In software development, investigating the accessibility of dependency vulnerabilities is of great importance, as third-party libraries often contain known vulnerabilities that could be exploited in the application's business logic. The existing accessibility analysis methods encounter challenges such as undecidability, abstraction loss, and path explosion in large-scale programs, resulting in an inaccurate distinction between accessibility vulnerabilities and non-accessibility vulnerabilities. This paper introduces an approach called ConVReach for analyzing the reachability of vulnerabilities in dependencies in C/C++ programs. ConVReach overcomes the problems of high abstraction loss and potential path explosion in the current methods by combining static and dynamic approaches, particularly a constraint-guided analysis method. This approach extracts and decomposes the path constraints that trigger vulnerabilities, independently verifies the satisfiability of each constraint, and then aggregates the feasible paths. This effectively reduces unnecessary path exploration and avoids the common path explosion issues in traditional methods. Experimental results show that ConVReach outperforms existing tools in both accuracy and efficiency, effectively distinguishing between reachable and unreachable vulnerabilities, and significantly reducing false positives and false negatives. We constructed a benchmark dataset to evaluate ConVReach , which includes 53 CVEs and 347 flags artificially inserted into various open-source projects. This dataset was designed to simulate both real-world vulnerabilities and complex scenarios. Through testing on this dataset, ConVReach demonstrated exceptional performance. It successfully identified 59 out of 61 reachable vulnerabilities and all 23 unreachable ones in the CVE dataset. Within a 24-hour time budget, ConVReach detected above 50% more reachable vulnerabilities than the baseline tools in the first 6 hours and nearly completed the detection of reachable vulnerabilities by the 12-hour mark. These results highlight ConVReach 's superior ability to handle both real-world vulnerabilities and challenging cases.

With the escalating threat of software vulnerabilities to the security of modern software systems, an increasing number of deep learning (DL) model-based vulnerability detectors have been developed for vulnerability detection. However, their practical reliability, consistency in usage, and adaptability across diverse software contexts remain unclear. This uncertainty may lead to unreliable detection results in practical applications, increased false positives and false negatives, and limited adaptability to newly emerged vulnerabilities. Conducting a large-scale and in-depth analysis of DL-based vulnerability detectors can help uncover critical factors influencing detection performance, improve the design and training of these models, and enhance their practical deployment in real-world scenarios. In this paper, we present VulTegra, a novel evaluation framework that, for the first time, conducts a multidimensional assessment comparing scratch-trained models and pre-trained-based models for vulnerability detection, while verifying key factors influencing detection performance. Our framework reveals that state-of-the-art (SOTA) detectors still suffer from low consistency, limited practical detection capabilities, and limited adaptability. Moreover, comparative results indicate that the increasingly favored pre-trained-based models are not universally superior to scratch-trained models; instead, they exhibit distinct strengths and application scenarios. Most importantly, our study highlights the limitations of relying solely on CWE-based classification and reveals a set of critical factors that significantly influence detection performance. Experimental validation shows that these factors have a substantial impact: modifying only any single factor led to recall improvements across all seven evaluated SOTA detectors, with six detectors also achieving higher F1 scores. Our findings provide deep insights into model behavior, highlighting the need to consider both vulnerability types and inherent code features to ensure practical applicability in real-world software environments.

Satisfiability Modulo Theories (SMT) solvers are foundational in applications such as software verification and automated bug detection, where both correctness and performance are critical to the reliability and scalability of these systems. While existing methods predominantly focus on functional testing, performance testing has received insufficient attention, particularly regarding performance regression caused by both intentional and unintentional factors during software evolution. Current performance regression testing approaches are primarily designed for string solvers, neglecting the full spectrum of SMT theories. Furthermore, these methods often rely on time comparisons or log analysis, which makes the identification of the responsible commit slow and inefficient. To address the above issues, we propose a novel general purpose testing framework, SMTPRT, that efficiently detects and localizes performance regression issues across diverse SMT solver theories. We utilize large language models (LLMs) based on genetic algorithms (GAs) to guide the search for performance regression-inducing cases. We introduce an optimized localization technique that filters irrelevant commits using code coverage, followed by a bisecting algorithm to rapidly pinpoint the responsible commit. To thoroughly evaluate SMTPRT, we conducted extensive experiments involving six types of logic, demonstrating its superior performance. Specifically, SMTPRT successfully detected 59 regression cases, performing 3.44 times better than the baseline, and located the issues $\mathbf{1. 1 6}$ times faster than the baseline.

