ASE 2024
Sun 27 October - Fri 1 November 2024 Sacramento, California, United States
Thu 31 Oct 2024 11:40 - 11:50 at Magnoila - Vulnerability and security2 Chair(s): Yiming Tang

In the dynamic landscape of modern software development, open-source software plays a crucial role, driving advancements in computer science across industries. However, the inherent complexity and diversity of open-source software reuse pose challenges in quality, security, management, and sustainability. Existing open-source governance approaches, while excelling in community building and collaboration, still face shortcomings in decentralized management, security, and maintenance. Specifically, under the circumstance of generative software engineering based on large language models (LLMs), it is even more fragmented and complex in the management of open-source reuse, leading to the urgent requirements for a finer-grained understanding of software compositions. To address these challenges, inspired by the Human Genome Project, we treat the software source code as software DNA and propose the \textbf{Software Genome Project (SGP)}, which is geared towards the secure monitoring and exploitation of open-source software. By identifying and labelling integrated and classified code features at a fine-grained level, and effectively identifying safeguards for functional implementations and non-functional requirements at different levels of granularity, the SGP could build a comprehensive set of software genome maps to help developers and managers gain a deeper understanding of software complexity and diversity. By dissecting and summarizing functional and undesirable genes, SGP could help facilitate targeted software optimization, provide valuable insight and understanding of the entire software ecosystem, and support critical development tasks such as technology selection and open source governance. SGP could also serve as a comprehensive dataset with abundant semantic labelling to enhance the training of LLMs for code. Based on these, we expect SGP to drive the evolution of software development towards more efficient, reliable, and sustainable software solutions.

Thu 31 Oct

Displayed time zone: Pacific Time (US & Canada) change

10:30 - 12:00
Vulnerability and security2NIER Track / Research Papers / Tool Demonstrations at Magnoila
Chair(s): Yiming Tang Rochester Institute of Technology
10:30
15m
Talk
Coding-PTMs: How to Find Optimal Code Pre-trained Models for Code Embedding in Vulnerability Detection?
Research Papers
Yu Zhao , Lina Gong Nanjing University of Aeronautics and Astronautic, Zhiqiu Huang Nanjing University of Aeronautics and Astronautics, Yongwei Wang Shanghai Institute for Advanced Study and College of Computer Science, Zhejiang University, Mingqiang Wei School of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Fei Wu College of Computer Science and Technology in Zhejiang University
10:45
15m
Talk
STASE: Static Analysis Guided Symbolic Execution for UEFI Vulnerability Signature Generation
Research Papers
Md Shafiuzzaman University of California at Santa Barbara, Achintya Desai University of California Santa Barbara, Laboni Sarker University of California at Santa Barbara, Tevfik Bultan University of California at Santa Barbara
11:00
15m
Talk
Effective Vulnerable Function Identification based on CVE Description Empowered by Large Language Models
Research Papers
Yulun Wu Huazhong University of Science and Technology, Ming Wen Huazhong University of Science and Technology, Zeliang Yu Huazhong University of Science and Technology, Xiaochen Guo Huazhong University of Science and Technology, Hai Jin Huazhong University of Science and Technology
11:15
15m
Talk
COBRA: Interaction-Aware Bytecode-Level Vulnerability Detector for Smart Contracts
Research Papers
Wenkai Li Hainan University, Xiaoqi Li Hainan University, Zongwei Li Hainan University, Yuqing Zhang University of Chinese Academy of Sciences; Zhongguancun Laboratory
Link to publication DOI Pre-print Media Attached
11:30
10m
Talk
MADE-WIC: Multiple Annotated Datasets for Exploring Weaknesses In Code
Tool Demonstrations
Moritz Mock Free University of Bozen-Bolzano, Jorge Melegati Free University of Bozen-Bolzano, Max Kretschmann Hamburg University of Technology, Nicolás E. Díaz Ferreyra Hamburg University of Technology, Barbara Russo Free University of Bozen/Bolzano, Italy
DOI Pre-print
11:40
10m
Talk
The Software Genome Project: Unraveling Software Through Genetic Principles
NIER Track
Yueming Wu Nanyang Technological University, Chengwei Liu Nanyang Technological University, Zhengzi Xu Nanyang Technological University; Imperial Global Singapore, Lyuye Zhang Nanyang Technological University, Yiran Zhang , Zhu Zhiling Zhejiang University of Technology, Yang Liu Nanyang Technological University
11:50
10m
Talk
Mining for Mutation Operators for Reduction of Information Flow Control Violations
NIER Track
Ilya Kosorukov University College London, Daniel Blackwell University College London, David Clark University College London, Myra Cohen Iowa State University, Justyna Petke University College London