Despite Rust’s memory safety guarantees, developers can still introduce security vulnerabilities due to limited security awareness and training. Assessing the security risks of such vulnerabilities is challenging, especially when the resulting failures are not directly observable in the application’s runtime behavior. However, the Rust ecosystem currently lacks reproducible vulnerability datasets, and many vulnerability advisories do not provide proof-of-vulnerability (PoV) examples to demonstrate the issue. As a result, reproducing vulnerabilities from advisory information alone is technically difficult and time-consuming, which limits developers’ ability to recognize and understand security risks in practice.

Developers often build software on top of third-party libraries (Libs) to improve programmer productivity and software quality. The libraries may contain vulnerabilities exploitable by hackers to attack the applications (Apps) built on top of them. Such attacks are known as software supply chain attacks, the documented number of which has increased 742% in 2022. Researchers and developers created tools to mitigate such attacks, by scanning the library dependencies of Apps, identifying the usage of vulnerable library versions, and suggesting secure alternatives to vulnerable dependencies. However, recent studies show that many developers do not trust the reports by these tools; they need code or evidence to demonstrate how library vulnerabilities lead to security exploits, in order to assess vulnerability severity and modification necessity. Unfortunately, manually crafting demos of application-specific attacks is challenging and timeconsuming, and there is insufficient tool support to automate that procedure.To help developers enhance software security, in this study, we systematically explored the usage of a large language model (LLM)–ChatGPT-4.0–to generate security tests, which unit tests demonstrate how vulnerable library dependencies facilitate the supply chain attacks to givenApps. In our exploration, we defined prompt templates to take in the various vulnerability-relevant information we manually collected, and generated prompts from those templates to query ChatGPT for security test generation. We found that ChatGPT-generated tests demonstrated 24 evidence or proof of vulnerability for 49 Apps. To assess the consistency of test generation, we also evaluated another five state-of-the-art LLMs. All the models generated security tests for at least 17 cases that successfully demonstrate the vulnerabilities. We filed six reports for the newly revealed vulnerabilities in Apps, and got four Common Vulnerability Entries (CVEs) assigned. Our use of ChatGPT outperformed two state-of-the-art security test generators (TRANSFER and SIEGE), by generating a lot more tests and achieving more attacks. Our research will shed light on new research in security test generation.

The Java platform provides various cryptographic APIs to facilitate secure coding. However, correctly using these APIs is challenging for developers who lack cybersecurity training. Prior work shows that many developers misused APIs and consequently introduced vulnerabilities into their software. To eliminate such vulnerabilities, people created tools to detect and/or fix cryptographic API misuses. However, it is still unknown (1) how current tools are designed to detect cryptographic API misuses, (2) how effectively the tools work to locate API misuses, and (3) how developers perceive the usefulness of tools’ outputs. For this paper, we conducted an empirical study to investigate the research questions mentioned above. Specifically, we first conducted a literature survey on existing tools and compared their approach design from different angles. Then we applied six of the tools to three popularly used benchmarks to measure tools’ effectiveness of API-misuse detection. Next, we applied the tools to 200 Apache projects and sent 57 vulnerability reports to developers for their feedback. Our study revealed interesting phenomena. For instance, none of the six tools was found universally better than the others; however, CogniCrypt, CogniGuard, and Xanitizer outperformed SonarQube. More developers rejected tools’ reports than those who accepted reports (30 versus 9) due to their concerns on tools’ capabilities, the correctness of suggested fixes, and the exploitability of reported issues. This study reveals a significant gap between the state-of-the-art tools and developers’ expectations; it sheds light on future research in vulnerability detection.

The Java libraries JCA and JSSE offer cryptographic APIs to facilitate secure coding. When developers misuse some of the APIs, their code becomes vulnerable to cyber-attacks. To eliminate such vulnerabilities, people built tools to detect security-API misuses via pattern matching. However, most tools do not (1) fix misuses or (2) allow users to extend tools' pattern sets. To overcome both limitations, we created Seader---an example-based approach to detect and repair security-API misuses. Given an exemplar (insecure, secure) code pair, Seader compares the snippets to infer any API-misuse template and corresponding fixing edit. Based on the inferred info, given a program, Seader performs inter-procedural static analysis to search for security-API misuses and to propose customized fixes.

Many real-time systems are safety-critical, where reliability is crucial. Under traditional scheduling mechanism, the execution patterns of the tasks on such system can be easily derived from side-channel attacks, such that attackers can launch short high-priority tasks at critical instants which may cause deadline miss for high-critical tasks. In order to protect the system from such kind of attacks, this paper proposes the roulette wheel scheduler (RWS) to randomize the task execution pattern. Under RWS, probabilities will be assigned to each task at predefined scheduling points, and the choice for execution is randomized, such that the execution pattern is no longer fixed. We formalize the concept of schedule entropy the additional safety provided by any randomized scheduler. It is used to measure the amount of uncertainty introduced by the new scheduler.

As the number of cores and utilization of the system are increasing quickly, shared resources like caches are interfering tasks' execution behaviors more heavily. In order to achieve resource efficiency in both temporal and spatial domains for multi-core real-time systems, caches should be taken into consideration when performing partitions. In this paper, partitioned Earliest Deadline First (EDF) scheduling on a preemptive multi-core platform is considered. We propose a new system model that covers inter-task cache interference and describe some ongoing work in identifying proper partition schemes under such settings.