A defensive capability analysis for JavaScript libraries that soundly reports every exercised capability for code executed under a lightweight protected runtime, complementing the static analysis with a lightweight runtime enforcement mechanism that blocks those patterns.
A defensive capability analysis for JavaScript libraries that soundly reports every exercised capability for code executed under a lightweight protected runtime, complementing the static analysis with a lightweight runtime enforcement mechanism that blocks those patterns.
StackPatroller is proposed, a stack-integrity-based runtime supervision framework that enforces program integrity through configurable policies that monitors runtime stack contexts to detect early deviations from normal execution, enabling the identification of whole-function reuse and certain forward-edge attacks earlier—within user mode before any unintended system calls occur.
Yuanheng Xu, Si-Yu Zhang, Juan Wang et al.· Journal of computing and sec...· 0 citations
CWEEP can identify the exact location in the RTL where the potential vulnerability resides and supports automatic code repair suggestions when applicable, so it can be used in the early stages of RTL development while properties are still under construction.
The adoption of Large Language Models (LLMs) is changing how code is written, but the security implications of using LLMs to generate complete web API backends remain insufficiently characterized. Prior studies have assessed the security of LLM-generated code by detecting vulnerabilities in isolated code snippets; however, these assessments are too narrow to surface vulnerabilities that emerge in multi-endpoint backend services. To address this gap, we performed a security assessment on 75 FastAPI backends generated by three contemporary LLMs (Gemini 2.5 Pro, GPT 5.2, and DeepSeek V3.2). We designed a benchmark comprising the following five code generation categories: Authentication, Role-Based Access Control, File Uploads, Payment Processing, and Webhook Handling. Automated analysis of the generated APIs with Static Application Security Testing (SAST) tools, whose raw alerts we manually triaged to remove false positives, mainly revealed configuration problems, while Dynamic Application Security Testing (DAST) tools helped uncover runtime fragility such as application crashes on malformed input. Automated analysis was augmented with a manual assessment phase, which revealed vulnerabilities such as mass assignment and server-side request forgery. We also observed a disconnect between functional correctness and secure logic. In our trials, DeepSeek V3.2 produced the most vulnerable code despite the highest build success rate. Gemini 2.5 Pro had the highest startup-failure rate and produced shorter implementations, which coincided with fewer observed runtime findings among the APIs that started. GPT-5.2 fell between the two, characterized by near-correct security controls that took the right form but lacked the intended effect. We interpret this disconnect as a review-risk pattern, which we call the human-in-the-loop paradox: syntactically correct and well-structured LLM-generated code can still contain architectural vulnerabilities that are not revealed by surface-level inspection. The takeaway is that LLM-generated code warrants the same treatment as untrusted input from an external system.
Abdul Ali Khan, S. Rauti, T. Mäkilä· IEEE Access· 0 citations
CHARGE is an automated framework for generating security properties for unverified RTL modules using CWEs and large language models using CWEs and large language models that leverages the hierarchical nature of CWE entries to improve accuracy when identifying security-critical assets in unverified RTL modules.
Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.
Vani Pasupula, M. N. V. Manikanth, Nagaraju Vassey· International Journal of Cre...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
