure the security and stability of the Java ecosystem, researchers have designed multiple test program generation methods for Java compilers and virtual machines to detect potential defects. However, the existing research primarily focuses on designing test program generation methods or mutation strategies for mature Java syntax, making it challenging to effectively test new language features. To this end, this study proposes LumiX, a test program generation method for Java’s new features based on large language models (LLMs). First, LumiX adopts LLMs to summarize new language features using natural language descriptions and obtains the usage descriptions of the new features. Then, it employs historically bug-revealing test programs as seed programs and applies program analysis tools to extract reusable program elements from the seed programs. By combining the usage descriptions of new features, LLMs are employed to generate code snippets that incorporate the new features. The newly generated code snippets are then inserted into the seed programs to generate test programs that can cover the new features. Finally, LumiX designs a dual-layer differential testing method, which utilizes different Java compilers (javac and ECJ) and virtual machines (HotSpot and OpenJ9) to compile and execute the newly generated test programs, with potential defects detected by comparing the execution results of different compilers and virtual machines. Experimental results show that LumiX can effectively generate test programs that cover Java’s new language features and enhance the testing capabilities of existing tools for Java’s new language features. Additionally, this study applies LumiX to the latest released Java compilers and virtual machines, and a total of 16 unknown defects have been discovered, 12 of which have been confirmed or fixed by developers.

Abstract:The safety of software package repositories is a critical aspect of software supply chain analysis, but existing research and tools often lack effective analysis of foreign language calls in the package repositories. As the official package repository for Python, PyPI stores a vast amount of Python software packages from various application domains. In addition to programs written in Python, these packages often include C/C++ foreign language programs that are called via Python’s foreign interface—the Python/C API. Analyzing the safety of foreign language calls in Python package repositories is crucial for ensuring the safety and reliability of software supply chains. By analyzing official documentation for interoperability and relevant methods and tools for interoperability program analysis, a bug benchmark suite for Python-C/C++ interoperability programs is established. This suite includes benchmark test programs for 15 bug patterns across nine categories, covering five language features of the memory, type, exception, concurrency, and numerical issues, as well as interoperability program bugs in the 16 most installed PyPI software packages that involve C/C++ foreign calls. By evaluating the existing state-of-the-art Python-C/C++ interoperability bug checkers on the bug benchmark suite, a comparative analysis of the reliability, completeness, and scalability of existing research and tools is conducted, with the current status and limitations of Python-C/C++ interoperability safety analysis analyzed and summarized. By analyzing more than 700 bug warnings, 21 new real-world bugs across three bug patterns are found in six PyPI repositories.

Abstract:As an emerging online communication platform, Discord has been widely adopted in the process of open-source software development in recent years. Existing research on Discord proposes specific methods and technologies to help software practitioners efficiently retrieve information, identify duplicate questions in conversation history, and build message datasets to mine valuable information. However, there is still a lack of systematic and comprehensive empirical research on the communication behavior of open-source software practitioners on Discord. The in-depth analysis of this kind of communication behavior is of significance for improving the collaboration efficiency of open-source communities and solving the problems in the process of open-source software development. This study conducts extensive empirical studies on the communication of open-source software practitioners on Discord, constructing two datasets. The first dataset contains 616443 messages from seven open-source software communities, and the second dataset is built on the first dataset via manual selection and validation, containing 17289 high-quality messages. Based on the two datasets, the communication characteristics of open-source software practitioners are systematically characterized from the message and conversation dimensions, including participation, interaction patterns, and discussion topics. Additionally, the influence of these communication characteristics on the response time of conversations and problem-solving status is evaluated. Finally, by combining the research findings, this study summarizes the insights for the design of online communication platforms, proposes recommendations for open-source community management, and points out future research directions for in-depth exploration.

