arXiv subjects

Sakuna Harinda Jayasundara

Publications and source records attributed to Sakuna Harinda Jayasundara.

4 recordsLinked to original sources

arXiv2026

Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use

Cryptographic API misuse in large language model-generated code can compromise software security. While many existing approaches improve code security by modifying model parameters or inputs, how representation changes associated with different cryptographic API repairs can support a shared intervention for safer code generation remains underexplored. To investigate this, we construct 48,000 matched program pairs across four programming languages and ten cryptographic API misuse categories. Each pair changes a specified API decision while preserving the programming task. Subtracting the misuse program's internal representation from its secure counterpart's gives a repair vector. Across five models, comparisons of mean repair vectors reveal stronger organization by misuse category than by language. These category-specific patterns also support a shared intervention. We introduce CrypSteer, which extracts a shared direction by normalizing repair differences and selecting a principal component aligned with repairs across misuse categories. With model weights fixed, adding one shared direction per model to its internal activations during generation improves aggregate target security rates by 5.28--15.00 percentage points over unsteered generation across languages and misuse categories. These findings connect the shared structure of cryptographic repair representations to a reusable intervention for safer code generation.

cs.CR↗

arXiv2026

From Retrieved Evidence to Security Outcomes: A Data-Driven Analysis of Java Security API Misuse in LLM-Generated Code

The misuse of Java security APIs is a serious security problem in software development. Large language models can generate compilable code, while still misusing cryptographic and secure-communication APIs. We investigate whether external security evidence can reduce this risk and how retriever choice and evidence source shape the resulting programs. Our study evaluates the GPT-5.5 model and Llama-3.3-70B-Instruct model on 12 Java Cryptography Architecture (JCA) and Java Secure Socket Extension (JSSE) security functionalities under 11 prompt and evidence conditions, yielding 23,760 generated programs. We measure program validity, detected Java security API misuse, and the top-5 evidence selected by four full-corpus retrievers. Under task-only prompting, 58.5% of valid Llama-3.3-70B-Instruct-generated programs and 36.6% of valid GPT-5.5-generated programs contain detected security API misuse. Dense full-corpus retrieval reduces conditional misuse among valid programs by 29.0--32.7 and 22.4--31.0 percentage points, respectively. The retrievers show preferences for substantially different evidence types. BM25 and the OpenAI embedding retrievers favor official guidance, the Qwen embedding retriever favors code examples, and the Jina embedding retriever selects a more heterogeneous mixture. Under source-restricted retrieval, code examples yield the lowest observed conditional misuse for the Llama-3.3-70B-Instruct model, while explicit misuse patterns produce zero detected misuse cases for known benchmark patterns among 1,016 valid programs generated by the GPT-5.5 model, with validity reduced to 94.1%. External evidence can substantially reduce detected misuse in the evaluated settings, and the results motivate actionable evidence selection and post-generation validation.

cs.CR↗

arXiv2024

RAGent: Retrieval-based Access Control Policy Generation

Manually generating access control policies from an organization's high-level requirement specifications poses significant challenges. It requires laborious efforts to sift through multiple documents containing such specifications and translate their access requirements into access control policies. Also, the complexities and ambiguities of these specifications often result in errors by system administrators during the translation process, leading to data breaches. However, the automated policy generation frameworks designed to help administrators in this process are unreliable due to limitations, such as the lack of domain adaptation. Therefore, to improve the reliability of access control policy generation, we propose RAGent, a novel retrieval-based access control policy generation framework based on language models. RAGent identifies access requirements from high-level requirement specifications with an average state-of-the-art F1 score of 87.9%. Through retrieval augmented generation, RAGent then translates the identified access requirements into access control policies with an F1 score of 77.9%. Unlike existing frameworks, RAGent generates policies with complex components like purposes and conditions, in addition to subjects, actions, and resources. Moreover, RAGent automatically verifies the generated policies and iteratively refines them through a novel verification-refinement mechanism, further improving the reliability of the process by 3%, reaching the F1 score of 80.6%. We also introduce three annotated datasets for developing access control policy generation frameworks in the future, addressing the data scarcity of the domain.

cs.CR↗

arXiv2023

SoK: Access Control Policy Generation from High-level Natural Language Requirements

Administrator-centered access control failures can cause data breaches, putting organizations at risk of financial loss and reputation damage. Existing graphical policy configuration tools and automated policy generation frameworks attempt to help administrators configure and generate access control policies by avoiding such failures. However, graphical policy configuration tools are prone to human errors, making them unusable. On the other hand, automated policy generation frameworks are prone to erroneous predictions, making them unreliable. Therefore, to find ways to improve their usability and reliability, we conducted a Systematic Literature Review analyzing 49 publications, to identify those tools, frameworks, and their limitations. Identifying those limitations will help develop effective access control policy generation solutions while avoiding access control failures.

cs.CR↗