| 2025 | SEKE | AePPollo: Automated Exploit Generation for Prototype Pollution Vulnerabilities in Node.js Application. | Wenya Wang, Wang Gao, Zhenghe Wang, Sicong Cao, Xingwei Lin, Dawu Gu |
| 2024 | ICSE | Coca: Improving and Explaining Graph Neural Network-Based Vulnerability Detection Systems. | Sicong Cao, Xiaobing Sun, Xiaoxue Wu, David Lo, Lili Bo, Bin Li, Wei Liu |
| 2023 | ICSE | Improving Java Deserialization Gadget Chain Mining via Overriding-Guided Object Generation. | Sicong Cao, Xiaobing Sun, Xiaoxue Wu, Lili Bo, Bin Li, Rongxin Wu, Wei Liu, Biao He, Yu Ouyang, Jiajia Li |
| 2023 | SP | ODDFuzz: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing. | Sicong Cao, Biao He, Xiaobing Sun, Yu Ouyang, Chao Zhang, Xiaoxue Wu, Ting Su, Lili Bo, Bin Li, Chuanlei Ma, Jiajia Li, Tao Wei |
| 2022 | ICSE | MVD: Memory-Related Vulnerability Detection Based on Flow-Sensitive Graph Neural Networks. | Sicong Cao, Xiaobing Sun, Lili Bo, Rongxin Wu, Bin Li, Chuanqi Tao |
| 2021 | QRS | GrasP: Graph-to-Sequence Learning for Automated Program Repair. | Ben Tang, Bin Li, Lili Bo, Xiaoxue Wu, Sicong Cao, Xiaobing Sun |