检索结果-内蒙古大学图书馆

Why Smart Contracts Reported as Vulnerable Were Not Exploited?

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2025年第3期22卷 2579-2596页

作者： Hu, Tianyuan Li, Jingyue Li, Bixin Storhaug, Andre Southeast Univ Sch Comp Sci & Engn Nanjing 211189 Peoples R China Norwegian Univ Sci & Technol Dept Comp Sci N-7034 Trondheim Norway

Smart contract security is crucial for blockchain applications. While studies suggest that only a small fraction of reported vulnerabilities are exploited, no follow-up research has investigated the reasons behind this. Our goal is to understand the factors contributing to the low exploitation rate to improve vulnerability detection and defense mechanisms. We collected 136,969 real-world smart contracts and analyzed them using seven vulnerability detectors. We applied Strauss' grounded theory to gain insights into exploitability and analyzed transaction logs to trace the historic exploitations. Among the 4,364 smart contracts flagged as vulnerable, a significant 75.25% were found to be unexploitable, meaning they were either false positives or posed no security risk. We identified ten reasons for reporting unexploitable vulnerabilities. Furthermore, we found that only 66 out of 1,080 (6%) exploitable contracts had been exploited. We compared the characteristics of exploited versus non-exploited vulnerabilities and identified five factors that may reduce the likelihood of exploitation. Our findings highlight the importance of not treating smart contracts as conventional object-oriented (OO) applications. Researchers must account for the unique features of Solidity, smart contract design principles, and execution environments. Based on these insights, we propose six recommendations to improve smart contract vulnerability detection, prioritization, and mitigation.

关键词： Smart contracts Detectors Blockchains Security Fuzzing source coding Static analysis Knowledge graphs Graph neural networks Engines Ethereum smart contract source code analysis vulnerability detection

来源：评论

学校读者我要写书评

暂无评论

Static analysis of Corpus of source codes of Python Applications

引用

PROGRAMMING AND COMPUTER SOFTWARE 2023年第4期49卷 302-309页

作者： Kapustin, D. A. Shvyrov, V. V. Shulika, T. I. Lugansk State Pedag Univ Ul Oboronnaya 2 Lugansk 91011 Russia

A static analysis method is one of the popular methods of software code analysis. Such method allows checking the code for compliance with the language specification as well as finding potential vulnerabilities. In this work, a static analysis of a corpus of listings of open-source Python applications is performed. Using the Bandit library, statistical values of various categories of potential vulnerabilities are found, and a rating table of vulnerabilities detected in the dataset involved is constructed. A qualitative analysis of threats is performed according to their severity based on the CWE data.

关键词： security analysis big data static analysis vulnerability threat Bandit CWE OWASP linters source code analysis Python dataset

来源：评论

学校读者我要写书评

暂无评论

Using heuristics to estimate an appropriate number of latent topics in source code analysis

引用

SCIENCE OF COMPUTER PROGRAMMING 2013年第9期78卷 1663-1678页

作者： Grant, Scott Cordy, James R. Skillicorn, David B. Queens Univ Sch Comp Kingston ON Canada

Latent Dirichlet Allocation (LDA) is a data clustering algorithm that performs especially well for text documents. In natural-language applications it automatically finds groups of related words (called "latent topics") and clusters the documents into sets that are about the same "topic". LDA has also been applied to source code, where the documents are natural source code units such as methods or classes, and the words are the keywords, operators, and programmer-defined names in the code. The problem of determining a topic count that most appropriately describes a set of source code documents is an open problem. We address this empirically by constructing clusterings with different numbers of topics for a large number of software systems, and then use a pair of measures based on source code locality and topic model similarity to assess how well the topic structure identifies related source code units. Results suggest that the topic count required can be closely approximated using the number of software code fragments in the system. We extend these results to recommend appropriate topic counts for arbitrary software systems based on an analysis of a set of open source systems. (C) 2013 Elsevier B.V. All rights reserved.

