Mobile devices have been and will be continuously prevalent as rich applications are provided for various demands. However, the mobile operating system lacks efficient malware detection tools, which puts personal data at risk. This paper presents MobiPCR, a trict, accurate, efficient mobile-oriented malware detection system. MobiPCR basically integrates a (n) (edge) cloud-based architecture, a powerful yet efficient machine learning-based detection model, and a neat detection process. We implemented the MobiPCR prototype system and conducted rigorous experiments to evaluate its performance from different perspectives. We implemented the MobiPCR prototype system on the Android platform (Installer Hooker part) considering that Android is an open-source platform that (i) can be easily modified and (ii) provides rich documentation. We used LineageOS 13 (a widespread Android distribution) to provide the necessary drivers to support communication and the camera for casual usage. Experimental results prove that MobiPCR can strictly and accurately detect malwares and outperform existing similar applications without extra operations.

Security is critical to networks, but TCP/IP-basedlegacynetworks are difficult to advance new security functions due to the use of costly inflexible hardware devices and error-prone network configurations. Recent literature explores the paradigm of consolidating security services with the forwarding functionality using Software-defined Networking (SDN). Existingfull SDNdeployment, replacing all legacy network devices with SDN devices, is cost-prohibitive. Whereas thehybrid SDNthat only upgrades partial legacy devices to SDN switches is considered practical. However, the challenge is to minimize threats and deployment expenses simultaneously under heterogeneous end-host businesses that have various importance. In this paper, we study the challenge and propose theEnd-host-importance-Aware secure service-enabled hybrid Sdn deplOymeNt (EASON)problem. We mathematically formulate the EASON problem as an integer programming problem, prove its non-polynomial time complexity, and propose a heuristic algorithm called BonSèc. We conduct rigorous simulations on real-world topologies and traces. Experimental results show that BonSèc achieves comparable security and cost performances to the optimal solution on small topologies. Meanwhile, it is scalable on larger topologies.

Heavy flow identification is essential for discovering potential adversarial activities in mobile edge networks. However, state-of-the-art falls short in accuracy with approximation algorithms and unbounded memory usages with precise measurement. To this end, we introduce BatchSketch, a "network - server" aligned solution to achieve both high accuracy and low memory usage. The intelligence behind is that BatchSketch first conducts coarse-grained filtering from the switch with bounded memory and computation resources, and it then sends the filtered flows to the RDMA-link attached server with plenty of memory for accurate measurement. Our primary experimental results indicate that the filter on the switch can filter 99% of non-heavy flows, remarkably reducing the memory usage for the measurement.

Software-Defined Networking (SDN), providing flexible controlling and monitoring mechanisms that simplifies network management, is becoming prevalent in recent years. However, replacing all legacy network devices with SDN-capable devices is cost-prohibitive. One practical approach for the SDN deployment is to incrementally upgrade a few legacy devices to SDN devices. The network, which consists of legacy and SDN devices, is called a hybrid SDN. Existing hybrid SDN deployment schemes do not consider the security impact of device deployment. They use the same type of devices to upgrade, and upgraded devices could be compromised if an attacker controls one SDN device by leveraging its vulnerabilities.In this paper, we consider this security issue in the hybrid SDN deployment and present the Secure and Cost-effective Switch Upgrade (SCESU) problem. The SCESU problem aims to upgrade a few network devices to satisfy the security requirement by using multiple SDN switch types with a minimal upgrade cost. The complexity of the SCESU problem comes from common vulnerabilities shared among different types of SDN devices and attack propagations among network nodes. To efficiently solve the problem, we propose the BAGUETTE algorithm to judiciously choose and upgrade critical legacy switches with selected SDN devices. Simulation results show that BAGUETTE achieves up to about 92.1% security enhancement compared with legacy network and reduces to 11.1% cost of the securest deployment.

Sensitive data protection is vital for mobile users. An effective way is to store sensitive data in the hidden volume of mobile devices with Plausibly Deniable Encryption (PDE) systems. Typically, PDE creates a hidden volume inside the outer volume. However, existing PDE systems could lose data, due to overriding the hidden volume, and significantly waste physical storage, because of the fixedly reserved area for the hidden volume. In this paper, we present MobiGyges to solve the above problems. MobiGyges leverages the Thin Pool to coordinate the storage allocation for both the outer volume and the hidden volume which avoids data override and prevents data loss. Moreover, it improves the storage efficiency by virtualizing the total physical storage into small storage blocks and utilizing the blocks for the outer volume and the hidden volume, which eliminates the reserved area. We implement MobiGyges prototype on Google Nexus 6P with LineageOS 13 operating system. Experimental results show that MobiGyges avoids data loss and improves storage utilization up to 31% compared with existing works.

No abstract available.

As the dominant mobile operating system in the markets of smartphones, Android platform is increasingly targeted by attackers. Besides, attackers often produce novel malware to bypass the conventional detection approaches, which are largely reliant on expert analysis to design the discriminative features manually. Therefore, more effective and easy-to-use approaches for detection of Android malware are in demand. In this paper, we design and implement EasyDefense, a lightweight defense system that is integrated with Android OS for easy and effective detection of Android malware utilizing machine learning methods and the ensemble of them. Besides universal static features such as permissions and API calls, EasyDefense also employs the N-gram features of operation codes (opcodes). These N-gram features are extracted and learnt automatically from raw data of applications. Experimental results on 204,650 applications show that users can easily and effectively protect the privacy and security on their smartphones through this system.

