The rapid integration of AI coding assistants into student workflows has fundamentally challenged the role of traditional programming assignments as a measure of individual understanding. Rather than attempting to prohibit these tools, we propose a pedagogical shift: from assessing the process of code creation to verifying a student's comprehension and ownership of their final submitted work. We present a fully automated pipeline that leverages a Large Language Model (LLM) to generate individualized, in-class quizzes with questions targeting specific segments of each student's own code. This approach compels students to engage deeply with their submissions, as they must be prepared to explain their logic and implementation choices. While students might rely too heavily on AI tools to complete out-of-class assignments, this method places the responsibility of understanding the code on the student. The instructor remains central to the process, reviewing the quizzes before distributing to the class, and hand-grading the quizzes to provide meaningful, nuanced feedback. This ensures both fairness and a human connection in the assessment loop.

A variety of factors, accelerated by rapid advances in generative AI, have prompted CS educators to reconsider traditional assessment methods. This year, our BoF expands beyond just oral assessment to consider broader alternative approaches such as oral exams, mastery assessment, assignment-specific evaluation, etc., and has expanded as the focus shifts toward measuring authentic proficiency while upholding academic integrity. This Birds of a Feather (BoF) session brings the CS education community together to share experiences, strategies, and concerns surrounding the evolution of assessment. Participation is encouraged from all experience levels, from those who have previously piloted novel alternative assessment methods, to those who are currently experimenting with the feasibility of non-traditional assessment, and especially those who are looking to engage in a conversation about the benefits and challenges of emerging practices. The BoF session will feature multiple ways for attendees to engage, including small-group discussion on topics such as scalability, academic integrity, oral assessment, and others. The goal of this BoF is to inspire future research (and connect active researchers) on alternative assessment methods, and create a community of practice around assessment in the age of AI. Results of the session will be compiled and shared with the community.

The rapid advancement of Large Language Models (LLMs) like ChatGPT has raised concerns among computer science educators about how programming assignments should be adapted. This paper explores the capabilities of LLMs (GPT-3.5, GPT-4, and Claude Sonnet) in solving complete, multi-part CS homework assignments from the SIGCSE Nifty Assignments list. Through qualitative and quantitative analysis, we found that LLM performance varied significantly across different assignments and models, with Claude Sonnet consistently outperforming the others. The presence of starter code and test cases improved performance for advanced LLMs, while certain assignments, particularly those involving visual elements, proved challenging for all models. LLMs often disregarded assignment requirements, produced subtly incorrect code, and struggled with context-specific tasks. Based on these findings, we propose strategies for designing LLM-resistant assignments. Our work provides insights for instructors to evaluate and adapt their assignments in the age of AI, balancing the potential benefits of LLMs as learning tools with the need to ensure genuine student engagement and learning.

Oral exams provide a compelling alternative to traditional evaluation methods, expanding or replacing traditional written work. Interest in oral exams is growing rapidly in computer science (CS) education due to shifts to remote learning and concerns around AI-supported programming. This Birds of a Feather (BoF) session is broadly applicable to many in the CS education community, whether they have previously tried oral exams, have concerns about the use of oral exams in CS education, or are curious to hear more about how oral exams might work. The BoF session will provide a forum to discover and discuss previous approaches to oral exams, dive into common themes of interest in small groups, and collectively identify promising future directions for oral exams in CS courses.

Oral exams are an inviting alternative to traditional paper-and-pencil exams. However, they are largely under-utilized in computer science education. In this report, we describe our design for comprehensive final oral exams in five software engineering class sections, across two different small institutions. We present our exam format and our subjective assessment of the exam format in assessing student knowledge as instructors. We also gather quantitative and qualitative data from student surveys. We surveyed students before and after the oral exam to assess their perceptions of it, including their predicted grade and their subjective opinions and experiences. Our work shows evidence that oral exams are effective and practical mechanisms for software engineering classes of a smaller size (approximately 20 students). Student survey responses indicated favorable feedback for our oral exam format; students viewed oral exams as a good assessment of their knowledge and useful beyond that individual class.

