检索结果-内蒙古大学图书馆

International Conference on Networks Security, Wireless Communications and Trusted Computing

作者： Liang, Bin Renmin Univ China Sch Informat Beijing 100872 Peoples R China

ISBN: (纸本)9780769536101

A static vulnerability detection method based on an extended vulnerability state machine is proposed in this paper. In this method, the state space of state machine model is extended. The security state of a variable can be identified by a property set that may consist of multiple security-related properties rather than a single property. As results, fine-grained state transition is provided to support accurate recognition of program security-related behaviors. Specially, the recognition of validation checking is introduced to reduce false positives. Besides, a systematic discrimination mechanism for tainted data is constructed to prevent false negatives result from neglecting tainted data sources. The experimental results of a prototype system show that this method can effectively detect vulnerabilities in software systems with obviously lower false positive than existing methods, and avoid some serious false negative.

关键词： vulnerabilities detection static analysis state machine

来源：评论

学校读者我要写书评

暂无评论

Opcode Sequences-Based Smart Contract vulnerabilities detection Using Deep Learning 22

Opcode Sequences-Based Smart Contract Vulnerabilities Detect...

引用

IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) / BigDataSE Conference / CSE Conference / EUC Conference / ISCI Conference

作者： Zhu, Jinyao Xing, Xiaofei Wang, Guojun Li, Peiqiang Guangzhou Univ Sch Comp Sci & Cyber Engn Guangzhou 510006 Peoples R China

ISBN: (纸本)9798350381993;9798350382006

Ethereum is a blockchain platform that allows developers to create smart contracts. Smart contracts are programs that can automatically execute and handle cryptocurrency funds. However, over a hundred thousand new smart contracts are deployed every day and inevitably contain vulnerabilities due to programming errors. Once deployed, smart contracts cannot be fixed or changed, leaving funds at risk. To mitigate it, we use deep learning to detect vulnerabilities in smart contracts. First, we create our own dataset of labeled smart contracts based on opcode sequences, since few smart contract codes and labeled datasets are publicly available. We collect opcode sequences by replaying real-world transactions from the Ethereum Mainnet in our fully synchronized node while we leverage a plugin called "SODA" to label opcode sequences with vulnerability classes. Second, after data collection, we preprocess the data by removing duplicate opcode sequences, normalizing the sequences to the same length, and converting them into vectors. Finally, to detect vulnerabilities in smart contracts, we train a deep classification model using LSTM neural networks. Our model achieved an average accuracy of 82.63% and an F1-score of 79.74% across seven types of vulnerabilities, which is important for securing funds and logic in smart contracts.

关键词： Smart Contracts vulnerabilities detection Opcode Sequences Deep Learning LSTM

来源：评论

学校读者我要写书评

暂无评论

5G RRC Protocol and Stack vulnerabilities detection via Listen-and-Learn 20

5G RRC Protocol and Stack Vulnerabilities Detection via List...

引用

IEEE 20th Consumer Communications and Networking Conference (CCNC)

作者： Yang, Jingda Wang, Ying Tran, Tuyen X. Pan, Yanjun Stevens Inst Technol Hoboken NJ 07030 USA AT&T Labs Res Bedminster NJ USA Univ Arkansas Fayetteville AR 72701 USA

ISBN: (纸本)9781665497343

The paper proposes a protocol-independent Listen-and-Learn (LAL) based fuzzing system, which provides a systematic solution for vulnerabilities and unintended emergent behavior detection with sufficient automation and scalability, for 5G and nextG protocols and large-scale open programmable stacks. We use the relay model as our base and capture and interpret packets without prior knowledge of protocols implementation. Radio Resource Control (RRC) is selected proof of concept of the proposed system. Our fuzzing architecture incorporates two abstractions of different dimension fuzzing-command-level and bit-level, and the proposed LAL fuzzing framework focuses on command-level fuzzing covering potential attacks by autonomously generating a comprehensive fuzzing case set. Our analysis of 39 RRC states successfully illustrates 129 vulnerabilities resulting in RRC connection establishment failure from 205 command-level fuzzing cases and reveals insights into exploitable vulnerabilities in each channel of RRC procedure. Furthermore, to assess risks and prevent potential vulnerability, we use the Long Short-Term Memory (LSTM) based model to perform a deep analysis of transaction states in sequenced commands. With the LSTM based model, we efficiently predict more than 95% connection failure at an average duration of 0.059 seconds after the fuzzing attack and provide sufficient time for proactive defense before RRC connection completion or failure, with an average of 3.49 seconds. The rapid vulnerability prediction capability also enables proactive defenses to potential attacks. The proposed fuzzing system offers sufficient automation, scalability, and usability to improve 5G security assurance, and could be used for existing and newly released protocols and stacks validation and real-time system vulnerability detection and prediction.