Abstract:Open-source software is deeply embedded in enterprise product research, development, and delivery processes, shortening development cycles, reducing costs, and enhancing system compatibility. Meanwhile, attacks targeting the open-source software supply chain continue to increase and have become one of the most critical security threats to the software industry. From an industrial research and development (R&D) perspective, this study analyzes the inherent tension between R&D efficiency and software security and identifies an implicit consensus in industrial practice: under efficiency constraints imposed by process compliance, organizations tend to respond passively to open-source software supply chain security threats. Through representative real-world cases, it is demonstrated that security systems primarily driven by process compliance are insufficient to address open-source software supply chain attacks. From an industrial perspective, this study further proposes an evolutionary classification framework of open-source software supply chain attacks, in which attacks are categorized into three stages: threat emergence during open-source co-development, threat evolution during closed-source industrial R&D, and attack manifestation during product deployment and usage. For each stage, typical attack patterns and technical mechanisms are systematically summarized. Based on this analysis, a security rebalancing framework for the open-source software supply chain is proposed from three complementary dimensions: collaborative governance oriented toward the open-source ecosystem, continuous compliance, and attack-surface reduction oriented toward industrial R&D processes, and adaptive protection mechanisms oriented toward deployed products.

Abstract:Third-party libraries (TPLs) are widely used in software development but also introduce risks such as security vulnerabilities and license conflicts. In response, software composition analysis (SCA) has emerged to help developers detect security vulnerabilities, outdated patches, and license compliance issues by identifying and analyzing open-source components and their dependencies, thereby ensuring the security of software supply chains. However, existing SCA techniques in the C/C++ domain face three major limitations: a lack of comprehensive TPL feature libraries, difficulty in detecting library-granularity reuse, and insufficient capability to analyze TPL dependencies. To address these limitations, a SCA technique for C/C++ source code—CAnalyzer—is proposed for software library-granularity reuse detection scenarios. By integrating data from 15 platforms, CAnalyzer builds a feature database containing 33100 TPLs with 30047290 functions. Meanwhile, the precision of TPL detection is significantly improved through feature database preprocessing and a multi-threshold matching strategy. Additionally, CAnalyzer analyzes dependency directives in the source code to automatically construct dependencies among TPLs. Experimental results show that CAnalyzer achieves a precision of 90.63% and a recall of 86.57% in TPL detection, outperforming CENTRIS, TPLite, and OSSFP in both metrics. In TPL dependency detection, CAnalyzer achieves a recall of 94.79% and a precision of 98.99%. Currently, CAnalyzer has been adopted by the OpenHarmony community and has identified 166 external components across 689 code repositories, demonstrating its practical value in open-source community management.

Abstract:Log data record system operating status, user behavior, and error information. Log-based anomaly detection enables the rapid identification of potential security risks or performance bottlenecks, thereby enhancing operational efficiency and facilitating fault diagnosis. However, existing log anomaly detection methods still face several challenges, including the inability to effectively adapt to log pattern changes caused by system updates and the lack of efficient feedback mechanisms to consistently maintain detection performance. To address these issues, this study proposes a log anomaly detection framework, PCLog, which adopts the proximal policy optimization (PPO) algorithm from reinforcement learning for model training. In the proposed framework, the detection model is formulated as an agent, semantic vectors of logs are regarded as states, and events are treated as actions. By maximizing the cumulative rewards of normal sequences, normal system behavior patterns are learned to enable anomaly detection. In addition, when detection performance decreases, PCLog collects mispredicted samples as expert demonstration data and integrates behavior cloning from imitation learning to maximize the log-likelihood of expert data. This mechanism enables the model to more effectively approximate expert behavior, achieve adaptive self-correction, reduce false positives, and enhance long-term reliability. Experimental results on three public log datasets, HDFS, BGL, and OpenStack, show that PCLog outperforms existing methods and exhibits high adaptability to dynamic log patterns.

