An Empirical Study of Human–LLM Teaming in Software Reverse Engineering - zionbasque.com/files/papers/…
In our human study, we instrumented the SRE workflow of 48 participants (split between 24 novices and 24 experts), observing over 109 hours of SRE.
Through 18 findings, we found various benefits and harms of LLMs in SRE. Remarkably, we found that LLM assistance narrows the expertise gap: novices’ comprehension rate rises by approximately 98%, matching that of experts, whereas experts gain little; however, they also had harmful hallucinations, unhelpful suggestions, and ineffective results.
Known-algorithm functions are triaged up to 2.4× faster, and artifact recovery (symbols, comments, types) increases by at least 66%. Overall, our findings identify powerful synergies of humans and LLMs in SRE, but also emphasize the significant shortcomings of LLMs in their current integration.
@mahal0z, @AnantaSoneji, @cl4sm, @adamdoupe, @Zardus, Ruoyu Wang, @losiouk, Samuele Doria, @packm4d - @ASU, @UniPadova, @EURECOM#Decompilation#ReverseEngineering#BinaryAnalysis#ProgramAnalysis#Cybersecurity#SoftwareSecurity#LLMSecurity#AIforSecurity#UsableSecurity#HumanFactors#VulnerabilityResearch#AcademicSecurity
Our work on detecting supply-chain attacks using program analysis is accepted in @ICSEconf SEIP Track.
We present an inter-package program analysis technique to detect malicious packages in the Python ecosystem.
#SupplyChain#ProgramAnalysis#MalwareDetection#ICSE#SEIP
@iitmadras congratulates Prof. Krishna Nandivada from the Department of Computer Science and Engineering, #IITMadras, on being jointly awarded the Faculty of the Year Award 2024 by the #IBM Center for Advanced Studies.
This recognition highlights Prof. Nandivada’s exceptional contributions to compiler technologies, high-performance #computing, and #programanalysis. His work bridges academia and industry, focusing on multicore systems and modern compiler optimisation techniques.
We are delighted to see his efforts recognised globally and look forward to his continued contributions to the field!
@IBM#IITMadras#FacultyExcellence#IBM#ComputerScience#ResearchInnovation
I wrote an article about “Why Static analysis will not resolve your performance problem?” I briefly discussed Static Analysis in that article and compared it with Dynamic Analysis from a performance perspective. In my last article, I focused on these two approaches for Program Analysis and compared them in detail in all aspects, not only performance:
#ProgramAnalysis#DynamicAnalysis#StaticAnalysisitnext.io/static-analysis-vs…
Fuzztruction - Prototype Of A Fuzzer That Does Not Directly Mutate Inputs (As Most Fuzzers Do) But Instead Uses A So-Called Generator Application To Produce An Input For Our Fuzzing Target #Fuzztruction#ProgramAnalysis#Scripts#Shellsdlvr.it/Sq8JxF