Large language models (LLMs) are increasingly used as evaluators in natural language generation tasks, offering advantages in scalability and interpretability over traditional evaluation methods.However, existing LLMbased evaluations often suffer from biases and misalignment, particularly in domain-specific tasks, due to limited functional understanding and knowledge gaps.To address these challenges, we first investigate the relationship between an LLM-based evaluator's familiarity with the target task and its evaluation performance.We then introduce the Co-Eval framework, which leverages a criteria planner model and optimized machine metrics to enhance the scalability and fairness of LLMbased evaluation.Experimental results on both general and domain-specific tasks demonstrate that Co-Eval reduces biases, achieving up to a 0.4903 reduction in self-preference bias, and improves alignment with human preferences, with gains of up to 0.324 in Spearman correlation.

Lightweight robots are frequently engaged in real-time tracking tasks to provide human companionship services. For effective target tracking, the YOLO series is often employed as a lightweight object detection framework in robot systems. However, YOLO still demands substantial resources to train larger-scale models, striking a balance between accuracy and resource efficiency. Deploying YOLO directly on robots with limited computing resources can lead to significant delays in detection, compromising the effectiveness of tracking tasks. A deeper concern arises from the prevalent use of CPUs as the primary computing units in robots, rendering many existing model optimization techniques, which primarily target GPU computing, unsuitable for this context.

Domain-Flux technique has been widely used by attackers to maintain a botnet for many years and the core of it is the adoption of domain generation algorithm (DGA). To combat attackers, there are lots of works in DGA domain detection area recently. But they usually collect quite limited data and conduct experiments in a closed dataset, meaning that the DGA data and the benign data they collected can not well represent the real distribution between them. Moreover, they handle the domains roughly and use the origin data to train the classifier directly, which is also not adequate to classify these two types of domains with lots of false positives and false negatives happening during the real-world deployment. In this paper, we conduct the first large-scale DGA domain analysis in traffic level and argue that the preprocessing stage is also vital for the final classifier, which is usually ignored by the existing works. We collect the largest amount of DGA domain data than prior works and collect DNS log offered by a big company, whose DNS data covers most important industries in China. Based on this data, we analyze the distribution of DGA domains in traffic and give quantifiable results showing that NXDomain (domain not exist) is more suitable for DGA detection. Moreover, we give detailed preprocessing steps to handle the original domains. Our experiment shows that with the preprocessing stage mentioned above, classifier performs better in DGA detection task. Our research indicates that improving the classification algorithm is far from enough in DGA detection and the preprocessing stage is also the key component in bringing the DGA detection methods from lab to product.

Although machine learning (ML) based solutions are ever-evolving for the attack defending paradigm, signatures of malicious network traffic are vital resources for intrusion detection systems (IDSs) and network forensic procedure, covering the lack of interpretability and stability for ML models. However, signature extraction is still a time and labor consuming task nowadays, resulting in possible increase of the attackers' dwell time. Existing automatic solutions rely too much on sequence similarity based and heuristic based methods, encountering performance degradation in large scale and dynamic network environment. In this paper, we present a novel method, called Clustering and Model Inference-based Rule Generation (CMIRGen), automatically generating token-set based signature rules for malicious traffic payloads to be inspected. CMIRGen leverages both optimized sequence similarity based and black-box model inference based methods to extract patterns from homogeneous and heterogeneous payloads respectively. Experimental evaluations have been conducted on several datasets and show the CMIRGen framework can extract discriminative signatures, presenting high recall rate and low false positive rate at the same time for malicious content recognition.

Active random testing is a powerful technique to find concurrency bugs through predicting the potential buggy inter-leaves. It helps improve the effectiveness of random testing such that the buggy scenarios are selected actively from trivial ones. However, applying active random testing to find null pointer dereference (NPD) still faces a strong challenge in that these NPDS are usually caused by the nontrivial data races, and therefore it is insufficient to adopt a general dynamic prediction approach to find them. In this paper, we propose a race-driven active random testing approach, RADIATE, to detect NPDs. The essential idea of RADIATE is to perform a race-driven prediction of the original trace for obtaining the potential NPD scenarios, and then use active random testing technique to actively control the thread schedules for exposing the real NPDs. We have implemented our RADIATE approach, and evaluated it over 7 benchmark programs. The evaluation results show that RADIATE can effectively find the indiscoverable NPDs.

Concurrency semantics plays an important role in both concurrency theory and software engineering. Although many results on various concurrency semantics have been proposed, there is still room for improvement. This paper focuses on the locality semantics, an important non-interleaving semantics, based on studying the relationship between the located CCS and the π-calculus. We present a practical full abstraction result for the locality semantics, and reduce the location bisimulation of the located CCS to the observation bisimulation of the π-calculus. The full abstraction result respects process finiteness, i.e., finite processes of the located CCS are mapped onto finite π-processes. As a result, the location bisimulation on finite processes of the located CCS can be proved by an existing proof system on finite π-processes, which is not achieved in [31].