How should dynamic programming be taught to students experiencing it for the first time? Dynamic programming is a sophisticated programming technique that exercises many aspects of computer science in concert. Because of the deep technical complexity therein, building effective lessons is challenging. In this work we propose a worked example model for teaching dynamic programming that centers around a midterm exam in which the solutions are provided to the students weeks in advance. 35 students were surveyed about their experiences learning dynamic programming with and without this model.

An oral exam is an assessment approach involving verbal explanations of key concepts or thought process to achieve a solution to a problem, sometimes accompanied by written or typed work. As a complement or refreshing alternative to standard written assessments, oral exams are being implemented in CS courses in a variety of formats. This Birds of a Feather (BoF) session will bring together the growing community of CS educators who have previously used oral exams and those interested in alternative assessment approaches to share ideas and discuss best practices. The discussion leaders represent a wide range of institutions and have varied previous expertise in the design, implementation, and study of oral exams in CS courses. The BoF session will involve (1) introduction to oral exams and previous approaches led by the discussion leaders, (2) small group discussions based on shared interests or concerns with oral exams, and (3) discussion of best practices for oral exams in CS courses.

This Research to Practice Work-In-Progress paper examines video lecture interactions and engagement boosting techniques. Posting video lectures online allows lecturers to extend their impact beyond the classroom. However, conventional video players may not be the best way to distribute lecture video content. When we looked at audience retention data for videos, we found that the watch patterns for lecture videos differed drastically from the watch patterns observed for non-lecture videos. In particular, we found that students were more likely to replay or skip sections of lecture videos than they were with non-lecture videos. Given these differences in viewing patterns, we created a new custom video player that is better suited for lectures to enhance student learning and to give instructors valuable feedback. Our custom video player has three main features: it logs student interactions to help instructors identify topics that students might struggle with, it allows students to search for key words in the video, and it has an integrated quiz tool to enhance active learning.

In the current state of communication technology, the abuse of VoIP has led to the emergence of telecommunications fraud. We urgently need an end-to-end identity authentication mechanism to verify the identity of the caller. This paper proposes an end-to-end, dual identity authentication mechanism to solve the problem of telecommunications fraud. Our first technique is to use the Hermes algorithm of data transmission technology on an unknown voice channel to transmit the certificate, thereby authenticating the caller’s phone number. Our second technique uses voice-print recognition technology and a Gaussian mixture model (a general background probabilistic model) to establish a model of the speaker to verify the caller’s voice to ensure the speaker’s identity. Our solution is implemented on the Android platform, and simultaneously tests and evaluates transmission efficiency and speaker recognition. Experiments conducted on Android phones show that the error rate of the voice channel transmission signature certificate is within 3.247 %, and the certificate signature verification mechanism is feasible. The accuracy of the voice-print recognition is 72%, making it effective as a reference for identity authentication.

Smartphones carry a plethora of sensitive and personally identifiable information (PII) such as email addresses, GPS coordinates, names, and phone numbers. A common occurrence in the design of many popular smartphone applications is to harvest this user data for consumer market analysis and targeted advertising. Transmitting sensitive PII data without the user's explicit knowledge has been given the name “information leakage Unfortunately, the permission systems employed by modern smartphone OSes are too coarse grained, presenting an “all or nothing” choice to users making it largely insufficient to defend against information leakage attacks. In this paper we propose a network-filtering based solution, which uses an entirely on-device VPN to capture and scan network packets for PII data. Our novelty is a specially designed string searching algorithm used to scan network packets, and a Naive Bayes classifier to learn and predict the user's desired action when information leakage occurs. We evaluate and compare our work to other recent literature. We achieve 2MB/s throughput with our string searching algorithm and ~66% accuracy with our Naive Bayes classifier after building a training set of only 50 observations.

Over the past decade the pace of software publication has increased dramatically. Thanks to the advent of "app markets" software distribution on mobile devices is centralized and software updates are, by default, fully automated. In this work we study the pace of software updates on Android smart mobile devices. Specifically, we measure the rate at which users experience software updates, and the delay between the time an app update is made available, and when it is actually installed. Our data shows that, of the top 12 most popular apps in our dataset, over 10 of them are updated more frequently than once every two weeks. On average users install an update for at least one app every 56hrs.

