Qiang Wei

Automatic Exploit Generation (AEG) plays an important role in proactive assessment of software threats by identifying vulnerabilities and constructing functional payloads. Existing Large Language Model (LLM)-based methods, however, often struggle to reason about complex exploit logic and to perform runtime introspection, leaving a gap between static vulnerability analysis and dynamic memory behavior. We present PwnAgent, an LLM-driven multi-agent framework for end-to-end exploit generation that combines offensive domain knowledge with active runtime introspection. PwnAgent uses a hierarchical knowledge base for multi-stage exploit reasoning and a feedback-driven self-correction engine to calibrate dynamic memory parameters during execution. Because broad Capture The Flag (CTF) benchmarks offer limited binary-exploitation depth and pwn-specific evaluation must balance reproducibility, difficulty progression, and exploit diversity, we construct a 66-task pwn benchmark from public CTF-style challenges. The benchmark is primarily composed of Linux x86/x86-64 ELF binaries and stack-oriented tasks, with smaller format-string, heap, integer-overflow, ARM, and MIPS subsets used as limited probes beyond the dominant setting. Under the same recent Kimi-K2.6 backend, PwnAgent achieves a 62.12% end-to-end success rate, compared with 31.82% for the evaluated PwnGPT baseline, a 30.30 percentage-point gain. These paired results indicate that structured knowledge guidance, execution-grounded measurement, and feedback repair improve LLM-based exploit generation in the evaluated setting, while the absolute success rate shows that fully autonomous exploitation remains challenging.

Cybersecurity incidents targeting the power grid have been increasing in recent years. The IEC 61850 protocol serves as a safeguard for substation communications, and its security plays an important role in the safe and stable operation of the power grid. Aiming at the problem of low accuracy of intrusion detection of IEC 61850 communication protocols, this paper proposes ATCV model by combining feature selection and triadic concept analysis. The ATCV model includes three parts: data preprocessing, feature selection, and FL (Fuzzy Triadic Concept Analysis) classification model construction. Firstly, due to the different forms of datasets, the training set and test set are preprocessed separately, and for the test set the data grammar library is used to standardize it; Then, redundant features are eliminated based on feature contribution to generate a streamlined dataset; Finally, fuzzy triadic backgrounds are generated based on the streamlined dataset, fuzzy triadic concepts are constructed and transformed into feature triadic concept vectors. Construct a vector group based on the representation vectors and set the initial weight values, then dynamically adjust the weight values through the vector group to the classification results of the test data to generate the FL classification model. In order to test the classification effect of the ATCV model, the model was validated through horizontal and longitudinal comparison experiments. Experiments show that the accuracy, precision, recall and F1-Score of the ATCV model reach 93.92, 93.26, 99.96 and 96.5% respectively, which are significantly better than those of the SVM, KNN, CNN, DPL-FSAD and FSL-SCNN models; And the more the amount of data, the better the detection effect of ATCV.

The Linux kernel remains vulnerable to numerous bugs, with approximately 65% detected by Syzkaller lacking Proof-of-Concept (PoC), hampering risk mitigation efforts. These bugs, termed irreproducible kernel bugs, highlight the challenge of statefulness issue-related irreproducibility in kernel fuzzing, which is an open research without definitive solutions. Our investigation reveals that suboptimal seed quality distribution in fuzzing is the root obstacle preventing effective tracking of the states leading to crashes. Inspired by this insight, we introduce Reverse Fuzzing (RF), an innovative approach that infers hard-to- reach states by continuously reverse-oriented deriving from subsequently encountered bridge states to increase reproduction probability. RF differentiates between the “trigger” seed, which directly causes crashes, and “activator” seeds, which establish the necessary preconditions, prioritizing exploration around trigger while simultaneously regenerating and maintaining activators during fuzzing, which effectively facilitate to restructure such elusive states from “yesterday”. We implement YOME, a prototype leveraging RF to strike a balance between fuzzing efficiency and effectiveness through customized scheduling and mutation strategies, armed with a refinement mechanism to improve seed quality distribution. Our evaluations validate that YOME reproduce 110% more bugs than previous kernel fuzzers and demonstrate its practicality in real-world scenarios. YOME generated 125 PoCs (30.1% of the total) and uncovered 23 unique bugs, with 40 confirmed and 5 assigned CVEs.

Recent advances in graph neural networks have transformed structural pattern learning in domains ranging from social network analysis to biomolecular modeling. Nevertheless, practical deployments in mission-critical scenarios such as binary code similarity detection face two fundamental obstacles: first, the inherent noise in graph construction processes exemplified by incomplete control flow edges during binary function recovery; second, the substantial distribution discrepancies caused by cross-architecture instruction set variations. Conventional GNN architectures demonstrate severe performance degradation under such low signal-to-noise ratio conditions and cross-domain operational environments, particularly in security-sensitive vulnerability identification tasks where feature instability or domain shifts could trigger critical false judgments. To address these challenges, we propose GBsim, a novel approach that combines graph neural networks with natural language processing. GBsim employs a cross-architecture language model to transform binary functions into semantic graphs, leverages a multilayer GCN for structural feature extraction, and employs a Transformer layer to integrate semantic information, generates robust cross-architecture embeddings that maintain high performance despite significant distribution shifts. Extensive experiments on a large-scale cross-architecture dataset show that GBsim achieves an MRR of 0.901 and a Recall@1 of 0.831, outperforming state-of-the-art methods. In real-world vulnerability detection tasks, GBsim achieves an average recall rate of 81.3% on a 1-day vulnerability dataset, demonstrating its practical effectiveness in identifying security threats and outperforming existing methods by 2.1%. This performance advantage stems from GBsim’s ability to maximize information preservation across architectural boundaries, enhancing model robustness in the presence of noise and distribution shifts.

Encrypted traffic classification poses significant challenges in network security due to the growing use of encryption protocols, which obscure packet payloads. This paper introduces a novel framework that leverages dual embedding mechanisms and Graph Neural Networks (GNNs) to model both temporal and spatial dependencies in traffic flows. By utilizing metadata features such as packet size, inter-arrival times, and protocol attributes, the framework achieves robust classification without relying on payload content. The proposed framework demonstrates an average classification accuracy of 96.7%, F1-score of 96.0%, and AUC-ROC of 97.9% across benchmark datasets, including ISCX VPN-nonVPN, QUIC, and USTC-TFC2016. These results mark an improvement of up to 8% in F1-score and 10% in AUC-ROC compared to state-of-the-art baselines. Extensive experiments validate the framework’s scalability and robustness, confirming its potential for real-world applications like intrusion detection and network monitoring. The integration of dual embedding mechanisms and GNNs allows for accurate fine-grained classification of encrypted traffic flows, addressing critical challenges in modern network security.

With the increasing utilization of drones, the cyber security threats they face have become more prominent. Code reuse in the software development of drone systems has led to vulnerabilities in drones. The binary code similarity analysis method offers a way to analyze drone firmware lacking source code. This paper proposes DEGNN, a novel graph neural network for binary code similarity analysis. It uses call-enhanced control graphs and attention mechanisms to generate dual embeddings of functions and predict similarity based on graph structures and node features. DEGNN is effective in cross-architecture tasks. Experimental results show that in the cross-architecture binary function search, DEGNN’s mean reciprocal rank and recall@1 surpass the state of the art by 12% and 28.6%, respectively. In the cross-architecture real-world vulnerability search, specifically targeting drone systems, it has a 33.3% performance improvement over the SOTA model, indicating its great potential in enhancing drone cyber security.