关键词： Fuzz Testing vulnerabilities detection RRC Protocols 5G Stack LSTM

来源：评论

学校读者我要写书评

暂无评论

Security vulnerabilities detection Through Assertion-Based Approach 16th

Security Vulnerabilities Detection Through Assertion-Based A...

引用

16th International Symposium on Theoretical Aspects of Software Engineering (TASE)

作者： Ait-Ameur, Yamine Kissi, Salim Yahia Ameur-Boulifa, Rabea Seladji, Yassamin Univ Abou Bekr Belkaid Tlemcen LRIT Tilimsen Algeria Inst Polytech Paris Telecom ParisTech LTCI Palaiseau France

ISBN: (纸本)9783031103636;9783031103629

Organizations and companies develop very complex software today. Errors and flaws can be introduced at different phases of the software development life cycle and can lead to exploitable vulnerabilities. Furthermore, considering that most systems are exposed to multiple users and environments, such flaws can lead to attacks (or actions) with unpredictable consequences in terms of damage and costs. Most research that deals with security-related issues of software focuses their efforts on coding errors and flaws, regardless of the infrastructure and platforms that run the software applications. Often, such analyses of software applications vulnerabilities may lack sufficient specification details, thus possibly miss larger systematic flaws, and consequently obscure the existence of serious vulnerabilities. Our research aims at developing a technique capable of discovering the security weaknesses, specifically buffer overflow vulnerabilities in C/C++ programs, through the analysis of source code combined with architecture specifications. The proposed approach relies on the notion of platform assertions that is, a collection of logical relationships used to characterize a platform (execution environment). In this paper, we focus on such assertions and show how vulnerabilities analysis of software applications can be performed with our assertion-based approach. Furthermore, the generation of assertion specifications as well as the construction of an assertion library including various platforms are explored.

关键词： Assertions Formal analysis vulnerabilities detection Execution environment

来源：评论

学校读者我要写书评

暂无评论

Smart contract vulnerabilities detection with bidirectional encoder representations from transformers and control flow graph

引用

MULTIMEDIA SYSTEMS 2024年第4期30卷 204-204页

作者： Su, Peng Hu, Jingyuan Univ Sci & Technol Beijing Sch Comp & Commun Engn Beijing Peoples R China Chinese Acad Sci Inst Informat Engn Beijing Peoples R China

Up to now, the smart contract vulnerabilities detection methods based on sequence modal data and sequence models have been the most commonly used. However, existing state-of-the-art methods disregard the issue of sequence modal data loses structural information and control flow information. Additionally, it is hard for sequence models to extract global features of smart contracts. Moreover, these methods rarely consider the impact of noise data on vulnerabilities detection. To tackle these issues, we propose a smart contract vulnerabilities detection model based on bidirectional encoder representation from transformers (BERT) and control flow graph (CFG). On the one hand, we design a denoising method suitable for control flow graphs to reduce the impact of noisy data on vulnerabilities detection. On the other hand, we design a novel method to parse the control flow graph into a BERT input form that retains control flow information and structural information. The BERT learns the potential vulnerability characteristics of smart contracts to fine-tune itself. Through an empirical evaluation of a large-scale real-world dataset and compare 5 state-of-the-art baseline methods. Our method achieves (1) optimal performance over all baseline methods;(2) 0.6-17.1% higher F1-score than baseline methods;(3) 0.7-16.7% higher accuracy than baseline methods;(4) 0.6-17% higher precision than baseline methods;(5) 0.2-19.5% higher recall than baseline methods.

关键词： Smart contract vulnerabilities detection Control flow graph BERT

来源：评论

学校读者我要写书评

暂无评论

detection of vulnerabilities in blockchain smart contracts using deep learning

引用

WIRELESS NETWORKS 2025年第1期31卷 201-217页

作者： Gupta, Namya Aankur Bansal, Mansi Sharma, Seema Mehrotra, Deepti Kakkar, Misha Amity Univ Noida India

