SearcharxivSearch

arXiv subjects

Chuqi Zhang

Publications and source records attributed to Chuqi Zhang.

11 recordsLinked to original sources

Shoot the Honey, Cloak the Player: Towards Zero-Runtime-Overhead Proactive Defense and Detection for Visual Game Cheating

Visual aimbots have emerged as a serious cheating threat in first-person shooter (FPS) games, as they evade existing anti-cheat defenses by operating only on rendered frames rather than game memory. However, existing defenses fail to provide an end-to-end solution: post-hoc behavior detectors cannot protect match integrity in real time and are increasingly fragile against human-mimicking aimbots, while proactive runtime defenses often lack accountability, incur substantial overhead, or require intrusive system integration. We present AimTrap, the first end-to-end visual-aimbot defense that combines runtime protection with post-game detection through two adversarial texture mechanisms. Adversarial Camouflage Textures (ACT) hide real players from aimbots, while Adversarial Honeypot Textures (AHT) lure aimbots into locking onto fake targets, yielding strong evidence of cheating. AimTrap integrates differentiable rendering with Expectation over Renderings for robust 3D texture synthesis and analyzes honeypot-interaction trajectory to facilitate cheating attribution. In real-game evaluation against a visual aimbot, ACT achieves 85.1% defense success, AHT achieves 96.9%. Compared with prior baselines, AimTrap also achieves extremely low false-positive rates with negligible runtime overhead, demonstrating a practical end-to-end defense.

cs.CR

Reducio: Optimized Confidential Serverless Cloud Deployments for Enterprise Customers

Serverless platforms based on Confidential Virtual Machines (CVMs) have been recently proposed to address the privacy problems with serverless functions, while achieving low latency. Unfortunately, our study indicates that to achieve these properties, existing proposals impose non-trivial requirements in terms of infrastructure changes and platform memory. Reducio is an alternate serverless platform design that does not require infrastructure changes and significantly reduces platform memory requirements. The platform is designed using two key components: (1) a function isolation framework inside a CVM based on kernel deprivileging features that minimize infrastructure requirements, and (2) a layer-wise caching methodology and algorithm that effectively uses a small in-memory function cache. Our evaluation indicates that Reducio can significantly reduce both platform requirements for deployment and function memory consumption.

cs.CR

Data-Driven Batteryless Channel Sounding for Wi-Fi 8-Inspired Downlink MU-MIMO

Batteryless overlays couple passive throughput to Wi-Fi sounding overhead and channel state information (CSI) aging. This paper investigates channel sounding for ultra-high reliability (UHR) operation in a Wi-Fi 8/IEEE 802.11bn-inspired downlink multi-user multiple-input multiple-output (MU-MIMO) system with a batteryless passive overlay. We optimize the post-sounding transmission interval to maximize the aggregate throughput of the active Wi-Fi and passive links, while jointly accounting for sounding overhead, CSI aging, modulation and coding scheme (MCS), passive attenuation, and passive data rate. A packet-level cross-layer model evaluates the cycle-average throughput, and a data-driven search identifies the optimal interval under different operating conditions. Simulations demonstrate that passive overlay reshapes the conventional sounding tradeoff: depending on the MCS and passive-link configuration, the additional passive throughput may or may not compensate for the associated Wi-Fi reliability loss, causing the optimal interval to shift. The results provide design guidance for reliable and low-power MU-MIMO WLANs.

cs.IT

Heimdallr: Characterizing and Detecting LLM-Induced Security Risks in GitHub CI Workflows

GitHub Continuous Integration (CI) workflows increasingly integrate Large Language Models (LLMs) to automate review, triage, content generation, and repository maintenance. This creates a new attack surface: externally controllable workflow inputs can shape LLM prompts and outputs, which may in turn affect security decisions, repository state, or privileged execution. Although LLM security and CI security have each been studied extensively, their intersection remains underexplored. In this paper, we present the first study of LLM-induced security risks in GitHub CI workflows. We characterize the problem along the full execution chain and develop a taxonomy of high-level risk classes and concrete threat vectors. To detect such risks in practice, we design Heimdallr, a hybrid analysis framework that normalizes workflows into an LLM-Workflow Property Graph (L-WPG) and combines triggerability analysis, LLM-assisted dataflow summarization, and deterministic propagation to synthesize concrete threat-vector findings. Evaluated on 300 manually annotated unique workflows, Heimdallr achieves high accuracy on LLM-node identification (F1~=~0.994), triggerability classification (99.8%), and threat-vector detection (micro-average F1~=~0.917). As part of an ongoing detection and disclosure effort, we have so far responsibly disclosed 802 vulnerable workflow instances across 759 repositories and received 71 acknowledgments.

