Research

The reuse of open-source software (OSS) provides efficiency for developers. However, unmanaged OSS reuse may lead to the propagation of vulnerabilities. We have conducted research to devise scalable and precise vulnerability detection techniques aimed at resolving security threats caused by vulnerable OSS reuse. Our techniques can actually be used to resolve vulnerabilities in real-world popular software programs (e.g., Android, Redis, Mozjpeg, etc.). In addition, our research papers have been published in international conferences, including VUDDY [S&P ‘17], MOVERY [USENIX Security ‘22], V1SCAN [USENIX Security ‘23], TIVER [ICSE ‘25], SBridge [FSE ‘26], and Uncovering [FSE ‘26].

Identifying what and how OSS projects are reused in the software program is the very first step towards ensuring software security. Our research can precisely identify third-party OSS components from the target software codebase, especially in C/C++ languages where identifying OSS components is challenging. The results of the research have been published in international conferences, including CENTRIS [ICSE ‘21] and CNEPS [ICSE ‘24].

As AI becomes a core component of modern software systems, security risks arise not only from traditional code vulnerabilities but also from models, prompts, agents, data, and AI software supply chains. We investigate these emerging threats and develop techniques to analyze and mitigate security risks in AI-based systems. In addition, we leverage AI techniques to improve software security analysis. Our research explores LLM-assisted approaches for vulnerability detection, security patch analysis, and API misuse identification, with the goal of making security analysis more accurate and practical. The results of the research have been published in international conferences, including CRYPTBARA [ASE ‘25].

Assessing the quality of security patches provided through public vulnerability databases (e.g., NVD) is an essential task for proper vulnerability resolution. We have conducted research ranging from effective methods of collecting security patches to techniques for verifying their quality. The results of our research have been presented in international conferences and journals as papers, including V0Finder [USENIX Security ‘21], xVDB [IEEE ACCESS ‘22], and Clovery [IFIPSEC ‘26].