Lifting stripped and highly optimized binaries to the canonical compiler intermediate representation (IR) enables program analysis when source code is unavailable.However, compiler optimizations severely distort controlflow and data-flow structure, making existing rule-based and LLM-based decompilation approaches brittle.We present BRIDGE, a system that reliably lifts optimized binaries to analysis-friendly compiler IR.BRIDGE combines control-flow-aware retrieval-augmented generation with feedback-driven verification.It uses pseudo-probe instrumentation to align optimized binary fragments with normalized IR semantics, and then employs an iterative refinement loop guided by static analysis and runtime feedback to improve executability and semantic consistency.We evaluate BRIDGE on HumanEval-Decompile and MBPP, lifting x86-64 and ARM64 binaries to LLVM IR.BRIDGE outperforms seven baselines, achieving an average of over 30% higher re-executability than the strongest general-purpose LLM baseline.Void func (){ PROBE(1); If else branch …… PROBE(2); PROBE(3); for Loop … PROBE(4);}

Very Long Instruction Word (VLIW) processors can expose substantial instruction-level parallelism (ILP), yet compiler-generated schedules often fail to fully utilize available functional units, leaving performance on the table and forcing costly manual tuning. We present GRASP (Graph Reinforcement Assembly Scheduling Platform), an assembly-level post-pass optimizer that improves VLIW instruction scheduling and packing via graph reinforcement learning. GRASP represents each basic block as an Instruction Dependency Graph (IDG) that explicitly encodes dependence, latency, and machine resource constraints, and trains a GNN-based reinforcement learning agent to iteratively select legal scheduling decisions and construct high-throughput issue packets. By operating after compilation, GRASP requires no source-code changes and does not modify compiler internals, making it easy to integrate into existing toolchains. Across a suite of AI and HPC kernels, GRASP accelerates execution by up to 1.38 × (1.22 × on average), narrowing the gap between compiler output and expert-tuned VLIW code.

MLIR, a modular compiler framework, evolves quickly, with regular updates expanding its dialects and operations across LLVM versions and downstream projects. This fast development reduces the effectiveness of traditional fuzzing tools, which test only a small portion of dialects, require extensive manual work (e.g., nearly ten thousand lines of C++ code), and do not match the update speed of MLIR. To address these challenges, we propose NÜwa, the first LLM-based approach for MLIR fuzzing. Nüwa employs a two-phase strategy: first generating valid operations by encoding constraints into LLMs prompts, then synthesizing multi-operation test cases by learning inter-operation dependencies. To enhance operation coverage, it incorporates high-coverage cases from MLIR's test suite and uses LLM-driven mutations to boost diversity. A self-improvement mechanism enhances the prompts using feedback from highquality test cases, improving the LLMs' understanding of MLIR's complex semantics. Nüwa demonstrates that the generation and mutation process can be fully automated via the intrinsic capabilities of llMs (including in-context learning), while being applicable to MLIR's fast evolution. The experimental study shows that NÜwa outperforms the state-of-the-art tools MLIRSmith and MLIRod, detecting$2.9 \times$more unique bugs and achieving$1.6 \times$greater code coverage. To date, Nüwa has identified 55 bugs in the MLIR framework, with 18 confirmed or fixed.

Voice assistants (VAs) have become integral to daily life, yet their always-on microphones make them attractive targets for attacks that threaten user privacy and safety. We present MetaGuardian, the first system to leverage acoustic metamaterials to defend against three major classes of attacks for VAs - inaudible, adversarial, and laser-based - within a single, portable design. Unlike prior defenses, MetaGuardian can be seamlessly integrated into the enclosures of commercial smart devices, providing strong protection without requiring software modification, hardware redesign, or costly machine learning models. MetaGuardian leverages mutual impedance effects between metamaterial units to extend the protection range to 16–40 kHz, effectively blocking wideband inaudible attacks. It also employs a carefully designed coiled space structure to disrupt adversarial signals while preserving normal VA operations. Its universal design allows flexible adaptation to different devices, striking a balance between portability and protection effectiveness. In controlled evaluations, MetaGuardian achieves a high defense success rate across all attack types, offering a practical and reliable foundation for securing VAs on smart devices.