Sharing small pieces of information, such as URLs, Internet of Things (IoT) commands, or encryption keys is an extremely common use case in IoT applications. These are examples of transient, spontaneous proximity networking, in which both the sender and receiver are physically co-located. In this paper, we aim to provide a mechanism for proximity networking based on very high-frequency sound waves emitted and captured by the speaker and microphone found on commodity smartphones. Our approach has several benefits over existing solutions including easy deployment, lower cost for manufacturers, and intuitive security guarantees based on the physical characteristics of ultrasound signals. We implement a software-based modem called “Hush,” which we provide in an open source library for use in Android applications. It is practically inaudible and fast, achieving an effective transmission rate of 4900 bits per second at an ideal distance of 5-20 cm.

Because of the smaller size of mobile devices, text entry with on-screen keyboards becomes inefficient. Therefore, we present CamK, a camera-based text-entry method, which can use a panel (e.g., a piece of paper) with a keyboard layout to input text into small devices. With the built-in camera of the mobile device, CamK captures images during the typing process and utilizes image processing techniques to recognize the typing behavior, i.e., extract the keys, track the user's fingertips, detect, and locate keystrokes. To achieve high accuracy of keystroke localization and low false positive rate of keystroke detection, CamK introduces the initial training and online calibration. To reduce the time latency, CamK optimizes computation-intensive modules by changing image sizes, focusing on target areas, introducing multiple threads, removing the operations of writing or reading images. Finally, we implement CamK on mobile devices running Android. Our experimental results show that CamK can achieve above 95 percent accuracy in keystroke localization, with only a 4.8 percent false positive rate. When compared with on-screen keyboards, CamK can achieve a 1.25X typing speedup for regular text input and 2.5X for random character input. In addition, we introduce word prediction to further improve the input speed for regular text by 13.4 percent.

While the Internet of Things (IoT) is making our lives much easier, managing the IoT becomes a big issue due to the huge number of connections, and the lack of protections for devices. Recent work shows that software-defined networking (SDN) has a great capability in automatically and dynamically managing network flows. Besides, switches in SDNs are usually powerful machines, which can be used as fog nodes simultaneously. Therefore, SDN seems a good choice for IoT-Fog networks. However, before deploying to IoT-Fog networks, the security of the OpenFlow channel between the controller and its switches need to be addressed. Since all the controller commands are sent through this channel, once compromised, the network will be completely controlled by an attacker. This is a disaster for both the network service providers and their customers. Previous works on SDN security either protect controllers themselves or make a strong assumption that the OpenFlow channel is already secured. Using TLS to encrypt the channel is not a “silver-bullet” solution due to the known TLS vulnerabilities. In this paper, we specifically investigate the potential threats of man-in-the-middle attacks on the OpenFlow control channel. We first introduce a feasible attack model in an IoT-Fog architecture, and then we implement attack demonstrations to show the severe consequences of such attacks. Additionally, we propose a lightweight countermeasure using Bloom filters. We implement a prototype for this method to monitor stealthy packet modifications. The result of our evaluation shows that our Bloom filter monitoring system is efficient and consumes few resources.

Securing a wireless channel between any two vehicles is a crucial component of vehicular networks security. This can be done by using a secret key to encrypt the messages. We propose a scheme to allow two cars to extract a shared secret from RSSI (Received Signal Strength Indicator) values in such a way that nearby cars cannot obtain the same key. The key is information-theoretically secure, i.e., it is secure against an adversary with unlimited computing power. Although there are existing solutions of key extraction in the indoor or low-speed environments, the unique channel conditions make them inapplicable to vehicular environments. Our scheme effectively and efficiently handles the high noise and mismatch features of the measured samples so that it can be executed in the noisy vehicular environment. We also propose an online parameter learning mechanism to adapt to different channel conditions. Extensive real-world experiments are conducted to validate our solution.