cs.CR

Discovery of parity-violating chiral polar-nematic charge density wave and superconductivity in kagome metals

Nonmagnetic kagome metals and superconductors AV3Sb5 (A = K, Rb, Cs) host unconventional charge density wave (CDW) and superconducting (SC) phases accompanied by multiple electronic symmetry breaking. Due to the centrosymmetric crystal structure, inversion symmetry has generally been assumed to hold. Here, using scanning tunneling microscopy complemented by atomic force microscopy and optical second-harmonic generation, we directly reveal that inversion symmetry in the kagome plane is spontaneously broken in the CDW state. The mixed-parity CDW state exhibits ferroelectric dipolar and nematic quadrupolar ordered moments. The coexistence and coupling between the dipole and quadrupole favor noncollinear ferro-polar and nematic alignment that breaks all mirror symmetries and gives rise to robust electronic chirality in the 3Q CDW. The multipolar coupling to in-plane electric field enables electric field control and manipulation of the chiral polar-nematic CDW state, including its chirality. Below the SC transition, we observe parity-violating pair density modulations at both the original and the CDW lattice wavevectors. Our findings of parity-violating electronic chiral multipolar order provide microscopic insights into the magnetoelectric and nonreciprocal transport, loop current order, pairing density waves, and unconventional superconductivity in kagome metals and related quantum materials.

cond-mat.supr-con

DevOps-Gym: Benchmarking AI Agents in Software DevOps Cycle

Even though demonstrating extraordinary capabilities in code generation and software issue resolving, AI agents' capabilities in the full software DevOps cycle are still unknown. Different from pure code generation, handling the DevOps cycle in real-world software, including developing, deploying, and managing, requires analyzing large-scale projects, understanding dynamic program behaviors, leveraging domain-specific tools, and making sequential decisions. However, existing benchmarks focus on isolated problems and lack environments and tool interfaces for DevOps. We introduce DevOps-Gym, the first end-to-end benchmark for evaluating AI agents across core DevOps workflows: build and configuration, monitoring, issue resolving, and test generation. DevOps-Gym includes 700+ real-world tasks collected from 30+ projects in Java and Go. We develop a semi-automated data collection mechanism with rigorous and non-trivial expert efforts in ensuring the task coverage and quality. Our evaluation of state-of-the-art models and agents reveals fundamental limitations: they struggle with issue resolving and test generation in Java and Go, and remain unable to handle new tasks such as monitoring and build and configuration. These results highlight the need for essential research in automating the full DevOps cycle with AI agents.

cs.SE

Propagation-Based Vulnerability Impact Assessment for Software Supply Chains

Identifying the impact scope and scale is critical for software supply chain vulnerability assessment. However, existing studies face substantial limitations. First, prior studies either work at coarse package-level granularity, producing many false positives, or fail to accomplish whole-ecosystem vulnerability propagation analysis. Second, although vulnerability assessment indicators like CVSS characterize individual vulnerabilities, no metric exists to specifically quantify the dynamic impact of vulnerability propagation across software supply chains. To address these limitations and enable accurate and comprehensive vulnerability impact assessment, we propose a novel approach: (i) a hierarchical worklist-based algorithm for whole-ecosystem and call-graph-level vulnerability propagation analysis and (ii) the Vulnerability Propagation Scoring System (VPSS), a dynamic metric to quantify the scope and evolution of vulnerability impacts in software supply chains. We implement a prototype of our approach in the Java Maven ecosystem and evaluate it on 100 real-world vulnerabilities. Experimental results demonstrate that our approach enables effective ecosystem-wide vulnerability propagation analysis, and provides a practical, quantitative measure of vulnerability impact through VPSS.

cs.SE

Fuzzing the PHP Interpreter via Dataflow Fusion

PHP, a dominant scripting language in web development, powers a vast range of websites, from personal blogs to major platforms. While existing research primarily focuses on PHP application-level security issues like code injection, memory errors within the PHP interpreter have been largely overlooked. These memory errors, prevalent due to the PHP interpreter's extensive C codebase, pose significant risks to the confidentiality, integrity, and availability of PHP servers. This paper introduces FlowFusion, the first automatic fuzzing framework to detect memory errors in the PHP interpreter. FlowFusion leverages dataflow as an efficient representation of test cases maintained by PHP developers, merging two or more test cases to produce fused test cases with more complex code semantics. Moreover, FlowFusion employs strategies such as test mutation, interface fuzzing, and environment crossover to increase bug finding. In our evaluation, FlowFusion found 158 unknown bugs in the PHP interpreter, with 125 fixed and 11 confirmed. Comparing FlowFusion against the official test suite and a naive test concatenation approach, FlowFusion can detect new bugs that these methods miss, while also achieving greater code coverage. FlowFusion also outperformed state-of-the-art fuzzers AFL++ and Polyglot, covering 24% more lines of code after 24 hours of fuzzing. FlowFusion has gained wide recognition among PHP developers and is now integrated into the official PHP toolchain.