User and device authentication are vital to the deployment of smart Internet of Things (IoT) devices. Unfortunately, achieving robust authentication on a diverse set of heterogeneous IoT devices remains an open problem. This paper presentsScenario, a generic authentication method to support user-device authentication on a wide range of IoT devices, using RFID-based wireless sensing.Scenarioonly requires attaching an RFID tag on the target device surface. It then uses the unique RFID signal characteristics introduced by the device material and user gestures to perform device and user authentication. We developed a prototype ofScenariousing commercial off-the-shelf devices and applied it to a multi-device smart environment. Experimental results show thatScenariois reliable, giving an average identification accuracy of 97.3% and 96.7% of the device and user authentication stages in diverse environments, respectively.

Homomorphic encryption (HE) and secret sharing (SS) enable computations on encrypted data, providing significant privacy benefits for large transformer-based models (TBM) in sensitive sectors like medicine and finance. However, private TBM inference incurs significant costs due to the coarse-grained application of HE and SS. We present FASTLMPI, a new approach to accelerate private TBM inference through fine-grained computation optimization. Specifically, through the fine-grained co-design of homomorphic encryption and secret sharing, FASTLMPI achieves efficient protocols for matrix multiplication, SoftMax, LayerNorm, and GeLU. In addition, FASTLMPI introduces a precise segmented approximation technique for differentiable non-linear functions, improving its fitting accuracy while maintaining a low polynomial degree. Compared to solution BOLT (S&P’24), FASTLMPI shows a remarkable 25.1% to 55.3% decrease in runtime and an impressive 39.0% reduction in communication costs.

We present METAATTACK, the first approach to leverage acoustic metamaterials for inaudible attacks for voice control systems. Compared to the state-of-the-art inaudible attacks requiring complex and large speaker setups, METAATTACK achieves a longer attacking range and higher accuracy using a compact, portable device small enough to be put into a carry bag. These improvements in portability and stealth have led to the practical applicability of inaudible attacks and their adaptation to a wider range of scenarios. We demonstrate how the recent advancement in metamaterials can be utilized to design a voice attack system with carefully selected implementation parameters and commercial off-the-shelf components. We showcase that METAATTACK can be used to launch inaudible attacks for representative voice-controlled personal assistants, including Siri, Alexa, Google Assistant, XiaoAI, and Xiaoyi. The average success rate of all assistants is 76%, with a range of 8.85 m.

Deep learning (DL) has emerged as a viable means for identifying software bugs and vulnerabilities. The success of DL relies on having a suitable representation of the problem domain. However, existing DL-based solutions for learning program representations have limitations - they either cannot capture the deep, precise program semantics or suffer from poor scalability. We present Concoction, the first DL system to learn program presentations by combining static source code information and dynamic program execution traces. Concoction employs unsupervised active learning techniques to determine a subset of important paths to collect dynamic symbolic execution traces. By implementing a focused symbolic execution solution, Concoction brings the benefits of static and dynamic code features while reducing the expensive symbolic execution overhead. We integrate Concoction with fuzzing techniques to detect function-level code vulnerabilities in C programs from 20 open-source projects. In 200 hours of automated concurrent test runs, Concoction has successfully uncovered vulnerabilities in all tested projects, identifying 54 unique vulnerabilities and yielding 37 new, unique CVE IDs. Concoction also significantly outperforms 16 prior methods by providing higher accuracy and lower false positive rates.

History-driven testing techniques have been proven to be an effective method for detecting compiler bugs. It employs fuzzing history (e.g., historical test cases or historical execution information) to guide to generate valid test cases. However, prior methods either have an inefficient capability in synthesizing bug-triggering test cases or suffer from a plateau of code coverage, causing a low bug-exposing ability. This paper presents ASMFUZZ, another history-driven compiler testing framework by applying a multi-metric hybrid scheduling strategy. Specifically, ASMFUZZ first extracts the bug-triggering code segments from the historical test cases that triggered bugs. The extracted bug-triggering code segments are then used to assemble new test cases. To ensure the correctness of the newly synthesized test cases, ASMFUZZ always selects the segments with code context dependencies for assembly. Duration assembly, the ingredients to be assembled are determined based on multiple feedback metrics (e.g., anomalous behaviors and code coverage). To do so, we proposed a multi-metric hybrid scheduling scheme to select optimal code segments in each testing iteration. This contributes to continuously covering deep code branches of compiler duration whole testing process, avoiding getting stuck in the plateau of code coverage. We evaluated ASMFUZZ on three mainstream JVMs including OpenJ9, HotSpot, and GraalVM involving six JDK versions. Within a 72-hour concurrent test run, ASMFUZZ exposed 16 previously unknown unique bugs, of which 11 have been confirmed by the developers. We also compared ASMFUZZ to four prior state-of-the-art fuzzers. ASMFUZZ uncovers 1.6~2.2× more bugs than comparative baselines.

