Pith. sign in

REVIEW 4 major objections 6 minor 77 references

WAFBOOSTER: Automatic Boosting of WAF Security Against Mutated Malicious Payloads

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read WAFBOOSTER claims an automatic pipeline that finds mutated payloads bypassing WAFs and generates signatures that lift true rejection from 21% to 96% with zero false rejections.

desk verdict WAFBOOSTER's end-to-end pipeline is novel and worth knowing, but the headline 21% to 96% TRR claim is an in-sample artifact because signatures are evaluated on the same bypassing payloads used to build them. read the letter →

arxiv 2501.14008 v1 pith:26U57TF2 submitted 2025-01-23 cs.CR

Cong Wu , Jing Chen , Simeng Zhu , Wenqi Feng , Ruiying Du , Yang Xiang This is my paper · ORCID
classification cs.CR
keywords webapplicationfirewallSQLinjectioncross-sitescriptingcommandmutatedpayloadssignaturegenerationshadowmodeltruerejectionrate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

WAFBOOSTER tries to prove that web application firewalls can be hardened automatically against payload mutations that slip past their rules. The method trains a shadow model to imitate the target WAF, generates mutated malicious payloads that evade both the shadow model and the real WAF, filters those mutations so they stay executable, and then mines signatures from the surviving bypassing payloads. The headline result is that adding these signatures raises the true rejection rate of mutated SQL injection, cross-site scripting, and command injection payloads from 21% to 96% on eight WAFs, with no benign traffic falsely rejected. If the result holds, WAF rule maintenance shifts from hand-written expert rules to a learning loop that can keep pace with new evasions.

What carries the argument

The load-bearing mechanism is the signature producer built on four token scoring functions. For each token in a payload, it compares the WAF decision before and after deleting the token, replacing it with a fixed placeholder, removing everything after it, and removing everything before it; tokens whose scores indicate a large effect on the WAF's decision are treated as important. Important tokens are clustered by edit distance, and within each cluster a common subsequence is extracted with a sequence-alignment dynamic program using a match reward of 1 and a gap penalty of 0.8. The output is a simplified regular expression, defined in the paper as a regular expression whose only wildcard is `\S*`, meaning any run of non-whitespace characters, so a signature such as `\S*select\S*from\S*` matches the attack skeleton that survives across mutations.

What would settle it

Take the set of payloads that bypass a WAF under one mutation family, remove every substring that also appears in a large benign corpus, and check whether any common substring remains across the group; if for some family nothing remains, the basic assumption behind the signature producer fails and the reported combination of high true rejection with zero false rejections cannot generalize to that family.

Watch

Extended reading notes

Core claim

The paper's central claim is that the vulnerable gap in a WAF's rule set can be found and patched automatically, without per-attack expert rule writing. WAFBOOSTER trains a CNN shadow model to imitate a black-box WAF, feeds it mutated payloads produced by a sequence generator built from gated recurrent units, repairs or discards payloads whose tokens are too far from known attack keywords, and then learns signatures from the payloads that bypass both the shadow model and the real WAF. The signature producer scores each token by how much the WAF decision changes under deletion, replacement, head truncation, and tail truncation, clusters the important tokens by edit distance, and emits a simplified regular expression. In the evaluation, adding these signatures to eight WAFs raises the true rejection of mutated payloads from 21% to 96%, with false rejections at zero.

Load-bearing premise

The signature-generation step rests on the paper's basic assumption that a single payload substring remains unchanged through the mutation process and is unique enough to use as a signature without matching benign traffic; if a mutation family leaves no such stable, unique substring, the generated signatures will either miss the evasions or reject legitimate requests.

