检索结果-内蒙古大学图书馆

FIRE: combining multi-stage filtering with taint analysis for scalable recurring vulnerability detection 24

学校读者我要写书评

暂无评论

FIRE: combining multi-stage filtering with taint analysis fo...

Proceedings of the 33rd USENIX Conference on Security Symposium

作者： Siyue Feng Yueming Wu Wenjie Xue Sikui Pan Deqing Zou Yang Liu Hai Jin National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Key Laboratory of Distributed System Security Hubei Engineering Research Center on Big Data Security Cluster and Grid Computing Lab and School of Cyber Science and Engineering Huazhong University of Science and Technology China Nanyang Technological University Singapore National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Key Laboratory of Distributed System Security Hubei Engineering Research Center on Big Data Security Cluster and Grid Computing Lab and School of Cyber Science and Engineering Huazhong University of Science and Technology China and Jinyinhu Laboratory China National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Key Laboratory of Distributed System Security Hubei Engineering Research Center on Big Data Security Cluster and Grid Computing Lab and School of Computer Science and Technology Huazhong University of Science and Technology China

ISBN: (纸本)9781939133441

With the continuous development of software open-sourcing, the reuse of open-source software has led to a significant increase in the occurrence of recurring vulnerabilities. These vulnerabilities often arise through the practice of copying and pasting existing vulnerabilities. Many methods have been proposed for detecting recurring vulnerabilities, but they often struggle to ensure both high efficiency and consideration of semantic information about vulnerabilities and patches. In this paper, we introduce FIRE, a scalable method for large-scale recurring vulnerability detection. It utilizes multi-stage filtering and differential taint paths to achieve precise clone vulnerability scanning at an extensive scale. In our evaluation across ten open-source software projects, FIRE demonstrates a precision of 90.0% in detecting 298 recurring vulnerabilities out of 385 ground truth instance. This surpasses the performance of existing advanced recurring vulnerability detection tools, detecting 31.4% more vulnerabilities than VUDDY and 47.0% more than MOVERY. When detecting vulnerabilities in large-scale software, FIRE outperforms MOVERY by saving about twice the time, enabling the scanning of recurring vulnerabilities on an ultra-large scale.

关键词：

It Takes Two to Tango: Serverless Workflow Serving via Bilaterally Engaged Resource Adaptation

学校读者我要写书评

暂无评论

arXiv 2025年

作者： Wu, Jing Wang, Lin Deng, Quanfeng Yu, Chen Zhang, Dong Yan, Bingheng Liu, Fangming National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Cluster and Grid Computing Lab Huazhong University of Science and Technology China Paderborn University Germany Inspur Data Co. Ltd. China Peng Cheng Laboratory China

Serverless platforms typically adopt an early-binding approach for function sizing, requiring developers to specify an immutable size for each function within a workflow beforehand. Accounting for potential runtime variability, developers must size functions for worst-case scenarios to ensure service-level objectives (SLOs), resulting in significant resource inefficiency. To address this issue, we propose Janus, a novel resource adaptation framework for serverless platforms. Janus employs a late-binding approach, allowing function sizes to be dynamically adapted based on runtime conditions. The main challenge lies in the information barrier between the developer and the provider: developers lack access to runtime information, while providers lack domain knowledge about the workflow. To bridge this gap, Janus allows developers to provide hints containing rules and options for resource adaptation. Providers then follow these hints to dynamically adjust resource allocation at runtime based on real-time function execution information, ensuring compliance with SLOs. We implement Janus and conduct extensive experiments with real-world serverless workflows. Our results demonstrate that Janus enhances resource efficiency by up to 34.7% compared to the state-of-the-art. © 2025, CC BY-NC-ND.

关键词： Resource allocation

FedMHO: Heterogeneous One-Shot Federated Learning Towards Resource-Constrained Edge Devices

学校读者我要写书评

暂无评论

arXiv 2025年

作者： Yao, Dezhong Shi, Yuexin Liu, Tongtong Xu, Zhiqiang National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Cluster and Grid Computing Lab School of Computer Science and Technology Huazhong University of Science and Technology Wuhan430074 China Mohamed bin Zayed University of Artificial Intelligence United Arab Emirates

