arXiv subjects

Menghan Wu

Publications and source records attributed to Menghan Wu.

5 recordsLinked to original sources

arXiv2026

Triggering and Detecting Exploitable Library Vulnerability from the Client by Directed Greybox Fuzzing

Developers utilize third-party libraries to improve productivity, which also introduces potential security risks. Existing approaches generate tests for public functions to trigger library vulnerabilities from client programs, yet they depend on proof-of-concepts (PoCs), which are often unavailable. In this paper, we propose a new approach, LiveFuzz, based on directed greybox fuzzing (DGF) to detect the exploitability of library vulnerabilities from client programs without PoCs. LiveFuzz exploits a target tuple to extend existing DGF techniques to cross-program scenarios. Based on the target tuple, LiveFuzz introduces a novel Abstract Path Mapping mechanism to project execution paths, mitigating the preference for shorter paths. LiveFuzz also proposes a risk-based adaptive mutation to mitigate excessive mutation. To evaluate LiveFuzz, we construct a new dataset including 61 cases of library vulnerabilities exploited from client programs. Results show that LiveFuzz increases the number of target-reachable paths compared with all baselines and improves the average speed of vulnerability exposure. Three vulnerabilities are triggered exclusively by LiveFuzz.

cs.CR↗

arXiv2025

HFuzzer: Testing Large Language Models for Package Hallucinations via Phrase-based Fuzzing

Large Language Models (LLMs) are widely used for code generation, but they face critical security risks when applied to practical production due to package hallucinations, in which LLMs recommend non-existent packages. These hallucinations can be exploited in software supply chain attacks, where malicious attackers exploit them to register harmful packages. It is critical to test LLMs for package hallucinations to mitigate package hallucinations and defend against potential attacks. Although researchers have proposed testing frameworks for fact-conflicting hallucinations in natural language generation, there is a lack of research on package hallucinations. To fill this gap, we propose HFUZZER, a novel phrase-based fuzzing framework to test LLMs for package hallucinations. HFUZZER adopts fuzzing technology and guides the model to infer a wider range of reasonable information based on phrases, thereby generating enough and diverse coding tasks. Furthermore, HFUZZER extracts phrases from package information or coding tasks to ensure the relevance of phrases and code, thereby improving the relevance of generated tasks and code. We evaluate HFUZZER on multiple LLMs and find that it triggers package hallucinations across all selected models. Compared to the mutational fuzzing framework, HFUZZER identifies 2.60x more unique hallucinated packages and generates more diverse tasks. Additionally, when testing the model GPT-4o, HFUZZER finds 46 unique hallucinated packages. Further analysis reveals that for GPT-4o, LLMs exhibit package hallucinations not only during code generation but also when assisting with environment configuration.

cs.SE↗

arXiv2024

Complex generalized Gauss-Radau quadrature rules for Hankel transforms of integer order

Complex Gaussian quadrature rules for oscillatory integral transforms have the advantage that they can achieve optimal asymptotic order. However, their existence for Hankel transform can only be guaranteed when the order of the transform belongs to $[0,1/2]$. In this paper we consider the construction of generalized Gauss-Radau quadrature rules for Hankel transform. We show that, if adding certain value and derivative information at the left endpoint, then complex generalized Gauss-Radau quadrature rules for Hankel transform of integer order can be constructed with theoretical guarantees. Orthogonal polynomials that are closely related to such quadrature rules are investigated and their existence for even degrees is proved. Numerical experiments are presented to confirm our findings.

math.NA↗

arXiv2023

ROS package search for robot software development: a knowledge graph-based approach

ROS (Robot Operating System) packages have become increasingly popular as a type of software artifact that can be effectively reused in robotic software development. Indeed, finding suitable ROS packages that closely match the software's functional requirements from the vast number of available packages is a nontrivial task using current search methods. The traditional search methods for ROS packages often involve inputting keywords related to robotic tasks into general-purpose search engines or code hosting platforms to obtain approximate results of all potentially suitable ROS packages. However, the accuracy of these search methods remains relatively low because the task-related keywords may not precisely match the functionalities offered by the ROS packages. To improve the search accuracy of ROS packages, this paper presents a novel semantic-based search approach that relies on the semantic-level ROS Package Knowledge Graph (RPKG) to automatically retrieve the most suitable ROS packages. Firstly, to construct the RPKG, we employ multi-dimensional feature extraction techniques to extract semantic concepts from the dataset of ROS package text descriptions. The semantic features extracted from this process result in a substantial number of entities and relationships. Subsequently, we create a robot domain-specific small corpus and further fine-tune a pre-trained language model, BERT-ROS, to generate embeddings that effectively represent the semantics of the extracted features. These embeddings play a crucial role in facilitating semantic-level understanding and comparisons during the ROS package search process within the RPKG. Secondly, we introduce a novel semantic matching-based search algorithm that incorporates the weighted similarities of multiple features from user search queries, which searches out more accurate ROS packages than the traditional keyword search method.

cs.SE↗

arXiv2021

Gaussian quadrature rules for composite highly oscillatory integrals

Highly oscillatory integrals of composite type arise in electronic engineering and their calculations is a challenging problem. In this paper, we propose two Gaussian quadrature rules for computing such integrals. The first one is constructed based on the classical theory of orthogonal polynomials and its nodes and weights can be computed efficiently by using tools of numerical linear algebra. We show that the rate of convergence of this rule depends solely on the regularity of the non-oscillatory part of the integrand. The second one is constructed with respect to a sign-changing function and the classical theory of Gaussian quadrature can not be used anymore. We explore theoretical properties of this Gaussian quadrature, including the trajectories of the quadrature nodes and the convergence rate of these nodes to the endpoints of the integration interval, and prove its asymptotic error estimate under suitable hypotheses. Numerical experiments are presented to demonstrate the performance of the proposed methods.

math.NA↗