Conference:
2nd Workshop on Whole-Lifecycle Security for Smart Systems: Methods and Tools (LIFESEC 2026), collocated with the 12th IEEE International Conference on Smart Computing (SmartComp 2026)
22. June 2026, Messina, Italy

Authors:
Voulkopoulou A, Kalouptsoglou I, Kehagias D, Tzovaras D.

Abstract:
Nowadays, software security is considered an important aspect of the software quality of a project and, therefore, security testing is a critical part of the software development life-cycle. Various techniques have been proposed for the identification of vulnerabilities that reside in the source code, from traditional static analysis to emerging machine learning techniques. However, important challenges persist, such as the categorization of the detected vulnerabilities. Software vulnerability categorization to specific Common Weakness Enumeration (CWE) categories is crucial for interpreting the scope and  potential impact of detected weaknesses and for effective remediation. In this paper, we study multi-class CWE-ID classification from vulnerable C/C++ functions in the Big-Vul dataset, focusing on how code context affects performance. Specifically, we compare function level input, vulnerable-lines input, and their combination. Results show that by providing the vulnerable lines the predictive performance is improved, while the combination of vulnerable lines and the surrounding function code yields even more accurate categorization. Moreover, we propose a dual-encoder architecture hat processes function bodies and vulnerable lines separately before joint learning, achieving further improvement.

Conference:
International Joint Conference on Neural Networks (IJCNN)
21-26. June 2026, Maastricht, Netherlands

Authors:
Siavvas M, Kalouptsoglou I, Kehagias D, Tzovaras D.

Abstract:

The increasing integration of artificial intelligence (AI), and particularly machine learning (ML), into software intensive systems raises security concerns for AI/ML-specific code. Although AI-based vulnerability detection models (VDMs) achieve accurate prediction on contemporary software, their cross-domain effectiveness on AI/ML-specific software remains underexplored due to limited labeled data. To fill this gap, in this paper we aim to examine whether VDMs trained on contemporary software can accurately detect vulnerabilities in AI/ML-specific software as well, and to assess how domain adaptation can affect their performance. We construct a dataset of vulnerable and non-vulnerable Python functions split into contemporary and AI/ML-specific subsets, fine-tune CodeBERT and CodeGPT on the contemporary subset, and evaluate them on the AI/ML subset. We then perform gradual adaptation by adding 5%, 10%, 15%, 20%, 25%, 40%, and 50% target domain samples. We also analyze representation drift with UMAP and attention drift via self-attention-based explainability. Results suggest that AI-based VDMs built on contemporary software cannot be used effectively on AI/ML-specific software without proper domain adaptation, indicating that AI/ML-specific software exhibits unique characteristics; however, even a small moderate amount of domain-specific data can enable satisfactory cross-domain detection accuracy.

Conference:
IEEE International Conference on Cyber Security and Resilience (IEEE CSR 2026)
3-5. August 2026, Lisbon, Portugal

Authors:
Agbo E, Astekin M, Nguyen P, Goknil A.

Abstract:
Static Application Security Testing (SAST) tools are widely used in DevSecOps pipelines, but their effectiveness is often limited by brittle rule specifications, high false-positive rates, and limited contextual understanding of library and API usage. These challenges are particularly pronounced in dynamically typed languages such as Python, where manually curated source–sink specifications are difficult to maintain. We present Context Guardian, a hybrid vulnerability detection framework that integrates Large Language Models (LLMs) with static taint analysis to improve context-aware security analysis of Python applications. Context Guardian infers candidate source and sink nodes by analyzing import–attribute usage patterns extracted from the program’s abstract syntax tree and classifying them using LLM reasoning. A static taint analysis engine then discovers potential data flows, after which an LLM performs semantic triage to filter benign flows and retain high-confidence vulnerabilities. This design combines the scalability of static analysis with the contextual reasoning capabilities of LLMs. We evaluate Context Guardian on a benchmark of Python projects containing paired vulnerable and hardened implementations across four OWASP Top 10 injection-related weaknesses (CWE-78, CWE-79, CWE-89, and CWE-94). The results show that Context Guardian achieves higher precision, recall, and F1-score than three widely used SAST tools (CodeQL, Bandit, and Snyk) while substantially reducing false positives.

Conference:
5^th International Workshop on Architecting and Engineering Digital Twins (AEDT), co-located with the 23^rd IEEE International Conference on Software Architecture (ICSA)
22-26. June 2026, Amsterdam, Netherlands

Authors:
Truong L, Nguyen P.

Abstract:
This paper presents a conceptual view on a data platform of a distributed digital twin (DT) architecture for edgecloud software systems, of which entities are provided and built by multiple stakeholders in a supply chain. We focus on exploring data platform approaches for DTs to support security-based assurance development and operation activities in an integrated manner by considering a holistic view of data, AI/ML models and service-based components as part of the edge-cloud software.

Journal:
Automated Software Engineering, Volume 33, 2026

Authors:
Nguyen P, Rauniyar A, Bartel J, Laufer J, Dalamagkas C, Pohl K.

Abstract:
The more critical infrastructures (CIs) being digitized, the more vulnerable they are regarding cyber security attacks. Digitisation-leveraging technologies in the Inter­net of Things (IoT) and Cyber-Physical Systems (CPS) have been largely adopted for CIs, along with the Digital Twin (DT) paradigm. However, the distributed and heterogeneous nature of IoT or CPS poses significant challenges in safeguarding against diverse attack surfaces, including physical devices, network infrastructures, and third-party integration. To tackle these challenges, we propose an AI-driven DT-based security orchestration automation and response framework (SOAR4BC). Gathering system contexts from the DT in combination with security intelligence from the security tools gives us a holistic context for SOAR, which has not been seen in the existing approaches. We leverage this holistic context into the decision-making core, which utilizes advanced algorithms, like deep reinforcement learning, to generate adaptation recommendations based on incident alerts, risk assessments, and system state observations. By rigorously evaluating tampered data and distrib­uted denial of service (DDoS) scenarios, we validate the SOAR4BC framework’s efficacy in handling security incidents leveraging digital twin environments. We further demonstrate real-world applicability through false-data injection and DoS attacks on an operational electric-vehicle charging testbed, confirming the practical effectiveness of SOAR4BC in securing critical infrastructures. Together, these re­sults establish SOAR4BC as a robust and explainable AI-driven SOAR framework that advances the use of digital twins for cybersecurity in IoT and CPS ecosystems, offering actionable contributions for both research and industrial deployment.