Lijuan Xu

Large language model (LLM)-based vulnerability detection has made substantial progress in understanding code semantics and identifying vulnerabilities at the function level. However, constrained context windows and probabilistic reasoning make it difficult to reliably track data flows across framework callbacks, complex call chains, and project-specific interfaces in whole software projects. This limitation may result in missing propagation relations or vulnerability reports that lack sufficient program evidence. To address this problem, we propose AgentSAST, a knowledge-driven, closed-loop approach to static vulnerability analysis that combines the semantic reasoning capabilities of LLMs with the project-level data-flow analysis of CodeQL. AgentSAST constructs a structured security knowledge base from historical vulnerabilities and employs retrieval-augmented generation to support taint-semantics inference in the target project. The inferred security roles are translated into CodeQL queries to generate project-level data-flow evidence. AgentSAST further feeds CodeQL execution results and candidate-path review decisions back to the agent, enabling iterative refinement of interface roles and propagation relations. The resulting reports preserve complete propagation paths, source-code locations, and review rationales for subsequent auditing. Experiments on a real-world vulnerability benchmark demonstrate that AgentSAST achieves strong project-level vulnerability coverage and candidate-path quality across multiple backbone models. The best observed Recall, Avg.F1, and Avg.FDR across the evaluated configurations are 73.96%, 64.02%, and 13.53%, respectively. These results show that the closed-loop collaboration between LLM-based semantic reasoning and static data-flow analysis improves vulnerability coverage while reducing the manual effort required to inspect invalid candidate paths.

Extreme Gradient Boosting (XGBoost) is widely used due to its excellent learning performance. In real-world scenarios, data is often held by multiple owners, the sample size of a single data owner is usually insufficient for effectively training the model. Therefore, how to integrate data resources from different owners to collaboratively train a higher-performing model while ensuring data privacy has become an urgent problem that needs to be solved. To solve the above problems, we propose a privacy-preserving XGBoost scheme (PriXGB) with wide applicability and design a series of secure protocols for its key steps. We proposed a SecureArgmax protocol based on function secret sharing, which significantly improves the efficiency of securely computing the maximum value in the secret sequence while ensuring that intermediate information is not leaked. We designed a privacy sigmoid function protocol based on secret sharing to improve the accuracy of the model. In the vertical data partition scenario, PriXGB is roughly 30% more efficient than existing solutions. Finally, we provide security proofs for designed protocols and verify the advantages of the scheme through experiments. The experimental results show that PriXGB effectively protects data privacy while maintaining accuracy comparable to non-private XGBoost, thereby demonstrating strong security and effectiveness.

Aiming to address the distributed consensus issues for Lipschitz nonlinear multiagent systems suffering from DoS attacks, this work develops a novel distributed event-triggered secure control (DETSC) schemes that achieve leader-follower consensus with fully distributed, strict Zeno-free manners. First, a distributed secure control scheme is proposed. A novel adaptive couple parameter, two kinds of state observers, and the distributed event-triggered mechanism working in tandem with the control scheme are further raised. For the elimination of global information reliance, the adaptive couple parameter with exponential term is designed, which helps in classifying Lyapunov function behavior separately in attack and normal intervals. Zeno behavior is excluded strictly by designing the upper limit and decay rate of the event-triggered function (ETF). By constructing a Lyapunov function incorporating both the exponential term and decay rate of the ETF, the time blocking caused by DoS attacks in stability analysis is overcome. Zeno-freeness analysis gives the strict positive minimum inter-event interval. Finally, the capability of the proposed DETSC scheme is tried out through the numerical simulations on a group of single-joint robotic arms.

Provenance graph-based anomaly detection, particularly for Advanced Persistent Threat (APT) detection, addresses the issues of large-scale graphs and data imbalance. However, existing methods struggle with information loss, high computational complexity, and low detection accuracy. To address the above challenges, this paper proposes TraceCluster, a lightweight and adaptive clustering-based Subgraph Attention Network (SAN) for APT detection in provenance graph. TraceCluster mitigates the neighborhood explosion problem by clustering nodes to partition large-scale graphs, thus reducing reliance on the global graph while preserving local neighborhood information. Furthermore, the method dynamically models complex inter-node dependencies within subgraphs. It employs an attention mechanism to adaptively highlight the most relevant connections. This enhances node representations and improves overall feature extraction. This design substantially reduces memory consumption and avoids the high computational complexity of global graph processing. In addition, an adaptive category-weighting loss function assigns variable weights to different classes, improving the detection of rare and anomalous behaviors. Experimental results show that on the OpTC dataset, the currently faster method is 37-fold and 3-fold slower than our approach in terms of inference time respectively. Furthermore, in the nine real-world scenarios of four evaluated datasets, TraceCluster outperforms state-of-the-art (SOTA) approaches in terms of overall performance, especially in node-level APT detection tasks.