High-level programming models like Q# significantly simplify the complexity of programming for quantum computing. These models are supported by a set of foundation libraries for code development. However, errors can occur in the library implementation, and one common root cause is the lack of or incomplete checks on properties like values, length, and quantum states of inputs passed to user-facing subroutines. This paper presents Upbeat, a fuzzing tool to generate random test cases for bugs related to input checking in Q# libraries. Upbeat develops an automated process to extract constraints from the API documentation and the developer implemented input-checking statements. It leverages open-source Q# code samples to synthesize test programs. It frames the test case generation as a constraint satisfaction problem for classical computing and a quantum state model for quantum computing to produce carefully generated subroutine inputs to test if the input-checking mechanism is appropriately implemented. Under 100 hours of automated test runs, Upbeat has successfully identified 16 bugs in API implementations and 4 documentation errors. Of these, 14 have been confirmed, and 12 have been fixed by the library developers.

Abstract Storage stack layers in high-performance computing (HPC) systems offer many tunable parameters controlling I/O behaviors and underlying file system settings. The setting of these parameters plays a decisive role in I/O performance. Nevertheless, the increasing complexity of data operations and storage architectures makes identifying a set of well-performing configurations a challenge. Auto-tuning is a promising technology. This paper presents a comprehensive survey on "Auto-tuning in HPC I/O". We expound a general storage structure based on a general storage stack and critical elements of auto-tuning, and categorize related studies according to the way of tuning. On the basis of the order in which the approaches were applied, we introduce the specific works of each approach in detail, and summarize and compare the pros and cons of these approaches. Through a comprehensive and in-depth study of existing research, we elaborate on the development history of auto-tuning technology in HPC I/O, analyze the current situation, and provide guidance for optimization technology in the future.

To improve parallel I/O performance, it is imperative to optimize the adjustable parameters across the different layers of the I/O software stack. Finding an optimal configuration for different scenarios is hampered by the complex interaction dynamics between these parameters and the large parameter space. Previous research efforts have focused on tuning these parameters using independent algorithms; however, these approaches exhibit certain shortcomings such as unstable performance results and delayed convergence rates.This paper introduces OPRAEL, an auto-tuning approach on parallel I/O tasks by ensembles and performance modeling using regression analysis. To test its effectiveness, we applied this approach on the Tianhe-II supercomputer using one well-known I/O benchmark(IOR) and two I/O kernels(S3D-I/O, BT-I/O). Leveraging our experience in predictive modeling, we optimized the tuning of the I/O stack parameters. Our experimental results show a remarkable 10.2X improvement in write performance speedup for the optimization task with BT-I/O and a 500x500x500 input. We also compared the potential of using a single search algorithm versus using reinforcement learning search in the I/O parameter auto-optimization task. Our results show that OPRAEL outperforms the traditional approach, resulting in a maximum 8.4X improvement in write performance for the 128-process IOR optimization.

Random test case generation, or fuzzing, is a viable means for uncovering compiler bugs. Unfortunately, compiler fuzzing can be time-consuming and inefficient with purely randomly generated test cases due to the complexity of modern compilers. We present COMFUZZ, a focused compiler fuzzing framework. COMFUZZ aims to improve compiler fuzzing efficiency by focusing on testing components and language features that are likely to trigger compiler bugs. Our key insight is human developers tend to make common and repeat errors across compiler implementations; hence, we can leverage the previously reported buggy-exposing test cases of a programming language to test a new compiler implementation. To this end, COMFUZZ employs deep learning to learn a test program generator from open-source projects hosted on GitHub. With the machine-generated test programs in place, COMFUZZ then leverages a set of carefully designed mutation rules to improve the coverage and bug-exposing capabilities of the test cases. We evaluate COMFUZZ on 11 compilers for JS and Java programming languages. Within 260 hours of automated testing runs, we discovered 33 unique bugs across nine compilers, of which 29 have been confirmed and 22, including an API documentation defect, have already been fixed by the developers. We also compared COMFUZZ to eight prior fuzzers on four evaluation metrics. In a 24-hour comparative test, COMFUZZ uncovers at least 1.5× more bugs than the state-of-the-art baselines.

