Cross-market recommendation (CMR) faces severe challenges from distribution shifts between data-rich source markets and sparse target markets. Existing methods rely on a pre-training and fine-tuning paradigm for knowledge transfer, yet suffer from two key limitations: i) the objective gap between pre-training and full-parameter fine-tuning causes loss of generalized knowledge from source markets; ii) the high computational costs of extensive fine-tuning hinder scalability. To this end, we propose DCMPT, a novel Distilled Cross-Market Prompt-Tuning approach. DCMPT reframes the problem under a more efficient pre-training and prompt-tuning paradigm. Instead of full fine-tuning, we adapt a pre-trained universal backbone by freezing its weights and injecting a minimal set of learnable prompts to form a "student" model. To effectively optimize these prompts on sparse data, we introduce a novel teacher-student architecture: a specialized "teacher" model, trained exclusively on the target market, provides dense, market-specific supervision. This guidance is delivered via a dual distillation strategy designed to transfer global ranking patterns and adapt to local consumer tastes. Extensive experiments on real-world market datasets demonstrate that DCMPT significantly outperforms state-of-the-art methods, achieving superior target market performance with substantial parameter-efficiency.

Exergames can motivate sedentary individuals to adopt more active lifestyles, and VR implementations offer even greater engagement. However, VR exergames can also induce cybersickness, which may threaten long-term adherence. Since exercise and cybersickness share several physiological symptoms, it remains unclear whether increased exertion contributes to greater discomfort. This study examined whether exercise intensity affects cybersickness during VR cycling. Participants (N=24) completed three fixed-path sessions, each lasting 2.5 minutes, at no, light, and moderate exertion while providing real-time and post-session sickness ratings. No significant differences in cybersickness were observed across conditions. While the modest sample size and short exposure duration limit the strength of the conclusions, these findings suggest that, within short-duration fixed-motion VR cycling, light to moderate physical effort does not substantially alter reported cybersickness. This indicates that exercise intensity could be varied to support improved user outcomes without clear increases in discomfort under similar controlled conditions.

Teaching effective countermeasures against emerging threats and vulnerabilities in mobile applications has always been an important focus in cybersecurity curriculums. In this paper, we share our experience in developing a group project that allows students to apply techniques learned in a postgraduate cybersecurity course. The group project aims to simulate a real-world challenge in mobile cybersecurity. The project consists of three progressive stages:~Build, Fortify, and Attack. The project involves students building a chat application powered by Artificial Intelligence (AI), fortifying it against vulnerabilities, and then attempting to extract the Application Programming Interface (API) keys of other groups. We provide details of the design and outcomes, and reflect on what has worked for those who wish to adopt similar kinds of group assessments.

Student disengagement remains a persistent challenge in higher education. This paper presents Genius-Coin, an open-source, self-hostable blockchain courseware designed to promote student motivation and engagement through gamification and token-economy mechanisms. The system connects verifiable learning activities to digital rewards: classroom attendance is recorded through dynamic QR code scanning, while online participation from learning management and discussion platforms is also captured. Once participation is verified, digital tokens and achievement badges are automatically distributed through smart contracts and can later be redeemed for rewards through an online store. Designed for practical institutional use, Genius-Coin supports straightforward deployment on institutional servers and provides a dedicated wallet application that simplifies student onboarding. A pilot deployment with 65 postgraduate students suggests that the system fostered intrinsic engagement, as many students appeared more motivated to attend class and participate in course activities than to redeem tokens for external rewards; only 33.1% of distributed tokens were redeemed.

Dependencies between modules can trigger ripple effects when changes are made, making maintenance complex and costly, so minimizing these dependencies is crucial. Consequently, understanding what drives dependencies is important. One potential factor is code smells, which are symptoms in code that indicate design issues and reduce code quality. When multiple code smells interact through static dependencies, their combined impact on quality can be even more severe. While individual code smells have been widely studied, the influence of their interactions remains underexplored. In this study, we aim to investigate whether and how the distribution of static dependencies changes in the presence of code smell interactions. We conducted a dependency analysis on 116 open-source Java systems to quantify these interactions by comparing cases where code smell interactions exist and where they do not. Our results suggest that overall, code smell interactions are linked to a significant increase in total dependencies in 28 out of 36 cases, and that all code smells are associated with a consistent change direction (increase or decrease) in certain dependency types when interacting with other code smells. Consequently, this information can be used to support more accurate code smell detection and prioritization, as well as to develop more effective refactoring strategies.