Federated Learning (FL) is increasingly adopted in edge computing scenarios, where a large number of heterogeneous clients operate under constrained or sufficient resources. The iterative training process in conventional FL introduces significant computation and communication overhead, which is unfriendly for resource-constrained edge devices. One-shot FL has emerged as a promising approach to mitigate communication overhead, and model-heterogeneous FL solves the problem of diverse computing resources across clients. However, existing methods face challenges in effectively managing model-heterogeneous one-shot FL, often leading to unsatisfactory global model performance or reliance on auxiliary datasets. To address these challenges, we propose a novel FL framework named FedMHO, which leverages deep classification models on resource-sufficient clients and lightweight generative models on resource-constrained devices. On the server side, FedMHO involves a two-stage process that includes data generation and knowledge fusion. Furthermore, we introduce FedMHO-MD and FedMHO-SD to mitigate the knowledge-forgetting problem during the knowledge fusion stage, and an unsupervised data optimization solution to improve the quality of synthetic samples. Comprehensive experiments demonstrate the effectiveness of our methods, as they outperform state-of-the-art baselines in various experimental setups. Our code is available at https://***/YXShi2000/FedMHO. © 2025, CC BY.

关键词： Federated learning

OUTLIER SYNTHESIS VIA HAMILTONIAN MONTE CARLO FOR OUT-OF-DISTRIBUTION DETECTION

学校读者我要写书评

暂无评论

arXiv 2025年

作者： Li, Hengzhuang Zhang, Teng National Engineering Research Center for Big Data Technology and System Service Computing Technology and Systems Laboratory Cluster and Grid Computing Lab School of Computer Science and Technology Huazhong University of Science and Technology Wuhan China

Out-of-distribution (OOD) detection is crucial for developing trustworthy and reliable machine learning systems. Recent advances in training with auxiliary OOD data demonstrate efficacy in enhancing detection capabilities. Nonetheless, these methods heavily rely on acquiring a large pool of high-quality natural outliers. Some prior methods try to alleviate this problem by synthesizing virtual outliers but suffer from either poor quality or high cost due to the monotonous sampling strategy and the heavy-parameterized generative models. In this paper, we overcome all these problems by proposing the Hamiltonian Monte Carlo Outlier Synthesis (HamOS) framework, which views the synthesis process as sampling from Markov chains. Based solely on the in-distribution data, the Markov chains can extensively traverse the feature space and generate diverse and representative outliers, hence exposing the model to miscellaneous potential OOD scenarios. The Hamiltonian Monte Carlo with sampling acceptance rate almost close to 1 also makes our framework enjoy great efficiency. By empirically competing with SOTA baselines on both standard and large-scale benchmarks, we verify the efficacy and efficiency of our proposed HamOS. Our code is available at: https://***/Fir-lat/HamOS_OOD. © 2025, CC BY.

关键词： Markov chains

Working Smarter Not Harder: Hybrid Cooling for Deep Learning in Edge Datacenters

学校读者我要写书评

暂无评论

IEEE Transactions on Sustainable Computing

IEEE Transactions on Sustainable computing 2025年

作者： Pei, Qiangyu Yuan, Yongjie Hu, Haichuan Wang, Lin Zhang, Dong Yan, Bingheng Yu, Chen Liu, Fangming Huazhong University of Science and Technology National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Cluster and Grid Computing Lab School of Computer Science and Technology 1037 Luoyu Road Wuhan430074 China Paderborn University TU Darmstadt Germany Jinan Inspur Data Co. Ltd. China Huazhong University of Science and Technology Peng Cheng Laboratory China

The proliferation of deep-learning-based mobile and IoT applications has driven the increasing deployment of edge datacenters equipped with domain-specific accelerators. The unprecedented computing power offered by these accelerators puts a heavy burden on the cooling system, motivating more potent cooling techniques like cold water cooling. However, we observe that cold water cooling results in significant energy waste in edge datacenters due to the fluctuating resource utilization both spatially and temporally. To tackle this issue, we propose the concept of "working smarter"by slowing down accelerators deliberately whenever possible and enabling warm water cooling during these times to achieve cooling efficiency. Based on this concept, we develop Hyco - a hybrid water cooling system tailored for edge datacenters running deep learning workloads. First, Hyco features a zone-based cooling architecture enabling dynamic switching between cold water and warm water cooling. Then, based on a lightweight latency estimation method, Hyco incorporates a learning-based scheduling scheme to determine "which"accelerator workers and "when"to slow down through an adaptive and intelligent power-latency trade-off for deep learning models. The simulation with real-world traces shows that Hyco reduces the cooling energy consumption by up to 34.74× while satisfying latency constraints more than 99% of the time for deep-learning-based applications. © 2016 IEEE.