Contactless wireless sensing without attaching a device to the target has achieved promising progress in recent years. However, one severe limitation is the small sensing range. This paper presents Widesee to realize wide-area sensing with only one transceiver pair. Widesee utilizes the LoRa signal to achieve a larger range of sensing and further incorporates drone’s mobility to broaden the sensing area. Widesee presents solutions across software and hardware to overcome two aspects of challenges for wide-range contactless sensing: (i) the interference brought by device mobility and LoRa’s high sensitivity; and (ii) the ambiguous target information such as location when employing just a single pair of transceivers for sensing. We have developed a working prototype of Widesee for human target detection and localization that are especially useful in emergency scenarios such as rescue search, and evaluated Widesee with both controlled experiments and the field study in a high-rise building. Extensive experiments demonstrate the great potential of Widesee for wide-area contactless sensing with a single LoRa transceiver pair hosted on a drone.

Reinforcement learning (RL) is emerging as a powerful technique for solving complex code optimization tasks with an ample search space. While promising, existing solutions require a painstaking manual process to tune the right task-specific RL architecture, for which compiler developers need to determine the composition of the RL exploration algorithm, its supporting components like state, reward, and transition functions, and the hyperparameters of these models. This paper introduces SuperSonic, a new open-source framework to allow compiler developers to integrate RL into compilers easily, regardless of their RL expertise. SuperSonic supports customizable RL architecture compositions to target a wide range of optimization tasks. A key feature of SuperSonic is the use of deep RL and multi-task learning techniques to develop a meta-optimizer to automatically find and tune the right RL architecture from training benchmarks. The tuned RL can then be deployed to optimize new programs. We demonstrate the efficacy and generality of SuperSonic by applying it to four code optimization problems and comparing it against eight auto-tuning frameworks. Experimental results show that SuperSonic consistently improves hand-tuned methods by delivering better overall performance, accelerating the deployment-stage search by 1.75x on average (up to 100x).

Wireless sensing builds upon machine learning shows encouraging results. However, adopting wireless sensing as a large-scale solution remains challenging as experiences from deployments have shown the performance of a machine-learned model to suffer when there are changes in the environment, e.g., when furniture is moved or when other objects are added or removed from the environment. We present Rise, a novel solution for enhancing the robustness and performance of learning-based wireless sensing techniques against such changes during a deployment. Rise combines probability and statistical assessments together with anomaly detection to identify samples that are likely to be misclassified and uses feedback on these samples to update a deployed wireless sensing model. We validate Rise through extensive empirical benchmarks by considering 11 representative sensing methods covering a broad range of wireless sensing tasks. Our results show that Rise can identify 92.3% of misclassifications on average. We showcase how Rise can be combined with incremental learning to help wireless sensing models retain their performance against dynamic changes in the operating environment to reduce the maintenance cost, paving the way for learning-based wireless sensing to become capable of supporting long-term monitoring in complex everyday environments.

JavaScript (JS) is a popular, platform-independent programming language. To ensure the interoperability of JS programs across different platforms, the implementation of a JS engine should conform to the ECMAScript standard. However, doing so is challenging as there are many subtle definitions of API behaviors, and the definitions keep evolving.

This paper presents FUNDED (Flow-sensitive vUl-Nerability coDE Detection), a novel learning framework for building vulnerability detection models. Funded leverages the advances in graph neural networks (GNNs) to develop a novel graph-based learning method to capture and reason about the program's control, data, and call dependencies. Unlike prior work that treats the program as a sequential sequence or an untyped graph, Funded learns and operates on a graph representation of the program source code, in which individual statements are connected to other statements through relational edges. By capturing the program syntax, semantics and flows, Funded finds better code representation for the downstream software vulnerability detection task. To provide sufficient training data to build an effective deep learning model, we combine probabilistic learning and statistical assessments to automatically gather high-quality training samples from open-source projects. This provides many real-life vulnerable code training samples to complement the limited vulnerable code samples available in standard vulnerability databases. We apply Funded to identify software vulnerabilities at the function level from program source code. We evaluate Funded on large real-world datasets with programs written in C, Java, Swift and Php, and compare it against six state-of-the-art code vulnerability detection models. Experimental results show that Funded significantly outperforms alternative approaches across evaluation settings.

Deep learning is emerging as a promising technique for building predictive models to support code-related tasks like performance optimization and code vulnerability detection. One of the critical aspects of building a successful predictive model is having the right representation to characterize the model input for the given task. Existing approaches in the area typically treat the program structure as a sequential sequence but fail to capitalize on the rich semantics of data and control flow information, for which graphs are a proven representation structure.

