In the intelligence of social things (IoST) paradigm, where interconnected devices and social networks create a dynamic ecosystem, understanding information diffusion is essential. IoST integrates user interactions, device behaviors, and contextual factors, adding complexity to information networks and necessitating accurate prediction models. This work analyses user behavior in terms of both group and individual relationships and presents an information propagation prediction model that combines information propagation topology features with user relationship representations. Information diffusion prediction analyzes patterns of spread in networks to understand and forecast propagation processes. Existing studies emphasize social and dynamic influence relationships within user groups but often neglect user similarity in group relations and intrinsic factors affecting individual sharing decisions. To address these gaps, a novel model is proposed, combining user relationship representations and diffusion topological features. At the group level, a user cooccurrence graph captures similarity relationship, integrating these with diffusion topology to analyze group interactions. At the individual level, user-specific feature representations and influence factor vectors address intrinsic motivations for sharing. Experimental results validate the model’s efficacy, achieving performance improvements on public datasets. On the Memetracker dataset, the model increased MAP@k by 6.54% and hits@k by 2.75%, demonstrating its ability to capture both group and individual dynamics for enhanced diffusion prediction.

The concepts of software antipatterns and smells are foundational to understanding and improving software quality. However, their definitions often lack consistency and the boundaries between them frequently blur, leading to confusion in both academic and industrial contexts. This paper presents research in progress that focuses on understanding the differences and similarities between using the terms antipattern and smell. We briefly reviewed the literature to gather information about definitions, categories, and understanding between antipatterns and smells. The findings indicate that there exists a substantial difference between those terms that could influence the technical debt. Furthermore, practitioners and researchers seem to use both terms indistinctly, being “smell” the most popular; however, this ambiguity could bias practitioners away from an optimal solution.

Freeware is proprietary software that can be used free of charge. A popular vector for distributing freeware is download portals , i.e. websites that index, categorise, and host programs. Download portals can be abused to distribute potentially unwanted programs (PUP) and malware. The abuse can be due to PUP and malware authors uploading their ware, by benign freeware authors joining as affiliate publishers of pay‐per‐install (PPI) services and other affiliate programs, or by malicious download portal owners. The authors perform a systematic study of abuse in download portals. They build a platform to crawl download portals and apply it to download 191 K Windows freeware installers from 20 download portals. They analyse the collected installers and execute them in a sandbox to monitor their installation. They measure an overall ratio of PUP and malware between 8% (conservative estimate) and 26% (lax estimate). In 18 of the 20 download portals examined the amount of PUP and malware is below 9%. However, they also find two download portals exclusively used to distribute PPI downloaders. Finally, they detail different abusive behaviours that authors of undesirable programs use to distribute their programs through download portals.

Code signing is a solution to verify the integrity of software and its publisher's identity, but it can be abused by malware and potentially unwanted programs (PUP) to look benign. This work performs a systematic analysis of Windows Authenticode code signing abuse, evaluating the effectiveness of existing defenses by certification authorities. We identify a problematic scenario in Authenticode where timestamped signed malware successfully validates even after the revocation of their code signing certificate. We propose hard revocations as a solution. We build an infrastructure that automatically analyzes potentially malicious executables, selects those signed, clusters them into operations, determines if they are PUP or malware, and produces a certificate blacklist. We use our infrastructure to evaluate 356 K samples from 2006-2015. Our analysis shows that most signed samples are PUP (88%-95%) and that malware is not commonly signed (5%-12%). We observe PUP rapidly increasing over time in our corpus. We measure the effectiveness of CA defenses such as identity checks and revocation, finding that 99.8% of signed PUP and 37% of signed malware use CA-issued certificates and only 17% of malware certificates and 15% of PUP certificates have been revoked. We observe most revocations lack an accurate revocation reason. We analyze the code signing infrastructure of the 10 largest PUP operations exposing that they heavily use file and certificate polymorphism and that 7 of them have multiple certificates revoked. Our infrastructure also generates a certificate blacklist 9x larger than current ones.