Export Citations
Save this search
Please login to be able to save your searches and receive alerts for new content matching your search criteria.
- research-articleJuly 2024
Learning to Detect and Localize Multilingual Bugs
Proceedings of the ACM on Software Engineering (PACMSE), Volume 1, Issue FSEArticle No.: 97, Pages 2190–2213https://doi.org/10.1145/3660804Increasing studies have shown bugs in multi-language software as a critical loophole in modern software quality assurance, especially those induced by language interactions (i.e., multilingual bugs). Yet existing tool support for bug detection/...
- research-articleJuly 2024Distinguished Paper
The Dark Side of NFTs: A Large-Scale Empirical Study of Wash Trading
Internetware '24: Proceedings of the 15th Asia-Pacific Symposium on InternetwareJuly 2024, Pages 447–456https://doi.org/10.1145/3671016.3674808NFTs (Non-Fungible Tokens) have seen significant growth since they first captured public attention in 2021. However, the NFT market is plagued by fake transactions and economic bubbles, e.g., NFT wash trading. Wash trading typically refers to a ...
- research-articleJuly 2023
BSHUNTER: Detecting and Tracing Defects of Bitcoin Scripts
ICSE '23: Proceedings of the 45th International Conference on Software EngineeringMay 2023, Pages 307–318https://doi.org/10.1109/ICSE48619.2023.00037Supporting the most popular cryptocurrency, the Bitcoin platform allows its transactions to be programmable via its scripts. Defects in Bitcoin scripts will make users lose their bitcoins. However, there are few studies on the defects of Bitcoin ...
- research-articleJuly 2024
Keep Me Updated: An Empirical Study on Embedded Javascript Engines in Android Apps
MSR '24: Proceedings of the 21st International Conference on Mining Software RepositoriesApril 2024, Pages 361–372https://doi.org/10.1145/3643991.3644901Although JavaScript (JS) has been widely used in mobile development, little is known about the security implications of utilizing JS engines shipped as native app libraries. In this paper, we conduct an empirical study by designing a JS-Inspector ...
- research-articleJune 2024
EVMBT: A Binary Translation Scheme for Upgrading EVM Smart Contracts to WASM
LCTES 2024: Proceedings of the 25th ACM SIGPLAN/SIGBED International Conference on Languages, Compilers, and Tools for Embedded SystemsJune 2024, Pages 131–142https://doi.org/10.1145/3652032.3657570Ethereum is the first and largest blockchain that supports smart contracts. To enhance scalability and security, one major planned change of Ethereum 2.0 (Eth2) is to upgrade the smart contract interpreter from Ethereum Virtual Machine (EVM) to ...
-
- research-articleJune 2024JUST ACCEPTED
FunFuzz: A Function-oriented Fuzzer for Smart Contract Vulnerability Detection with High Effectiveness and Efficiency
ACM Transactions on Software Engineering and Methodology (TOSEM), Just Accepted https://doi.org/10.1145/3674725With the increasing popularity of Decentralized Applications (DApps) in blockchain, securing smart contracts has been a long-term, high-priority subject in the domain. Among the various research directions for vulnerability detection, fuzzing has received ...
- research-articleJune 2024JUST ACCEPTED
Understanding Vulnerability Inducing Commits of the Linux Kernel
ACM Transactions on Software Engineering and Methodology (TOSEM), Just Accepted https://doi.org/10.1145/3672452The Linux kernel is popular and well-maintained. Over the past decade, around 860 thousand commits were merged with hundreds of vulnerabilities (i.e., 223 on average) disclosed every year, taking the total lines of code to 35.1 million in 2022. Many ...
- research-articleApril 2024
An Empirical Study on Oculus Virtual Reality Applications: Security and Privacy Perspectives
ICSE '24: Proceedings of the IEEE/ACM 46th International Conference on Software EngineeringMay 2024, Article No.: 159, Pages 1–13https://doi.org/10.1145/3597503.3639082Although Virtual Reality (VR) has accelerated its prevalent adoption in emerging metaverse applications, it is not a fundamentally new technology. On one hand, most VR operating systems (OS) are based on off-the-shelf mobile OS (e.g., Android). As a ...
- research-articleNovember 2023
PyRTFuzz: Detecting Bugs in Python Runtimes via Two-Level Collaborative Fuzzing
CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications SecurityNovember 2023, Pages 1645–1659https://doi.org/10.1145/3576915.3623166Given the widespread use of Python and its sustaining impact, the security and reliability of the Python runtime system is highly and broadly critical. Yet with real-world bugs in Python runtimes being continuously and increasingly reported, technique/...
- research-articleJuly 2024
CapsuleFormer: A Capsule and Transformer combined model for Decentralized Application encrypted traffic classification
ASIA CCS '24: Proceedings of the 19th ACM Asia Conference on Computer and Communications SecurityJuly 2024, Pages 1418–1429https://doi.org/10.1145/3634737.3637664Network traffic classification plays a crucial role in both network management and monitoring. Recently, an increasing number of Decentralized Applications (DApps) are appearing on various blockchain platforms. DApps employ encryption techniques such as ...
