检索结果-内蒙古大学图书馆

Towards Effective and Efficient Error Handling Code Fuzzing Based on Software Fault Injection

学校读者我要写书评

暂无评论

Towards Effective and Efficient Error Handling Code Fuzzing ...

IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)

作者： Kang Chen Ming Wen Haoxiang Jia Rongxin Wu Hai Jin School of Cyber Science and Engineering Huazhong University of Science and Technology (HRUST) Wuhan China National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Engineering Research Center on Big Data Security Hubei Key Laboratory of Distributed System Security Jin YinHu Laboratory Wuhan China School of Informatics Xiamen University Xiamen China School of Computer Science and Technology HUST Wuhan China Cluster and Grid Computing Lab

ISBN: (数字)9798350330663

ISBN: (纸本)9798350330670

Software systems often encounter various errors or exceptions in practice, and thus proper error handling code is essential to ensure the reliability of software systems. Unfortunately, error handling code is often bug-prone, while sufficiently testing them is challenging as such code often cannot be triggered under normal conditions. Motivated by this, recent studies have proposed to leverage software fault injection (SFI) based fuzzing to discover potential bugs in complicated error handling code. Despite the promising results achieved, their effectiveness and efficiency are still compromised in practice due to the huge search space of error sites, inadequate fuzzing guidance, and the overhead induced by context-sensitive SFI. To achieve effective and efficient testing of error handling code, this study presents AFL-FI, which first utilizes a similarity-based method to identify suspicious error sites, and then incorporates the idea of error site coverage to guide the fuzzing process. Finally, the design of lightweight context-sensitive SFI enables AFL-FI to execute test cases efficiently. We evaluate AFL-FI on eight large-scale open-source projects, and the results show that it can outperform existing state-of-the-art fuzzing tools significantly in terms of branch code coverage. More importantly, AFL-FI has discovered 13 previously unknown bugs, and all of them have been confirmed while 12 of them have been fixed. Besides, our evaluation also demonstrates that all the key designs of AFL- F I are effective that contribute significantly to its overall performance.

关键词： Codes Computer bugs Fuzzing Software systems Software reliability Testing

Graph Neural Networks for Vulnerability Detection: A Counterfactual Explanation

学校读者我要写书评

暂无评论

arXiv 2024年

作者： Chu, Zhaoyang Wan, Yao Li, Qian Wu, Yang Zhang, Hongyu Sui, Yulei Xu, Guandong Jin, Hai School of Computer Science and Technology Huazhong University of Science and Technology China School of Electrical Engineering Computing and Mathematical Sciences Curtin University Australia School of Big Data and Software Engineering Chongqing University China School of Computer Science and Engineering University of New South Wales Australia School of Computer Science University of Technology Sydney Australia National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Cluster and Grid Computing Lab Huazhong University of Science and Technology Wuhan430074 China

Vulnerability detection is crucial for ensuring the security and reliability of software systems. Recently, Graph Neural Networks (GNNs) have emerged as a prominent code embedding approach for vulnerability detection, owing to their ability to capture the underlying semantic structure of source code. However, GNNs face significant challenges in explainability due to their inherently black-box nature. To this end, several factual reasoning-based explainers have been proposed. These explainers provide explanations for the predictions made by GNNs by analyzing the key features that contribute to the outcomes. We argue that these factual reasoning-based explanations cannot answer critical what-if questions: "What would happen to the GNN's decision if we were to alter the code graph into alternative structures?" Inspired by advancements of counterfactual reasoning in artificial intelligence, we propose CFExplainer, a novel counterfactual explainer for GNN-based vulnerability detection. Unlike factual reasoning-based explainers, CFExplainer seeks the minimal perturbation to the input code graph that leads to a change in the prediction, thereby addressing the what-if questions for vulnerability detection. We term this perturbation a counterfactual explanation, which can pinpoint the root causes of the detected vulnerability and furnish valuable insights for developers to undertake appropriate actions for fixing the vulnerability. Extensive experiments on four GNN-based vulnerability detection models demonstrate the effectiveness of CFExplainer over existing state-of-the-art factual reasoning-based explainers. © 2024, CC BY.

关键词： Graph neural networks

Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency

学校读者我要写书评

暂无评论

Detecting Backdoors During the Inference Stage Based on Corr...

