arXiv subjects

Kaixuan Li

Publications and source records attributed to Kaixuan Li.

17 recordsLinked to original sources

arXiv2026

DeepFWI: Identifying Bug-Sensitive Warnings with Multi-Modal Code-Warning Semantics

Static analysis tools have evolved over time to assist in detecting bugs. However, the excessive false warnings can impede developers' productivity and confidence in the tools. Previous research efforts have explored learning-based approaches to identify bug warnings. Nevertheless, their coarse granularity, focusing on either long-term warnings or function-level alerts, is insensitive to individual bugs. Also, they rely on manually crafted features or solely on source code semantics, which is inadequate for effective learning. In this paper, we propose DeepFWI, a learning-based approach that identifies bug-sensitive warnings at a fine-grained granularity. Specifically, we design a novel LSTM-based model that captures multi-modal semantics of source code and warnings from automated static analysis tools (ASATs) and highlights their correlations with cross-attention. To tackle the data scarcity of training and evaluation, we collected a large-scale dataset of 280,273 warnings. We conducted extensive experiments on the dataset to evaluate DeepFWI. The experimental results demonstrate the effectiveness of our approach, with an F1-score 67.06% for confirming true warnings in a finer-grained manner, significantly outperforming all baselines. Additionally, to validate the practicality of DeepFWI from the perspective of developers, we applied DeepFWI to four popular open-source projects. Our approach filtered out the vast majority of warnings, while still successfully surfacing 25 true bug-related warnings that were confirmed through manual analysis.

cs.SE↗

arXiv2026

Upward Spatial Coverage Recovery via Movable Antenna in Low-Altitude Communications

The rapid proliferation of unmanned aerial vehicle (UAV) applications imposes stringent requirements on continuous and reliable communication coverage in low-altitude airspace. Conventional cellular systems built upon fixed-position antennas (FPAs) are inherently constrained by static array geometries and limited mechanical degrees of freedom, which severely restrict their ability to adapt to highly dynamic three-dimensional (3D) propagation environments. Movable antenna (MA) technology has recently emerged as a promising paradigm to overcome these limitations by actively reconfiguring electromagnetic radiation characteristics through controllable antenna positioning and array orientation, thereby enabling flexible spatial coverage adaptation. To systematically quantify the airspace coverage capability of MA-enabled systems, this paper formulates a spatial coverage maximization problem over a discretized 3D voxel space. For each voxel, the received signal-to-noise ratio (SNR) is maximized via joint optimization of the MA's 3D positions and beamforming matrices. To efficiently solve the resulting non-convex problem, a hybrid particle swarm optimization and simulated annealing framework is developed to search for high-quality antenna configurations. Simulation results demonstrate that the proposed MA design framework substantially outperforms conventional FPA-based schemes in terms of spatial coverage, achieving coverage rates of 26.8% and 29.65% for airspace below 300m and 600m, respectively. Moreover, further coverage enhancement can be attained by incorporating mechanical tilt adjustment, highlighting the strong potential of MA technology for reliable low-altitude communication coverage.

cs.IT↗

arXiv2025

Minimizing Breaking Changes and Redundancy in Mitigating Technical Lag for Java Projects

Re-using open-source software (OSS) can avoid reinventing the wheel, but failing to keep it up-to-date can lead to missing new features and persistent bugs or vulnerabilities that have already been resolved. The use of outdated OSS libraries introduces technical lag, necessitating timely upgrades. However, maintaining up-to-date libraries is challenging, as it may introduce incompatibility issues that break the project or redundant dependencies that unnecessarily increase the size of the project. These issues discourage developers from upgrading libraries, highlighting the need for a fully automated solution that balances version upgrades, reduces technical lag, ensures compatibility, and avoids redundant dependencies. To this end, we propose DepUpdater, which ensures that upgrades minimize technical lag as much as possible while avoiding incompatibility issues and redundant dependencies. The comparison with existing dependency management tools demonstrates that DepUpdater more effectively reduces technical lag while ensuring compatibility and pruning redundant dependencies. Additionally, an ablation study highlights the potential benefits of considering pruning requirements during upgrades to mitigate incompatibility issues. Finally, leveraging DepUpdater, we investigate the impact of transitive dependency upgrades on client compatibility, providing insights for future research.

