Abstract The widespread adoption of deep learning (DL) libraries has raised concerns about their reliability and security. While prior works leveraged large language models (LLMs) to generate test programs for DL library APIs, the hardcoded program behaviors and low code validity rates render them impractical for real-world testing. To address these challenges, we propose FD-FACTORY, a fully automated framework that leverages LLMs to generate fuzz drivers for DL API testing. The fuzz driver programs accept mutated inputs from fuzzing engines to achieve effective code analysis. Inspired by the modular design of industrial production lines, FD-FACTORY decomposes the generation process into eight distinct stages: Preparation, Initial Fuzz Driver Generation, Early Stop Checks, Verification, Issue Diagnosis, Decision Making, Repair Loop, and Deployment . Each stage is handled by dedicated agents or tools to enhance construction efficiency. Experimental results demonstrate that FD-FACTORY achieves 73.67% and 65.33% success rates in generating fuzz drivers for PyTorch and TensorFlow, producing an improvement of 34.66 to $$-$$ - 54.66% than existing approaches. In addition, FD-FACTORY provides more comprehensive coverage tracking by supporting both Python and native C/C code. It achieves a total coverage of 308,351 lines on PyTorch and 528,427 lines on TensorFlow, substantially surpassing the results reported by previous approaches. Unlike prior approaches relying on repeated interactions with the LLM servers throughout the entire testing process, our framework confines the use of LLMs strictly to the fuzz driver generation stages before deployment. Once generated, the fuzz drivers can be reused without further LLM involvement, thereby enhancing the practicality and sustainability of LLM-assisted fuzzing in real-world scenarios.

Automated software vulnerability detection using learning-based approaches has been a focal point in the field of software engineering. However, the training and benchmarking of software vulnerability detection models are significantly influenced by the quality of the training data. Existing solutions have made limited efforts in addressing data quality issues due to limited and challenging data collection. Publicly available datasets have been found to suffer from data quality problems, hindering effective model training and performance evaluation. Although awareness of the potential negative impact of software vulnerability data quality is increasing, to the best of our knowledge, no systematic solution has been proposed to improve data quality during the automated labeling process. In this paper, we propose a data collection and cleansing framework that first collects the latest vulnerabilities and patches from publicly available vulnerability databases. Then, a rule-based filter is applied to classify function-level vulnerability fixing modifications into three categories: high quality, unknown quality, and low quality. Subsequently, a semantic filter trained on high-quality samples is used to filter samples of unknown quality, resulting in a cleansed version of the raw dataset. This is the first framework that distinguishes the quality of function-level modification samples for software vulnerability fixes and performs data cleansing, without solely relying on traditional heuristic label assignment strategies. In our experiments, we evaluate the properties of SRVul, the effectiveness of the framework, and the feasibility of using it for training vulnerability detection models. SRVul outperforms existing works on multiple metrics, demonstrating the best combination of dataset scale and quality, with a well-designed and effective framework and components. Training the advanced LineVul model with SRVul yields improved performance on benchmark datasets, indicating that SRVul is well-suited for the effective training of vulnerability detection models.

With the development of software vulnerability analysis, the evaluation of different bug-detecting tools has become quite important for selecting better-performed ones and improving existing approaches. To obtain a convincing evaluation result, a well-constructed vulnerability corpus is indispensable. However, the existing corpora are either constructed from real-world bugs or artificially designed, suffering various problems like small volume, lack of ground truth, etc. Thus, generating large-scale bug corpora through an automated way has been widely noticed. In this paper, we propose an automated vulnerability injection system to generate code samples with triggerable vulnerabilities. Specifically, the system analyzes a host program with the symbolic execution tool to generate high-coverage test cases. Meanwhile, it identifies the potential bug injection points and performs static taint analysis to mark tainted variables and their relevance to the bug injection points. Based on the variables, the system modifies the host program to vulnerable code samples that could be verified by the test cases. In conclusion, the system realizes the injection of buffer overflow vulnerabilities in $\mathrm{C}/ \mathrm{C}++$ programs. A study case is shown to demonstrate the injection processes, and the evaluation presents our advantages in the realness and magnitude of generated bug samples as well as solving highcoverage test cases.

Tor is a relay-based communication network that provides users with anonymous access to the Internet. Tor hidden services protect the identities of the content publishers to achieve anonymity and anti-censorship. However, hidden services are abused to conduct illegal activities, including hosting botnets and trading drugs. This paper proposes a tracing approach to locate illegal hidden services based on the Tor protocol characteristics, which allows a Tor client to embed a signal into a Tor circuit connecting with the illegal hidden service. Once the Tor node nearest to the the hidden service detects the signal, the identity of the hidden service can be revealed. Our approach is simple, powerful, and stable compared with previous methods. We implemented the approach and performed experiments over the Tor network, whose results show that our approach is feasible and effective, with 100% accuracy, 99.25% true positive rate, and zero false positive rate.