Editorial extensions

If this is right

  • If the reported measurements are right, WAFBOOSTER's signatures lift true rejection of mutated SQL injection, cross-site scripting, and command injection payloads to at least 89% (average 96%) across eight real WAFs, while false rejections stay at zero.
  • WAF hardening becomes an automated loop: generate mutated payloads, keep only valid ones, test them against the shadow model and the real WAF, and derive new rules from the bypassing set, with no per-attack mutation operators designed by hand.
  • A shadow model trained for one WAF can be reused for another WAF with only small changes in true rejection rate, which lowers the cost of applying the method to many WAFs.
  • The generated bypassing payloads are harder for WAFs to catch than those from the two comparison baselines; in the reported SQL-injection comparison the false-acceptance rate reaches 84%, versus 24% and 22% for the mutation-based and penetration-testing baselines.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: if the pipeline is run repeatedly after each signature update, an adversary can learn which substring the signature depends on and mutate that substring too, so the 96% figure is best read as a snapshot of one hardening cycle rather than a permanent security level.
  • Inference: the same generate-correct-signature loop should transfer to other structured attack families, such as LDAP, XML/XPath, or NoSQL injection, wherever a shadow model can imitate the detector and a validity check can enforce the target language; the architecture has no attack-specific component except the training data.
  • Inference: the zero-false-rejection result is measured on the evaluation's benign set, so a deployment should re-estimate false rejections on live benign traffic before treating the generated signatures as safe to enable in production.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. WAFBOOSTER is a learning-based framework that aims to automatically strengthen Web Application Firewalls (WAFs) against mutated malicious payloads. The system trains a CNN shadow model to imitate a target WAF, uses an RNN-based generator plus a payload corrector to produce mutated payloads that bypass the shadow model, and finally runs a signature producer that scores substrings, clusters them by edit distance, and emits simplified regular-expression signatures to update the WAF's rules. The paper evaluates the pipeline on eight real-world WAFs against SQL injection, XSS, and command injection, and claims that the generated signatures raise the true rejection rate (TRR) of mutated payloads from 21% to 96% with no false rejections, and that WAFBOOSTER's payload generation achieves a false acceptance rate three times better than state-of-the-art mutation/generation tools.

Significance. If the reported results were valid, WAFBOOSTER would be a practically valuable contribution: it would automate the discovery of WAF bypasses and the generation of new signatures without per-attack expert knowledge, which is a meaningful step beyond manual rule maintenance and prior mutation/generation tools that target only specific attack types or ML-based WAFs. The idea of combining a shadow model, RNN-based payload generation, and substring-based signature synthesis is coherent and worth exploring. However, the current evidence does not support the headline numbers: the signature evaluation is in-sample, the shadow model is validated only at the aggregate level, and the state-of-the-art comparison is not a fair apples-to-apples benchmark. With a proper held-out evaluation and clarified experimental protocol, the underlying approach could still be of interest to the security testing community.

major comments (4)
  1. [Section IV-F, Table V] The main evaluation of signature effectiveness is circular. In Section III-E, the signature producer (Algorithm 2) consumes the 'bypassing malicious payloads against WAF' and builds regular expressions by extracting common substrings from exactly those payloads. Section IV-F then measures TRR 'after' by applying the generated signatures to 'bypassing adversarial payloads and benign payloads from original dataset.' A regex constructed from a payload's own tokens will match that payload by construction, so the observed increase from roughly 16-34% to 90-100% TRR does not demonstrate that unseen mutated payloads are blocked. The FRR=0 result is likewise uninformative because the benign set is the same set used to select for specificity. Please re-run the evaluation on a disjoint set of mutated payloads (e.g., payloads generated with held-out seeds or from a separate mutation campaign) and report TRR/FRR on those held-out samples.
  2. [Section III-E, Algorithm 2] The scoring functions DS, RS, HS, and TS in Algorithm 2 are defined in terms of f, described as 'the discrimination result of WAF.' The paper does not specify whether f is the real WAF or the shadow model. If f is the real WAF, the signature producer needs four black-box queries per token per payload, which is costly and contradicts the authors' earlier rationale for building a shadow model. If f is the shadow model, the identified 'important' tokens are only important for the shadow model, and the paper provides no evidence that these tokens transfer to the real WAF's decision boundary. This ambiguity directly affects the central claim that the generated signatures repair real WAF security gaps, so it must be resolved and justified.
  3. [Section III-B and IV-B] The shadow model is validated only through aggregate TRR and TAR values in Table I. Because the payload generator is optimized to produce inputs that bypass the shadow model's per-payload predictions, aggregate agreement is insufficient: two classifiers with identical TRR/TAR can disagree on the specific adversarial payloads being generated. The paper should report per-sample agreement between the shadow model and the real WAF, especially on generated bypassing payloads, or otherwise demonstrate that a payload that evades the shadow model also evades the real WAF. Without this, the transfer of the generated adversarial payloads from shadow model to real WAF is an unverified assumption.
  4. [Section IV-D] The comparison with WAF-A-MoLE is not a fair state-of-the-art comparison. The authors removed WAF-A-MoLE's mutation-prioritization step and state that the adapted version 'may not fully utilize WAF-A-MoLE's optimization techniques.' The subsequent claim that WAFBOOSTER's FAR is 'more than 3×' that of WAF-A-MoLE/SQLMap is therefore not a valid measure of superiority. Additionally, the Abstract says 'false acceptance rate 3X lower than state-of-the-art methods,' while Section IV-D reports a FAR of 84% for WAFBOOSTER versus 24% and 22% for the baselines, which is higher, not lower. These contradictory statements must be reconciled, and the SOTA comparison should either run WAF-A-MoLE as intended or clearly explain and justify the adaptation and its effect on the comparison.
minor comments (6)
  1. [Section II-A] The descriptions of cross-site scripting and command injection are somewhat run-on; splitting them into shorter sentences would improve readability.
  2. [Section III-E] The Smith-Waterman algorithm is credited to reference [44], which is an efficient GPU implementation paper; please cite the original Smith-Waterman paper or a standard algorithm reference instead.
  3. [Section IV-A] The phrase 'challenge collapsar attack' appears to be a typo or undefined technical term; please clarify what protection is being disabled.
  4. [Section VI] The sentence 'the shadow models are individually limited on specific attacks, cannot not fully reflect the behavior of the target W AF' contains a double negative; it should read 'cannot fully reflect.'
  5. [Table I] The header layout of Table I is confusing because the 'W AF' and 'Shadow model' columns are not clearly separated; realigning the columns would help readers compare TRR and TAR across models.
  6. [Figure 3] Figure 3 is hard to parse because the three attack types appear to be represented by nearly identical-looking payload strings; adding labeled panels or distinct axes for each attack type would make the figure comprehensible.

