Xiaokang Yin

Dependency Confusion Attacks (DCA), which exploit resolver-level source bypass in multi-repository environments, have emerged as a critical threat to software supply chain security. Existing dependency confusion detection tools are limited by incomplete dependency extraction, insufficient transitive dependency analysis, and a lack of cross-repository version-precedence evaluation. We propose DCFinder, an automated dependency confusion detection method based on multi-dimensional dependency analysis. DCFinder first extracts dependencies from heterogeneous configuration sources by combining format-specific parsing for static configuration files with AST-based static analysis for executable build scripts. It then reconstructs multi-layer dependency trees through a source-aware dependency expansion strategy implemented with BFS traversal, where dependency expansion obtains metadata from configured private indexes when available and from PyPI otherwise, and continues recursively through the discovered sub-dependencies. Finally, it performs cross-repository version analysis to determine whether resolver behavior may allow a public package to override an intended private source. We evaluate DCFinder on 28 real-world Python projects with observable multi-index configurations. The results show that DCFinder achieves 88.7% precision and 83.3% recall for resolver-level dependency-confusion condition detection, whereas the evaluated baseline tools report no positive cases under the same setting due to their more limited modeling of cross-index resolution behavior. These results demonstrate that combining heterogeneous dependency extraction, source-aware dependency expansion, and cross-repository version analysis enables more comprehensive auditing of dependency-confusion risks.

Binary code similarity detection (BCSD) plays a crucial role in vulnerability discovery and malware analysis. However, it faces two major challenges in cross-architecture scenarios: syntactic variations arising from architectural differences and semantic distortions induced by compiler optimizations. To address these issues, we propose SemASTer, a robust framework for cross-architecture BCSD that leverages abstract syntax tree (AST) as its semantic backbone. A degradation-aware channel attention mechanism dynamically incorporates compensatory information only when the AST backbone is deemed unreliable due to aggressive optimizations. Furthermore, we introduce two complementary compensation pathways: behavioral semantic compensation to recover lost runtime dynamics, and control-flow compensation to reconstruct disrupted logical dependencies. Experimental results demonstrate that SemASTer achieves an 8.3% improvement in Recall@1 over the current state-of-the-art method in cross-architecture tasks, and an 11.4% gain under fully heterogeneous compilation settings (varying architectures, compilers, and optimization levels). Moreover, its effectiveness and robustness are validated through real-world vulnerability detection scenarios.

The surge in Linux kernel vulnerabilities poses a significant challenge for security analysts, as the scale of bug reports far outstrips manual patching capacity. Assessing the exploitability risk of Linux kernel bugs is vital for prioritizing bug repair efforts, yet the first discovered crash report provides a limited view of the bug’s exploitability risk, potentially underestimating its true security impact. We introduce SyzCrash, a directed fuzzing framework that utilizes post-crash traces to guide the exploitability risk escalation in the Linux kernel. To mitigate kernel panic instability, SyzCrash employs a loadable kernel module with panic_notifier hook to capture post-crash kCOV and ftrace data. By combining context similarity feedback with a two-phase mutation strategy, the framework preserves the original crash context while systematically exploring proximate execution paths. Evaluation on a benchmark of 108 real-world Linux kernel bugs shows that SyzCrash achieves a 72.22% escalation success rate in bug risk escalation, outperforming state-of-the-art approaches in both efficacy and speed. These results highlight its capability to systematically uncover hidden security risks and assist developers in bug prioritization and patching.

The discovery of vulnerabilities in embedded firmware has received significant attention from security researchers. However, current vulnerability detection methods still suffer from false negatives and inefficiency, which limit detection effectiveness and require substantial analysis time. To alleviate the above problems, we propose a bidirectional path and data flow analysis method, named BPDA, that effectively compensates for the limitations in detecting firmware vulnerabilities at nonstandard sink points. Our key insight is that, some vulnerabilities arise in nonstandard library sinks, and not all user inputs can reach each corresponding sink. Guided by these insights, we design a more comprehensive sink identification algorithm and leverage accurate backward data flow tracking to eliminate the non-vulnerable paths. After that, we execute forward taint analysis and generate the final Proof of Concepts (PoCs). To evaluate the effectiveness of BPDA, we evaluated it on 84 firmware samples (including both Linux and VxWorks firmware) from 8 major brands, comparing it with state-of-the-art methods (i.e., SaTC and Mango). BPDA discovered 163 real vulnerabilities, including 34 0-day vulnerabilities, of which 32 have been confirmed by CVE/CNVD. Besides, results show that BPDA completed its analysis in just 6% of the time required by SaTC, and remarkably identified 21 vulnerabilities that SaTC and Mango had not detected. It also resolved the issue of Mango failing to analyze specific firmware. In addition, we also performed an ablation study to verify the effectiveness of optimization methods in taint analysis. These results demonstrate the superiority of BPDA in terms of effectiveness and efficiency in detecting embedded firmware vulnerabilities.