Providing students with hands-on experience in kernel programming within a real-world operating system is highly beneficial in an Operating Systems (OS) course for teaching core operating system concepts and developing practical skills. However, accessing suitable devices for such hands-on experimentation poses significant challenges. Traditional solutions involve hosting virtual machines on cloud platforms, which are expensive and do not scale well with increasing student numbers. Additionally, many students' personal devices, such as Macs or iPads, have limited support for running Linux, creating further barriers. In this paper, we introduce KernelVM, a novel cost-effective platform that offers students a Linux virtual machine with full superuser access and pre-configured kernel programming toolchains. KernelVM is accessible via any modern browser on any device. It performs all computations locally within the user's browser, thus eliminating cloud computing costs. KernelVM provides a robust learning environment by incorporating interactive virtual hardware components and an automatic evaluation system, supporting a wide range of tasks, including multi-threaded cryptographic kernel modules and Linux drivers for hardware interaction. We detail the design of KernelVM, and describe our experiences incorporating it for the first time into an OS course with 159 undergraduate students. We found that KernelVM was instrumental in improving the quality and efficiency of hands-on learning experiences, with students reporting increased satisfaction and engagement due to the immediate feedback and the ability to experiment in a risk-free environment. Our experience suggests that KernelVM not only addresses the logistical challenges of kernel programming education, but it helps foster a highly interactive and engaging learning experience.

In-band Network Telemetry (INT) technology enables fine-grained network monitoring by encapsulating intra-switch network status into INT probes, which is essential in data center networks for ensuring Quality of Service (QoS). Existing INT-based telemetry systems leverage centralized controllers to compute non-overlapping probe paths, thereby facilitating lightweight and network-wide measurements. However, these systems fail to adapt effectively to network topology changes caused by link or device failures, primarily due to inflexible path planning under dynamic conditions. To address this problem, we propose INT-Source, a unified policy-based network-wide telemetry system for probing and forwarding. First, we design a data plane forwarding mechanism for INT probes to ensure telemetry coverage during topology changes and reduce telemetry overhead. Second, we design a probe packet structure and introduce a switch-based probe verification and discard mechanism to prevent redundant link probing. Third, we introduce two algorithms for INT-Source: a Single-Source algorithm to facilitate deployment and a Multi-Source algorithm to enable lightweight and scalable telemetry. Our evaluation shows that INT-Source reduces bandwidth overhead to 12.5% compared to existing methods across three network topologies. Even with a 10% link failure rate, INT-Source is able to monitor 93.1% of network ports, demonstrating strong robustness.

Despite extensive security research on various Android components, such as kernel or runtime, little attention has been paid to the proprietary vendor blobs within Android firmware. In this paper, we conduct a large-scale empirical study to understand the update patterns and assess the security implications of vendor blobs. We specifically focus on GPU blobs because they are loaded into every process for displaying graphics user interfaces and can affect the entire system’s security. We examine over 13,000 Android firmware releases between January 2018 and April 2024. Our results reveal that device manufacturers often neglect vendor blob updates. About 82% of firmware releases contain outdated GPU blobs (up to 1,281 days). A significant number of blobs also rely on obsolete LLVM core libraries released more than 15 years ago. To analyze their security implications, we develop a performant fuzzer that requires no physical access to mobile devices. We discover 289 security and behavioral bugs within the blobs. We also present a case study demonstrating how these vulnerabilities can be exploited via WebGL. This work underscores the critical security concerns associated with vulnerable vendor blobs and emphasizes the urgent need for timely updates from device manufacturers.

Although JavaScript (JS) has been widely used in mobile development, little is known about the security implications of utilizing JS engines shipped as native app libraries. In this paper, we conduct an empirical study by designing a JS-Inspector pipeline to identify the embedded JS engines in Android apps and assess their security. We investigate over 65,000 Android apps released between Jan 2018 and July 2023. The results show that many popular apps use embedded JS engines, and their engines remain outdated for extended periods. Moreover, approximately 85% of apps have not received updates since their initial release. As such, over 70% of the identified embedded engines are vulnerable to known exploits. We further present case studies of popular apps catering to millions of users. By exploiting their unpatched JS engines through various strategies, such as man-in-the-middle attacks, intent abuse, and malicious mini-apps, we can easily seize control of the targeted apps and execute arbitrary code. This work highlights critical security concerns associated with embedded JS engines. It emphasizes the urgency for timely updates and enhanced security measures during app development.