Circularity Check

1 steps flagged · score 8.0 of 10

The reported TRR jump in Table V is in-sample: signatures are generated from the very bypassing payloads used to measure the 'after' TRR.

  1. fitted input called prediction [Section III-E (Signature Producer, Algorithm 2) and Section IV-F (Table V)]
    "This module takes in the bypassing malicious payloads against W AF, and generate rules to update the security policies for the given W AF. ... To evaluate effectiveness of our generated signatures, we measured TRR and TAR by applying these signatures to enhance W AF. We used bypassing adversarial payloads and benign payloads from original dataset."

    Algorithm 2 fits signatures by extracting 'important tokens' from each input payload and clustering them into common-subsequence regexes. Section IV-F then evaluates the resulting signatures on 'bypassing adversarial payloads' — the same payloads that were fed into the signature producer. A regex built from a payload's own important tokens matches that payload by construction, so the before/after TRR increase (e.g., 16% to 96% for ModSecurity SQLi) is a training-set fit, not a prediction on unseen mutated payloads. The FRR=0 result is equally uninformative because no held-out or newly mutated benign traffic is tested; the signatures are simply chosen to avoid the benign payloads in the same original dataset. Thus the abstract's 21%-to-96% claim reduces to an in-sample evaluation.

full rationale

The central security-boosting claim rests on Table V, which compares WAF TRR before and after adding generated signatures. The signature producer (Section III-E) consumes the bypassing malicious payloads — the ones that evaded both the shadow model and the real WAF — and outputs regexes derived from those exact payloads' important tokens. Section IV-F measures the after-signature TRR on 'bypassing adversarial payloads and benign payloads from original dataset,' i.e., the same corpus from which the signatures were derived. Since a common-subsequence regex of a payload's own important tokens necessarily matches that payload, the near-100% after-TRR is guaranteed by the construction rather than demonstrated as generalization. No held-out mutated payload set is evaluated, and the FRR=0 claim is also based only on the original benign set used during signature selection. The shadow-model and payload-generation components have independent content, but the headline improvement of mutated-payload rejection from 21% to 96% is the paper's main security claim and it is an in-sample artifact. This is a train-on-test circularity, not a self-citation problem; the score reflects that the central reported result reduces by construction.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central evaluation rests on hand-picked thresholds (LT=4, UT=8), a gap penalty (0.8), and a top-5 keyword choice; these are free parameters not varied in sensitivity analysis. The framework assumes shadow model transferability, the persistence of a stable signature substring, and that mutated payloads retain maliciousness. No new physical entities are introduced.

free parameters (4)
  • Lower threshold LT = 4
    Used in the payload corrector to decide when to modify a generated payload; chosen by hand, no sensitivity analysis (Section III-D).
  • Upper threshold UT = 8
    Used to discard payloads whose substrings are too far from known keywords; hand-set (Section III-D).
  • Gap penalty gp in Smith-Waterman = 0.8
    Penalty for non-matching characters when scoring candidate regular expressions; hand-set (Section III-E).
  • Top-5 keyword selection = 5
    Only the five most frequent substrings are treated as keywords for correction; chosen because other keywords occur with 'quite small frequency' (Section III-D).
assumptions (4)
  • domain assumption Payloads that deceive the shadow model can also deceive the target WAF.
    Stated in Section III-D: 'We assume that the payloads that deceive the shadow model can also deceive the WAF...' The paper says it is verified, but only via aggregate TRR/TAR, not per-sample agreement.
  • domain assumption There exists a single payload substring that remains unchanged in the mutation process and is unique enough to serve as a signature without false rejections.
    Announced as the 'basic assumption' of signature-based protection in Section III-E; if false, the signature producer cannot work.
  • domain assumption Mutated payloads derived from detected malicious inputs retain malicious characteristics with high likelihood.
    This is the 'fundamental insight' in the Introduction, used to justify generating new payloads from old positives rather than from scratch.
  • domain assumption The WAF can be modeled as a binary classifier over decoded payloads.
    The shadow model builder treats WAFs as binary classifiers (Section III-B) and assumes URL-decoding all malicious payloads preserves classification validity.