cs.SE↗

arXiv2025

A Location-Aware Hybrid Deep Learning Framework for Dynamic Near-Far Field Channel Estimation in Low-Altitude UAV Communications

In low altitude UAV communications, accurate channel estimation remains challenging due to the dynamic nature of air to ground links, exacerbated by high node mobility and the use of large scale antenna arrays, which introduce hybrid near and far field propagation conditions. While conventional estimation methods rely on far field assumptions, they fail to capture the intricate channel variations in near-field scenarios and overlook valuable geometric priors such as real-time transceiver positions. To overcome these limitations, this paper introduces a unified channel estimation framework based on a location aware hybrid deep learning architecture. The proposed model synergistically combines convolutional neural networks (CNNs) for spatial feature extraction, bidirectional long short term memory (BiLSTM) networks for modeling temporal evolution, and a multihead self attention mechanism to enhance focus on discriminative channel components. Furthermore, real-time transmitter and receiver locations are embedded as geometric priors, improving sensitivity to distance under near field spherical wavefronts and boosting model generalization. Extensive simulations validate the effectiveness of the proposed approach, showing that it outperforms existing benchmarks by a significant margin, achieving at least a 30.25% reduction in normalized mean square error (NMSE) on average.

cs.IT↗

arXiv2025

Moving or Predicting? RoleAware-MAPP: A Role-Aware Transformer Framework for Movable Antenna Position Prediction to Secure Wireless Communications

Movable antenna (MA) technology provides a promising avenue for actively shaping wireless channels through dynamic antenna positioning, thereby enabling electromagnetic radiation reconstruction to enhance physical layer security (PLS). However, its practical deployment is hindered by two major challenges: the high computational complexity of real time optimization and a critical temporal mismatch between slow mechanical movement and rapid channel variations. Although data driven methods have been introduced to alleviate online optimization burdens, they are still constrained by suboptimal training labels derived from conventional solvers or high sample complexity in reinforcement learning. More importantly, existing learning based approaches often overlook communication-specific domain knowledge, particularly the asymmetric roles and adversarial interactions between legitimate users and eavesdroppers, which are fundamental to PLS. To address these issues, this paper reformulates the MA positioning problem as a predictive task and introduces RoleAware-MAPP, a novel Transformer based framework that incorporates domain knowledge through three key components: role-aware embeddings that model user specific intentions, physics-informed semantic features that encapsulate channel propagation characteristics, and a composite loss function that strategically prioritizes secrecy performance over mere geometric accuracy. Extensive simulations under 3GPP-compliant scenarios show that RoleAware-MAPP achieves an average secrecy rate of 0.3569 bps/Hz and a strictly positive secrecy capacity of 81.52%, outperforming the strongest baseline by 48.4% and 5.39 percentage points, respectively, while maintaining robust performance across diverse user velocities and noise conditions.

cs.IT↗

arXiv2025

Real-World Usability of Vulnerability Proof-of-Concepts: A Comprehensive Study

The Proof-of-Concept (PoC) for a vulnerability is crucial in validating its existence, mitigating false positives, and illustrating the severity of the security threat it poses. However, research on PoCs significantly lags behind studies focusing on vulnerability data. This discrepancy can be directly attributed to several challenges, including the dispersion of real-world PoCs across multiple platforms, the diversity in writing styles, and the difficulty associated with PoC reproduction. To fill this gap, we conduct the first large-scale study on PoCs in the wild, assessing their report availability, completeness, reproducibility. Specifically, 1) to investigate PoC reports availability for CVE vulnerability, we collected an extensive dataset of 470,921 PoCs and their reports from 13 platforms, representing the broadest collection of publicly available PoCs to date. 2) To assess the completeness of PoC report at a fine-grained level, we proposed a component extraction method, which combines pattern-matching techniques with a fine-tuned BERT-NER model to extract 9 key components from PoC reports. 3) To evaluate the effectiveness of PoCs, we recruited 8 participants to manually reproduce 150 sampled vulnerabilities with 32 vulnerability types based on PoC reports, enabling an in-depth analysis of PoC reproducibility and the factors influencing it. Our findings reveal that 78.9% of CVE vulnerabilities lack available PoCs, and existing PoC reports typically miss about 30% of the essential components required for effective vulnerability understanding and reproduction, with various reasons identified for the failure to reproduce vulnerabilities using available PoC reports. Finally, we proposed actionable strategies for stakeholders to enhance the overall usability of vulnerability PoCs in strengthening software security.