关键词： source code analysis Latent Dirichlet Allocation Latent topic model code clusters

来源：评论

学校读者我要写书评

暂无评论

Outside the Comfort Zone: Analysing LLM Capabilities in Software Vulnerability Detection 29th

Outside the Comfort Zone: Analysing LLM Capabilities in Soft...

引用

29th European Symposium on Research in Computer Security (ESORICS)

作者： Guo, Yuejun Patsakis, Constantinos Hu, Qiang Tang, Qiang Casino, Fran Luxembourg Inst Sci & Technol Esch Sur Alzette Luxembourg Athena Res Ctr ARC Informat Management Syst Inst Artemidos 6 Maroussi Greece Univ Piraeus Dept Informat 80 Karaoli & Dimitriou St Piraeus 18534 Greece Univ Tokyo Dept Comp Sci Tokyo Japan Rovira & Virgili Univ Dept Comp Engn & Math Tarragona Spain

ISBN: (纸本)9783031708787;9783031708794

The significant increase in software production driven by automation and faster development lifecycles has resulted in a corresponding surge in software vulnerabilities. In parallel, the evolving landscape of software vulnerability detection, highlighting the shift from traditional methods to machine learning and large language models (LLMs), provides massive opportunities at the cost of resource-demanding computations. This paper thoroughly analyses LLMs' capabilities in detecting vulnerabilities within source code by testing models beyond their usual applications to study their potential in cybersecurity tasks. We evaluate the performance of six open-source models that are specifically trained for vulnerability detection against six general-purpose LLMs, three of which were further fine-tuned on a dataset that we compiled. Our dataset, alongside five state-of-the-art benchmark datasets, were used to create a pipeline to leverage a binary classification task, namely classifying code into vulnerable and non-vulnerable. The findings highlight significant variations in classification accuracy across benchmarks, revealing the critical influence of fine-tuning in enhancing the detection capabilities of small LLMs over their larger counterparts, yet only in the specific scenarios in which they were trained. Further experiments and analysis also underscore the issues with current benchmark datasets, particularly around mislabeling and their impact on model training and performance, which raises concerns about the current state of practice. We also discuss the road ahead in the field suggesting strategies for improved model training and dataset curation.

关键词： Software vulnerability detection source code analysis Large language models Cybersecurity

来源：评论

学校读者我要写书评

暂无评论

HIPAA Technical Compliance Evaluation of Laravel-based mHealth Apps

HIPAA Technical Compliance Evaluation of Laravel-based mHeal...

引用

IEEE International Conference on Digital Health (IEEE ICDH)

作者： Akter, Mst Shapna Barek, Md Abdul Rahman, Md Mostafizur Riad, Abm Kamrul Islam Rahman, Md Abdur Mia, Md Raihan Shahriar, Hossain Chu, William Ahamed, Sheikh Iqbal Univ West Florida Pensacola FL 32514 USA Tunghai Univ Taichung Taiwan Marquette Univ Milwaukee WI USA

ISBN: (纸本)9798350368581;9798350368574

The advent of mobile health applications (mHealth apps) has significantly altered the landscape of personal health management. Particularly, mHealth apps developed with the Laravel framework have gained popularity due to their robustness and scalability. However, this convenience comes with the increased responsibility of safeguarding Protected Health Identifier (PHI). The Health Insurance Portability and Accountability Act (HIPAA) sets forth standards for entities handling PHI to ensure privacy and security. Despite these critical regulations, many Laravel developers lack in-depth knowledge of HIPAA compliance, leading to potential vulnerabilities. This work introduces a comprehensive evaluation framework for assessing Laravel-based mHealth apps' HIPAA Technical compliance. Our framework provides developers with analytical tools to review their source code for compliance issues and guide them in implementing robust security features. Through static code analysis, the framework examines access control, audit controls, integrity, authentication, encryption, transmission security, user inactivity monitoring, and data lifecycle management. To validate our framework's effectiveness, we developed a specialized web-based tool and conducted an empirical analysis of 200 Medical and Health Fitness category Laravel applications from Github. The analysis revealed significant compliance gaps, particularly in user authorization, data protection, audit controls, and transmission security. In response, we offer detailed recommendations for developers to address common pitfalls and adhere to HIPAA standards. Additionally, the framework has been used to develop a secured web-based portal to assist consumers in evaluating the privacy and security of mHealth apps.

