Second-Order vulnerabilities, such as second-order Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF), occur when user-controlled inputs are stored in databases and later retrieved in different execution contexts, complicating static detection. Existing static analysis approaches struggle primarily with two challenges. First, they struggle in accurately identifying database-accessing functions defined by third-party libraries or custom data access layers, often leading to missed taint propagation paths. Second, they may fail to contextually model database operations when queries are dynamically constructed and depend on runtime parameters. To address these limitations, we propose STaint, a novel bi-directional static analysis method that integrates taint analysis with large language models (LLMs). Using semantic reasoning, STaint accurately identifies and models custom database reads and writes, effectively reconstructing comprehensive taint data flows in the database. Preliminary evaluations on ten real-world PHP applications show that STaint successfully detects 56 second-order vulnerability paths, including 7 previously unknown cases, outperforming existing techniques.

In microservices, requests’ workflows with the complex dependency graphs pose challenges to auto-scaling strategies. This paper presents QueueFlower, an adaptive and dependency- agnostic auto-scaling framework for orchestrating microservice workflows. QueueFlower leverages real-time latency feedback to estimate queue lengths, effectively identifying congested services without offline profiling. Unlike previous methods that build dependency graphs between services, QueueFlower operates on individual services and adjusts resources proportionally based on estimated queues, ensuring resources of services are balanced globally. We have implemented a prototype of QueueFlower and evaluated its performance on a real-world microservice application. The experimental results demonstrate that compared to baseline methods, QueueFlower significantly reduces request latencies and percentages of SLA violations under stationary and non-stationary workloads.

Abstract Deep learning is a powerful technique to boost application performance in various fields, including face recognition, image classification, natural language understanding, and recommendation system. With the rapid increase in the computing power of mobile devices, developers can embed deep learning models into their apps for building more competitive products with more accurate and faster responses. Although there are several works of adversarial attacks against deep learning models in apps, they all need information about the models' internals (i.e., structures and weights) or need to modify the models. In this paper, we propose an effective black‐box approach by training substitute models to spoof the deep learning systems inside the apps. We evaluate our approach on 10 real‐world deep‐learning apps from Google Play to perform black‐box adversarial attacks. Through the study, we find three factors that can affect the performance of attacks. Our approach can reach a relatively high attack success rate of 66.60% on average. Compared with other adversarial attacks on mobile deep learning models, in terms of the average attack success rates, our approach outperforms its counterparts by 27.63%.