cs.SE↗

arXiv2025

A Systematic Study on Generating Web Vulnerability Proof-of-Concepts Using Large Language Models

Recent advances in Large Language Models (LLMs) have brought remarkable progress in code understanding and reasoning, creating new opportunities and raising new concerns for software security. Among many downstream tasks, generating Proof-of-Concept (PoC) exploits plays a central role in vulnerability reproduction, comprehension, and mitigation. While previous research has focused primarily on zero-day exploitation, the growing availability of rich public information accompanying disclosed CVEs leads to a natural question: can LLMs effectively use this information to automatically generate valid PoCs? In this paper, we present the first empirical study of LLM-based PoC generation for web application vulnerabilities, focusing on the practical feasibility of leveraging publicly disclosed information. We evaluate GPT-4o and DeepSeek-R1 on 100 real-world and reproducible CVEs across three stages of vulnerability disclosure: (1) newly disclosed vulnerabilities with only descriptions, (2) 1-day vulnerabilities with patches, and (3) N-day vulnerabilities with full contextual code. Our results show that LLMs can automatically generate working PoCs in 8%-34% of cases using only public data, with DeepSeek-R1 consistently outperforming GPT-4o. Further analysis shows that supplementing code context improves success rates by 17%-20%, with function-level providing 9%-13% improvement than file-level ones. Further integrating adaptive reasoning strategies to prompt refinement significantly improves success rates to 68%-72%. Our findings suggest that LLMs could reshape vulnerability exploitation dynamics. To date, 23 newly generated PoCs have been accepted by NVD and Exploit DB.

cs.SE↗

arXiv2025

Predictive Position Control for Movable Antenna Arrays in UAV Communications: A Spatio-Temporal Transformer-LSTM Framework

In complex urban environments, dynamic obstacles and multipath effects lead to significant link attenuation and pervasive coverage blind spots. Conventional approaches based on large-scale fixed antenna arrays and UAV trajectory optimization struggle to balance energy efficiency, real-time adaptation, and spatial flexibility. The movable antenna (MA) technology has emerged as a promising solution, offering enhanced spatial flexibility and reduced energy consumption to overcome the bottlenecks of urban low-altitude communications. However, MA deployment faces a critical velocity mismatch between UAV mobility and mechanical repositioning latency, undermining real-time link optimization and security assurance. To overcome this, we propose a predictive MA-UAV collaborative control framework. First, optimal antenna positions are derived via secrecy rate maximization. Second, a Transformer-enhanced long short-term memory (LSTM) network predicts future MA positions by capturing spatio-temporal correlations in antenna trajectories. Extensive simulations demonstrate superior prediction accuracy (NMSE reduction exceeds 49\%) and communication reliability versus current popular benchmarks.

cs.IT↗

arXiv2025

ACFIX: Guiding LLMs with Mined Common RBAC Practices for Context-Aware Repair of Access Control Vulnerabilities in Smart Contracts

Smart contracts are susceptible to various security issues, among which access control (AC) vulnerabilities are particularly critical. While existing research has proposed multiple detection tools, the automatic and appropriate repair of AC vulnerabilities in smart contracts remains a challenge. Unlike commonly supported vulnerability types by existing repair tools, such as reentrancy, which are usually fixed by template-based approaches, the main obstacle of AC lies in identifying the appropriate roles or permissions amid a long list of non-AC-related source code to generate proper patch code, a task that demands human-level intelligence. Leveraging recent advancements in large language models (LLMs), we employ the state-of-the-art GPT-4 model and enhance it with a novel approach called ACFIX. The key insight is that we can mine common AC practices for major categories of code functionality and use them to guide LLMs in fixing code with similar functionality. To this end, ACFIX involves both offline and online phases. First, during the offline phase, ACFIX mines a taxonomy of common Role-based Access Control (RBAC) practices from 344,251 on-chain contracts, categorizing 49 role-permission pairs from the top 1,000 pairs mined. Second, during the online phase, ACFIX tracks AC-related elements across the contract and uses this context information along with a Chain-of-Thought pipeline to guide LLMs in identifying the most appropriate role-permission pair for the subject contract and subsequently generating a suitable patch. This patch will then undergo a validity and effectiveness check. To evaluate ACFIX, we built the first benchmark dataset of 118 real-world AC vulnerabilities, and our evaluation revealed that ACFIX successfully repaired 94.92% of them. This represents a significant improvement compared to the baseline GPT-4, which achieved only 52.54%.