关键词： mHealth Applications Laravel Framework HIPAA Compliance source code analysis Mobile Health Security

来源：评论

学校读者我要写书评

暂无评论

Drilling Down I/O Bottlenecks with Cross-layer I/O Profile Exploration 38

Drilling Down I/O Bottlenecks with Cross-layer I/O Profile E...

引用

International Parallel and Distributed Processing Symposium (IPDPS)

作者： Ather, Hammad Bez, Jean Luca Xia, Yankun Byna, Suren Univ Oregon Eugene OR 97403 USA Lawrence Berkeley Natl Lab Berkeley CA 94720 USA Ohio State Univ Columbus OH USA

ISBN: (纸本)9798350387117;9798350387124

I/O performance monitoring tools such as Darshan and Recorder collect I/O-related metrics on production systems and help understand the applications' behavior. However, some gaps prevent end-users from seeing the whole picture when it comes to detecting and drilling down to the root causes of I/O performance slowdowns and where those problems originate. These gaps arise from limitations in the available metrics, their collection strategy, and the lack of translation to actionable items that could advise on optimizations. This paper highlights such gaps and proposes solutions to drill down to the source code level to pinpoint the root causes of I/O bottlenecks scientific applications face by relying on cross-layer analysis combining multiple performance metrics related to I/O software layers. We demonstrate with two real applications how metrics collected in high-level libraries (which are closer to the data models used by an application), enhanced by source-code insights and natural language translations, can help streamline the understanding of I/O behavior and provide guidance to end-users, developers, and supercomputing facilities on how to improve I/O performance. Using this cross-layer analysis and the heuristic recommendations, we attained up to 6.9x speedup from run-as-is executions.

关键词： I/O bottleneck source code analysis root causes

来源：评论

学校读者我要写书评

暂无评论

DeepcodeGraph: A Language Model for Compile-Time Resource Optimization Using Masked Graph Autoencoders 29th

DeepCodeGraph: A Language Model for Compile-Time Resource Op...

引用

29th International Conference on Applications of Natural Language to Information Systems (NLDB)

作者： Cichetti, Federico Parisi, Emanuele Acquaviva, Andrea Barchi, Francesco Univ Bologna I-40126 Bologna BO Italy

ISBN: (纸本)9783031702389;9783031702396

Analysing source code using deep learning aids compile-time decisions affecting performance in embedded devices. We propose Deep-codeGraph, a general graph-based language model, which learns patterns to identify better compilation strategies, optimal hardware configurations and software transformations. DCG includes i) A large-scale dataset containing over 100k graphs. ii) A graph neural network to implement a graph-based language model. iii) A self-supervised pre-training framework leveraging Masked Graph Autoencoders. The performance of DCG is evaluated on two downstream tasks: heterogeneous device mapping and thread block size prediction. DCG outperforms previous graph-based state-of-the-art improving previous results by 3%.

关键词： Masked graph autoencoder source code analysis Compile-time decisions

来源：评论

学校读者我要写书评

暂无评论

Enabling Type Checking on Columns in Data Frame Libraries by Abstract Interpretation

引用

IEEE ACCESS 2022年 10卷 14418-14428页

作者： Zhuang, Yungyu Lu, Ming-Yang Natl Cent Univ Dept Comp Sci & Informat Engn Taoyuan 32001 Taiwan

Data frames are a tabular data structure widely used in transforming data to an appropriate form in data analysis, especially in data wrangling. However, when data frames are implemented with libraries rather than supported at the language level, it is hard to find out errors due to the limitation of type checking on columns. Data scientists may encounter errors due to missing column labels or inconsistent types, especially when they reuse code snippets for new data. These errors are usually left to runtime, and it is sometimes difficult to find out where the problems are. To address this issue, we propose using abstract interpretation to perform type checking on data frame columns. We defined the type for data frames based on column labels and developed semantics to verify the typing in general operations. A static checker can be implemented based on the semantics to help programmers quickly fix errors without executing the code. To show the feasibility, we implemented a proof-of-concept for the pandas library as an example, PDChecker, to discuss the limitation and usage. It is then used to compare the functionalities with existing solutions. The results show our approach can fulfill the function of type checking for data frames. Supporting more data frame operations is included in our future work.