how reviews work

0 comments
Cite this review

Pith. "Pith review of WAFBOOSTER: Automatic Boosting of WAF Security Against Mutated Malicious Payloads." pith.science (2026). https://pith.science/paper/26U57TF2

@misc{pith2026250114008,
  author       = {Pith},
  title        = {Pith review of: WAFBOOSTER: Automatic Boosting of WAF Security Against Mutated Malicious Payloads},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/26U57TF2}},
  note         = {Machine review of arXiv:2501.14008}
}
read the original abstract

Web application firewall (WAF) examines malicious traffic to and from a web application via a set of security rules. It plays a significant role in securing Web applications against web attacks. However, as web attacks grow in sophistication, it is becoming increasingly difficult for WAFs to block the mutated malicious payloads designed to bypass their defenses. In response to this critical security issue, we have developed a novel learning-based framework called WAFBOOSTER, designed to unveil potential bypasses in WAF detections and suggest rules to fortify their security. Using a combination of shadow models and payload generation techniques, we can identify malicious payloads and remove or modify them as needed. WAFBOOSTER generates signatures for these malicious payloads using advanced clustering and regular expression matching techniques to repair any security gaps we uncover. In our comprehensive evaluation of eight real-world WAFs, WAFBOOSTER improved the true rejection rate of mutated malicious payloads from 21% to 96%, with no false rejections. WAFBOOSTER achieves a false acceptance rate 3X lower than state-of-the-art methods for generating malicious payloads. With WAFBOOSTER, we have taken a step forward in securing web applications against the ever-evolving threats.

Figures

Figures reproduced from arXiv: 2501.14008 by the authors.

Figure 1
Figure 1. Workflow of WAFBOOSTER that successfully bypass the shadow model are then evaluated against the real WAF. Payloads that evade detection by both systems are utilized by the signature producer to build a payload signature. This approach ensures that the shadow model accurately reflects the real WAF’s detection capabilities, and any discrepancies prompt updates to the shadow model for improved fidelity 7 . The signatur… view at source ↗
Figure 2
Figure 2. Example of scoring the token 1=1 in SELECT name FROM users WHERE user_id=1 or 1=1 #qwer. The WAF result is 1 if the blue and red parts differ, and 0 if they are the same. causing false rejections. This module takes in the bypassing malicious payloads against WAF, and generate rules to update the security policies for the given WAF. Finding important substrings. Considering a large search space, we aim to find the su… view at source ↗
Figure 3
Figure 3. TRR of original and generated payloads against SQL injection, cross-site scripting, and command injection attacks [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: FAR of SQLi payloads against Modsecurity and [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

77 extracted references · 60 canonical work pages

  1. [1]

    A survey on web application security,

    X. Li and Y . Xue, “A survey on web application security,” Nashville, TN USA , 2011

    work page 2011

  2. [2]

    2019 ntt global threat intelligence report

    NTTsecurity, “2019 ntt global threat intelligence report.”

    work page 2019

  3. [3]

    The introduction of web application firewall,

    “The introduction of web application firewall,” https://en .wikipedia.org/wiki/Web application firewall

    work page

  4. [4]

    Modsecurity,

    “Modsecurity,” https://github .com/SpiderLabs/ModSecurity

    work page

  5. [5]

    Evolutionary Multi-Task Injection Testing on Web Application Firewalls

    K. Li, H. Yang, and W. Visser, “Evolutionary multi-task injection testing on web application firewalls,” arXiv preprint arXiv:2206.05743 , 2022

    work page Pith review arXiv 2022

  6. [6]

    Owasp top ten,

    “Owasp top ten,” https://owasp .org/www-project-top-ten/

    work page

  7. [7]

    Fuse: finding file upload bugs via penetration testing,

    T. Lee, S. Wi, S. Lee, and S. Son, “Fuse: finding file upload bugs via penetration testing,” in Network and Distributed System Security (NDSS) Symposium , 2020

    work page 2020

  8. [8]

    Waf-a-mole: evading web application firewalls through adversarial machine learning,

    L. Demetrio, A. Valenza, G. Costa, and G. Lagorio, “Waf-a-mole: evading web application firewalls through adversarial machine learning,” in Annual ACM Sym- posium on Applied Computing (ACSAC) , 2020

    work page 2020

Show all 77 references
  1. [9]