cs.SE↗

arXiv2025

VFArchē: A Dual-Mode Framework for Locating Vulnerable Functions in Open-Source Software

Software Composition Analysis (SCA) has become pivotal in addressing vulnerabilities inherent in software project dependencies. In particular, reachability analysis is increasingly used in Open-Source Software (OSS) projects to identify reachable vulnerabilities (e.g., CVEs) through call graphs, enabling a focus on exploitable risks. Performing reachability analysis typically requires the vulnerable function (VF) to track the call chains from downstream applications. However, such crucial information is usually unavailable in modern vulnerability databases like NVD. While directly extracting VF from modified functions in vulnerability patches is intuitive, patches are not always available. Moreover, our preliminary study shows that over 26% of VF do not exist in the modified functions. Meanwhile, simply ignoring patches to search vulnerable functions suffers from overwhelming noises and lexical gaps between descriptions and source code. Given that almost half of the vulnerabilities are equipped with patches, a holistic solution that handles both scenarios with and without patches is required. To meet real-world needs and automatically localize VF, we present VFArchē, a dual-mode approach designed for disclosed vulnerabilities, applicable in scenarios with or without available patch links. The experimental results of VFArchē on our constructed benchmark dataset demonstrate significant efficacy regarding three metrics, achieving 1.3x and 1.9x Mean Reciprocal Rank over the best baselines for Patch-present and Patch-absent modes, respectively. Moreover, VFArchē has proven its applicability in real-world scenarios by successfully locating VF for 43 out of 50 latest vulnerabilities with reasonable efforts and significantly reducing 78-89% false positives of SCA tools.

cs.SE↗

arXiv2025

Can Movable Antenna-enabled Micro-Mobility Replace UAV-enabled Macro-Mobility? A Physical Layer Security Perspective

This paper investigates the potential of movable antenna (MA)-enabled micro-mobility to replace UAV-enabled macro-mobility for enhancing physical layer security (PLS) in air-to-ground communications. While UAV trajectory optimization offers high flexibility and Line-of-Sight (LoS) advantages, it suffers from significant energy consumption, latency, and complex trajectory optimization. Conversely, MA technology provides fine-grained spatial reconfiguration (antenna positioning within a confined area) with ultra-low energy overhead and millisecond-scale response, enabling real-time channel manipulation and covert beam steering. To systematically compare these paradigms, we establish a dual-scale mobility framework where a UAV-mounted uniform linear array (ULA) serves as a base station transmitting confidential information to a legitimate user (Bob) in the presence of an eavesdropper (Eve). We formulate non-convex average secrecy rate (ASR) maximization problems for both schemes: 1) MA-based micro-mobility: Jointly optimizing antenna positions and beamforming (BF) vectors under positioning constraints; 2) UAV-based macro-mobility: Jointly optimizing the UAV's trajectory and BF vectors under kinematic constraints. Extensive simulations reveal distinct operational regimes: MA micro-mobility demonstrates significant ASR advantages in low-transmit-power scenarios or under antenna constraints due to its energy-efficient spatial control. Conversely, UAV macro-mobility excels under resource-sufficient conditions (higher power, larger antenna arrays) by leveraging global mobility for optimal positioning. The findings highlight the complementary strengths of both approaches, suggesting hybrid micro-macro mobility as a promising direction for balancing security, energy efficiency, and deployment complexity in future wireless networks.