Web technology underpins many interactive mobile applications. However, energy-efficient mobile web interactions is an outstanding challenge. Given the increasing diversity and complexity of mobile hardware, any practical optimization scheme must work for a wide range of users, mobile platforms and web workloads. This paper presents CAMEL, a novel energy optimization system for mobile web interactions. CAMEL leverages machine learning techniques to develop a smart, adaptive scheme to judiciously trade performance for reduced power consumption. Unlike prior work, CAMEL directly models how a given web content affects the user expectation and uses this to guide energy optimization. It goes further by employing transfer learning and conformal predictions to tune a previously learned model in the end-user environment and improve it over time. We apply CAMEL to Chromium and evaluate it on four distinct mobile systems involving 1,000 testing webpages and 30 users. Compared to four state-of-the-art web-event optimizers, CAMEL delivers 22% more energy savings, but with 49% fewer violations on the quality of user experience, and exhibits orders of magnitudes less overhead when targeting a new computing environment.

Text-based CAPTCHAs remains a popular scheme for distinguishing between a legitimate human user and an automated program. This article presents a novel genetic text captcha solver based on the generative adversarial network. As a departure from prior text captcha solvers that require a labor-intensive and time-consuming process to construct, our scheme needs significantly fewer real captchas but yields better performance in solving captchas. Our approach works by first learning a synthesizer to automatically generate synthetic captchas to construct a base solver. It then improves and fine-tunes the base solver using a small number of labeled real captchas. As a result, our attack requires only a small set of manually labeled captchas, which reduces the cost of launching an attack on a captcha scheme. We evaluate our scheme by applying it to 33 captcha schemes, of which 11 are currently used by 32 of the top-50 popular websites. Experimental results demonstrate that our scheme significantly outperforms four prior captcha solvers and can solve captcha schemes where others fail. As a countermeasure, we propose to add imperceptible perturbations onto a captcha image. We demonstrate that our countermeasure can greatly reduce the success rate of the attack.

Target material identification is playing an important role in our everyday life. Traditional camera and video-based methods bring in severe privacy concerns. In the last few years, while RF signals have been exploited for indoor localization, gesture recognition and motion tracking, very little attention has been paid in material identification. This paper introduces WiMi, a device-free target material identification system, implemented on ubiquitous and cheap commercial off-the-shelf (COTS) Wi-Fi devices. The intuition is that different materials produce different amounts of phase and amplitude changes when a target appears on the line-of-sight (LoS) of a radio frequency (RF) link. However, due to multipath and hardware imperfection, the measured phase and amplitude of the channel state information (CSI) are very noisy. We thus present novel CSI pre-processing schemes to address the multipath and hardware noise issues before they can be used for accurate material sensing. We also design a new material feature which is only related to the material type and is independent of the target size. Comprehensive real-life experiments demonstrate that WiMi can achieve fine-grained material identification with cheap commodity Wi-Fi devices. WiMi can identify 10 commonly seen liquids at an overall accuracy higher than 95% with strong multipath indoors. Even for very similar items such as Pepsi and Coke, WiMi can still differentiate them at a high accuracy.

Contactless wireless sensing without attaching a device to the target has achieved promising progress in recent years. However, one severe limitation is the small sensing range. This paper presents WideSee to realize wide-area sensing with only one transceiver pair. WideSee utilizes the LoRa signal to achieve a larger range of sensing and further incorporates drone's mobility to broaden the sensing area. WideSee presents solutions across software and hardware to overcome two aspects of challenges for wide-range contactless sensing: (i) the interference brought by the device mobility and LoRa's high sensitivity; and (ii) the ambiguous target information such as location when employing just a single pair of transceivers. We have developed a working prototype of WideSee for human target detection and localization that are especially useful in emergency scenarios such as rescue search, and evaluated WideSee with both controlled experiments and the field study in a high-rise building. Extensive experiments demonstrate the great potential of WideSee for wide-area contactless sensing with a single LoRa transceiver pair hosted on a drone.

Contactless wireless sensing without attaching a device to the target has achieved promising progress in recent years. However, one severe limitation in this field is the limited sensing range. This paper presents WideSee to realize wide-area sensing with only one transceiver pair. WideSee utilizes the LoRa signal to achieve a larger range of sensing and further incorporates drone's mobility to broaden the sensing area. We have developed a working prototype of WideSee for human target detection and localization that are especially useful in emergency scenarios like rescue and terrorist search. We also evaluated WideSee with field study in a high-rise building, which demonstrates the great potential of WideSee for supporting wide-area contactless sensing applications with a single LoRa transceiver pair hosted on a drone.

