36 results
Now showing1 - 10 of 36
- Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Automatic rule checking for microservices: supporting security analysis with explainability(Association for Computing Machinery (ACM), 2026-07-16); ; ; ; Software security analysis is often done manually, raising performance and correctness issues. Introducing automation is challenging because human verification of the outcomes is often required, especially for security assessment and certification. The distributed nature of microservice applications further increases these concerns. We present an approach for automatically checking architectural security rules on models of microservice applications. It provides explainability for verdicts of rules that are expressed as model queries in our rule specification language. This comprehensible, step-by-step evidence leverages traceability information from the input models to link to artifacts in code. Hence, the complete analysis process from source code via model to rule verdict can be traced and verified. Custom rules can be formulated in addition to a library of 25 best-practice architectural security rules. We evaluated the approach’s correctness by checking the 25 rules on 16 dataflow diagrams of microservice applications with a prototype (called MicroCertiSec) and observed promising results (precision=0.98; recall=1). Additionally, we performed an evaluation with industry experts and academics to gain initial insights into the approach’s usefulness for real-world security analysis. The nine participants gave highly positive feedback on usefulness and usability and stated they would use such an approach in their daily work.Publicationtype: Journal Article35 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , VULTERMINATOR: bringing back template-based automated repair for fixing Java vulnerabilitiesMainstream techniques for Automated Vulnerability Repair (AVR) lean heavily on Large Language Models (LLMs) and treat the vulnerability repair as a code translation task. Yet, their effectiveness is limited due to the complex nature of vulnerability fixes and, possibly, the lack of training datasets in the Java programming language. On the other hand, templatebased Automated Program Repair (APR) remains a popular way to fix general bugs. However, only a few approaches have ever employed vulnerability-specific fix templates. This paper introduces VulTerminator, a novel repair approach for Java vulnerabilities that leverages both heuristic-based and data-driven fix templates. The former are specialized for certain vulnerability types, such as XML External Entity (XXE) injection, which can be more easily patched with predefined heuristics. The latter aim to repair a broader class of vulnerabilities by generating common patch templates with masks, which are later filled by a fine-tuned Masked Language Model (MLM). In this paper, we introduce a total of eleven fix templates distilled from real-world Java patches and evaluate VulTerminator on 106 vulnerabilities with test cases from Vul4J+, as well as on 169 unseen vulnerabilities from a newly curated dataset called Vul4JL. VulTerminator achieves the best overall repair performance, outperforming the state-of-the-art approaches by 7 % on Vul4J+ and 27 % on Vul4JL, as confirmed by manual inspection. Vulterminator managed to fix 10 vulnerabilities in Vul4J+ and 16 in Vul4JL that no other approach could do, mainly due to the contribution of heuristicbased templates.Publicationtype: Conference Paper15 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Back to the roots: assessing mining techniques for Java vulnerability-contributing commits(Association for Computing Machinery (ACM), 2025-09-24); ; ; 30 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Retrieve, Refine, or Both? Using Task-Specific Guidelines for Secure Python Code GenerationLarge Language Models (LLMs) are increasingly used for code generation, but they often produce code with security vulnerabilities. While techniques like fine-tuning and instruction tuning can improve security, they are computationally expensive and require large amounts of secure code data. Recent studies have explored prompting techniques to enhance code security without additional training. Among these, Recursive Criticism and Improvement (RCI) has demonstrated strong improvements by iteratively refining the generated code by leveraging LLMs' self-critiquing capabilities. However, RCI relies on the model's ability to identify security flaws, which is constrained by its training data and susceptibility to hallucinations. This paper investigates the impact of incorporating taskspecific secure coding guidelines extracted from MITRE's CWE and CodeQL recommendations into LLM prompts. For this, we employ Retrieval-Augmented Generation (RAG) to dynamically retrieve the relevant guidelines that help the LLM avoid generating insecure code. We compare RAG with RCI, observing that both deliver comparable performance in terms of code security, with RAG consuming considerably less time and fewer tokens. Additionally, combining both approaches further reduces the amount of insecure code generated, requiring only slightly more resources than RCI alone, highlighting the benefit of adding relevant guidelines in improving LLM-generated code security.Publicationtype: Conference Paper35 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , In specs we trust? Conformance-analysis of implementation to specifications in Node-RED and associated security risksLow-code development frameworks for IoT platforms offer a simple drag-and-drop mechanism to create applications for the billions of existing IoT devices without the need for extensive programming knowledge. The security of such software is crucial given the close integration of IoT devices in many highly sensitive areas such as healthcare or home automation. Node-RED is a framework to build applications from nodes that are contributed by open-source developers. Its reliance on unvetted contributions and lack of security checks raises the concern that the applications could be vulnerable to attacks, thereby posing a security risk to end users. The low-code approach could imply that users lack the technical knowledge to mitigate or even realize such security concerns. This paper focuses on hidden information flows in Node-RED nodes, meaning flows that are not captured by the specifications. They could (unknowingly or with malicious intent) cause leaks of sensitive information to unauthorized entities. We report the results of a conformance analysis of all nodes in the Node-RED framework, for which we compared the numbers of specified inputs and outputs of each node against the number of sources and sinks detected with CodeQL. The results show, that 55% of all nodes exhibit more possible flows than are specified. A risk assessment of a subset of the nodes showed, that 28% of them are associated with a high severity and 36% with a medium severity rating.Publicationtype: Conference Paper21 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Impact of identifier normalization on vulnerability detection techniquesThis study examines the impact of identifier normalization on software vulnerability detection using three approaches: static application security testing (SAST), specialized machine learning (ML) models, and Large Language Models (LLM). Using the BigVul dataset of vulnerabilities in C/C++ projects, the research evaluates the performance of these methods under