{"id":"https://openalex.org/W4416360780","doi":"https://doi.org/10.1145/3744916.3773205","title":"Diffploit: Facilitating Cross-Version Exploit Migration for Open Source Library Vulnerabilities","display_name":"Diffploit: Facilitating Cross-Version Exploit Migration for Open Source Library Vulnerabilities","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W4416360780","doi":"https://doi.org/10.1145/3744916.3773205"},"language":"en","primary_location":{"id":"doi:10.1145/3744916.3773205","doi":"https://doi.org/10.1145/3744916.3773205","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3744916.3773205","pdf_url":null,"source":{"id":"https://openalex.org/S4210203175","display_name":"ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","issn_l":"0270-5257","issn":["0270-5257","1558-1225"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-2"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3744916.3773205","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100658149","display_name":"Zirui Chen","orcid":"https://orcid.org/0009-0004-4849-5003","observed_orcids":["https://orcid.org/0009-0004-4849-5003","https://orcid.org/0009-0004-6236-9150","https://orcid.org/0009-0007-3189-7147"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zirui Chen","raw_affiliation_strings":["The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0009-0004-6236-9150","affiliations":[{"raw_affiliation_string":"The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078400601","display_name":"Zhipeng Xue","orcid":"https://orcid.org/0000-0002-9060-4064","observed_orcids":["https://orcid.org/0000-0002-9060-4064"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhipeng Xue","raw_affiliation_strings":["The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-9060-4064","affiliations":[{"raw_affiliation_string":"The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012386754","display_name":"Jiayuan Zhou","orcid":"https://orcid.org/0000-0002-5181-3146","observed_orcids":["https://orcid.org/0000-0002-5181-3146"]},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Jiayuan Zhou","raw_affiliation_strings":["Queen's University, Kingston, Canada"],"raw_orcid":"https://orcid.org/0000-0002-5181-3146","affiliations":[{"raw_affiliation_string":"Queen's University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110924283","display_name":"Xing Hu","orcid":"https://orcid.org/0000-0003-0093-3292","observed_orcids":["https://orcid.org/0000-0003-0093-3292","https://orcid.org/0009-0001-8282-8009"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xing Hu","raw_affiliation_strings":["The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-0093-3292","affiliations":[{"raw_affiliation_string":"The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006669765","display_name":"Xin Xia","orcid":"https://orcid.org/0000-0002-6302-3256","observed_orcids":["https://orcid.org/0000-0002-6302-3256"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Xia","raw_affiliation_strings":["The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-6302-3256","affiliations":[{"raw_affiliation_string":"The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101577570","display_name":"Xiaohu Yang","orcid":"https://orcid.org/0000-0003-4111-4189","observed_orcids":["https://orcid.org/0000-0003-4111-4189"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaohu Yang","raw_affiliation_strings":["The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-4111-4189","affiliations":[{"raw_affiliation_string":"The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":15.7459,"has_fulltext":true,"cited_by_count":9,"citation_normalized_percentile":{"value":0.98744676,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"2224","last_page":"2236"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.8964999914169312,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.8964999914169312,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.03530000150203705,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.030300000682473183,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/breaking-changes","display_name":"breaking changes","score":0.5979999899864197}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.9556999802589417},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8138999938964844},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6807000041007996},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.6104999780654907},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.5940999984741211},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.5533999800682068},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.45730000734329224},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.4569000005722046},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.4163999855518341},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.36500000953674316},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.319599986076355},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.31450000405311584},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.311599999666214},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.3059000074863434},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2720000147819519},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.26969999074935913},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.26919999718666077},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.2680000066757202},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.26600000262260437},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.265500009059906},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.2531999945640564},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.25110000371932983},{"id":"https://openalex.org/C152752567","wikidata":"https://www.wikidata.org/wiki/Q116877","display_name":"Code