Demo Data from VLDB 2026 / reviewers in the wild / expert
Zong Cao
dblp:433/2084
· DBLP profile ↗
2ranked-venue papers
1as first author
2since 2021 · last 2026
0009-0001-2069-4949ORCID · corroborated
Domains — the database's venue-derived domains; a paper can count in several
Security and privacy · 1 · 1 since 2021Software engineering, systems software and programming languages · 1 · 1 first-author · 1 since 2021
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Network and information security
1 paper |
Systems and software security · 100% | |
| Software engineering, system software, and programming languages
1 paper |
Operating systems · 100% |
Topics — the 2 heaviest of 2, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Systems and software security › vulnerability analysis
attack surface analysis |
1.0 | 1 | 2026 | NetPanic: the Attack Surface You Can't Syscall · SP 2026 |
Operating systems › system security › operating system security
kernel security |
0.3 | 1 | 2026 | NetPanic: the Attack Surface You Can't Syscall · SP 2026 |
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2026 | NetPanic: the Attack Surface You Can't Syscall
Tianshuo Han, Zong Cao, Xiapu Luo |
SP | 2 |
| 2026 | Reframing Paths as Logic: Semantic Segmentation for Vulnerability DetectionabstractPath-sensitive vulnerabilities, such as use-after-free, integer overflows, and command injection, pose significant challenges for traditional static analysis tools, which often face trade-offs between precision, scalability, and interpretability. To address these challenges, we present SEVDF (Semantic-Enhanced Vulnerability Detection Framework), a novel methodology that integrates may-analysis taint propagation with large language models (LLMs) to detect path-related vulnerabilities in large C/C++ codebases. SEVDF begins by constructing a program dependency graph and performing a sound but incomplete taint analysis to extract all potential vulnerable paths. After segmentation, deduplication, feasibility check, and semantic summarization by LLMs, the vulnerable paths are reformed and confirmed with LLMs for their inter-procedural feasibility and semantic consistency. We evaluate SEVDF on the Juliet Test Suite (thirteen CWE categories) and a curated real-world dataset of 71 vulnerabilities across 9 projects. SEVDF consistently outperforms the default CodeQL rules, CodeQL rules with all unnecessary constraints removed, and three open-source detectors, which are Infer, Cppcheck and CodeChecker. SEVDF is able to achieve 100% precision on several CWEs while maintaining or improving recall on Juliet benchmark. Moreover, our segment-based design reduces the analysis workload for LLMs by 90.6% compared to direct-path prompting through Logic Unit deduplication, making SEVDF cost-effective for large-scale deployment. Finally, SEVDF uncovered and reported 29 0-day vulnerabilities (12 confirmed to date), including 3 CVEs in VirtualBox, demonstrating practical value. Zong Cao, Yuqiang Sun 0001, Zhengzi Xu, Kaixuan Li 0002, Yeqi Fu, Ziqiao Kong, Yang Liu 0003 |
Proc. ACM Program. Lang. | 1 |