关键词： Libraries codes Programming Semantics Runtime Data analysis Python Data frames type checking source code analysis static program analysis data wrangling computer languages programming programming environments software tools

来源：评论

学校读者我要写书评

暂无评论

Making the Most of Scarce Input Data in Deep Learning-Based source code Classification for Heterogeneous Device Mapping

引用

IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS 2022年第6期41卷 1636-1648页

作者： Parisi, Emanuele Barchi, Francesco Bartolini, Andrea Acquaviva, Andrea Univ Bologna Dept Elect & Comp Engn I-40136 Bologna Italy

Despite its relatively recent history, deep learning (DL)-based source code analysis is already a cornerstone in machine learning for compiler optimization. When applied to the classification of pieces of code to identify the best computational unit in a heterogeneous Systems-on-Chip, it can be effective in supporting decisions that a programmer has otherwise to take manually. Several techniques have been proposed exploiting different networks and input information, prominently sequence-based and graph-based representations, complemented by auxiliary information typically related to payload and device configuration. While the accuracy of DL methods strongly depends on the training and test datasets, so far no exhaustive and statistically meaningful analysis has been done on its impact on the results and on how to effectively extract the available information. This is relevant also considering the scarce availability of source code datasets that can be labeled by profiling on heterogeneous compute units. In this article, we first present such a study, which leads us to devise the contribution of code sequences and auxiliary inputs separately. Starting from this analysis, we then demonstrate that by using the normalization of auxiliary information, it is possible to improve state-of-the-art results in terms of accuracy. Finally, we propose a novel approach exploiting Siamese networks that further improve mapping accuracy by increasing the cardinality of the dataset, thus compensating for its relatively small size.

关键词： codes Kernel Feature extraction Computational modeling Benchmark testing Deep learning Analytical models Computation mapping deep learning (DL) heterogeneous platform machine learning source code analysis

来源：评论

学校读者我要写书评

暂无评论

analysis of the change in bugginess and adaptiveness of python software systems

引用

MULTIMEDIA TOOLS AND APPLICATIONS 2022年第30期81卷 43107-43123页

作者： Yousuf, Mir Mohammad Rashid, Mamoon Univ Kashmir Dept Comp Sci & Engn North Campus Delina Jammu & Kashmir India Vishwakarma Univ Fac Sci & Technol Dept Comp Engn Pune 411048 Maharashtra India

The useful constructs in terms of dynamic features of programming languages bring the developers convenience and flexibility, but can also lead to the risks in the software maintenance. Evaluating whether the use of such features affects the maintenance can be significant for both practitioners as well as researchers, yet a very little amount of work has been done to investigate it in python software systems. Researchers believe that the occurrence of the bugs (pre-release or post-release) affects the maintenance activities. Thus, software maintenance is frequently a challenging and hectic process for both engineers as well as IT consultancy firms. There are few studies concerning the different aspects of the source code quality of python software systems such as comprehensiveness, bugginess, and adaptiveness. In this paper, the authors analyzed the python software systems to find the effect of the bugs on the overall project and correlate the effects with the maintenance cost. This study also analyzed the relation between coding practices using the coding standards of the programming language with that of the bugs. In order to provide more experimental evidence about the impact of the source code quality and bugginess on the software development and maintenance, the authors provided an experimental study on the 8 versions of Trac 0.12, 16 versions of Trac 1.0, 6 versions of Trac 1.1, and 3 versions of Trac 1.2. The results are more indicative of the bugs affecting the quality of the product and thus increasing the maintenance cost. Moreover, the results also show that with the uplifting of the software patch, the quality of the code is improved, thus reducing the maintenance cost.

关键词： Adaptiveness Bugs Correlation Patch Uplift Prediction Regression Software maintenance source code analysis Python software systems

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：