Blockchain helps to give a sense of security as there is only one history of transactions visible to all the involved parties. Smart contracts enable users to manage significant asset amounts of finances on the blockchain without the involvement of any intermediaries. The conditions and checks that have been written in smart contract and executed to the application cannot be changed again. However, these unique features pose some other risks to the smart contract. Smart contracts have several flaws in its programmable language and methods of execution, despite being a developing technology. To build smart contracts and implement numerous complicated business logics, high-level languages are used by the developers to code smart contracts. Thus, blockchain smart contract is the most important element of any decentralized application, posing the risk for it to be attacked. So, the presence of vulnerabilities are to be taken care of on a priority basis. It is important for detection of vulnerabilities in a smart contract and only then implement and connect it with applications to ensure security of funds. The motive of the paper is to discuss how deep learning may be utilized to deliver bug-free secure smart contracts. Objective of the paper is to detect three kinds of vulnerabilities- reentrancy, timestamp and infinite loop. A deep learning model has been created for detection of smart contract vulnerabilities using graph neural networks. The performance of this model has been compared to the present automated tools and other independent methods. It has been shown that this model has greater accuracy than other methods while comparing the prediction of smart contract vulnerabilities in existing models.

关键词： Blockchain smart contracts Deep learning vulnerabilities detection AI for blockchain

来源：评论

学校读者我要写书评

暂无评论

Hierarchical Contextual Embedding with Hybrid Deep Ensemble for IoT Smart Contract Vulnerability detection

引用

SN Computer Science 2025年第3期6卷 1-16页

作者： Taseen, Rakheeba Koul, Nimrita School of Computer Science and Engineering REVA University Karnataka Bengaluru 560064 India

Smart contracts, widely utilized in blockchain applications, are vulnerable to security threats that can lead to severe financial and operational consequences. This study introduces the Hierarchical Contextual Embedding with Hybrid Deep Ensemble Network (HCE-HDEN) framework, designed to enhance the detection of critical vulnerabilities, specifically Integer Overflow, Reentrancy, and Timestamp Dependency. The proposed methodology integrates semantic learning techniques with hierarchical code tree architectures, significantly improving detection accuracy by capturing complex contextual relationships within smart contract code. To evaluate its effectiveness, HCE-HDEN was tested against nine state-of-the-art vulnerability detection tools, including SmartCheck, Manticore, Osiris, Oyente, ES, and Slither. Experimental results demonstrate that HCE-HDEN outperforms existing tools, achieving superior detection rates of 75% for Integer Overflow, 95% for Reentrancy, and 88% for Timestamp Dependency, compared to ES, the closest competitor, which achieved detection rates of 64%, 90%, and 80%, respectively. While ES exhibited the fastest execution time at 0.16 seconds, HCE-HDEN maintained a balance between accuracy and efficiency, processing smart contracts within 0.8 seconds. The study further highlights that the optimization strategies employed in HCE-HDEN, such as parallel-processing neural networks and hierarchical code structures, significantly enhance vulnerability detection while ensuring reasonable processing speed. These findings establish HCE-HDEN as a highly effective framework for smart contract security analysis, offering superior accuracy over existing automated tools. Future research will focus on further optimizing execution efficiency while expanding vulnerability detection capabilities to address a broader range of security threats in blockchain-based applications. © The Author(s), under exclusive licence to Springer Nature Singapore Pte Ltd. 2025.

关键词： Blockchain Security Deep Learning Hierarchical Embedding IoT Machine Learning Smart Contract Analysis Smart Contracts vulnerabilities detection

来源：评论

学校读者我要写书评

暂无评论

An automated framework for detecting and mitigating memory safety vulnerabilities in UEFI firmware

引用

COMPUTERS & ELECTRICAL ENGINEERING 2025年 122卷

作者： Lu, Zheng Tan, Yu-an Cheng, Xiaochun Zheng, Zhihan Shi, Ning Li, Yuanzhang Beijing Inst Technol Cyberspace Secur Dept Beijing 100081 Peoples R China Swansea Univ Comp Sci Dept Bay Campus Swansea SA1 8EN Wales Beijing Inst Technol Comp Sci Dept Beijing 100081 Peoples R China Hebei Key Lab IoT Blockchain Integrat Shijiazhuang 050035 Peoples R China

