arXiv subjects

Yingnan Zhou

Publications and source records attributed to Yingnan Zhou.

5 recordsLinked to original sources

arXiv2026

KubeCap: A Framework for Capability Minimization in Kubernetes via Static Analysis and LLM-Assisted Rule Inference

As the most widely used container orchestration platform, Kubernetes provides flexible privilege configuration by allowing developers to manage Linux capabilities via manifest files. However, developers rely on default settings or coarse-grained security contexts in practice, violating the principle of least privilege and enlarging the attack surface of containerized workloads. Existing studies either detect vulnerable patterns in Kubernetes manifests or infer required capabilities for standalone Linux programs, but they do not directly address capability minimization in Kubernetes. To bridge this gap, we first conduct an empirical study on three open-source datasets, revealing that 74.67% of projects lack capability configurations. Motivated by our observations, we propose KubeCap, a framework for Kubernetes capability minimization. KubeCap translates deployment specifications into deterministic manifests, locates container entrypoints, performs reachability-guided system call analysis, and leverages LLM-assisted rule specification to derive syscall--parameter--capability relations from Linux kernel code. Based on these results, KubeCap infers the minimal capability set required by each workload and automatically generates repaired manifests. Evaluation on 10 representative Go-based Kubernetes projects shows an average capability reduction rate of 54.97%, outperforming rapid type analysis and class hierarchy analysis baselines while maintaining practical analysis cost. These results demonstrate KubeCap's effectiveness in enforcing least privilege in Kubernetes.

cs.CR↗

arXiv2026

SkillConsist: Detecting Inconsistencies in Agent Skills via Bidirectional Graph Alignment

Agent Skills provide reusable capabilities to LLM agents. Agent Skill inconsistencies can expose undisclosed dangerous behavior or cause wrong Skill selection. Recent Agent Skill research has increasingly examined Agent Skill consistency detection. Existing methods evaluate behaviors or security-property graphs against predefined categories or declared scopes. More recently, PL-HCL uses an LLM-based model to learn consistency across metadata, instructions, and resources. However, declaration and implementation behavior can be mixed across text and code, and a concise declaration can correspond to multiple connected implementation steps. We present SkillConsist to address both challenges. An LLM separates declaration and implementation content into behavior records on the implementation and declaration sides, while static analysis supplements implementation records. These records form declaration and implementation behavior graphs, respectively. Starting from a behavior record on either side, bidirectional graph alignment searches the other graph for a candidate subgraph and expands it along behavior relations until it completely expresses the source-side behavior. Graph differencing identifies conflicts between aligned subgraphs and outputs the detection results. We construct a 633-Skill benchmark from ClawHub's 500 most-downloaded public Skills and 133 Skill-Inject packages. The benchmark contains 319 inconsistent and 314 consistent Skills and 442 localized inconsistency annotations. On this benchmark, SkillConsist achieves 86.85% precision, 89.03% recall, and 87.93% F1 for package-level detection, improving F1 over the best baseline by 20.43 percentage points. For localization, it achieves 67.60% precision, 58.14% recall, and 62.52% F1.

cs.LG↗

arXiv2026

Rethinking Software Misconfigurations in the Real World: An Empirical Study and Literature Analysis

Software misconfiguration has consistently been a major reason for software failures. Over the past two decades, much work has been done to detect and diagnose software misconfigurations. However, there is still a gap between real-world misconfigurations and the literature. It is desirable to investigate whether existing taxonomy and tools are applicable for real-world misconfigurations in modern software. In this paper, we conduct an empirical study on 772 real-world misconfiguration issues, based on which we propose a novel classification of the root causes of software misconfigurations, i.e., constraint violation, resource unavailability, component integration error, and configuration semantic misinterpretation. Then, we systematically review the literature on misconfiguration troubleshooting to study the trends of research and the practicality of the tools and datasets in this field. We find that the research targets have changed from system and infrastructure software to advanced applications (e.g., cloud service). Meanwhile, research on non-crash misconfigurations has also grown significantly. Despite the progress, a majority of studies lack reproducibility due to the unavailable tools and evaluation datasets. In total, only eleven tools and four datasets are publicly available. We analyze the trends of existing literature on misconfiguration troubleshooting, summarize the challenges that users are faced with, and highlight the suggestions to mitigate and diagnose software misconfigurations. We release the real-world dataset of misconfiguration issues for follow-up research.

cs.SE↗

arXiv2018

Enhancement of spatial resolution of ghost imaging via localizing and thresholding

In ghost imaging scheme, an illuminated light is split into test and reference beams which pass through two different optical systems respectively and an image is constructed by the second-order correlation between the two light beams. Since both the two light beams are all diffracted when passing through the optical systems, spatial resolution of ghost imaging is in general lower than that of a corresponding conventional imaging system. When Gaussian-shaped light spots are used to illuminate an object, randomly scanning across the object plane, in ghost imaging scheme, we show that by localizing central positions of the spots of the reference light beam, the resolution can be enhanced by a factor of $\sqrt{2}$ same as that of the corresponding conventional imaging system. We also find that the resolution can be further enhanced by setting an appropriate threshold to the bucket measurement of ghost imaging.

physics.optics↗

arXiv2018

An experimental measurement of the topological charge of orbital angular momentum beams through weak measurement

As a special experimental technique, weak measurement extracts very little information about the measured system and will not cause the measured state collapse. When coupling the orbital angular momentum (OAM) state with a well-defined pre-selected and post-selected system of a weak measurement process, there is an indirect coupling between position and topological charge (TC) of OAM state. Based on these ideas, we propose an experimental scheme that experimentally measure the TC of OAM beams from -14 to 14 through weak measurement.

physics.optics↗