- research-articleJuly 2022
Park: accelerating smart contract vulnerability detection via parallel-fork symbolic execution
ISSTA 2022: Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and AnalysisJuly 2022, Pages 740–751https://doi.org/10.1145/3533767.3534395Symbolic detection has been widely used to detect vulnerabilities in smart contracts. Unfortunately, as reported, existing symbolic tools cost too much time, since they need to execute all paths to detect vulnerabilities. Thus, their accuracy is limited ...
- research-articleMay 2024
Contrastive Fingerprinting: A Novel Website Fingerprinting Attack over Few-shot Traces
WWW '24: Proceedings of the ACM Web Conference 2024May 2024, Pages 1203–1214https://doi.org/10.1145/3589334.3645575Website Fingerprinting (WF) attacks enable passive adversaries to identify the website a user visits over encrypted or anonymized network connections. WF attacks based on deep learning have achieved high accuracy in identifying websites based on abundant ...
- research-articleAugust 2024
Meta-Learning for Multi-Family Android Malware Classification
ACM Transactions on Software Engineering and Methodology (TOSEM), Volume 33, Issue 7Article No.: 174, Pages 1–27https://doi.org/10.1145/3664806With the emergence of smartphones, Android has become a widely used mobile operating system. However, it is vulnerable when encountering various types of attacks. Every day, new malware threatens the security of users’ devices and private data. Many ...
DeepInfer: Deep Type Inference from Smart Contract Bytecode
ESEC/FSE 2023: Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software EngineeringNovember 2023, Pages 745–757https://doi.org/10.1145/3611643.3616343Smart contracts play an increasingly important role in Ethereum platform. It provides various functions implementing numerous services, whose bytecode runs on Ethereum Virtual Machine. To use services by invoking corresponding functions, the callers need ...
- research-articleJuly 2024
Global Prosperity or Local Monopoly? Understanding the Geography of App Popularity
MSR '24: Proceedings of the 21st International Conference on Mining Software RepositoriesApril 2024, Pages 322–334https://doi.org/10.1145/3643991.3644935App stores allow developers to globally distribute their apps to gain more users and attention. In the highly competitive market of app stores, developers need to cater to a large number of users spanning multiple countries. We posit that the ...
- research-articleMay 2024
Understanding GDPR Non-Compliance in Privacy Policies of Alexa Skills in European Marketplaces
WWW '24: Proceedings of the ACM Web Conference 2024May 2024, Pages 1081–1091https://doi.org/10.1145/3589334.3645409Amazon Alexa is one of the largest Voice Personal Assistant (VPA) platforms and it allows third-party developers to publish their voice apps, named skills, to the Alexa skill store. To satisfy the needs of European users, Amazon Alexa has established ...
- research-articleApril 2024
MalCertain: Enhancing Deep Neural Network Based Android Malware Detection by Tackling Prediction Uncertainty
ICSE '24: Proceedings of the IEEE/ACM 46th International Conference on Software EngineeringMay 2024, Article No.: 150, Pages 1–13https://doi.org/10.1145/3597503.3639122The long-lasting Android malware threat has attracted significant research efforts in malware detection. In particular, by modeling malware detection as a classification problem, machine learning based approaches, especially deep neural network (DNN) ...
VGX: Large-Scale Sample Generation for Boosting Learning-Based Software Vulnerability Analyses
ICSE '24: Proceedings of the IEEE/ACM 46th International Conference on Software EngineeringMay 2024, Article No.: 149, Pages 1–13https://doi.org/10.1145/3597503.3639116Accompanying the successes of learning-based defensive software vulnerability analyses is the lack of large and quality sets of labeled vulnerable program samples, which impedes further advancement of those defenses. Existing automated sample generation ...
- surveyJuly 2023
Security Threat Mitigation for Smart Contracts: A Comprehensive Survey
ACM Computing Surveys (CSUR), Volume 55, Issue 14sArticle No.: 326, Pages 1–37https://doi.org/10.1145/3593293The blockchain technology, initially created for cryptocurrency, has been re-purposed for recording state transitions of smart contracts—decentralized applications that can be invoked through external transactions. Smart contracts gained popularity and ...
- posterSeptember 2023
Attribute-based Proxy Re-encryption with Direct Revocation Mechanism for Data Sharing in Clouds
ACM TURC '23: Proceedings of the ACM Turing Award Celebration Conference - China 2023July 2023, Pages 164–165https://doi.org/10.1145/3603165.3607460Cloud computing, which provides adequate storage and computation capability, has been a prevalent information infrastructure. Secure data sharing is a basic demand when data was outsourced to a cloud server. Attribute-based proxy re-encryption has been ...