cs.IT↗

arXiv2025

Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management

In the rapidly evolving landscape of software development, addressing security vulnerabilities in open-source software (OSS) has become critically important. However, existing research and tools from both academia and industry mainly relied on limited solutions, such as vulnerable version adjustment and adopting patches, to handle identified vulnerabilities. However, far more flexible and diverse countermeasures have been actively adopted in the open-source communities. A holistic empirical study is needed to explore the prevalence, distribution, preferences, and effectiveness of these diverse strategies. To this end, in this paper, we conduct a comprehensive study on the taxonomy of vulnerability remediation tactics (RT) in OSS projects and investigate their pros and cons. This study addresses this oversight by conducting a comprehensive empirical analysis of 21,187 issues from GitHub, aiming to understand the range and efficacy of remediation tactics within the OSS community. We developed a hierarchical taxonomy of 44 distinct RT and evaluated their effectiveness and costs. Our findings highlight a significant reliance on community-driven strategies, like using alternative libraries and bypassing vulnerabilities, 44% of which are currently unsupported by cutting-edge tools. Additionally, this research exposes the community's preferences for certain fixing approaches by analyzing their acceptance and the reasons for rejection. It also underscores a critical gap in modern vulnerability databases, where 54% of CVEs lack fixing suggestions, a gap that can be significantly mitigated by leveraging the 93% of actionable solutions provided through GitHub issues.

cs.SE↗

arXiv2025

First Glimpse on Physical Layer Security in Internet of Vehicles: Transformed from Communication Interference to Sensing Interference

Integrated sensing and communication (ISAC) plays a crucial role in the Internet of Vehicles (IoV), serving as a key factor in enhancing driving safety and traffic efficiency. To address the security challenges of the confidential information transmission caused by the inherent openness nature of wireless medium, different from current physical layer security (PLS) methods, which depends on the \emph{additional communication interference} costing extra power resources, in this paper, we investigate a novel PLS solution, under which the \emph{inherent radar sensing interference} of the vehicles is utilized to secure wireless communications. To measure the performance of PLS methods in ISAC-based IoV systems, we first define an improved security performance metric called by transmission reliability and sensing accuracy based secrecy rate (TRSA\_SR), and derive closed-form expressions of connection outage probability (COP), secrecy outage probability (SOP), success ranging probability (SRP) for evaluating transmission reliability, security and sensing accuracy, respectively. Furthermore, we formulate an optimization problem to maximize the TRSA\_SR by utilizing radar sensing interference and joint design of the communication duration, transmission power and straight trajectory of the legitimate transmitter. Finally, the non-convex feature of formulated problem is solved through the problem decomposition and alternating optimization. Simulations indicate that compared with traditional PLS methods obtaining a non-positive STC, the proposed method achieves a secrecy rate of 3.92bps/Hz for different settings of noise power.

cs.IT↗

arXiv2024

A Comprehensive Study on Static Application Security Testing (SAST) Tools for Android

To identify security vulnerabilities in Android applications, numerous static application security testing (SAST) tools have been proposed. However, it poses significant challenges to assess their overall performance on diverse vulnerability types. The task is non-trivial and poses considerable challenges. {Firstly, the absence of a unified evaluation platform for defining and describing tools' supported vulnerability types, coupled with the lack of normalization for the intricate and varied reports generated by different tools, significantly adds to the complexity.} Secondly, there is a scarcity of adequate benchmarks, particularly those derived from real-world scenarios. To address these problems, we are the first to propose a unified platform named VulsTotal, supporting various vulnerability types, enabling comprehensive and versatile analysis across diverse SAST tools. Specifically, we begin by meticulously selecting 11 free and open-sourced SAST tools from a pool of 97 existing options, adhering to clearly defined criteria. After that, we invest significant efforts in comprehending the detection rules of each tool, subsequently unifying 67 general/common vulnerability types for {Android} SAST tools. We also redefine and implement a standardized reporting format, ensuring uniformity in presenting results across all tools. Additionally, to mitigate the problem of benchmarks, we conducted a manual analysis of huge amounts of CVEs to construct a new CVE-based benchmark based on our comprehension of Android app vulnerabilities. Leveraging the evaluation platform, which integrates both existing synthetic benchmarks and newly constructed CVE-based benchmarks from this study, we conducted a comprehensive analysis to evaluate and compare these selected tools from various perspectives, such as general vulnerability type coverage, type consistency, tool effectiveness, and time performance.