    Automated testing for SQL injection vulnerabilities: an input mutation approach,

    D. Appelt, C. D. Nguyen, L. C. Briand, and N. Alshahwan, “Automated testing for SQL injection vulnerabilities: an input mutation approach,” in International Symposium on Software Testing and Analysis (ISSTA) , 2014

    2014

  2. [10]

    A machine-learning- driven evolutionary approach for testing web application firewalls,

    D. Appelt, C. D. Nguyen, A. Panichella, and L. C. Briand, “A machine-learning- driven evolutionary approach for testing web application firewalls,” IEEE Transac- tions on Reliability , 2018

    2018

  3. [11]

    Skyfire: data-driven seed generation for fuzzing,

    J. Wang, B. Chen, L. Wei, and Y . Liu, “Skyfire: data-driven seed generation for fuzzing,” in IEEE Symposium on Security and Privacy (S&P) , 2017

    2017

  4. [12]

    MOPT: optimized mutation scheduling for fuzzers,

    C. Lyu, S. Ji, C. Zhang, Y . Li, W. Lee, Y . Song, and R. Beyah, “MOPT: optimized mutation scheduling for fuzzers,” in USENIX Security Symposium , 2019

    2019

  5. [13]

    Web application attacks rise to account for almost half of all data breaches,

    “Web application attacks rise to account for almost half of all data breaches,” https://portswigger.net/daily-swig/web-application-attacks-rise-to-account-for- almost-half-of-all-data-breaches

  6. [14]

    Pkt-sin: A secure communication protocol for space information networks with periodic k- time anonymous authentication,

    Y . Yang, W. Xue, J. Sun, G. Yang, Y . Li, H. Pang, and R. H. Deng, “Pkt-sin: A secure communication protocol for space information networks with periodic k- time anonymous authentication,” IEEE Transactions on Information F orensics and Security, 2024

    2024

  7. [15]

    Privacy-aware and security-enhanced efficient matchmaking encryption,

    J. Sun, G. Xu, T. Zhang, X. Yang, M. Alazab, and R. H. Deng, “Privacy-aware and security-enhanced efficient matchmaking encryption,” IEEE Transactions on Information F orensics and Security, 2023

    2023

  8. [16]

    Ic3m: In- car multimodal multi-object monitoring for abnormal status of both driver and passengers,

    Z. Fang, Z. Lin, S. Hu, H. Cao, Y . Deng, X. Chen, and Y . Fang, “Ic3m: In- car multimodal multi-object monitoring for abnormal status of both driver and passengers,” arXiv preprint arXiv:2410.02592 , 2024

    2024 arXiv

  9. [17]

    Satsense: Multi-satellite collaborative framework for spectrum sensing,

    H. Yuan, Z. Chen, Z. Lin, J. Peng, Z. Fang, Y . Zhong, Z. Song, and Y . Gao, “Satsense: Multi-satellite collaborative framework for spectrum sensing,” IEEE Transactions on Cognitive Communications and Networking , 2024

    2024

  10. [18]

    Channel power gain estimation for terahertz vehicle-to-infrastructure networks,

    Z. Lin, L. Wang, J. Ding, B. Tan, and S. Jin, “Channel power gain estimation for terahertz vehicle-to-infrastructure networks,” IEEE Communications Letters , vol. 27, no. 1, pp. 155–159, 2022

    2022

  11. [19]

    Lcfed: An efficient clustered federated learning framework for heterogeneous data,

    Y . Zhang, H. Chen, Z. Lin, Z. Chen, and J. Zhao, “Lcfed: An efficient clustered federated learning framework for heterogeneous data,” arXiv preprint arXiv:2501.01850, 2025

    2025 arXiv

  12. [20]

    Tracking and transmission design in terahertz v2i networks,

    Z. Lin, L. Wang, J. Ding, Y . Xu, and B. Tan, “Tracking and transmission design in terahertz v2i networks,” IEEE Transactions on Wireless Communications , vol. 22, no. 6, pp. 3586–3598, 2022

    2022

  13. [21]

    Satfed: A resource-efficient leo satellite-assisted heterogeneous federated learning framework,

    Y . Zhang, Z. Lin, Z. Chen, Z. Fang, W. Zhu, X. Chen, J. Zhao, and Y . Gao, “Satfed: A resource-efficient leo satellite-assisted heterogeneous federated learning framework,” arXiv preprint arXiv:2409.13503 , 2024

    2024 arXiv

  14. [22]

    Fedsn: A federated learning framework over heterogeneous leo satellite networks,

    Z. Lin, Z. Chen, Z. Fang, X. Chen, X. Wang, and Y . Gao, “Fedsn: A federated learning framework over heterogeneous leo satellite networks,” IEEE Transactions on Mobile Computing , 2024

