41.6%的开源研究代码存在安全风险，需警惕滥用隐患。
On the Security of Research Artifacts
- 构建上下文感知安全评估体系，识别真实攻击向量。
- 分析509个顶会安全类项目，41.6%存在可被利用的安全缺陷。
- 提出SAFE框架，自动判别风险真伪，准确率达84.8%。
研究型成果常通过共享代码、数据等资源促进可复现性，学术会议中的成果评估（AE）也普遍开展。但现有评估主要关注能否复现，忽视潜在安全风险。这些公开发布的研究资源可能被误用或恶意利用，带来安全隐患。我们分析了来自顶级安全会议的509个研究资源，发现大量代码包含不安全模式，可能引入实际攻击路径。为此，我们提出一种上下文感知的安全评估分类法，结合静态分析与人工过滤，识别真实风险。结果显示，在实际使用中，41.60%的常见问题可能构成安全威胁。为实现高效分析，我们设计了首个面向可复现性评估的安全感知框架SAFE，能综合代码语义、运行上下文与可利用性判断风险真伪。SAFE在区分安全与非安全风险上达到84.80%准确率和84.63% F1值。研究证明，安全应成为负责任共享研究资源的重要考量。源码已公开于：https://github.com/nanda-rani/SAFE
原文摘要 · Abstract (English)
Research artifacts are widely shared to support reproducibility, and artifact evaluation (AE) has become common at many leading conferences. However, AE mainly checks whether artifacts work as claimed and can be reproduced. It largely overlooks potential security risks. Since these artifacts are publicly released and reused, they may unintentionally create opportunities for misuse and raise concerns about safe and responsible sharing. We study 509 research artifacts from top-tier security venues and find that many contain insecure code patterns that may introduce potential attack vectors. We propose a taxonomy for context-aware security assessment to enable structured analysis of such risks. We perform static analysis and examine the resulting findings, filtering false positives and identifying real security risks. Our analysis shows that 41.60% of the prevalent findings may pose security concerns under practical usage. To support scalable analysis, we introduce SAFE (Security-Aware Framework for Artifact Evaluation), a first step toward an autonomous framework that analyzes tool-reported findings by considering code semantics, execution context, and practical exploitability. SAFE achieves 84.80% accuracy and 84.63% F1-score in distinguishing security and non-security risks. Overall, our results show that security is also important in AE for promoting safe and responsible research sharing. The source code is available at: https://github.com/nanda-rani/SAFE
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。