Currently, the smartphone has become an essential communication and amusement tool, which has strong computing power and a variety of functions. Especially, the market share of smartphone with android system account for 84% in 2016[1]. Under android system, a large of privacy data (e.g. photos or videos) are stored in external storage (emulated Sdcard storage), which can be accessed by installed apps. This not only results in privacy leakage but also incurs ransomware attack[2] (e.g. simplocker). Therefore, we present Sdguard, an app, can implement fine-grain permission control based on Linux DAC mechanism and detect ransomware which encrypts content of file stored in external storage or lock user screen. To install Sdguard app, we need to ensure that the smartphone has been rooted and use FUSE filesystem on external storage. During installing, sdcard daemon of android (i.e. FUSE daemon) is replaced by our customized sdcard daemon. After rebooting system, the customized daemon is loaded, and each component of Sdguard is running.

Applications in Android often have the ability of accessing sensitive resources on mobile devices. These resources have different levels of security and usage constraint in scenarios which have different requirements for privacy. Therefore, it is in demand for users to have fine-grained privacy protection and resources usage constraint that taking the context information into account, which is not supported by inherent access control mechanism of Android. To address these issues, we designed and implemented an enhanced context-aware adaptive access control system (EasyGuard) in Android to provide adaptive access control automatically when the specific context is detected according to the pre-configured policies. In addition, we developed an application to facilitate users that have little domain knowledge in android to configure policies reasonably. Experimental results show that users can easily protect their privacy, security and save energy of mobile devices through this system.

Service platforms have disadvantages such as they have long construction periods, low resource utilizations and isolated constructions. Migrating service platforms into clouds can solve these problems. The scalability is an important characteristic of service clouds. With the scalability, the service cloud can offer on-demand capacities to different services. In order to achieve the scalability, we need to know when and how to scale virtual resources assigned to different services. In this paper, a linear regression model is used to predict the workload. Based on this predicted workload, an auto-scaling mechanism is proposed to scale virtual resources at different resource levels in service clouds. The automatic scaling mechanism combines the real-time scaling and the pre-scaling. Finally experimental results are provided to demonstrate that our approach can satisfy the user SLA while keeping scaling costs low.

As cloud-based services become more numerous and dynamic, service deployment becomes more and more challenging. For the reason of economic, the service deployment strategy is crucial for maximize the system utility and profit gained. In this paper, considered both the cost and quality, the service deployment in cloud is modeled as a congestion game, where every service has several components is considered as a player and his strategy is to select the subset of resources to deploy his components. Based on the congestion game, a game theoretic method is proposed to optimize both the overall cost and quality. To solve the congestion game, efficient algorithms are proposed to achieve the equilibrium in polynomial time.

MapReduce is an important programming model for large-scale data-intensive applications such as web indexing, scientific simulation, and data mining. Hadoop is an open-source implementation of MapReduce enjoying wide adoption. Partition function is an important component of Hadoop which split outputs of maps into bulks that place the input data of reduces. Based on the assumptions that cluster nodes are homogeneous and perform work at roughly the same rate, its default partition function splits intermediate keys into reduces. However, in practice the homogeneity assumptions seldom hold and cluster nodes usually perform work at different rate. In this paper, we design a heterogeneity-load-aware partition function named proportional partition function (PPF). Besides the dynamic loading of cluster nodes, PPF considers the capacity diversity of cluster nodes such as CPU processing speed and disk writing speed.

During the design procedure of BPEL (Business Process Execution Language) processes, there may be control dependency deadlocks among the activities in BPEL. We design a novel Agree/Refuse Matrix (ARM) to real-timely detect control dependency deadlocks. Online detection approach can be integrated into Active BPEL Designer to extend their functions and improve the accuracy of BPEL processes. Most importantly, this method's real-time property can help avoiding detecting the whole process from scratch caused by process's partial modifications.

In order to naturally incorporate the information provided by Web services into the data integration systems, we propose a novel model, uniform query, to uniformly describe the data query/view and the semantic of information-providing Web services. With the proper matching algorithm we have implemented a prototype in which Web services act as normal data sources (e.g. RDF datasets), and data queries could be answered through dynamic invocation of matched services.

With the wide application of Web services, its performance has caused the extensive concern and becomes one of the key factors of determining whether it is widely applied further. Based on the idea of differentiating Web services, the paper presents a SLA-based Web services performance guarantee model to improve Web services runtime environment, and expatiates on the key techniques of realizing the model: the request class utility function, the predicting model of response time, the genetic algorithm-based resource allocation and the dynamic weight-based weighted round-robin scheduling algorithm. Experiments prove the model can guarantee the response performance of Web services requests and improve the stability of the system.

Goal Web services description languages and service discovery algorithms are two keys to deal with the service discovery problem. Based on the analysis of the current Web services description languages, the paper designs a goal Web services description ontology which can depict the functional features, the performance features and the semantic features of Web services. On the principle of enhancing efficiency and quality of the service discovery, the paper presents a Web services feature elements-based service discovery model, and implements a prototype system in the tourist domain

With the development of Web service, it is critical to compose existing Web services dynamically based on the need of users. This paper analyzes semantic association between services and proposes a dynamic Web service composition approach based on dynamic semantic association between services (DSAC). DSAC discovers the dynamic semantic of services when they are executing, integrates IO interface-match method and services' semantic relation ontology to get candidate successive services. This semi-automatically method could get an optimized service matchmaking results, ensure efficiency while composing services. The prototype and experiments show that DSAC can help user select proper services simply and is quite feasible for solving problems with real world sizes