refactoring","level":3,"score":0.25099998712539673}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3744916.3773205","doi":"https://doi.org/10.1145/3744916.3773205","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3744916.3773205","pdf_url":null,"source":{"id":"https://openalex.org/S4210203175","display_name":"ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","issn_l":"0270-5257","issn":["0270-5257","1558-1225"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-2"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2511.12950","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2511.12950","pdf_url":"https://arxiv.org/pdf/2511.12950","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2511.12950","doi":"https://doi.org/10.48550/arxiv.2511.12950","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2511.12950","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.1145/3744916.3773205","doi":"https://doi.org/10.1145/3744916.3773205","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3744916.3773205","pdf_url":null,"source":{"id":"https://openalex.org/S4210203175","display_name":"ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","issn_l":"0270-5257","issn":["0270-5257","1558-1225"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-2"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416360780.pdf","grobid_xml":"https://content.openalex.org/works/W4416360780.grobid-xml"},"referenced_works_count":58,"referenced_works":["https://openalex.org/W1753711502","https://openalex.org/W1989385531","https://openalex.org/W1990762361","https://openalex.org/W2005223977","https://openalex.org/W2025910764","https://openalex.org/W2103663553","https://openalex.org/W2158082837","https://openalex.org/W2741600166","https://openalex.org/W2766540688","https://openalex.org/W2951926492","https://openalex.org/W2954401434","https://openalex.org/W2957919018","https://openalex.org/W3036658711","https://openalex.org/W3121596715","https://openalex.org/W3195348753","https://openalex.org/W3214251355","https://openalex.org/W4210493608","https://openalex.org/W4238178744","https://openalex.org/W4284709537","https://openalex.org/W4285490369","https://openalex.org/W4308643127","https://openalex.org/W4308648311","https://openalex.org/W4313563416","https://openalex.org/W4377235553","https://openalex.org/W4379014622","https://openalex.org/W4384302744","https://openalex.org/W4384302745","https://openalex.org/W4384304763","https://openalex.org/W4384345694","https://openalex.org/W4385080372","https://openalex.org/W4387055195","https://openalex.org/W4388229767","https://openalex.org/W4388483130","https://openalex.org/W4390533936","https://openalex.org/W4391725287","https://openalex.org/W4394744182","https://openalex.org/W4394745126","https://openalex.org/W4394746930","https://openalex.org/W4394769042","https://openalex.org/W4394769379","https://openalex.org/W4396763775","https://openalex.org/W4399795583","https://openalex.org/W4400484796","https://openalex.org/W4400716830","https://openalex.org/W4402442680","https://openalex.org/W4402457491","https://openalex.org/W4402670356","https://openalex.org/W4403536249","https://openalex.org/W4403536371","https://openalex.org/W4403536700","https://openalex.org/W4407375771","https://openalex.org/W4408797770","https://openalex.org/W4409311382","https://openalex.org/W4411450043","https://openalex.org/W4411450131","https://openalex.org/W4411950895","https://openalex.org/W4415746291","https://openalex.org/W7106324058"],"related_works":["https://openalex.org/W7163990483","https://openalex.org/W7143287001","https://openalex.org/W6981722126","https://openalex.org/W4385080372","https://openalex.org/W3214251355","https://openalex.org/W7167268379","https://openalex.org/W6912597459","https://openalex.org/W7131240366","https://openalex.org/W7159925074","https://openalex.org/W4394769379"],"abstract_inverted_index":{"Exploits":[0],"are":[1,56],"commonly":[2],"used":[3],"to":[4,22,28,58,170],"demonstrate":[5],"the":[6,114,118,132,139,150,199,208],"presence":[7],"of":[8,164,229],"library":[9],"vulnerabilities":[10],"and":[11,46,60,77,117,134,142,167,186,207],"validate":[12],"their":[13,19],"impact":[14],"across":[15,95,190],"different":[16],"versions.":[17,96],"However,":[18],"direct":[20],"application":[21],"alternative":[23],"versions":[24,239],"often":[25,85],"fails":[26],"due":[27],"breaking":[29],"changes":[30,39,94],"introduced":[31],"during":[32],"evolution.":[33],"These":[34],"failures":[35,173],"stem":[36],"from":[37,127],"both":[38,75],"in":[40,211,240],"triggering":[41,92],"conditions":[42],"(e.g.,":[43,50],"API":[44],"refactorings)":[45],"broken":[47],"dynamic":[48],"environments":[49],"build":[51],"or":[52],"runtime":[53],"errors),":[54],"which":[55,73,137,230],"challenging":[57],"interpret":[59],"adapt":[61],"manually.":[62],"Existing":[63],"techniques":[64],"primarily":[65],"focus":[66],"on":[67,178],"code-level":[68],"trace":[69],"alignment":[70],"through":[71,157],"fuzzing,":[72],"is":[74],"time-consuming":[76],"insufficient":[78],"for":[79],"handling":[80],"environment-level":[81],"failures.":[82],"Moreover,":[83],"they":[84],"fall":[86],"short":[87],"when":[88],"dealing":[89],"with":[90,223],"complicated":[91],"condition":[93],"To":[97],"overcome":[98],"this,":[99],"we":[100],"propose":[101],"Diffploit,":[102],"an":[103,154,158],"iterative,":[104],"diff-driven":[105],"exploit":[106],"migration":[107],"method":[108],"structured":[109],"around":[110],"two":[111],"key":[112],"modules:":[113],"Context":[115,122],"Module":[116,123,152],"Migration":[119,151],"Module.":[120],"The":[121],"constructs":[124],"contexts":[125],"derived":[126],"analyzing":[128],"behavioral":[129],"discrepancies":[130],"between":[131],"target":[133],"reference":[135],"versions,":[136],"capture":[138],"failure":[140],"symptom":[141],"its":[143],"related":[144],"diff":[145,165],"hunks.":[146],"Leveraging":[147],"these":[148],"contexts,":[149],"guides":[153],"LLM-based":[155],"adaptation":[156],"iterative":[159],"feedback":[160],"loop,":[161],"balancing":[162],"exploration":[163],"candidates":[166],"gradual":[168],"refinement":[169],"resolve":[171],"reproduction":[172],"effectively.":[174],"We":[175,234],"evaluate":[176],"Diffploit":[177,193,218],"a":[179],"large-scale":[180],"dataset":[181],"containing":[182],"102":[183],"Java":[184],"CVEs":[185],"689":[187],"version-migration":[188],"tasks":[189],"79":[191],"libraries.":[192],"successfully":[194],"migrates":[195],"84.2%":[196],"exploits,":[197],"outperforming":[198],"change-aware":[200],"test":[201],"repair":[202],"tool":[203,210],"TaRGET":[204],"by":[205,213],"52.0%":[206],"rule-based":[209],"IDEA":[212],"61.6%.":[214],"Beyond":[215],"technical":[216],"effectiveness,":[217],"identifies":[219],"5":[220],"CVE":[221],"reports":[222],"incorrect":[224],"affected":[225],"version":[226],"ranges,":[227],"three":[228],"have":[231],"been":[232],"confirmed.":[233],"also":[235],"discover":[236],"111":[237],"unreported":[238],"GitHub":[241],"Advisory":[242],"Database.":[243]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2025-11-19T00:00:00"}