关键词： Deep reinforcement learning

How to Select Pre-Trained Code Models for Reuse? A Learning Perspective

学校读者我要写书评

暂无评论

How to Select Pre-Trained Code Models for Reuse? A Learning ...

IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)

作者： Zhangqian Bi Yao Wan Zhaoyang Chu Yufei Hu Junyi Zhang Hongyu Zhang Guandong Xu Hai Jin National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Cluster and Grid Computing Lab Wuhan China School of Computer Science and Technology Huazhong University of Science and Technology Wuhan China School of Big Data and Software Engineering Chongqing University Chongqing China School of Computer Science University of Technology Sydney Sydney Australia

ISBN: (数字)9798331535100

ISBN: (纸本)9798331535117

Pre-training a language model and then fine-tuning it has shown to be an efficient and effective technique for a wide range of code intelligence tasks, such as code generation, code summarization, and vulnerability detection. However, pre-training language models on a large-scale code corpus is compu-tationally expensive. Fortunately, many off-the-shelf Pre-trained Code Models (PCMs), such as CodeBERT, CodeT5, CodeGen, and Code Llama, have been released publicly. These models acquire general code understanding and generation capability during pre-training, which enhances their performance on downstream code intelligence tasks. With an increasing number of these public pre-trained models, selecting the most suitable one to reuse for a specific task is essential. In this paper, we systematically investigate the reusability of PCMs. We first explore three intuitive model selection methods that select by size, training data, or brute-force fine-tuning. Experimental results show that these straightforward techniques either perform poorly or suffer high costs. Motivated by these findings, we explore learning-based model selection strategies that utilize pre-trained models without altering their parameters. Specifically, we train proxy models to gauge the performance of pre-trained models, and measure the distribution deviation between a model's latent features and the task's labels, using their closeness as an indicator of model transferability. We conduct experiments on 100 widely-used open-source PCMs for code intelligence tasks, with sizes ranging from 42.5 million to 3 billion parameters. The results demonstrate that learning-based selection methods reduce selection time to 100 seconds, compared to 2,700 hours with brute-force fine-tuning, with less than 6% performance degradation across related tasks.

关键词： Phase change materials Analytical models Adaptation models Codes Costs Computational modeling Training data Machine learning Software Software development management

How to Select Pre-Trained Code Models for Reuse? A Learning Perspective

学校读者我要写书评

暂无评论

arXiv 2025年

作者： Bi, Zhangqian Wan, Yao Chu, Zhaoyang Hu, Yufei Zhang, Junyi Zhang, Hongyu Xu, Guandong Jin, Hai National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Cluster and Grid Computing Lab Wuhan China School of Computer Science and Technology Huazhong University of Science and Technology Wuhan China School of Big Data and Software Engineering Chongqing University Chongqing China School of Computer Science University of Technology Sydney Sydney Australia

Pre-training a language model and then fine-tuning it has shown to be an efficient and effective technique for a wide range of code intelligence tasks, such as code generation, code summarization, and vulnerability detection. However, pre-training language models on a large-scale code corpus is computationally expensive. Fortunately, many off-the-shelf Pre-trained Code Models (PCMs), such as CodeBERT, CodeT5, CodeGen, and Code Llama, have been released publicly. These models acquire general code understanding and generation capability during pre-training, which enhances their performance on downstream code intelligence tasks. With an increasing number of these public pre-trained models, selecting the most suitable one to reuse for a specific task is essential. In this paper, we systematically investigate the reusability of PCMs. We first explore three intuitive model selection methods that select by size, training data, or brute-force fine-tuning. Experimental results show that these straightforward techniques either perform poorly or suffer high costs. Motivated by these findings, we explore learning-based model selection strategies that utilize pre-trained models without altering their parameters. Specifically, we train proxy models to gauge the performance of pre-trained models, and measure the distribution deviation between a model's latent features and the task's labels, using their closeness as an indicator of model transferability. We conduct experiments on 100 widely-used open-source PCMs for code intelligence tasks, with sizes ranging from 42.5 million to 3 billion parameters. The results demonstrate that learning-based selection methods reduce selection time to 100 seconds, compared to 2,700 hours with brute-force fine-tuning, with less than 6% performance degradation across related tasks. © 2025, CC BY-NC-SA.