Intelligent diagnostic systems require continual learning (CL) to learn to diagnose new diseases. However, the systems suffer from catastrophic forgetting of old knowledge when learning knowledge of new diseases. Existing CL methods that leverage pre-trained language models (PLMs) to guide visual encoders are ineffective in the medical domain due to PLMs' limited medical knowledge. Here, we propose Textual Prototype-Guided Continual Learning (TPGCL) for effective CL. TPGCL utilizes an image captioning model to generate semantically rich disease descriptions, which are then encoded into text embeddings via a text encoder to obtain the textual prototype for each class. These prototypes guide the visual encoder during CL. In addition, a gradient-weighting mechanism merges visual adapters learned from all CL stages to preserve old knowledge and prevent model growth and adapter selection issue. Extensive experiments on three medical image datasets demonstrate TPGCL's superiority in continually learning new diseases. The source code is available at https://github.com/z1968357787/TPGCL

Defect detection is a pivotal aspect ensuring product quality and production efficiency in industrial manufacturing. Existing studies on defect detection predominantly focus on locating defects through bounding boxes and classifying defect types. However, their methods can only provide limited information and fail to meet the requirements for further processing after detecting defects. To this end, we propose a novel task called defect detection report generation, which aims to provide more comprehensive and informative insights into detected defects in the form of text reports. For this task, we propose some new datasets, which contain 16 different materials and each defect contains a detailed report of human constructs. In addition, we propose a knowledge-aware report generation model as a baseline for future research, which aims to incorporate additional knowledge to generate detailed analysis and subsequent processing related to defect in images. By constructing defect report datasets and proposing corresponding baselines, we chart new directions for future research and practical applications of this task.

Adversarial waveform generation has been a popular approach as the backend of singing voice conversion (SVC) to generate high-quality singing audio. However, the instability of GAN also leads to other problems, such as pitch jitters and U/V errors. It affects the smoothness and continuity of harmonics, hence degrades the conversion quality seriously. This paper proposes to feed harmonic signals to the SVC model in advance to enhance audio generation. We extract the sine excitation from the pitch, and filter it with a linear time-varying (LTV) filter estimated by a neural network. Both these two harmonic signals are adopted as the inputs to generate the singing waveform. In our experiments, two mainstream models, MelGAN and ParallelWaveGAN, are investigated to validate the effectiveness of the proposed approach. We conduct a MOS test on clean and noisy test sets. The result shows that both signals significantly improve SVC in fidelity and timbre similarity. Besides, the case analysis further validates that this method enhances the smoothness and continuity of harmonics in the generated audio, and the filtered excitation better matches the target audio.

Abstract The authentication mechanism being equipped in most of the smartphones, by detecting a 4‐digit password or a simple pattern, are easy to be hacked and impersonated. In this paper, a 3‐D hand gesture signature (HGS) based biometric authentication system is designed and implemented by taking advantage of the on‐phone accelerometer to capture the 3‐D acceleration information when user makes a gesture to gain access to the phone. The captured data will be processed through a sequence of signal processing such as data smooth, gesture spotting, sequence alignment, and interpolation, and then a match rule will be used to compare the processed data and the genuine user's registered pattern to determine whether granting the access to the phone to the user. And an automatic template updating strategy based on cluster analysis is proposed to improve the stability of the system. The 3‐D HGS authentication system has been implemented on real smartphones, and the results tested for a total of 76 520 times by 19 users show very low false acceptance (0.27%) and false rejection rates (4.65%). Furthermore, comparison tests have been carried out among the 3‐D HGS and two similar authentication systems by exporting the real gesture samples from the phones to a desktop PC, the simulation results reveal the 3‐D HGS system has the best authentication accuracy. Copyright © 2016 John Wiley & Sons, Ltd.

Intrusion detection is an important technique in the defense-in-depth network security framework. The IDS continuously watch the activity on a network or computer, looking for attack and intrusion evidences. However, host-based intrusion detectors are particularly vulnerable, as they can be disabled or tampered by successful intruders. In this paper, a hidden semi-Markov models method for predicting the anomaly events and the intentions of possible intruders to a computer system is developed based on the observation of system call sequences. BSM audit data are used as research data sources. The HsMM structure is redefined to describe the intrusion detection. The time duration of the hidden states is computed by contributing the risk factor of every system call. Then the output probability of current system call sequences are calculated to decide whether the current system behavior is normal and compute the anomaly probability of the subsequent system calls. In the addition, the approximate time when the intrusion has established is estimated. The evaluation of the proposed methodology was carried out through DARPA 1998.The experiment result proves that the proposed method can find the attack attempt in advance to gain the precious time of the active intrusion precaution.