arXiv subjects

Pengbin Feng

Publications and source records attributed to Pengbin Feng.

21 records · Page 2Linked to original sources

arXiv2023

PatchRNN: A Deep Learning-Based System for Security Patch Identification

With the increasing usage of open-source software (OSS) components, vulnerabilities embedded within them are propagated to a huge number of underlying applications. In practice, the timely application of security patches in downstream software is challenging. The main reason is that such patches do not explicitly indicate their security impacts in the documentation, which would be difficult to recognize for software maintainers and users. However, attackers can still identify these "secret" security patches by analyzing the source code and generate corresponding exploits to compromise not only unpatched versions of the current software, but also other similar software packages that may contain the same vulnerability due to code cloning or similar design/implementation logic. Therefore, it is critical to identify these secret security patches to enable timely fixes. To this end, we propose a deep learning-based defense system called PatchRNN to automatically identify secret security patches in OSS. Besides considering descriptive keywords in the commit message (i.e., at the text level), we leverage both syntactic and semantic features at the source-code level. To evaluate the performance of our system, we apply it on a large-scale real-world patch dataset and conduct a case study on a popular open-source web server software - NGINX. Experimental results show that the PatchRNN can successfully detect secret security patches with a low false positive rate.

cs.CR↗

arXiv2021

Information flow based defensive chain for data leakage detection and prevention: a survey

Mobile and IoT applications have greatly enriched our daily life by providing convenient and intelligent services. However, these smart applications have been a prime target of adversaries for stealing sensitive data. It poses a crucial threat to users' identity security, financial security, or even life security. Research communities and industries have proposed many Information Flow Control (IFC) techniques for data leakage detection and prevention, including secure modeling, type system, static analysis, dynamic analysis, \textit{etc}. According to the application's development life cycle, although most attacks are conducted during the application's execution phase, data leakage vulnerabilities have been introduced since the design phase. With a focus on lifecycle protection, this survey reviews the recent representative works adopted in different phases. We propose an information flow based defensive chain, which provides a new framework to systematically understand various IFC techniques for data leakage detection and prevention in Mobile and IoT applications. In line with the phases of the application life cycle, each reviewed work is comprehensively studied in terms of technique, performance, and limitation. Research challenges and future directions are also pointed out by consideration of the integrity of the defensive chain.

cs.CR↗

arXiv2014

Inverse source problems for time-fractional mixed parabolic-hyperbolic type equations

In the present paper we consider an inverse source problem for time-fractional mixed parabolic-hyperbolic equation with the Caputo derivative. In case, when hyperbolic part of the considered mixed type equation is wave equation, the uniqueness of source and solution are strongly influenced by initial time and generally is ill-posed. However, when the hyperbolic part is time fractional, the problem is well posed if end time is large. Our method relies on the orthonormal system of eigenfunctions of the operator with respect to space variable. We proved the uniqueness and stability of certain weak solutions for considered problems.

math.AP↗