    2024

  15. [23]

    Demystifying the transferability of adversarial attacks in computer networks,

    E. Nowroozi, Y . Mekdad, M. H. Berenjestanaki, M. Conti, and A. E. Fergougui, “Demystifying the transferability of adversarial attacks in computer networks,” IEEE Transactions on Network and Service Management , 2022

    2022

  16. [25]

    Efficient privacy-preserving inference outsourcing for convolutional neural networks,

    X. Yang, J. Chen, K. He, H. Bai, C. Wu, and R. Du, “Efficient privacy-preserving inference outsourcing for convolutional neural networks,” IEEE Transactions on Information F orensics and Security, 2023

    2023

  17. [26]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy (S&P) , 2017

    2017

  18. [27]

    Privacy-preserving universal adversarial defense for black-box models,

    Q. Li, C. Wu, J. Chen, Z. Zhang, K. He, R. Du, X. Wang, Q. Zhao, and Y . Liu, “Privacy-preserving universal adversarial defense for black-box models,” arXiv preprint arXiv:2408.10647, 2024

    2024 arXiv

  19. [28]

    Adversarial examples for malware detection,

    K. Grosse, N. Papernot, P. Manoharan, M. Backes, and P. McDaniel, “Adversarial examples for malware detection,” inEuropean Symposium on Research in Computer Security (ESRCS) , 2017

    2017

  20. [29]

    Adversarial examples against the deep learning based network intrusion detection systems,

    K. Yang, J. Liu, C. Zhang, and Y . Fang, “Adversarial examples against the deep learning based network intrusion detection systems,” in IEEE Military Communi- cations Conference (MILCOM) , 2018

    2018

  21. [30]

    Toward robust detection of puppet attacks via characterizing fingertip-touch behaviors,

    C. Wu, K. He, J. Chen, Z. Zhao, and R. Du, “Toward robust detection of puppet attacks via characterizing fingertip-touch behaviors,” IEEE Transactions on Dependable and Secure Computing , 2022

    2022

  22. [31]

    Merit: Multimodal wearable vital sign waveform monitoring,

    Y . Tang, Z. Chen, A. Li, T. Zheng, Z. Lin, J. Xu, P. Lv, Z. Sun, and Y . Gao, “Merit: Multimodal wearable vital sign waveform monitoring,” arXiv preprint arXiv:2410.00392, 2024

    2024 arXiv

  23. [32]

    Caiauth: Context-aware implicit authentication when the screen is awake,

    C. Wu, K. He, J. Chen, R. Du, and Y . Xiang, “Caiauth: Context-aware implicit authentication when the screen is awake,” IEEE Internet of Things Journal , 2020

    2020

  24. [33]

    Icauth: Implicit and continuous authentication when the screen is awake,

    C. Wu, K. He, J. Chen, and R. Du, “Icauth: Implicit and continuous authentication when the screen is awake,” in Proc. of ICC , 2019

    2019

  25. [34]

    Convolutional neural networks for sentence classification,

    Y . Kim, “Convolutional neural networks for sentence classification,” arXiv preprint arXiv:1408.5882, 2014

    2014 arXiv

  26. [35]

    Malicious url sequence detection using event de-noising convo- lutional neural network,

    T. Shibahara, K. Yamanishi, Y . Takata, D. Chiba, M. Akiyama, T. Yagi, Y . Ohsita, and M. Murata, “Malicious url sequence detection using event de-noising convo- lutional neural network,” in IEEE International Conference on Communications (ICC), 2017

    2017

  27. [36]

    Efficient estimation of word representations in vector space,

    T. Mikolov, K. Chen, G. Corrado, and J. Dean, “Efficient estimation of word representations in vector space,” arXiv preprint arXiv:1301.3781 , 2013

    2013 arXiv

  28. [37]

    Deep api learning,

    X. Gu, H. Zhang, D. Zhang, and S. Kim, “Deep api learning,” in ACM SIGSOFT International Symposium on F oundations of Software Engineering (FSE) , 2016

    2016

  29. [38]

    Vuldeep- ecker: A deep learning-based system for vulnerability detection,

    Z. Li, D. Zou, S. Xu, X. Ou, H. Jin, S. Wang, Z. Deng, and Y . Zhong, “Vuldeep- ecker: A deep learning-based system for vulnerability detection,” in Network and Distributed System Security (NDSS) Symposium , 2018

    2018

  30. [39]

    N-gram-based text categorization,

    W. B. Cavnar, J. M. Trenkle et al. , “N-gram-based text categorization,” in Annual Symposium on Document Analysis and Information Retrieval , 1994. 13

    1994

  31. [40]

    Learning phrase representations using rnn encoder-decoder for statistical machine translation,