The record-and-replay approach for software testing is important and valuable for developers in designing mobile applications. However, the existing solutions for recording and replaying Android applications are far from perfect. When considering the richness of mobile phones' input capabilities including touch screen, sensors, GPS, etc., existing approaches either fall short of covering all these different input types, or require elevated privileges that are not easily attained and can be dangerous. In this paper, we present a novel system, called MobiPlay, which aims to improve record-and-replay testing. By collaborating between a mobile phone and a server, we are the first to capture all possible inputs by doing so at the application layer, instead of at the Android framework layer or the Linux kernel layer, which would be infeasible without a server. MobiPlay runs the to-be-tested application on the server under exactly the same environment as the mobile phone, and displays the GUI of the application in real time on a thin client application installed on the mobile phone. From the perspective of the mobile phone user, the application appears to be local. We have implemented our system and evaluated it with tens of popular mobile applications showing that MobiPlay is efficient, flexible, and comprehensive. It can record all input data, including all sensor data, all touchscreen gestures, and GPS. It is able to record and replay on both the mobile phone and the server. Furthermore, it is suitable for both white-box and black-box testing.

Smartphone users are often grouped to exchange files or perform collaborative tasks when meeting together. We argue that the location information of group members is critical to many mobile applications. Existing localization solutions mostly rely on anchor nodes or infrastructures to perform ranging and positioning. These approaches are inefficient for ad hoc scenarios. In this paper, we propose AMIL, an Acoustic Mobility-Induced TDoA (Time-Difference-of-Arrival)-based Localization scheme for smartphones. In AMIL, a smartphone user can use simple gestures (e.g., hold the phone and draw a triangle in the air) to quickly obtain the relative coordinates of neighboring mobile devices. We have implemented and evaluated AMIL on off-the-shelf smartphones. The field tests have shown that our scheme can achieve less than three degree orientation errors and can successfully build a simple map of 12 people in an office room with average error of 50cm.

We have seen an emerging trend towards wearables nowadays. In this paper, we focus on smart glasses, whose current interfaces are difficult to use, error-prone, and provide no or insecure user authentication. We thus present GlassGesture, a system that improves Google Glass through a gesture-based user interface, which provides efficient gesture recognition and robust authentication. First, our gesture recognition enables the use of simple head gestures as input. It is accurate in various wearer activities regardless of noise. Particularly, we improve the recognition efficiency significantly by employing a novel similarity search scheme. Second, our gesture-based authentication can identify owner through features extracted from head movements. We improve the authentication performance by proposing new features based on peak analyses, and employing an ensemble method. Last, we implement GlassGesture and present extensive evaluations. GlassGesture achieves a gesture recognition accuracy near 96%. For authentication, GlassGesture can accept authorized users in near 92% of trials, and reject attackers in near 99% of trials. We also show that in 100 trials imitators cannot successfully masquerade as the authorized user even once.

Due to the smaller size of mobile devices, on-screen keyboards become inefficient for text entry. In this paper, we present CamK, a camera-based text-entry method, which uses an arbitrary panel (e.g., a piece of paper) with a keyboard layout to input text into small devices. CamK captures the images during the typing process and uses the image processing technique to recognize the typing behavior. The principle of CamK is to extract the keys, track the user's fingertips, detect and localize the keystroke. To achieve high accuracy of keystroke localization and low false positive rate of keystroke detection, CamK introduces the initial training and online calibration. Additionally, CamK optimizes computation-intensive modules to reduce the time latency. We implement CamK on a mobile device running Android. Our experiment results show that CamK can achieve above 95% accuracy of keystroke localization, with only 4.8% false positive keystrokes. When compared to on-screen keyboards, CamK can achieve 1.25X typing speedup for regular text input and 2.5X for random character input.

The ability to attach external devices to smartphones has revolutionized the role of smartphones by extending their capabilities beyond the limitations of commodity hardware. Developing external attachments that allow smartphones to sense the depth of an area will facilitate the development of new immersive applications and technologies. In this paper, we propose a smartphone compatible SONAR ranging attachment and address the compatibility problem by proposing a hybrid hardware/software modulator that allows a digital sensor to communicate with a smartphone via the 3.5-mm headphone jack, found on most smartphones. We evaluate the proposed sensor using two metrics, accuracy and spatial resolution. We evaluate the accuracy of this system by measuring known distances with the sensor and comparing them. We measure the sensor's spatial resolution by using ranging information from the SONAR module along with the phone's gyroscope, accelerometer, and magnetometer to construct a two-dimensional map of a space.