Technology integration in educational settings has led to the development of novel sensor-based tools that enable students to measure and interact with their environment. Although reports from using such tools can be positive, evaluations are often conducted under controlled conditions and short timeframes. There is a need for longitudinal data collected in realistic classroom settings. However, sustained and authentic classroom use requires technology platforms to be seen by teachers as both easy to use and of value. We describe our development of a sensor-based platform to support science teaching that followed a 14-month design process. We share insights from this design and development approach, and report findings from a six-month large-scale evaluation involving 35 schools and 1245 students. We share lessons learnt, including that technology integration is not an educational goal per se and that technology should be a transparent tool to enable students to achieve their learning goals.

Researchers have used machine learning approaches to identify motion sickness in VR experience. These approaches would certainly benefit from an accurately labeled, real-world, diverse dataset that enables the development of generalizable ML models. We introduce 'VR.net', a dataset comprising 165-hour gameplay videos from 100 real-world games spanning ten diverse genres, evaluated by 500 participants. VR.net accurately assigns 24 motion sickness-related labels for each video frame, such as camera/object movement, depth of field, and motion flow. Building such a dataset is challenging since manual labeling would require an infeasible amount of time. Instead, we implement a tool to automatically and precisely extract ground truth data from 3D engines' rendering pipelines without accessing VR games' source code. We illustrate the utility of VR.net through several applications, such as risk factor detection and sickness level prediction. We believe that the scale, accuracy, and diversity of VR.net can offer unparalleled opportunities for VR motion sickness research and beyond.We also provide access to our data collection tool, enabling researchers to contribute to the expansion of VR.net.

Many web applications have adopted WebAssembly thanks to its near-native performance and high portability. However, as a WebAssembly application grows complex, it starts suffering from bloated file size and extensive startup time. This leads to poor usability, especially on low-end devices. Existing works attempt to address this issue by refactoring the codebase into several smaller shared libraries and dynamically linking them on demand. However, this approach requires source code access and extensive human effort, which are not always feasible. In this work, we present WasmSlim, a novel web server middleware that optimizes WebAssembly binary distribution without needing source code and user intervention. Our system exploits an observation that many functions are rarely used in the application's life cycle. Therefore, our system first serves users with an instrumented binary to collect execution profiles. It then performs a binary-level transformation to generate a slim main module and secondary modules. The main module contains frequently executed functions and patchable method stubs to load secondary modules on demand. Based on the module loading events, our system can also constantly refine the module partitioning scheme to suppress the module loading latency. Our preliminary experiments show that our system on average reduces the binary size by 69% and improves the startup speed by 71%.

Corneal Surface Reflections, or reflections on our eye-surface, have been shown as a valid and more socially acceptable source of information for passive lifelogging applications by prior work. However, automatic analysis of corneal surface reflections from a single RGB camera to support passive lifelogging is not extensively investigated in prior work. To address this, we developed a synthetic and self-supervised learning-based two-stage pipeline of deep learning models to detect objects in these reflections. Our prototype only consists a single RGB camera looking into the eye. We collected data from different users in uncontrolled environments using the prototype and trained our system to detect multiple classes of objects present in a typical office environment. We then evaluated our model in partially-controlled and in-the-wild scenarios. In addition, based on the findings from a follow up user study and prior work, we discuss strengths and weaknesses of our system and using corneal surface reflections for passive lifelogging. Finally, we opensource our source codes and trained checkpoints.

Abstract Retrieval Augment Generation (RAG) is a recent advancement in Open-Domain Question Answering (ODQA). RAG has only been trained and explored with a Wikipedia-based external knowledge base and is not optimized for use in other specialized domains such as healthcare and news. In this paper, we evaluate the impact of joint training of the retriever and generator components of RAG for the task of domain adaptation in ODQA. We propose RAG-end2end, an extension to RAG that can adapt to a domain-specific knowledge base by updating all components of the external knowledge base during training. In addition, we introduce an auxiliary training signal to inject more domain-specific knowledge. This auxiliary signal forces RAG-end2end to reconstruct a given sentence by accessing the relevant information from the external knowledge base. Our novel contribution is that, unlike RAG, RAG-end2end does joint training of the retriever and generator for the end QA task and domain adaptation. We evaluate our approach with datasets from three domains: COVID-19, News, and Conversations, and achieve significant performance improvements compared to the original RAG model. Our work has been open-sourced through the HuggingFace Transformers library, attesting to our work’s credibility and technical consistency.