Conference on Computer Vision and Pattern Recognition (CVPR)

作者： Xiaogeng Liu Minghui Li Haoyu Wang Shengshan Hu Dengpan Ye Hai Jin Libing Wu Chaowei Xiao School of Cyber Science and Engineering Huazhong University of Science and Technology National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Key Laboratory of Distributed System Security Hubei Engineering Research Center on Big Data Security School of Software Engineering Huazhong University of Science and Technology School of Cyber Science and Engineering Wuhan University School of Computer Science and Technology Huazhong University of Science and Technology Cluster and Grid Computing Lab Arizona State University

Deep neural networks are proven to be vulnerable to backdoor attacks. Detecting the trigger samples during the inference stage, i.e., the test-time trigger sample detection, can prevent the backdoor from being triggered. However, existing detection methods often require the defenders to have high accessibility to victim models, extra clean data, or knowledge about the appearance of backdoor triggers, limiting their practicality. In this paper, we propose the test-time corruption robustness consistency evaluation (TeCo) 1 1 https://***/CGCL-codes/TeCo, a novel test-time trigger sample detection method that only needs the hard-label outputs of the victim models without any extra information. Our journey begins with the intriguing observation that the backdoor-infected models have similar performance across different image corruptions for the clean images, but perform discrepantly for the trigger samples. Based on this phenomenon, we design TeCo to evaluate test-time robustness consistency by calculating the deviation of severity that leads to predictions' transition across different corruptions. Extensive experiments demonstrate that compared with state-of-the-art defenses, which even require either certain information about the trigger types or accessibility of clean data, TeCo outperforms them on different backdoor attacks, datasets, and model architectures, enjoying a higher AUROC by 10% and 5 times of stability.

关键词：

Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature

学校读者我要写书评

暂无评论

arXiv 2024年

作者： Wang, Yichen Chou, Yuxuan Zhou, Ziqi Zhang, Hangtao Wan, Wei Hu, Shengshan Li, Minghui National Engineering Research Center for Big Data Technology and System China Services Computing Technology and System Lab China Cluster and Grid Computing Lab China Hubei Engineering Research Center on Big Data Security China Hubei Key Laboratory of Distributed System Security China School of Cyber Science and Engineering Huazhong University of Science and Technology China School of Computer Science and Technology Huazhong University of Science and Technology China School of School of Software Engineering Huazhong University of Science and Technology China

As deep neural networks (DNNs) are widely applied in the physical world, many researches are focusing on physical-world adversarial examples (PAEs), which introduce perturbations to inputs and cause the model’s incorrect outputs. However, existing PAEs face two challenges: unsatisfactory attack performance (i.e., poor transferability and insufficient robustness to environment conditions), and difficulty in balancing attack effectiveness with stealthiness, where better attack effectiveness often makes PAEs more perceptible. In this paper, we explore a novel perturbation-based method to overcome the challenges. For the first challenge, we introduce a strategy Deceptive RF injection based on robust features (RFs) that are predictive, robust to perturbations, and consistent across different models. Specifically, it improves the transferability and robustness of PAEs by covering RFs of other classes onto the predictive features in clean images. For the second challenge, we introduce another strategy Adversarial Semantic Pattern Minimization, which removes most perturbations and retains only essential adversarial patterns in AEs. Based on the two strategies, we design our method Robust Feature Coverage Attack (RFCoA), comprising Robust Feature Disentanglement and Adversarial Feature Fusion. In the first stage, we extract target class RFs in feature space. In the second stage, we use attention-based feature fusion to overlay these RFs onto predictive features of clean images and remove unnecessary perturbations. Experiments show our method’s superior transferability, robustness, and stealthiness compared to existing state-of-the-art methods. Additionally, our method’s effectiveness can extend to Large Vision-Language Models (LVLMs), indicating its potential applicability to more complex tasks. Copyright © 2024, The Authors. All rights reserved.

关键词： Deep neural networks

VulCNN: An Image-inspired Scalable Vulnerability Detection system

学校读者我要写书评

暂无评论

VulCNN: An Image-inspired Scalable Vulnerability Detection S...

