FSE 2025
Mon 23 - Fri 27 June 2025 Trondheim, Norway
co-located with ISSTA 2025
Tue 24 Jun 2025 11:10 - 11:30 at Pirsenteret 150 - Vulnerability 2 Chair(s): Xiaoxue Ren

Deep Learning-based Vulnerability Detection (DLVD) techniques have garnered significant interest due to their ability to automatically learn vulnerability patterns from previously compromised code. Despite the notable accuracy demonstrated by pioneering tools, the broader application of DLVD methods in real-world scenarios is hindered by significant challenges. A primary issue is the “one-for-all” design, where a single model is trained to handle all types of vulnerabilities. This approach fails to capture the patterns of different vulnerability types, resulting in suboptimal performance, particularly for less common vulnerabilities that are often underrepresented in training datasets. To address these challenges, we propose MoEVD, which adopts the Mixture-of-Experts (MoE) framework for vulnerability detection. MoEVD decomposes vulnerability detection into two tasks, CWE type classification and CWE-specific vulnerability detection. By splitting the task, in vulnerability detection, MoEVD allows specific experts to handle distinct types of vulnerabilities instead of handling all vulnerabilities within one model. Our results show that MoEVD achieves an F1-score of 0.44, significantly outperforming all studied state-of-the-art (SOTA) baselines by at least 12.8%. MoEVD excels across almost all CWE types, improving recall over the best SOTA baseline by 9% to 77.8%. Notably, MoEVD does not sacrifice performance on long-tailed CWE types; instead, its MoE design enhances performance (F1-score) on these by at least 7.3%, addressing long-tailed issues effectively.

Tue 24 Jun

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

10:30 - 12:30
Vulnerability 2Research Papers / Demonstrations at Pirsenteret 150
Chair(s): Xiaoxue Ren Zhejiang University
10:30
20m
Talk
Statement-level Adversarial Attack on Vulnerability Detection Models via Out-Of-Distribution Features
Research Papers
Xiaohu Du Huazhong University of Science and Technology, Ming Wen Huazhong University of Science and Technology, Haoyu Wang , Zichao Wei Huazhong University of Science and Technology, Hai Jin Huazhong University of Science and Technology
DOI
10:50
20m
Talk
Large Language Models for In-File Vulnerability Localization can be “Lost in the End”
Research Papers
Francesco Sovrano Collegium Helveticum, ETH Zurich, Switzerland; Department of Informatics, University of Zurich, Switzerland, Adam Bauer University of Zurich, Alberto Bacchelli University of Zurich
DOI
11:10
20m
Talk
One-for-All Does Not Work! Enhancing Vulnerability Detection by Mixture-of-Experts (MoE)
Research Papers
Xu Yang University of Manitoba, Shaowei Wang University of Manitoba, Jiayuan Zhou Huawei, Wenhan Zhu Huawei Canada
DOI
11:30
20m
Talk
Gleipner: A Benchmark for Gadget Chain Detection in Java Deserialization Vulnerabilities
Research Papers
Bruno Kreyssig Umeå University, Alexandre Bartel Umeå University
DOI
11:50
10m
Talk
BinPool: A Dataset of Vulnerabilities for Binary Security Analysis
Demonstrations
Sima Arasteh University of Southern California, Georgios Nikitopoulos Dartmouth College, University of Thessaly, Wei-Cheng Wu Dartmouth College, Nicolaas Weideman USC Information Sciences Institute, Aaron Portnoy Dartmouth College, Mukund Raghothaman University of Southern California, Christophe Hauser Dartmouth College
12:00
20m
Talk
Today's cat is tomorrow's dog: accounting for time-based changes in the labels of ML vulnerability detection approaches
Research Papers
Ranindya Paramitha University of Trento, Yuan Feng , Fabio Massacci University of Trento; Vrije Universiteit Amsterdam
DOI Pre-print
12:20
10m
Talk
KAVe: A Tool to Detect XSS and SQLi Vulnerabilities using a Multi-Agent System over a Multi-Layer Knowledge Graph
Demonstrations
Rafael Ramires LASIGE, DI, Faculdade de Ciencias da Universidade de Lisboa, Ana Respício LASIGE, DI, Faculdade de Ciencias da Universidade de Lisboa, Ibéria Medeiros LaSIGE, Faculdade de Ciências da Universidade de Lisboa, Mike Papadakis University of Luxembourg

Information for Participants
Tue 24 Jun 2025 10:30 - 12:30 at Pirsenteret 150 - Vulnerability 2 Chair(s): Xiaoxue Ren
Info for room Pirsenteret 150:

This room is located outside Clarion Hotel

This room is located in the Pirsenteret (The Pier Center) convention center. It is just outside the hotel, on the back, towards the fjord.

You should be able to go through the emergency exit at Clarion, just on the side of the Cosmos 3 wing, which will be bring you close to Pirsenteret.

The entrance to the center is from here:
https://maps.app.goo.gl/dU3qH6kAimXGBNHe7
Once inside, go all straight and you will find signage to reach the room. The room is known as room 150 inside the center.

:
:
:
: