{"id":"https://openalex.org/W7161607706","doi":"https://doi.org/10.48550/arxiv.2605.15569","title":"Detecting Privilege Escalation in Polyglot Microservices via Agentic Program Analysis","display_name":"Detecting Privilege Escalation in Polyglot Microservices via Agentic Program Analysis","publication_year":2026,"publication_date":"2026-05-15","ids":{"openalex":"https://openalex.org/W7161607706","doi":"https://doi.org/10.48550/arxiv.2605.15569"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.15569","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15569","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.15569","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136454031","display_name":"Penghui Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Penghui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136365129","display_name":"Hong Yau Chong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chong, Hong Yau","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136395438","display_name":"Yinzhi Cao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cao, Yinzhi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136430841","display_name":"Junfeng Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Junfeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9444000124931335,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9444000124931335,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.009600000455975533,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.005499999970197678,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/microservices","display_name":"Microservices","score":0.7641000151634216},{"id":"https://openalex.org/keywords/polyglot","display_name":"Polyglot","score":0.7477999925613403},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.5321999788284302},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.5170000195503235},{"id":"https://openalex.org/keywords/privilege","display_name":"Privilege (computing)","score":0.49959999322891235},{"id":"https://openalex.org/keywords/program-analysis","display_name":"Program analysis","score":0.45100000500679016},{"id":"https://openalex.org/keywords/programming-paradigm","display_name":"Programming paradigm","score":0.42829999327659607},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4174000024795532},{"id":"https://openalex.org/keywords/concurrency","display_name":"Concurrency","score":0.40959998965263367},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.39480000734329224}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8027999997138977},{"id":"https://openalex.org/C2778505942","wikidata":"https://www.wikidata.org/wiki/Q18344624","display_name":"Microservices","level":3,"score":0.7641000151634216},{"id":"https://openalex.org/C2780239667","wikidata":"https://www.wikidata.org/wiki/Q2102850","display_name":"Polyglot","level":2,"score":0.7477999925613403},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.5321999788284302},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.5170000195503235},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.49959999322891235},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.45100000500679016},{"id":"https://openalex.org/C34165917","wikidata":"https://www.wikidata.org/wiki/Q188267","display_name":"Programming paradigm","level":2,"score":0.42829999327659607},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.427700012922287},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4174000024795532},{"id":"https://openalex.org/C193702766","wikidata":"https://www.wikidata.org/wiki/Q1414548","display_name":"Concurrency","level":2,"score":0.40959998965263367},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.39480000734329224},{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.3702999949455261},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.36000001430511475},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.359499990940094},{"id":"https://openalex.org/C6377922","wikidata":"https://www.wikidata.org/wiki/Q302542","display_name":"Deontic logic","level":2,"score":0.3546999990940094},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3343999981880188},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.33320000767707825},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.3301999866962433},{"id":"https://openalex.org/C57041688","wikidata":"https://www.wikidata.org/wiki/Q220644","display_name":"Service-oriented architecture","level":3,"score":0.3287000060081482},{"id":"https://openalex.org/C91071405","wikidata":"https://www.wikidata.org/wiki/Q1413145","display_name":"Program slicing","level":3,"score":0.32670000195503235},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.31360000371932983},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.31220000982284546},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.30559998750686646},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.30410000681877136},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.30239999294281006},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.2919999957084656},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.2879999876022339},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.27900001406669617},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.2700999975204468},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.26809999346733093},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2623000144958496},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.2621000111103058},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.2558000087738037},{"id":"https://openalex.org/C47487241","wikidata":"https://www.wikidata.org/wiki/Q5227230","display_name":"Data access","level":2,"score":0.2506999969482422},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.2506999969482422},{"id":"https://openalex.org/C76518257","wikidata":"https://www.wikidata.org/wiki/Q271680","display_name":"Software framework","level":5,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.15569","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15569","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.15569","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15569","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.463261216878891,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Microservices":[0],"are":[1],"widely":[2],"adopted":[3],"in":[4,21,166],"modern":[5],"cloud":[6],"systems":[7],"due":[8,46],"to":[9,37,47,78,107,155,180],"their":[10],"scalability":[11],"and":[12,23,53,57,96,110,116,130,143,147,159,170,184],"fault":[13],"tolerance.":[14],"However,":[15],"microservice":[16,124],"architectures":[17],"introduce":[18],"significant":[19,164],"complexity":[20],"privilege":[22,29,140],"permission":[24,58],"control,":[25],"creating":[26],"risks":[27],"of":[28,134],"escalation":[30,141],"where":[31],"attackers":[32],"can":[33],"gain":[34],"unauthorized":[35],"access":[36],"resources":[38],"or":[39],"operations.":[40],"Detecting":[41],"such":[42],"vulnerabilities":[43,142],"is":[44],"challenging":[45],"complex":[48],"cross-service":[49],"interactions,":[50],"polyglot":[51],"codebases,":[52],"diverse":[54],"privileged":[55],"operations":[56],"checks.":[59],"We":[60,99,118,172],"present":[61],"Neo,":[62],"an":[63,84],"agentic":[64,160],"program":[65,76,157],"analysis":[66,77,90,158],"framework":[67],"that":[68,87,104],"combines":[69],"large":[70],"language":[71],"models":[72],"(LLMs)":[73],"with":[74],"classic":[75],"address":[79],"these":[80],"challenges.":[81],"Neo":[82,106,120,136,162],"leverages":[83],"LLM-based":[85],"agent":[86],"dynamically":[88],"generates":[89],"plans,":[91],"adapts":[92],"code":[93,101,112],"search":[94,102],"strategies,":[95],"validates":[97],"semantics.":[98],"develop":[100],"primitives":[103],"enable":[105],"perform":[108],"scalable":[109],"flexible":[111],"exploration":[113],"across":[114],"services":[115],"languages.":[117],"evaluated":[119],"on":[121,150],"25":[122],"open-source":[123],"applications":[125],"spanning":[126],"7":[127],"programming":[128],"languages":[129],"6.2":[131],"million":[132],"lines":[133],"code.":[135],"uncovered":[137],"24":[138],"zero-day":[139,190],"achieved":[144],"81.0%":[145],"precision":[146],"85.0%":[148],"recall":[149],"a":[151],"ground-truth":[152],"dataset.":[153],"Compared":[154],"existing":[156],"solutions,":[161],"demonstrated":[163],"improvements":[165],"both":[167],"detection":[168],"accuracy":[169],"scalability.":[171],"further":[173],"showcased":[174],"Neo's":[175],"extensibility":[176],"by":[177],"applying":[178],"it":[179],"other":[181],"application":[182],"domains":[183],"vulnerability":[185],"types,":[186],"uncovering":[187],"18":[188],"additional":[189],"vulnerabilities.":[191]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-19T00:00:00"}