关键词： Adversarial machine learning

MeHyper: Accelerating Hypergraph Neural Networks by Exploring Implicit Dataflows

学校读者我要写书评

暂无评论

MeHyper: Accelerating Hypergraph Neural Networks by Explorin...

IEEE Symposium on High-Performance Computer Architecture

作者： Wenju Zhao Pengcheng Yao Dan Chen Long Zheng Xiaofei Liao Qinggang Wang Shaobo Ma Yu Li Haifeng Liu Wenjing Xiao Yufei Sun Bing Zhu Hai Jin Jingling Xue National Engineering Research Center for Big Data Technology and System/Services Computing Technology and System Lab/Cluster and Grid Computing Lab School of Computer Science and Technology Huazhong University of Science and Technology Wuhan China School of Computing National University of Singapore Singapore School of Computer Electronics and Information Guangxi University NanNing China School of Computer Science and Engineering University of New South Wales Sydney NSW Australia

ISBN: (数字)9798331506476

ISBN: (纸本)9798331506483

Hypergraph Neural Networks (HGNNs) are increasingly utilized to analyze complex inter-entity relationships. Traditional HGNN systems, based on a hyperedge-centric dataflow model, independently process aggregation tasks for hyperedges and vertices, leading to significant computational redundancy. This redundancy arises from recalculating shared information across different tasks. For the first time, we identify and harness implicit dataflows (i.e., dependencies) within HGNNs, introducing the microedge concept to effectively capture and reuse intricate shared information among aggregation tasks, thereby minimizing redundant computations. We have developed a new microedge-centric dataflow model that processes shared information as fine-grained microedge aggregation tasks. This dataflow model is supported by the Read-Process-Activate-Generate execution model, which aims to optimize parallelism among these tasks. Furthermore, our newly developed MeHyper, a microedge-centric HGNN accelerator, incorporates a decoupled pipeline for improved computational parallelism and a hierarchical feature management strategy to reduce off-chip memory accesses for large volumes of intermediate feature vectors generated. Our evaluation demonstrates that MeHyper substantially outperforms the leading CPUbased system PyG-CPU and the GPU-based system HyperGef, delivering performance improvements of $1,032.23 \times$ and $10.51 \times$, and energy efficiencies of $1,169.03 \times$ and $9.96 \times$, respectively.

关键词： Computational modeling Neural networks Redundancy Pipelines Memory management Parallel processing Vectors Energy efficiency Hardware acceleration

MalScan: Android Malware Detection Based on Social-Network Centrality Analysis

学校读者我要写书评

暂无评论

IEEE Transactions on Dependable and Secure computing 2025年

作者： Wu, Yueming Suo, Wenqi Feng, Siyue Zou, Deqing Yang, Wei Liu, Yang Jin, Hai Huazhong University of Science and Technology National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Engineering Research Center on Big Data Security School of Cyber Science and Engineering Wuhan430074 China Jinyinhu Laboratory Wuhan430074 China University of Texas at Dallas United States Nanyang Technological University Singapore Huazhong University of Science and Technology National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Cluster and Grid Computing Lab School of Computer Science and Technology Wuhan430074 China

Malware scanning of an app market is expected to be scalable and effective. However, existing approaches use syntax-based features that can be evaded by transformation attacks or semantic-based features which are usually extracted by expensive program analysis. Therefore, to address the scalability challenges of traditional heavyweight static analysis, we propose a graph-based lightweight approach MalScan for Android malware detection. MalScan considers the function call graph as a complex social network and employs centrality analysis on sensitive application program interfaces (APIs) to express the semantic characteristics of the graph. On this basis, machine learning algorithms and ensemble learning algorithms are applied to classify the extracted features. We evaluate MalScan on datasets of 104,892 benign apps and 108,640 malwares, and the results of experiments indicate that MalScan outperforms six state-of-the-art detectors and can quickly detect Android malware with an f-value as high as 99%. In addition, there are also significant improvements in the robustness of Android app evolution and robustness to obfuscation. Finally, we conduct an exhaustive statistical study of over one million applications in the Google-Play app market and successfully identify 498 zero-day malware, which further validates the feasibility of MalScan on market-wide malware scanning. © 2004-2012 IEEE.

关键词： Android malware