Abstract:Software fault localization tasks begin with the program execution failure, and locate the root cause of the fault at the code level by analyzing the abnormal internal state during program execution. The current mainstream spectrum-based and mutation-based fault localization techniques, and state-of-the-art technique SmartFL utilize coverage information, mutation information, and information represented by program semantics respectively as windows to observe the internal state of the program. The employed information is too broad and not targeted enough, and the three types of technology are limited by bottlenecks such as the tie of statement risk values, excessive mutation cost, and large information scale. To this end, EXPECT, a fault localization technique based on exception trigger information, has been proposed recently to monitor the execution state of program failure via the program’s built-in exception handling statements (Try-catch blocks), achieving fault localization effectiveness that surpasses the aforementioned mainstream techniques at a lower cost. The premise of EXPECT is that the faulty program must contain enough exception handling statements. However, in the real open-source environments, many software programs do not have a good exception handling mechanism, which causes their codes to contain only very sparse or even no exception handling statements, thus directly affecting the basis on which EXPECT runs. To this end, a software fault localization method based on exception checkpoint injection, INSPECT (inserted checkpoint-based fault localization), is proposed. By automatically injecting temporary exception handling statements into the faulty program as checkpoints for the internal state during running, and designing a more sophisticated method for program statements’ risk value calculation, the application scope of EXPECT is extended to more general programs that do not contain exception handling statements. The application scenario of exception trigger information as an efficient source of data for fault localization is extended to achieve generalization improvement. Experimental results show that INSPECT obtains better fault localization effectiveness than the current state-of-the-art technique with improvements of 95.25%, 55.92%, and 16.65% (simulated faults) as well as 93.39%, 57.54%, and 13.92% (real-world faults) in the best, average, and worst EXAM metrics respectively, and 311.47% (simulated faults) and 283.31% (real-world faults) in the MRR metric.

Abstract:As the large language models (LLMs) rapidly advance in code generation, their generated code gains increasingly widespread applications in intelligent foundational software supply chains. The foundational software supply chains integrate a large number of third-party modules and components developed by employing LLM-generated code. However, since LLMs are primarily trained based on open-source code, defects and security vulnerabilities in the training code may cause potential errors in the generated code and security problems in the software supply chain. To this end, targeted testing techniques such as EvalPlus have been proposed, but it is difficult for these techniques to achieve the full coverage of critical paths in the supply chain due to their reliance on probability-based test case generation, which makes it hard to uncover deep-seated logical software defects. To solve the above-mentioned problems, this study proposes a defect detection method for LLM-generated code in software supply chains that integrates symbolic execution. This method employs a symbolic execution mounting mechanism to automatically identify input parameters in LLM-generated code and perform adaptation and symbolic mounting. It then guides the symbolic execution engine to conduct precise constraint analysis on the program’s critical paths and generate efficient boundary test cases, thus detecting deep-seated logical software defects that the existing methods struggle to detect. This study conducts experimental evaluation on the top 11 mainstream LLMs from the LMSYS Chatbot Arena by adopting existing mainstream benchmark datasets. Experimental results show that the proposed method can more effectively detect logical defects in LLM-generated code, reducing the average test pass rate by 3.99% to 18.98% and increasing the average test coverage by 3.31% to 8.19%. Finally, the correctness of LLM-generated code and the security of intelligent foundational software supply chains are effectively improved.

Abstract:As a core technology for vulnerability detection in Web applications, static application security testing (SAST) holds widespread industrial applications. However, existing static analysis tools face challenges in handling complex logical structures in modern Web applications, such as asynchronous request patterns and multi-source input semantics, due to limitations in the underlying design of taint analysis algorithms. To this end, this study proposes a multi-data flow static analysis method for security vulnerability detection in Web applications, which is aimed at extending the ability of traditional taint analysis algorithms in multiple dimensions to improve both detection performance and generalization. Vertically, the multi-stage data flow analysis is introduced to comprehensively consider the data dependency across different control flow paths via correlation and iterative algorithms, thereby effectively supporting the detection of deep vulnerabilities that require multiple asynchronous calls to be triggered. Horizontally, the multi-tag data flow analysis is introduced to distinguish different input sources via taint tags, thereby obtaining more detailed program context semantic information and enhancing vulnerability detection Precision related to complex semantics. Based on the above-mentioned method, a vulnerability detection prototype system named MultiFlow is developed for Java/JavaScript Web applications. Experimental evaluations demonstrate that MultiFlow’s multi-data flow analysis method features sound effectiveness on a dataset containing 60 real-world Web applications and third-party components, yielding Precision of 87.18%, 75.00%, and 83.72% respectively on complex Web vulnerability detection tasks including stored vulnerabilities, broken access control, and prototype pollution, with eight CVE IDs obtained. Compared with the existing methods, MultiFlow achieves higher Precision and Recall with less analysis overhead, thereby validating its practical significance.

