Write a Blog >>
ICSE 2022
Sun 8 - Fri 27 May 2022
Tue 10 May 2022 21:10 - 21:15 at ICSE room 2-odd hours - Software Security 4 Chair(s): Hamid Bagheri
Wed 11 May 2022 03:25 - 03:30 at ICSE room 3-odd hours - Software Security 2 Chair(s): Liliana Pasquale

With the considerable success achieved by modern fuzzing infrastructures, more crashes are produced than ever before. To dig out the root cause, rapid and faithful crash triage for massive-sized crashes has always been attractive. However, hindered by the practical difficulty of reducing analysis imprecision without compromising efficiency, this goal has not been accomplished. \r\n\r\nIn this paper, we present an end-to-end crash triage solution DeFault, for accurately pinpointing unique root cause from massive crashes in a short time. In particular, we quantify the “crash relevance” of program entities based on mutual information, which serves as the criterion of unique crash bucketing and allows us to bucket massive crashes without pre-analyzing their root cause. The quantification of “crash relevance” is also used in the shortening of long crashing traces. On this basis, we use the interpretability of neural networks to precisely pinpoint the root cause in the shortened traces by evaluating each basic block’s impact on the crash label. Evaluated with 20 programs with 22216 crashes in total, DeFault demonstrates remarkable accuracy and performance, which is way beyond what the state-of-the-art techniques can achieve: crash de-duplication was achieved at a super-fast processing speed–0.017 second per crashing trace, without missing any unique bugs. After that, it identifies the root cause of 43 unique crashes with no false negatives and an average false positive rate of 9.2%.

Tue 10 May

Displayed time zone: Eastern Time (US & Canada) change

21:00 - 22:00
Software Security 4Journal-First Papers / Technical Track at ICSE room 2-odd hours
Chair(s): Hamid Bagheri University of Nebraska-Lincoln
21:00
5m
Talk
Out of Sight, Out of Mind? How Vulnerable Dependencies Affect Open-Source Projects
Journal-First Papers
Gede Artha Azriadi Prana Singapore Management University, Abhishek Sharma Veracode, Inc., Lwin Khin Shar Singapore Management University, Darius Foo National University of Singapore, Andrew Santosa Veracode, Inc., Asankhaya Sharma Veracode, Inc., David Lo Singapore Management University
Pre-print Media Attached
21:05
5m
Talk
Identifying Challenges for OSS Vulnerability Scanners - A Study & Test Suite
Journal-First Papers
Andreas Dann Paderborn University, Henrik Plate SAP Security Research, France, Ben Hermann Technical University Dortmund, Serena Elisa Ponta SAP Security Research, France, Eric Bodden University of Paderborn; Fraunhofer IEM
Link to publication DOI Pre-print Media Attached
21:10
5m
Talk
DeFault: Mutual Information-based Crash Triage for Massive Crashes
Technical Track
Xing Zhang National University of Defense Technology, Jiongyi Chen National University of Defense Technology, Chao Feng National University of Defense Technology, Ruilin Li National University of Defense Technolog, Wenrui Diao Shandong University, Kehuan Zhang The Chinese University of Hong Kong
Pre-print Media Attached
21:15
5m
Talk
Practical Automated Detection of Malicious npm Packages
Technical Track
Adriana Sejfia University of Southern California, Max Schaefer GitHub, Inc.
Pre-print Media Attached
21:20
5m
Talk
Exploiting Input Sanitization for Regex Denial of Service
Technical Track
Efe Barlas Purdue University, Xin Du Purdue University, James C. Davis Purdue University, USA
DOI Pre-print Media Attached
21:25
5m
Talk
Hiding Critical Program Components via Ambiguous Translation
Technical Track
Chijung Jung University of Virginia, Doowon Kim University of Tennessee, Knoxville, An Chen University of Georgia, Weihang Wang University at Buffalo, SUNY, Yunhui Zheng IBM Research, Kyu Hyung Lee University of Georgia, Yonghwi Kwon University of Virginia
Pre-print Media Attached

Wed 11 May

Displayed time zone: Eastern Time (US & Canada) change

03:00 - 04:00
Software Security 2Journal-First Papers / Technical Track at ICSE room 3-odd hours
Chair(s): Liliana Pasquale University College Dublin & Lero
03:00
5m
Talk
Lags in the release, adoption, and propagation of npm vulnerability fixes
Journal-First Papers
Bodin Chinthanet Nara Institute of Science and Technology, Raula Gaikovina Kula Nara Institute of Science and Technology, Shane McIntosh University of Waterloo, Takashi Ishio Nara Institute of Science and Technology, Akinori Ihara Wakayama University, Kenichi Matsumoto Nara Institute of Science and Technology
Link to publication DOI Pre-print Media Attached
03:05
5m
Talk
The Case for Adaptive Security Interventions
Journal-First Papers
Irum Rauf The Open University, UK, Marian Petre The Open University, Thein Tun , Tamara Lopez The Open University, Paul Lunn The University of Manchester, UK, Dirk van der Linden Northumbria University, John Towse Department of Psychology, University of Lancaster, UK, Helen Sharp The Open University, Mark Levine Lancaster University, Awais Rashid University of Bristol, UK, Bashar Nuseibeh The Open University (UK) & Lero (Ireland)
Link to publication DOI Pre-print Media Attached
03:10
5m
Talk
Out of Sight, Out of Mind? How Vulnerable Dependencies Affect Open-Source Projects
Journal-First Papers
Gede Artha Azriadi Prana Singapore Management University, Abhishek Sharma Veracode, Inc., Lwin Khin Shar Singapore Management University, Darius Foo National University of Singapore, Andrew Santosa Veracode, Inc., Asankhaya Sharma Veracode, Inc., David Lo Singapore Management University
Pre-print Media Attached
03:15
5m
Talk
MVD: Memory-related Vulnerability Detection Based on Flow-Sensitive Graph Neural Networks
Technical Track
Sicong Cao Yangzhou University, Xiaobing Sun Yangzhou University, Lili Bo Yangzhou University, Rongxin Wu Xiamen University, Bin Li Yangzhou University, Chuanqi Tao Nanjing University of Aeronautics and Astronautics
DOI Pre-print Media Attached
03:20
5m
Talk
VulCNN: An Image-inspired Scalable Vulnerability Detection System
Technical Track
Yueming Wu Huazhong University of Science and Technology, Deqing Zou Huazhong University of Science and Technology, Shihan Dou Huazhong University of Science and Technology, Wei Yang University of Texas at Dallas, Duo Xu Huazhong University of Science and Technology, Hai Jin Huazhong University of Science and Technology
DOI Pre-print Media Attached
03:25
5m
Talk
DeFault: Mutual Information-based Crash Triage for Massive Crashes
Technical Track
Xing Zhang National University of Defense Technology, Jiongyi Chen National University of Defense Technology, Chao Feng National University of Defense Technology, Ruilin Li National University of Defense Technolog, Wenrui Diao Shandong University, Kehuan Zhang The Chinese University of Hong Kong
Pre-print Media Attached

Information for Participants
Tue 10 May 2022 21:00 - 22:00 at ICSE room 2-odd hours - Software Security 4 Chair(s): Hamid Bagheri
Info for room ICSE room 2-odd hours:

Click here to go to the room on Midspace

Wed 11 May 2022 03:00 - 04:00 at ICSE room 3-odd hours - Software Security 2 Chair(s): Liliana Pasquale
Info for room ICSE room 3-odd hours:

Click here to go to the room on Midspace