normalized (generalized variables / functions names) and their original conditions. SAST tools such as Flawfinder and CppCheck exhibit limited effectiveness (F1 ∼ scores 0.1) and are unaffected by normalization. Specialized ML models, such as LineVul, achieve high F1 scores on nonnormalized data (F1 ∼ 0.9) but suffer significant performance drops when tested on normalized inputs, highlighting their lack of generalizability. In contrast, LLMs such as Llama3, although underperforming in their pre-trained state, show substantial improvement after fine-tuning, achieving robust and consistent results across both normalized and non-normalized datasets. The findings suggest that while SAST tools are less effective, fine-tuned LLMs hold strong potential for scalable and generalized vulnerability detection. The study recommends further exploration of hybrid approaches that combine ML models, LLMs, and traditional tools to enhance accuracy and adaptability in diverse scenarios.Publicationtype: Conference Paper55 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , The Good, the Bad, and the (Un)Usable: A Rapid Literature Review on Privacy as Code(2025); ; Privacy and security are central to the design of information systems endowed with sound data protection and cyber resilience capabilities. Still, developers often struggle to incorporate these properties into software projects as they either lack proper cybersecurity training or do not consider them a priority. Prior work has tried to support privacy and security engineering activities through threat modeling methods for scrutinizing flaws in system architectures. Moreover, several techniques for the automatic identification of vulnerabilities and the generation of secure code implementations have also been proposed in the current literature. Conversely, such as-code approaches seem under-investigated in the privacy domain, with little work elaborating on (i) the automatic detection of privacy properties in source code or (ii) the generation of privacy-friendly code. In this work, we seek to characterize the current research landscape of Privacy as Code (PaC) methods and tools by conducting a rapid literature review. Our results suggest that PaC research is in its infancy, especially regarding the performance evaluation and usability assessment of the existing approaches. Based on these findings, we outline and discuss prospective research directions concerning empirical studies with software practitioners, the curation of benchmark datasets, and the role of generative AI technologies.Publicationtype: Conference Paper29 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Designing secure AI-based systems: a multi-vocal literature review(IEEE, 2024-10); ; ; AI-based systems leverage recent advances in the field of AI/ML by combining traditional software systems with AI components. Applications are increasingly being developed in this way. Software engineers can usually rely on a plethora of supporting information on how to use and implement any given technology. For AI-based systems, however, such information is scarce. Specifically, guidance on how to securely design the architecture is not available to the extent as for other systems.We present 16 architectural security guidelines for the design of AI-based systems that were curated via a multi-vocal literature review. The guidelines could support practitioners with actionable advice on the secure development of AI-based systems. Further, we mapped the guidelines to typical components of AI-based systems and observed a high coverage where 6 out of 8 generic components have at least one guideline associated to them.Publicationtype: Conference Paper16 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , What can self-admitted technical debt tell us about security? A mixed-methods study(IEEE, 2024); ; Self-Admitted Technical Debt (SATD) encompasses a wide array of sub-optimal design and implementation choices reported in software artefacts (e.g., code comments and commit messages) by developers themselves. Such reports have been central to the study of software maintenance and evolution over the last decades. However, they can also be deemed as dreadful sources of information on potentially exploitable vulnerabilities and security flaws. Objective: This work investigates the security implications of SATD from a technical and developer-centred perspective. On the one hand, it analyses whether security pointers disclosed inside SATD sources can be used to characterise vulnerabilities in Open-Source Software (OSS) projects and repositories. On the other hand, it delves into developers' perspectives regarding the motivations behind this practice, its prevalence, and its potential negative consequences. Method: We followed a mixed-methods approach consisting of (i) the analysis of a preexisting dataset containing 8,812 SATD instances and (ii) an online survey with 222 OSS practitioners. Results: We gathered 201 SATD instances through the dataset analysis and mapped them to different Common Weakness Enumeration (CWE) identifiers. Overall, 25 different types of CWEs were spotted across commit messages, pull requests, code comments, and issue sections, from which 8 appear among MITRE's Top-25 most dangerous ones. The survey shows that software practitioners often place security pointers across SATD artefacts to promote a security culture among their peers and help them spot flaky code sections, among other motives. However, they also consider such a practice risky as it may facilitate vulnerability exploits. Implications: Our findings suggest that preserving the contextual integrity of security pointers disseminated across SATD artefacts is critical to safeguard both commercial and OSS solutions against zero-day attacks.CCS CONCEPTS•Security and privacy → Human and societal aspects of security and privacy; Software security engineering; • Software and its engineering → Maintaining software.Publicationtype: Conference Paper34 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , How dataflow diagrams impact software security analysis : an empirical experimentModels of software systems are used throughout the software development lifecycle. Dataflow diagrams (DFDs), in particular, are well-established resources for security analysis. Many techniques, such as threat modelling, are based on DFDs of the analysed application. However, their impact on the performance of analysts in a security analysis setting has not been explored before. In this paper, we present the findings of an empirical experiment conducted to investigate this effect. Following a within-groups design, participants were asked to solve security-relevant tasks for a given microservice application. In the control condition, the participants had to examine the source code manually. In the model-supported condition, they were additionally provided a DFD of the analysed application and traceability information linking model items to artefacts in source code. We found that the participants (n = 24) performed significantly better in answering the analysis tasks correctly in the model-supported condition (41 % increase in analysis correctness). Further, participants who reported using the provided traceability information performed better in giving evidence for their answers (315% increase in correctness of evidence). Finally, we identified three open challenges of using DFDs for security analysis based on the insights gained in the experiment.Publicationtype: Conference Paper18