The Unified Extensible Firmware Interface (UEFI) firmware has seen a rapid escalation in program size and complexity, including complex functional modules, diverse driver loading schemes, and innovative interface configurations, all of which expand the potential attack surface. In the field of computer security, there is a strong emphasis on quickly detecting both new and existing vulnerabilities. However, the subsequent critical steps, prioritizing and remedying these vulnerabilities, sometimes do not receive as much attention. We have detected a significant number of memory safety vulnerabilities in existing firmware images, which are reported but still remain in the latest firmware versions. In this paper, we introduce a novel framework, efiMemGuard, detecting and mitigating memory safety vulnerabilities in UEFI firmware. Our innovation with efiMemGuard is characterized by the synergistic integration of detection and mitigation mechanisms. It automatically implements mitigation based on the detection results, which including the majority of common memory security vulnerabilities found in UEFI firmware. Utilizing static analysis, we systematically locate memory safety vulnerabilities across UEFI firmware images from major vendors and deploy targeted repairs to mitigate these vulnerabilities efficiently. Our detection methodology primarily targets published Common vulnerabilities and Exposures(CVEs) and potential vulnerabilities similar to published CVEs. Our analysis contains 851 firmware samples, identifying memory safety vulnerabilities in 194 instances. We have discovered that a significant number of known vulnerabilities remain unfixed, even in the latest versions of these vendors' firmware. The experimental results show that efiMemGuard achieved an average precision of 85% and a recall of 78% in identifying memory safety vulnerabilities. Besides this, the mitigation module of efiMemGuard resulted in only a 12.5% average increase in execution time, which is mo

关键词： UEFI firmware Reverse engineering Static analysis Memory safety vulnerabilities detection vulnerabilities mitigation

来源：评论

学校读者我要写书评

暂无评论

VULHUNTER: TOWARD DISCOVERING vulnerabilities IN ANDROID APPLICATIONS

引用

IEEE MICRO 2015年第1期35卷 44-53页

作者： Qian, Chenxiong Luo, Xiapu Le, Yu Gu, Guofei Hong Kong Polytech Univ Dept Comp Hong Kong Hong Kong Peoples R China Hong Kong Polytech Univ Shenzhen Res Inst Hong Kong Hong Kong Peoples R China Texas A&M Univ Dept Comp Sci & Engn College Stn TX 77843 USA

A NEW STATIC-ANALYSIS FRAMEWORK HELPS SECURITY ANALYSTS DETECT VULNERABLE APPLICATIONS. THE AUTHORS DESIGNED AN APP PROPERTY GRAPH (APG), CONDUCTED GRAPH TRAVERSALS OVER APGS, AND REDUCED THE MANUAL-VERIFICATION WORKLOAD. THEY IMPLEMENTED THE FRAMEWORK IN VULHUNTER AND MODELED FIVE TYPES OF vulnerabilities. RESULTS SHOWED THAT OF 557 RANDOMLY COLLECTED APPS WITH AT LEAST 1 MILLION INSTALLATIONS, 375 APPS (67.3 PERCENT) HAD AT LEAST ONE VULNERABILITY.

关键词： Android applications Androids app property graph Data structures Humanoid robots Marketing and sales Mobile communication Network security static analysis Syntactics vulnerabilities detection

来源：评论

学校读者我要写书评

暂无评论

A smart contract vulnerability detection method based on deep learning with opcode sequences

引用

PEER-TO-PEER NETWORKING AND APPLICATIONS 2024年第5期17卷 3222-3238页

作者： Li, Peiqiang Wang, Guojun Xing, Xiaofei Zhu, Jinyao Gu, Wanyi Zhai, Guangxin Guangzhou Univ Sch Comp Sci & Cyber Engn Guangzhou 510006 Peoples R China

Ethereum is a blockchain network that allows developers to create smart contracts and programs that run on the blockchain. Smart contracts contain logic to transfer assets based on pre-defined conditions. With over 100,000 new smart contracts being deployed every day, the potential for coding errors is high, making the contracts vulnerable to exploits. A key limitation is that once deployed, smart contracts are immutable and cannot be updated, even if flaws are found. This inflexibility puts funds at risk of theft and loss. The rapid pace of deployment outpaces security audits, increasing vulnerabilities that put users' cryptocurrency at risk. To reduce the risk caused by smart contract vulnerabilities, we applied deep learning techniques. To develop a deep learning model capable of detecting vulnerabilities, we first created a dataset by replaying real transactions on the Ethereum Mainnet, collecting opcode sequences from real Ethereum contracts, and labeling them using the SODA plugin. We pre-processed this opcode data by removing duplicates, normalizing sequence lengths, simplifying opcodes into representative groups, and converting sequences into numerical vectors to ultimately obtain an optimal representation of the data. We then trained and evaluated three different neural network architectures on this dataset. Our best-performing model achieved an average accuracy of 88% in detecting seven types of vulnerabilities. Further analysis showed that the model was effective at identifying potential problems in smart contracts, which was an important capability for securing funds and executing logic in live contracts.

关键词： Smart contracts vulnerabilities detection Opcode sequences Deep learning LSTM

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：