Abstract:To address the dual challenges of data privacy and project heterogeneity in cross-project software defect prediction, this study proposes a framework named PRIDE-SDP. The core contribution of the proposed framework lies in the deep integration of three key techniques. First, a personalized federated learning paradigm is adopted to customize dedicated prediction models for heterogeneous projects. Second, an (ε, δ)-differential privacy mechanism with rigorous mathematical guarantees is integrated to ensure that data remains local. Third, a dedicated temporal-contextual fusion network (TCFN) is designed to efficiently capture software metric features. Experiments conducted on six dataset groups covering 27 open-source projects and 3 enterprise projects validate the effectiveness of the proposed framework. Compared with state-of-the-art cross-project defect prediction baselines, PRIDE-SDP achieves an average improvement of 10.7% in AUC and 7.3% in F1-score. More pronounced performance gains are observed on enterprise datasets, where average improvements of 45.2% in MCC, 29.5% in Effort@20%, and 35.4% in F1-score are obtained over all advanced baseline methods. Meanwhile, under strong privacy guarantees, the framework’s average performance retention rate remains above 98% of the optimal performance, and the attack accuracy in membership inference attack experiments is reduced by more than 36% on average. Experimental results demonstrate that PRIDE-SDP effectively balances high predictive performance with privacy protection and personalized adaptation capabilities.

Abstract:Graph neural networks (GNNs) have achieved remarkable performance on graph classification tasks, but their black-box nature has raised widespread concerns about the explainability of their prediction process. As a self-explaining mechanism, rationale extraction has received increasing attention in recent years. Its goal is to extract concise subgraph structures from the original graph (i.e., rationale subgraphs) as explanations while generating prediction results. However, existing methods often rely on spurious shortcut features in the data, resulting in explanations that lack faithfulness, which in turn compromises both the interpretability and robustness of the model. To address these issues, this study proposes a complement-aware rationale extraction (CaR) method, which treats the subgraph regions not selected as rationales as complement information. The method enhances counterfactual modeling and interpretability from the following three perspectives. First, a contrastive learning mechanism is introduced to disentangle rationale representations from complement representations, enhancing their semantic independence. Second, an echo-learning strategy is proposed to fully leverage the intermediate representations generated during the message-passing process of GNNs, capturing the structural differences in complement parts across different network depths. Finally, the method combines complement and rationale representations from both current and historical layers to construct counterfactual samples, increasing the diversity of the training data. Extensive experiments on multiple real-world benchmark datasets and a synthetic dataset demonstrate the effectiveness of CaR in producing faithful rationales.

Abstract:With the growing demand for wireless communication quality in high-speed railway (HSR), ensuring communication reliability in high-mobility scenarios has become a critical challenge. Constructing a reliable channel model is the key to addressing this issue. To build a highly general and reliable channel model, composite wireless communication channel modeling requires full consideration of the actual operating environment and channel propagation characteristics. With rigorous mathematical modeling and logical reasoning capabilities, the formal method demonstrates significant advantages in complex wireless channel modeling. Focusing on the typical HSR communication scenario of viaducts, this study proposes a high-order logic model of composite wireless communication channels based on a small-scale fading model using the formal method. To address the long-tail characteristic of composite channels, the theorem proving technique is used to verify that the probability density function (PDF) of the composite wireless communication channel conforms to the distribution of the modified Bessel function of the second kind.

Abstract:Fault localization is one of the most expensive, tedious, and time-consuming activities in software debugging, and it is also an indispensable step in software maintenance. Due to the variability of faults, fault localization is even more challenging in software product lines. Although significant progress has been made in fault localization for single-system software, research on fault localization for variability in software product lines is still insufficient. Meanwhile, existing methods face challenges such as low efficiency and poor root cause localization due to the issues of repeated generation and checking of feature interactions, as well as the propagation of faults between program statements. To address this, this study proposes an efficient and accurate fault localization method for software product lines, which performs localization at both the feature level and the statement level. At the feature level, based on observations of inclusion relationships and identical subsets between suspicious feature selection sets, the method identifies suspicious feature interactions more efficiently. At the statement level, a reduced causal model with mediator variables is used, combining causal effects and spectrum-based effects to achieve more precise fault localization. Four advanced fault localization methods for software product lines are selected, and experiments are conducted on six real-world software product line systems for comparison. The results demonstrate that the proposed method significantly outperforms other mainstream methods in terms of localization efficiency and accuracy.