International Conference on Software Engineering (ICSE)

作者： Yueming Wu Deqing Zou Shihan Dou Wei Yang Duo Xu Hai Jin Huazhong University of Science and Technology China Hubei Engineering Research Center on Big Data Security School of Cyber Science and Engineering HUST Wuhan China Services Computing Technology and System Lab National Engineering Research Center for Big Data Technology and System HUST Wuhan China Fudan University China University of Texas at Dallas United States Cluster and Grid Computing Lab School of Computer Science and Technology HUST Wuhan China

ISBN: (纸本)9781665495899

Since deep learning (DL) can automatically learn features from source code, it has been widely used to detect source code vulnerability. To achieve scalable vulnerability scanning, some prior studies intend to process the source code directly by treating them as text. To achieve accurate vulnerability detection, other approaches consider distilling the program semantics into graph representations and using them to detect vulnerability. In practice, text-based techniques are scalable but not accurate due to the lack of program semantics. Graph-based methods are accurate but not scalable since graph analysis is typically time-consuming. In this paper, we aim to achieve both scalability and accuracy on scanning large-scale source code vulnerabilities. Inspired by existing DL-based image classification which has the ability to analyze millions of images accurately, we prefer to use these techniques to accomplish our purpose. Specifically, we propose a novel idea that can efficiently convert the source code of a function into an image while preserving the program details. We implement Vul-CNN and evaluate it on a dataset of 13,687 vulnerable functions and 26,970 non-vulnerable functions. Experimental results report that VulCNN can achieve better accuracy than eight state-of-the-art vul-nerability detectors (i.e., Checkmarx, FlawFinder, RATS, TokenCNN, VulDeePecker, SySeVR, VulDeeLocator, and Devign). As for scalability, VulCNN is about four times faster than VulDeePecker and SySeVR, about 15 times faster than VulDeeLocator, and about six times faster than Devign. Furthermore, we conduct a case study on more than 25 million lines of code and the result indicates that VulCNN can detect large-scale vulnerability. Through the scanning reports, we finally discover 73 vulnerabilities that are not reported in NVD.

关键词： Deep learning Codes Scalability Semantics Detectors Transforms Rats

MR-COF:A Genetic MapReduce Configuration Optimization Framework

学校读者我要写书评

暂无评论

MR-COF:A Genetic MapReduce Configuration Optimization Framew...

The 7th International Symposium on Parallel Architectures, Algorithms and Programming, PAAP2015(2015年第七届国际并行体系结构,算法和编程研讨会)

作者： Chao Liu Deze Zeng Hong Yao Chengyu Hu Xuesong Yan Yuanyuan Fan China Services Computing Technology and System Lab and Cluster and GridComputing Lab Huazhong University of Science and TechnologyWuhan 430074China Hubei Key Laboratory of Intelligent Geo-Information Processing China University of GeosciencesWuhan 430074China

Hadoop/MapReduce has emerged as a de facto programming framework to explore cloud-computing *** has many configuration parameters,some of which are crucial to the performance of MapReduce *** practice,these parameters... 详细信息

ISBN: (纸本)9783319271392

关键词： Mapreduce Massive data processing Parameter configuration Performance optimization Search algorithm

BADROBOT: JAILBREAKING EMBODIED LLMS IN THE PHYSICAL WORLD

学校读者我要写书评

暂无评论

arXiv 2024年

作者： Zhang, Hangtao Zhu, Chenyu Wang, Xianlong Zhou, Ziqi Yin, Changgan Li, Minghui Xue, Lulu Wang, Yichen Hu, Shengshan Liu, Aishan Guo, Peijin Zhang, Leo Yu National Engineering Research Center for Big Data Technology and System China Services Computing Technology and System Lab China Cluster and Grid Computing Lab China Hubei Engineering Research Center on Big Data Security China Hubei Key Laboratory of Distributed System Security China Beihang University China School of Cyber Science and Engineering Huazhong University of Science and Technology China School of Software Engineering Huazhong University of Science and Technology China School of Information and Communication Technology Griffith University Australia