Open source hardware such as RISC-V has been gaining substantial momentum. Recently, they have begun to embrace Google’s Android operating system to leverage its software ecosystem. Despite the encouraging progress, a challenging issue arises: a majority of Android applications are written in native languages and need to be recompiled to target new hardware platforms. Unfortunately, this recompilation process is not scalable because of the explosion of new hardware platforms. To address this issue, we present WasmAndroid, a high-performance cross-platform runtime for native Android applications. With WasmAndroid, developers can compile their source code to WebAssembly, an efficient and portable bytecode format that can be executed everywhere without additional reconfiguration. Developers can also transpile existing application binaries to WebAssembly when source code is not available. WebAssembly’s language model is very different from other common languages. This mismatch leads to many unique implementation challenges. In this article, we provide workable solutions and conduct a thorough system evaluation. We show that WasmAndroid provides acceptable performance to execute native applications in a cross-platform manner.

Mobile cloud computing offloads intensive code to remote servers to improve execution performance and battery lifetime. Unfortunately, it is prone to data breaches and dependent on network connectivity. In light of these issues, we explore the potential of an under-utilized local computing resource: Digital Signal Processors (DSPs). Programmable DSPs are widely equipped in mobile devices and can conduct mathematical operations at high speed and low power. However, existing mobile applications rarely offload computation to DSPs due to two reasons. Firstly, conventional DSP development requires high proficiency in low-level programming languages. Secondly, DSP application deployment involves many complex steps such as kernel memory allocation and remote procedure calls. In this paper, we introduce DSPBooster, a framework to facilitate application offloading to DSPs for power-performance optimal execution. DSPBooster supports unmodified applications implemented in various high-level programming languages. It transparently deploys suitable application functions to DSPs based on runtime measurement and prediction. Implementing such a system entails many technical challenges thanks to DSPs' unique micro-architecture and inter-processor communication mechanism. In this paper, we provide workable solutions and a thorough system evaluation. We show that DSPBooster can provide up to 11 % performance gain and 3 × power reduction.

Collaborative software development platforms like GitHub have gained tremendous popularity. Unfortunately, many users have reportedly leaked authentication secrets (e.g., textual passwords and API keys) in public Git repositories and caused security incidents and finical loss. Recently, several tools were built to investigate the secret leakage in GitHub. However, these tools could only discover and scan a limited portion of files in GitHub due to platform API restrictions and band-width limitations. In this paper, we present SecretHunter, a real-time large-scale comprehensive secret scanner for GitHub. SecretHunter resolves the file discovery and retrieval difficulty via two major improvements to the Git cloning process. Firstly, our system will retrieve file metadata from repositories before cloning file contents. The early metadata access can help identify newly committed files and enable many bandwidth optimizations such as filename filtering and object deduplication. Secondly, SecretHunter adopts a reinforcement learning model to analyze file contents being downloaded and infer whether the file is sensitive. If not, the download process can be aborted to conserve bandwidth. We conduct a one-month empirical study to evaluate SecretHunter. Our results show that SecretHunter discovers 57% more leaked secrets than state-of-the-art tools. SecretHunter also reduces 85% bandwidth consumption in the object retrieval process and can be used in low-bandwidth settings (e.g., 4G connections).

Despite the increasing popularity of VR games, one factor hindering the industry’s rapid growth is motion sickness experienced by the users. Symptoms such as fatigue and nausea severely hamper the user experience. Machine Learning methods could be used to automatically detect motion sickness in VR experiences, but generating the extensive labeled dataset needed is a challenging task. It needs either very time consuming manual labeling by human experts or modification of proprietary VR application source codes for label capturing. To overcome these challenges, we developed a novel data collection tool, VRhook, which can collect data from any VR game without needing access to its source code. This is achieved by dynamic hooking, where we can inject custom code into a game’s run-time memory to record each video frame and its associated transformation matrices. Using this, we can automatically extract various useful labels such as rotation, speed, and acceleration. In addition, VRhook can blend a customized screen overlay on top of game contents to collect self-reported comfort scores. In this paper, we describe the technical development of VRhook, demonstrate its utility with an example, and describe directions for future research.