cs.SE↗

arXiv2024

PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software

Open-source software (OSS) vulnerabilities are increasingly prevalent, emphasizing the importance of security patches. However, in widely used security platforms like NVD, a substantial number of CVE records still lack trace links to patches. Although rank-based approaches have been proposed for security patch tracing, they heavily rely on handcrafted features in a single-step framework, which limits their effectiveness. In this paper, we propose PatchFinder, a two-phase framework with end-to-end correlation learning for better-tracing security patches. In the **initial retrieval** phase, we employ a hybrid patch retriever to account for both lexical and semantic matching based on the code changes and the description of a CVE, to narrow down the search space by extracting those commits as candidates that are similar to the CVE descriptions. Afterwards, in the **re-ranking** phase, we design an end-to-end architecture under the supervised fine-tuning paradigm for learning the semantic correlations between CVE descriptions and commits. In this way, we can automatically rank the candidates based on their correlation scores while maintaining low computation overhead. We evaluated our system against 4,789 CVEs from 532 OSS projects. The results are highly promising: PatchFinder achieves a Recall@10 of 80.63% and a Mean Reciprocal Rank (MRR) of 0.7951. Moreover, the Manual Effort@10 required is curtailed to 2.77, marking a 1.94 times improvement over current leading methods. When applying PatchFinder in practice, we initially identified 533 patch commits and submitted them to the official, 482 of which have been confirmed by CVE Numbering Authorities.

cs.SE↗

arXiv2024

Static Application Security Testing (SAST) Tools for Smart Contracts: How Far Are We?

In recent years, the importance of smart contract security has been heightened by the increasing number of attacks against them. To address this issue, a multitude of static application security testing (SAST) tools have been proposed for detecting vulnerabilities in smart contracts. However, objectively comparing these tools to determine their effectiveness remains challenging. Existing studies often fall short due to the taxonomies and benchmarks only covering a coarse and potentially outdated set of vulnerability types, which leads to evaluations that are not entirely comprehensive and may display bias. In this paper, we fill this gap by proposing an up-to-date and fine-grained taxonomy that includes 45 unique vulnerability types for smart contracts. Taking it as a baseline, we develop an extensive benchmark that covers 40 distinct types and includes a diverse range of code characteristics, vulnerability patterns, and application scenarios. Based on them, we evaluated 8 SAST tools using this benchmark, which comprises 788 smart contract files and 10,394 vulnerabilities. Our results reveal that the existing SAST tools fail to detect around 50% of vulnerabilities in our benchmark and suffer from high false positives, with precision not surpassing 10%. We also discover that by combining the results of multiple tools, the false negative rate can be reduced effectively, at the expense of flagging 36.77 percentage points more functions. Nevertheless, many vulnerabilities, especially those beyond Access Control and Reentrancy vulnerabilities, remain undetected. We finally highlight the valuable insights from our study, hoping to provide guidance on tool development, enhancement, evaluation, and selection for developers, researchers, and practitioners.

cs.SE↗

arXiv2023

A Comprehensive Study on Quality Assurance Tools for Java

Quality assurance (QA) tools are receiving more and more attention and are widely used by developers. Given the wide range of solutions for QA technology, it is still a question of evaluating QA tools. Most existing research is limited in the following ways: (i) They compare tools without considering scanning rules analysis. (ii) They disagree on the effectiveness of tools due to the study methodology and benchmark dataset. (iii) They do not separately analyze the role of the warnings. (iv) There is no large-scale study on the analysis of time performance. To address these problems, in the paper, we systematically select 6 free or open-source tools for a comprehensive study from a list of 148 existing Java QA tools. To carry out a comprehensive study and evaluate tools in multi-level dimensions, we first mapped the scanning rules to the CWE and analyze the coverage and granularity of the scanning rules. Then we conducted an experiment on 5 benchmarks, including 1,425 bugs, to investigate the effectiveness of these tools. Furthermore, we took substantial effort to investigate the effectiveness of warnings by comparing the real labeled bugs with the warnings and investigating their role in bug detection. Finally, we assessed these tools' time performance on 1,049 projects. The useful findings based on our comprehensive study can help developers improve their tools and provide users with suggestions for selecting QA tools.

cs.SE↗