Embodied AI represents systems where AI is integrated into physical entities. Large Language Model (LLM), which exhibits powerful language understanding abilities, has been extensively employed in embodied AI by facilitating sophisticated task planning. However, a critical safety issue remains overlooked: could these embodied LLMs perpetrate harmful behaviors? In response, we introduce BADROBOT, a novel attack paradigm aiming to make embodied LLMs violate safety and ethical constraints through typical voice-based user-system interactions. Specifically, three vulnerabilities are exploited to achieve this type of attack: (i) manipulation of LLMs within robotic systems, (ii) misalignment between linguistic outputs and physical actions, and (iii) unintentional hazardous behaviors caused by world knowledge’s flaws. Furthermore, we construct a benchmark of various malicious physical action queries to evaluate BADROBOT’s attack performance. Based on this benchmark, extensive experiments against existing prominent embodied LLM frameworks (e.g., Voxposer, Code as Policies, and ProgPrompt) demonstrate the effectiveness of our BADROBOT. Copyright © 2024, The Authors. All rights reserved.

关键词： Benchmarking

Genome-wide identification and analysis of MAPK and MAPKK gene families in Brachypodium distachyon

学校读者我要写书评

暂无评论

Genome-wide identification and analysis of MAPK and MAPKK ge...

第十四届全国植物基因组学大会

作者： Lihong Chen Yang Zhang Yuan He Wei Hu Shenglong Tan Min Wang Shiyi Zhou Xiaomin Deng Chao Huang Kexiu Li Junli Chang Mingjie Chen Yuesheng Wang Guangxiao Yang Guangyuan He The Genetic Engineering International Cooperation Base of Chinese Ministry of Science and Technology Key Laboratory of Molecular Biophysics of Chinese Ministry of EducationCollege of Life Science and TechnologyCollege of Life Science and TechnologyHuazhong University of Science & Technology(HUST) Services Computing Technology and System Laboratory Cluster and Grid Computing LaboratorySchool of Computer Science and TechnologyHuazhong University of Science & Technology(HUST)

Mitogen-activated protein kinase(MAPK) cascade,consisting of three Ser/Thr protein kinases,namely,MAPKKK,MAPKK and MAPK,is a universal module in signal transduction pathways in *** proteins have been implicated in diverse cellular processes including cell growth,proliferation,differentiation,survival, development and in responses to a diversity of environmental stimuli including cold, heat,reactive oxygen species,UV,drought and pathogen attack.

关键词： Brachypodium distachyon MAPK MAPKK phylogenetic analysis yeast two hybrid expression profile

A Four-Pronged Defense Against Byzantine Attacks in Federated Learning

学校读者我要写书评

暂无评论

arXiv 2023年

作者： Wan, Wei Hu, Shengshan Li, Minghui Lu, Jianrong Zhang, Longling Zhang, Leo Yu Jin, Hai School of Cyber Science and Engineering Huazhong University of Science and Technology China School of Software Engineering Huazhong University of Science and Technology China School of Information and Communication Technology Griffith University Australia School of Computer Science and Technology Huazhong University of Science and Technology China National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Key Laboratory of Distributed System Security China Hubei Engineering Research Center on Big Data Security China Cluster and Grid Computing Lab

Federated learning (FL) is a nascent distributed learning paradigm to train a shared global model without violating users' privacy. FL has been shown to be vulnerable to various Byzantine attacks, where malicious participants could independently or collusively upload well-crafted updates to deteriorate the performance of the global model. However, existing defenses could only mitigate part of Byzantine attacks, without providing an all-sided shield for FL. It is difficult to simply combine them as they rely on totally contradictory assumptions. In this paper, we propose FPD, a four-pronged defense against both non-colluding and colluding Byzantine attacks. Our main idea is to utilize absolute similarity to filter updates rather than relative similarity used in existingI works. To this end, we first propose a reliable client selection strategy to prevent the majority of threats in the bud. Then we design a simple but effective score-based detection method to mitigate colluding attacks. Third, we construct an enhanced spectral-based outlier detector to accurately discard abnormal updates when the training data is not independent and identically distributed (non-IID). Finally, we design update denoising to rectify the direction of the slightly noisy but harmful updates. The four sequentially combined modules can effectively reconcile the contradiction in addressing non-colluding and colluding Byzantine attacks. Extensive experiments over three benchmark image classification datasets against four state-of-the-art Byzantine attacks demonstrate that FPD drastically outperforms existing defenses in IID and non-IID scenarios (with 30% improvement on model accuracy). © 2023, CC BY.

关键词： Classification (of information)