Abstract:Deep learning models face some security risks, and security breaches in their applications can lead to severe consequences. Enhancing the security of deep learning models is therefore necessary. Existing reinforcement methods include adversarial training against adversarial noise, adversarial noise purification methods, and others. Among them, adversarial training is the most widely used method and provides effective defense against adversarial attacks. However, models trained with adversarial training often suffer from insufficient robust generalization and considerable loss of original accuracy. To address these issues, this study proposes a new adversarial training method called proxy-distribution-based adversarial training (PBAT). The proposed method employs a probabilistic model to capture the distribution patterns of data samples and generate enhanced training samples that balance original accuracy and robustness. The resilience of the model is further enhanced through an adjusted training process. Experiments are conducted using ResNet-20 and GoogLeNet on two benchmark datasets, CIFAR10 and MNIST. Furthermore, experiments are conducted on the Faster R-CNN model and the PASCAL VOC dataset for object detection tasks. The experimental results demonstrate that PBAT outperforms four representative methods.

Abstract:The rapid development of quantum computers poses significant threats to existing cryptographic systems. The implementation and migration of post-quantum cryptographic algorithms are therefore of utmost importance. Among these, NTRU lattice-based cryptographic schemes have gained attention due to their simplicity and computational efficiency. The CTRU-Prime scheme, based on NTRU lattices, stands out for its excellent performance in security, bandwidth, and implementation efficiency. Given the powerful capabilities of GPUs in handling large-scale parallel processing tasks, this study presents the first high-throughput implementation of CTRU-Prime using Tensor Core and compute unified device architecture (CUDA) Core. The underlying algebraic structure of CTRU-Prime is large-Galois-group prime-degree prime-ideal number field (LPPNF), which not only resists attacks targeting cyclotomic rings but also presents challenges for the implementation of polynomial multiplication. First, two GPU implementations of polynomial multiplication over LPPNF are proposed. The CUDA Core-based Pseudo-Mersenne incomplete NTT polynomial multiplication uses layer fusion techniques to optimize memory access patterns, achieving a throughput of 256.98 times. The Tensor Core-based schoolbook polynomial multiplication converts polynomial multiplication into matrix operations, leveraging low-precision matrix-multiply-and-accumulate (MMA) operations, achieving a throughput of 177.24 times. Next, an overall architecture for CTRU-Prime on the GPU platform is presented, focusing on throughput. This architecture combines batch mode and single mode, multi-stream technology, and multi-thread techniques. Optimization strategies such as fused kernels, coalesced global memory access, and optimized memory access patterns are employed to accelerate memory access and computation speeds of various kernel functions. Experimental results show that, on the RTX 3060 platform, CTRU-Prime-653, CTRU-Prime-761, and CTRU-Prime-1277 can perform key generation at rates of 63000, 54000, and 16000 times per second, respectively; key encapsulation at rates of 635000, 2745000, and 1601000 times per second, respectively; and key decapsulation at rates of 351000, 2622000, and 1524000 times per second, respectively. These rates are 68.85, 79.78, and 66.84 times higher for key generation, 10.32, 46.57, and 46.81 times higher for key encapsulation, and 11.43, 89.19, and 90.32 times higher for key decapsulation compared to the C implementation. Compared to the latest Kyber implementation, the key encapsulation throughput is 1.46 times higher, and the key decapsulation throughput is 1.74 times higher, making it 26 times more efficient than other high-throughput NTRU lattice-based GPU implementations.

Abstract:As the research on audio adversarial attacks advances, improving the transferability of adversarial audio across different models and ensuring its imperceptibility (that is, highly similar to the original audio in auditory perception) at the same time have become a research hotspot. This study proposes a new method called speak information attack (SIAttack) that can simultaneously improve the imperceptibility and transferability of adversarial audio. Specifically, the core idea of this method is to decouple speaker information from content information in the audio, and then apply small perturbations only to the speaker information, thereby achieving efficient attacks on the speaker recognition system under the premise of keeping the content information unchanged. The experiments on four speaker recognition models and three mainstream commercial APIs show that the audio generated by SIAttack is almost indistinguishable from the original audio, and can mislead all test models with a high success rate. Additionally, the transfer success rate on speaker recognition models can reach up to 100%.