{"id":"https://openalex.org/W7161791723","doi":"https://doi.org/10.48550/arxiv.2605.19668","title":"SCARA: A Semantics-Constrained Autonomous Remediation Agent for Opaque Industrial Software Vulnerabilities","display_name":"SCARA: A Semantics-Constrained Autonomous Remediation Agent for Opaque Industrial Software Vulnerabilities","publication_year":2026,"publication_date":"2026-05-19","ids":{"openalex":"https://openalex.org/W7161791723","doi":"https://doi.org/10.48550/arxiv.2605.19668"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.19668","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19668","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.19668","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5084699408","display_name":"Bowei Ning","orcid":"https://orcid.org/0000-0003-4553-9096"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ning, Bowei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012086248","display_name":"Xuejun Zong","orcid":"https://orcid.org/0009-0000-0084-2775"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zong, Xuejun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101746406","display_name":"Lian Lian","orcid":"https://orcid.org/0000-0002-5093-2450"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lian, Lian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136509336","display_name":"Kan He","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"He, Kan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017571459","display_name":"Guogang Wang","orcid":"https://orcid.org/0000-0002-8767-9567"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Guogang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136540899","display_name":"Yifei Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, Yifei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136561809","display_name":"Jinyang Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Jinyang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.2833999991416931,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.2833999991416931,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.21619999408721924,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.1673000007867813,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/correctness","display_name":"Correctness","score":0.781499981880188},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.5412999987602234},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5335000157356262},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.5099999904632568},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5033000111579895},{"id":"https://openalex.org/keywords/scara","display_name":"SCARA","score":0.4507000148296356}],"concepts":[{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.781499981880188},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6179999709129333},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.5412999987602234},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5335000157356262},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.5099999904632568},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5033000111579895},{"id":"https://openalex.org/C158732272","wikidata":"https://www.wikidata.org/wiki/Q1484792","display_name":"SCARA","level":3,"score":0.4507000148296356},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.38179999589920044},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.3303000032901764},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.3197999894618988},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3165000081062317},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3028999865055084},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2985000014305115},{"id":"https://openalex.org/C92991967","wikidata":"https://www.wikidata.org/wiki/Q7644329","display_name":"Supervisory control","level":3,"score":0.2897000014781952},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.2892000079154968},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.2727000117301941},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.2689000070095062},{"id":"https://openalex.org/C40842320","wikidata":"https://www.wikidata.org/wiki/Q19423","display_name":"Buffer overflow","level":2,"score":0.26330000162124634},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.26100000739097595}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.19668","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19668","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.19668","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19668","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure","score":0.690373957157135}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Critical-infrastructure":[0],"operators":[1],"are":[2],"increasingly":[3],"expected":[4],"to":[5,100,204],"assess":[6],"and":[7,31,73,94,133,137,150,163,182],"remediate":[8],"vulnerabilities":[9],"in":[10],"deployed":[11],"industrial":[12,22,117,210],"software.":[13,211],"However,":[14],"much":[15],"of":[16,177],"this":[17],"software":[18,23],"exists":[19],"as":[20,179],"opaque":[21,209],"(OIS),":[24],"including":[25],"stripped":[26],"firmware,":[27,160],"proprietary":[28],"protocol":[29,129,161],"handlers,":[30,162],"compiled":[32],"control":[33],"logic":[34],"without":[35],"source":[36,58,135],"code,":[37,59],"symbols,":[38],"build":[39],"environments,":[40],"or":[41,64],"hardware":[42],"interfaces.":[43],"While":[44],"binary":[45,97,131,201],"analysis":[46],"can":[47],"identify":[48],"vulnerability":[49,98,202],"candidates,":[50],"existing":[51],"automated":[52],"repair":[53],"systems":[54],"largely":[55],"rely":[56],"on":[57],"compilable":[60],"artifacts,":[61,165],"sanitizer":[62],"feedback,":[63],"instrumentable":[65],"builds,":[66],"leaving":[67],"a":[68,80,90,105,115,156],"gap":[69],"between":[70],"binary-level":[71],"discovery":[72],"validated":[74,102,206],"remediation.":[75],"This":[76],"paper":[77],"presents":[78],"SCARA,":[79],"Semantics-Constrained":[81],"Autonomous":[82],"Remediation":[83],"Agent":[84],"for":[85,208],"OIS.":[86],"SCARA":[87,166,193],"operates":[88],"under":[89],"source-unavailable":[91],"defender":[92],"model":[93],"connects":[95,200],"upstream":[96],"candidates":[99,113,203],"conditionally":[101,205],"remedies":[103],"through":[104],"four-stage":[106],"pipeline.":[107],"Operational-state-aware":[108],"verification":[109],"(OSVA)":[110],"filters":[111],"infeasible":[112],"using":[114],"nine-component":[116],"state":[118],"model;":[119],"remediation":[120,185,207],"synthesis":[121],"(RSA)":[122],"selects":[123],"the":[124,195],"strongest":[125],"available":[126],"remedy":[127],"across":[128],"mitigation,":[130],"hardening,":[132],"SSCKG-constrained":[134],"patches;":[136],"correctness":[138,143],"validation":[139],"(CVA)":[140],"provides":[141],"conditional":[142],"evidence":[144],"via":[145],"behavioral-coverage":[146],"preservation,":[147],"independent":[148],"replay,":[149],"typed":[151],"rejection":[152],"feedback.":[153],"On":[154],"OIS-RemedBench,":[155],"15-case":[157],"benchmark":[158],"spanning":[159],"ICS/PLC":[164],"achieves":[167],"observed":[168],"100%":[169],"precision":[170],"with":[171],"no":[172],"false":[173],"positives,":[174],"refutes":[175],"20.0%":[176],"cases":[178],"operationally":[180],"infeasible,":[181],"reaches":[183],"88.9%":[184],"success":[186],"after":[187],"targeted":[188],"reruns.":[189],"To":[190],"our":[191],"knowledge,":[192],"is":[194],"first":[196],"end-to-end":[197],"framework":[198],"that":[199]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-21T00:00:00"}