    K. Cho, B. Van Merri ¨enboer, C. Gulcehre, D. Bahdanau, F. Bougares, H. Schwenk, and Y . Bengio, “Learning phrase representations using rnn encoder-decoder for statistical machine translation,” arXiv preprint arXiv:1406.1078 , 2014

    2014 arXiv

  32. [41]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  33. [42]

    Liveness is not enough: Enhancing fingerprint authentication with behavioral biometrics to defeat puppet attacks,

    C. Wu, K. He, J. Chen, Z. Zhao, and R. Du, “Liveness is not enough: Enhancing fingerprint authentication with behavioral biometrics to defeat puppet attacks,” in Proc. of USENIX Security , 2020

    2020

  34. [43]

    Fast string correction with levenshtein automata,

    K. U. Schulz and S. Mihov, “Fast string correction with levenshtein automata,” International Journal on Document Analysis and Recognition , 2002

    2002

  35. [44]

    An efficient implementation of smith waterman al- gorithm on gpu using cuda, for massively parallel scanning of sequence databases,

    L. Ligowski and W. Rudnicki, “An efficient implementation of smith waterman al- gorithm on gpu using cuda, for massively parallel scanning of sequence databases,” in IEEE International Symposium on Parallel and Distributed Processing (IPDPS) , 2009

    2009

  36. [45]

    Github waf project,

    “Github waf project,” https://github .com/search?o=desc&q=waf&s=stars

  37. [46]

    “Naxsi,” https://github .com/nbs-system/naxsi

  38. [47]

    lua-resty-waf,

    “lua-resty-waf,” https://github .com/p0pr0ck5/lua-resty-waf

  39. [48]

    Safedog,

    “Safedog,” https://gitee .com/cc12655/safedog

  40. [49]

    “xwaf,” https://github .com/Alemalakra/xW AF

  41. [50]

    Openwaf,

    “Openwaf,” https://github .com/titansec/OpenW AF

  42. [51]

    Verynginx,

    “Verynginx,” https://github .com/alexazhou/VeryNginx

  43. [52]

    unixhot,

    “unixhot,” https://github .com/unixhot/waf

  44. [53]

    Http data set csic 2010,

    C. T. Gim ´enez, A. P. Villegas, and G. ´A. Mara ˜n´on, “Http data set csic 2010,” Information Security Institute of CSIC (Spanish Research National Council) , 2010

    2010

  45. [54]

    Ids2018,

    “Ids2018,” https://www .unb.ca/cic/datasets/ids-2018.html

    2018

  46. [55]

    Random query generator (with mariadb patches),

    “Random query generator (with mariadb patches),” https://github .com/MariaDB/ randgen

  47. [56]

    “sqlmap,” https://github .com/sqlmapproject/sqlmap

  48. [57]

    “Commix,” https://github .com/commixproject/commix

  49. [58]

    Xsstrike,

    “Xsstrike,” https://github .com/s0md3v/XSStrike

  50. [59]

    RAT: reinforcement-learning-driven and adaptive testing for vulnerability discovery in web application firewalls,

    M. Amouei, M. Rezvani, and M. Fateh, “RAT: reinforcement-learning-driven and adaptive testing for vulnerability discovery in web application firewalls,” IEEE Transactions on Dependable and Secure Computing (TDSC) , 2021

    2021

  51. [60]

    Adversarial texts with gradient methods,

    Z. Gong, W. Wang, B. Li, D. Song, and W.-S. Ku, “Adversarial texts with gradient methods,” arXiv preprint arXiv:1801.07175 , 2018

    2018 arXiv

  52. [61]

    Textbugger: generating adversarial text against real-world applications,

    J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: generating adversarial text against real-world applications,” in Network and Distributed System Security (NDSS) Symposium , 2019

    2019

  53. [62]

    Black-box generation of adver- sarial text sequences to evade deep learning classifiers,

    J. Gao, J. Lanchantin, M. L. Soffa, and Y . Qi, “Black-box generation of adver- sarial text sequences to evade deep learning classifiers,” arXiv preprint arXiv: 1801.04354, 2018

    2018 arXiv

  54. [63]

    Profuzzer: on-the-fly input type probing for better zero-day vulnerability discovery,

    W. You, X. Wang, S. Ma, J. Huang, X. Zhang, X. Wang, and B. Liang, “Profuzzer: on-the-fly input type probing for better zero-day vulnerability discovery,” in IEEE Symposium on Security and Privacy (S&P) , 2019

    2019

  55. [64]

    Recurrent neural networks for fuzz testing web browsers,

    M. Sablotny, B. S. Jensen, and C. W. Johnson, “Recurrent neural networks for fuzz testing web browsers,” in Information Security and Cryptology (ICISC) , 2018

    2018

  56. [65]