cs.CR

Enhanced Differential Testing in Emerging Database Systems

In recent years, a plethora of database management systems have surfaced to meet the demands of various scenarios. Emerging database systems, such as time-series and streaming database systems, are tailored to specific use cases requiring enhanced functionality and performance. However, as they are typically less mature, there can be bugs that either cause incorrect results or errors impacting reliability. To tackle this, we propose enhanced differential testing to uncover various bugs in emerging SQL-like database systems. The challenge is how to deal with differences of these emerging databases. Our insight is that many emerging database systems are conceptually extensions of relational database systems, making it possible to reveal logic bugs leveraging existing relational, known-reliable database systems. However, due to inevitable syntax or semantics gaps, it remains challenging to scale differential testing to various emerging database systems. We enhance differential testing for emerging database systems with three steps: (i) identifying shared clauses; (ii) extending shared clauses via mapping new features back to existing clauses of relational database systems; and (iii) generating differential inputs using extended shared clauses. We implemented our approach in a tool called SQLxDiff and applied it to four popular emerging database systems. In total, we found 57 unknown bugs, of which 17 were logic bugs and 40 were internal errors. Overall, vendors fixed 50 bugs and confirmed 5. Our results demonstrate the practicality and effectiveness of SQLxDiff in detecting bugs in emerging database systems, which has the potential to improve the reliability of their applications.

cs.SE

KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities

Linux kernel vulnerability reproduction is a critical task in system security. To reproduce a kernel vulnerability, the vulnerable environment and the Proof of Concept (PoC) program are needed. Most existing research focuses on the generation of PoC, while the construction of environment is overlooked. However, establishing an effective vulnerable environment to trigger a vulnerability is challenging. Firstly, it is hard to guarantee that the selected kernel version for reproduction is vulnerable, as the vulnerability version claims in online databases can occasionally be spurious. Secondly, many vulnerabilities can not be reproduced in kernels built with default configurations. Intricate non-default kernel configurations must be set to include and trigger a kernel vulnerability, but less information is available on how to recognize these configurations. To solve these challenges, we propose a patch-based approach to identify real vulnerable kernel versions and a graph-based approach to identify necessary configs for activating a specific vulnerability. We implement these approaches in a tool, KernJC, automating the generation of vulnerable environments for kernel vulnerabilities. To evaluate the efficacy of KernJC, we build a dataset containing 66 representative real-world vulnerabilities with PoCs from kernel vulnerability research in the past five years. The evaluation shows that KernJC builds vulnerable environments for all these vulnerabilities, 48.5% of which require non-default configs, and 4 have incorrect version claims in the National Vulnerability Database (NVD). Furthermore, we conduct large-scale spurious version detection on kernel vulnerabilities and identify 128 vulnerabilities which have spurious version claims in NVD. To foster future research, we release KernJC with the dataset in the community.

cs.CR

The HitchHiker's Guide to High-Assurance System Observability Protection with Efficient Permission Switches

Protecting system observability records (logs) from compromised OSs has gained significant traction in recent times, with several note-worthy approaches proposed. Unfortunately, none of the proposed approaches achieve high performance with tiny log protection delays. They also leverage risky environments for protection (\eg many use general-purpose hypervisors or TrustZone, which have large TCB and attack surfaces). HitchHiker is an attempt to rectify this problem. The system is designed to ensure (a) in-memory protection of batched logs within a short and configurable real-time deadline by efficient hardware permission switching, and (b) an end-to-end high-assurance environment built upon hardware protection primitives with debloating strategies for secure log protection, persistence, and management. Security evaluations and validations show that HitchHiker reduces log protection delay by 93.3--99.3% compared to the state-of-the-art, while reducing TCB by 9.4--26.9X. Performance evaluations show HitchHiker incurs a geometric mean of less than 6% overhead on diverse real-world programs, improving on the state-of-the-art approach by 61.9--77.5%.

cs.CR