The importance of random number generators (RNGs) to various computing applications is well understood. To ensure a quality level of output, high-entropy sources should be utilized as input. However, the algorithms used have not yet fully evolved to utilize newer technology. Even the Android pseudo RNG (APRNG) merely builds atop the Linux RNG to produce random numbers. This paper presents an exploratory study into methods of generating random numbers on sensor-equipped mobile and Internet of Things devices. We first perform a data collection study across 37 Android devices to determine two things-how much random data is consumed by modern devices, and which sensors are capable of producing sufficiently random data. We use the results of our analysis to create an experimental framework called SensoRNG, which serves as a prototype to test the efficacy of a sensor-based RNG. SensoRNG employs collection of data from on-board sensors and combines them via a lightweight mixing algorithm to produce random numbers. We evaluate SensoRNG with the National Institute of Standards and Technology statistical testing suite and demonstrate that a sensor-based RNG can provide high quality random numbers with only little additional overhead.

In recent years mobile smart devices such as tablets and smartphones have exploded in popularity. We are now in a world of ubiquitous smart devices that people rely on daily and carry everywhere. This is a fundamental shift for computing in two ways. Firstly, users increasingly place unprecedented amounts of sensitive information on these devices, which paints a precarious picture. Secondly, these devices commonly carry many physical world interfaces. In this paper, we propose information leakage malware, specifically designed for mobile devices, which uses covert channels over physical "real-world" media, such as sound or light. This malware is stealthy; able to circumvent current, and even state-of-the-art defenses to enable attacks including privilege escalation, and information leakage. We go on to present a defense mechanism, which balances security with usability to stop these attacks.

Mobile devices are now ubiquitous in the modern world. In this paper, we propose a novel and practical mobile-cloud platform for smart mobile devices. Our platform allows users to run the entire mobile device operating system and arbitrary applications on a cloud-based virtual machine. It has two design fundamentals. First, applications can freely migrate between the user's mobile device and a backend cloud server. We design a file system extension to enable this feature, so users can freely choose to run their applications either in the cloud (for high security guarantees), or on their local mobile device (for better user experience). Second, in order to protect user data on the smart mobile device, we leverage hardware virtualization technology, which isolates the data from the local mobile device operating system. We have implemented a prototype of our platform using off-the-shelf hardware, and performed an extensive evaluation of it. We show that our platform is efficient, practical, and secure.

As the ubiquity of smartphones increases we see an increase in the popularity of location based services. Specifically, online social networks provide services such as alerting the user of friend co-location, and finding a user's k nearest neighbors. Location information is sensitive, which makes privacy a strong concern for location based systems like these. We have built one such service that allows two parties to share location information privately and securely. Our system allows every user to maintain and enforce their own policy. When one party, (Alice), queries the location of another party, (Bob), our system uses homomorphic encryption to test if Alice is within Bob's policy. If she is, Bob's location is shared with Alice only. If she is not, no user location information is shared with anyone. Due to the importance and sensitivity of location information, and the easily deployable design of our system, we offer a useful, practical, and important system to users. Our main contribution is a flexible, practical protocol for private proximity testing, a useful and efficient technique for representing location values, and a working implementation of the system we design in this paper. It is implemented as an Android application with the Facebook online social network used for communication between users.

A crucial component of vehicular network security is to establish a secure wireless channel between any two vehicles. In this paper, we propose a scheme to allow two cars to extract a secret key from RSSI (Received Signal Strength Indicator) values in such a way that nearby cars cannot obtain the same secret. Our solution can be executed in noisy, outdoor vehicular environments. We also propose an online parameter learning mechanism to adapt to different channel conditions. We conduct extensive realworld experiments to validate our solution.