    Learn&fuzz: machine learning for input fuzzing,

    P. Godefroid, H. Peleg, and R. Singh, “Learn&fuzz: machine learning for input fuzzing,” in IEEE/ACM International Conference on Automated Software Engi- neering, 2017

    2017

  57. [66]

    Pushing large language models to the 6g edge: Vision, challenges, and opportunities,

    Z. Lin, G. Qu, Q. Chen, X. Chen, Z. Chen, and K. Huang, “Pushing large language models to the 6g edge: Vision, challenges, and opportunities,” arXiv preprint arXiv:2309.16739, 2023

    2023 arXiv

  58. [67]

    Agentscom- erge: Large language model empowered collaborative decision making for ramp merging,

    S. Hu, Z. Fang, Z. Fang, Y . Deng, X. Chen, Y . Fang, and S. Kwong, “Agentscom- erge: Large language model empowered collaborative decision making for ramp merging,” arXiv preprint arXiv:2408.03624 , 2024

    2024 arXiv

  59. [68]

    Lora: Low-rank adaptation of large language models,

    E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, and W. Chen, “Lora: Low-rank adaptation of large language models,” arXiv preprint arXiv:2106.09685, 2021

    2021 arXiv

  60. [69]

    Automated federated pipeline for parameter-efficient fine-tuning of large language models,

    Z. Fang, Z. Lin, Z. Chen, X. Chen, Y . Gao, and Y . Fang, “Automated federated pipeline for parameter-efficient fine-tuning of large language models,” arXiv preprint arXiv:2404.06448, 2024

    2024 arXiv

  61. [70]

    Splitlora: A split parameter-efficient fine-tuning framework for large language models,

    Z. Lin, X. Hu, Y . Zhang, Z. Chen, Z. Fang, X. Chen, A. Li, P. Vepakomma, and Y . Gao, “Splitlora: A split parameter-efficient fine-tuning framework for large language models,” arXiv preprint arXiv:2407.00952 , 2024

    2024 arXiv

  62. [71]

    An efficient privacy-aware split learning framework for satellite communications,

    J. Sun, C. Wu, S. Mumtaz, J. Tao, M. Cao, M. Wang, and V . Frascolla, “An efficient privacy-aware split learning framework for satellite communications,”IEEE Journal on Selected Areas in Communications , 2024

    2024

  63. [72]

    Split learning in 6g edge networks,

    Z. Lin, G. Qu, X. Chen, and K. Huang, “Split learning in 6g edge networks,” IEEE Wireless Communications, 2024

    2024

  64. [73]

    Fedac: A adaptive clus- tered federated learning framework for heterogeneous data,

    Y . Zhang, H. Chen, Z. Lin, Z. Chen, and J. Zhao, “Fedac: A adaptive clus- tered federated learning framework for heterogeneous data,” arXiv preprint arXiv:2403.16460, 2024

    2024 arXiv

  65. [74]

    Maglive: Near-field magnetic sensing-based voice liveness detection on smartphones,

    X. Sun, J. Chen, C. Wu, K. He, H. Xu, Y . Feng, R. Du, and X. Chen, “Maglive: Near-field magnetic sensing-based voice liveness detection on smartphones,” arXiv preprint arXiv:2404.01106, 2024

    2024 arXiv

  66. [75]

    Rethinking membership inference attacks against transfer learning,

    C. Wu, J. Chen, Q. Fang, K. He, Z. Zhao, H. Ren, G. Xu, Y . Liu, and Y . Xiang, “Rethinking membership inference attacks against transfer learning,” IEEE Transactions on Information F orensics and Security , 2024

    2024

  67. [76]

    Sok: Comprehensive security overview, challenges, and future directions of voice-controlled systems,

    H. Xu, C. Wu, Y . Gu, X. Shang, J. Chen, K. He, and R. Du, “Sok: Comprehensive security overview, challenges, and future directions of voice-controlled systems,” arXiv preprint arXiv:2405.17100 , 2024

    2024 arXiv

  68. [77]

    Earpass: Secure and implicit call receiver authentication using ear acoustic sensing,

    X. Sun, J. Chen, K. He, Z. He, R. Du, Y . Feng, Q. Zhao, and C. Wu, “Earpass: Secure and implicit call receiver authentication using ear acoustic sensing,” arXiv preprint arXiv:2404.15000, 2024

    2024 arXiv

  69. [78]

    Clad: Robust audio deepfake detection against manipulation attacks with contrastive learning,

    H. Wu, J. Chen, R. Du, C. Wu, K. He, X. Shang, H. Ren, and G. Xu, “Clad: Robust audio deepfake detection against manipulation attacks with contrastive learning,” arXiv preprint arXiv:2404.15854 , 2024

    2024 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.