Emotional Self-Awareness (ESA) plays a vital role in physical and mental well-being. Recent advancements in artificial intelligence technologies have shown promising emotion recognition results, opening new opportunities to build systems to support ESA. However, little research has been done to understand users' perspectives on artificial-intelligence-based emotion recognition systems. We introduce Troi, an automatic emotion recognition mobile app using wearable signals. With Troi, we ran a multi-day user study with 12 users to understand user preference parameters, such as perceived accuracy, confidence, preferred emotion representations, effect of self-awareness of emotions, and real-time use cases. Further, we extend our study to evaluate the machine learning model in-the-wild to understand behaviours in-the-wild. We found that users perceived accuracy of the emotion recognition model is higher than the actual model prediction accuracy; there was no strong preference for one specific emotion representation, and users' self-awareness of emotions improved over time.

Open-source hardware such as RISC-V has been gaining substantial momentum. Recently, they have begun to embrace Google's Android operating system to leverage its software ecosystem. Despite the encouraging progress, a challenging issue arises: a majority of Android applications are written in native languages and need to be recompiled to target new hardware platforms. Unfortunately, this recompilation process is not scalable because of the explosion of new hardware platforms. To address this issue, we present WasmAndroid, a high-performance cross-platform runtime for native programming languages on Android. WasmAndroid only requires developers to compile their source code to WebAssembly, an efficient and portable bytecode format that can be executed everywhere without additional reconfiguration. WasmAndroid can also trans-pile existing application binaries to WebAssembly when source code is not available. WebAssembly's language model is very different from C/C++ and this mismatch leads to many unique implementation challenges. In this paper, we provide workable solutions and conduct a preliminary system evaluation. We show that WasmAndroid provides acceptable performance to execute native applications in a cross-platform manner.

WebAssembly is gaining wide adoption in browser-centric applications thanks to its high portability and security. More recently, researchers start exploring the potential of WebAssembly in non-web environments, particularly in IoT and Edge computing. A key challenge of WebAssembly is performance gap with native code: applications compiled to WebAssembly run slower by an average of 45% as reported by previous benchmark. The main causes of the slowdown are two-folded. Firstly, conventional WebAssembly runtimes translate WebAssembly instructions to native machine code using just-in-time compilers, which do not apply complex code optimization. Secondly, system calls from WebAssembly applications have to be proxy-ed by runtimes in order to reach operating systems, which incurs a significant performance overhead. To address these issues, we present Wasmachine, an OS aiming to efficiently and securely execute WebAssembly applications in IoT and edge devices with constrained resources. Wasmachine achieves efficient execution by compiling WebAssembly ahead of time to native binary and executing it in kernel mode for zero-cost system calls. Even when executing in kernel space, Wasmachine stays secure by exploiting various language features of WebAssembly to deliver software-based fault isolation. We implement the Was-machine prototype in the memory-safe programming language Rust and conduct a performance evaluation. Our results show that WebAssembly applications running in Wasmachine are up to 21% faster than their native counterparts in Linux.

Web browsers are becoming a de-facto universal computing platform. Recently, research communities are attempting to enhance browsers with the capacity to run applications written in general programming languages. Existing approaches mainly compile source codes to browsers' native instruction sets JavaScript or WebAssembly. However, they usually fall short in practice because browsers lack operating system abstractions (e.g., thread and filesystem) and many programs would require extensive modifications. This paper presents BroswerVM, a new approach to run unmodified and complete operating systems and applications inside browsers. BrowserVM is a WebAssembly-based virtual machine hypervisor. BrowserVM efficiently conducts processor emulation through dynamic binary translation. It also provides performant hardware emulation for hard disks, graphics cards and network adapters. Implementing BrowserVM is challenging because of the unique characteristics of WebAssembly: semantic gap with low-level CPU assembly and high initialization overhead. We detail the methods to deal with these challenges and conduct a performance benchmark on BrowserVM. Our results indicate that though slower than native hypervisors, BroswerVM provides acceptable performance to execute existing applications that are not compute-intensive.

