Posts by Collection

publications

SecureImgStego: A Keyed Shuffling-based Deep Learning Model for Secure Image Steganography

Published in 2023 IEEE Conference on Communications and Network Security (CNS), 2023

In this study, we uncovered the inherent vulnerabilities in deep learning based steganogaphic systems, and proposed simple shuffling based solution to mitigate that.

Download Paper

How Quickly Do Development Teams Update Their Vulnerable Dependencies?

Published in arxiv, 2024

We quantified the updatedness of dependencies and updatedness of vulnerable dependencies in the context of open source dependencies in this project. The idea is very common in Reliability domain (e.g., Mean-Time-To-Update, Mean-Time-To-Repair, Mean-Time-To-Remediate). We did a large-scale study of our proposed update metrics in NPM, PyPI, and Cargo packages.

Download Paper

What’s in a Package? Getting Visibility Into Dependencies Using Security-Sensitive API Calls

Published in arxiv, 2024

We made a list of Security Sensitive APIs in Java using JDK documentation, past CVE fixes, and CWE examples. We then measured the prevalence of these Security-Sensitive API usage in our chosen 45 Java packages and in their dependencies. We finally conducted a developer survey to validate whether security-sensitive API information can be helpful in selecting dependencies.

Download Paper

Towards a Taxonomy of Challenges in Security Control Implementation

Published in 2024 Annual Computer Security Applications Conference (ACSAC), 2024

A taxonomy of challenges encountered when implementing security controls.

Download Paper

Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystem

Published in arxiv, 2025

An empirical study of 145,000 npm packages showing that adopting OpenSSF Scorecard security practices is associated with fewer vulnerabilities and faster remediation and update times.

Download Paper