Electronic paper (e-paper) is a display technology that aims to imitate conventional paper. Currently most e-paper applications on handheld devices are restricted to digital book readers. Few studies explore the potential of e-paper on input oriented applications. In this paper, we introduce a novel e-paper application PaperWork, which allows users to offload their commonly used office applications from a PC to an e-paper device remotely. There are considerable challenges when building a system for a resource constrained e-paper device which we will highlight in this work. In addition to presenting a new e-paper system we also conduct a usability study of this system.

The text processing tool LATEX has prevailed as a standard in many fields of exact sciences; it is evident that LATEX is likely to be here to stay. From that perspective, it is important to explore what are the best possible ways to support the author in efficiently editing documents. There have been several approaches that provide graphical editing support for LATEX. We argue that a true WYSIWYG (What You See Is What You Get) approach is a justified requirement for future systems and we present here the first cloud-based true WYSIWYG editor. This allows the author to edit the document in its print form directly in a web-based PDF viewer. Building such a system creates unique challenges compared to existing approaches. We identify these challenges and name workable solutions. We also provide a usability evaluation of the new system. In short our finding is that editing LATEX directly in the PDF view is possible for a wide range of edits and valuable for many major user groups and use cases; hence it is a fair requirement for future top-of-the-line LATEX editors.

The performance of GPUs on mobile devices is generally the bottleneck of multimedia mobile applications (e.g., 3D games and virtual reality). Previous attempts to tackle the issue mainly migrate GPU computation to servers residing in remote cloud centers. However, the costly network delay is especially undesirable for highly-interactive multimedia applications since a fast response time is critical for user experience. In this paper, we propose GBooster, a system that accelerates multimedia mobile applications by transparently offloading GPU tasks onto neighboring multimedia devices such as Smart TVs and Gaming Consoles. Specifically, GBooster intercepts and redirects system graphics calls by utilizing the Dynamic Linker Hooking technique, which requires no modification of the applications and the mobile systems. In addition, a major concern for offloading is the high energy consumption incurred by network transmissions. To address this concern, GBooster is designed to intelligently switch between the low-power Bluetooth and the high-throughput WiFi based on the traffic demand. We implement GBooster on the Android system and evaluate its performance. The results demonstrate that it can boost applications' frame rates by up to 85%. In terms of power consumption, GBooster can preserve up to 70% energy compared with local execution.

Distributed controller architectures have been proposed for Software-Defined Networking (SDN) to ensure scalability and reliability. One major drawback of the existing architectures is the uneven load distribution among controllers stemming from the static binding between controllers and switches. To address this issue, several existing studies introduce dynamic binding by adopting some switch migration mechanisms that re-associate switches from overloaded controllers to underutilized controllers. However, the migration process adds a considerable amount of complexity to the system and may incur significant network latency. In this paper, we propose BLAC, a novel BindingLess Architecture for distributed Controllers (BLAC), in which load balance is achieved with the help of the proposed scheduling layer, which intercepts flow requests from switches and dispatches them to different controllers as determined by selected scheduling algorithms. The process is proceeded transparently with no extra modification required for off-the-shelf SDN switches. Besides, the scheduling layer can flexibly support various scheduling algorithms and causes neither disruption of service nor significant network delay. We build a prototype that can work with various distributed controller systems and conduct experiments to demonstrate its efficacy. The results show that our design outperforms the static-binding controller system in terms of both system throughput and response time without the complexity of the dynamic-binding controller system.

Smart devices are increasingly shrinking in size, which results in new challenges for user-mobile interaction through minuscule touchscreens. Existing works to explore alternative interaction technologies mainly rely on external devices which degrade portability. In this paper, we propose UbiTouch, a novel system that extends smartphones with virtual touchpads on desktops using built-in smartphone sensors. It senses a user's finger movement with a proximity and ambient light sensor whose raw sensory data from underlying hardware are strongly dependent on the finger's locations. UbiTouch maps the raw data into the finger's positions by utilizing Curvilinear Component Analysis and improve tracking accuracy via a particle filter. We have evaluate our system in three scenarios with different lighting conditions by five users. The results show that UbiTouch achieves centimetre-level localization accuracy and poses no significant impact on the battery life. We envisage that UbiTouch could support applications such as text-writing and drawing.