Material sensing is an essential ingredient for many IoT applications. While hyperspectral camera, infrared, X-Ray, and Radar provide potential solutions for material identification, high cost is the major concern limiting their applications. In this paper, we explore the capability of employing RF signals for fine-grained material sensing with commodity RFID device. The key reason for our system to work is that the tag antenna's impedance is changed when it is close or attached to a target. The amount of impedance change is dependent on the target's material type, thus enabling us to utilize the impedance-related phase change available at commodity RFID devices for material sensing. Several key challenges are addressed before we turn the idea into a functional system: (i) the random tag-reader distance causes an additional unknown phase change on top of the phase change caused by the target material; (ii) the tag rotations cause phase shifts and (iii) for conductive liquid, there exists liquid reflection which interferes with the impedance-caused phase change. We address these challenges with novel solutions. Comprehensive experiments show high identification accuracies even for very similar materials such as Pepsi and Coke.

Wireless sensor networks (WSNs) have been used for many long-term monitoring applications with the strip topology that is ubiquitous in the real-world deployment, such as pipeline monitoring, water quality monitoring, vehicle monitoring, and Great Wall monitoring. The efficiency of routing strategy has been playing a key role in serving such monitoring applications. In this article, we first present a robust geographic opportunistic routing (GOR) approach—LIght Propagation Selection (LIPS)—that can provide a short path with low energy consumption, communication overhead, and packet loss. To overcome the complication caused by the multi-turning point structure, we propose the virtual Plane mirror (VPM) algorithm, inspired by the light propagation, which is to map the strip topology into the straight one logically. We then select partial neighbors as the candidates to avoid blindly involving all next-hop neighbors and ensure the data transmission along the correct direction. Two implementation problems of VPM—transmission spread angle and the communication range—are thoroughly analyzed based on the percolation theory. Based on the preceding candidate selection algorithms, we propose a GOR algorithm in the strip topology network. By theoretical analysis and extensive simulation, we illustrate the validity and higher transmission performance of LIPS in strip WSNs. In addition, we have proved that the length of the path in LIPS is two times the length of the shortest path via geometrical analysis. Simulation results show that the transmission success rate of our approach is 26.37% higher than the state-of-the-art approach, and the communication overhead and energy consumption rate are 33.11% and 40.23% lower, respectively.

Despite several attacks have been proposed, text-based CAPTCHAs are still being widely used as a security mechanism. One of the reasons for the pervasive use of text captchas is that many of the prior attacks are scheme-specific and require a labor-intensive and time-consuming process to construct. This means that a change in the captcha security features like a noisier background can simply invalid an earlier attack. This paper presents a generic, yet effective text captcha solver based on the generative adversarial network. Unlike prior machine-learning-based approaches that need a large volume of manually-labeled real captchas to learn an effective solver, our approach requires significantly fewer real captchas but yields much better performance. This is achieved by first learning a captcha synthesizer to automatically generate synthetic captchas to learn a base solver, and then fine-tuning the base solver on a small set of real captchas using transfer learning. We evaluate our approach by applying it to 33 captcha schemes, including 11 schemes that are currently being used by 32 of the top-50 popular websites including Microsoft, Wikipedia, eBay and Google. Our approach is the most capable attack on text captchas seen to date. It outperforms four state-of-the-art text-captcha solvers by not only delivering a significant higher accuracy on all testing schemes, but also successfully attacking schemes where others have zero chance. We show that our approach is highly efficient as it can solve a captcha within 0.05 second using a desktop GPU. We demonstrate that our attack is generally applicable because it can bypass the advanced security features employed by most modern text captcha schemes. We hope the results of our work can encourage the community to revisit the design and practical use of text captchas.

Code virtualization built upon virtual machine (VM)technologies is emerging as a viable method for implementing code obfuscation to protect programs against unauthorized analysis. State-of-the-art VM-based protection approaches use a fixed set of virtual instructions and bytecode interpreters across programs. This, however, exposes a security vulnerability where an experienced attacker can use knowledge extracted from other programs to quickly uncover the mapping between virtual instructions and native code for applications protected under the same scheme. In this paper, we propose a novel VM-based code obfuscation system to address this problem. The core idea of our approach is to obfuscate the mapping between the opcodes of bytecode instructions and their semantics. We achieve this by partitioning each protected code region into multiple segments where the mapping of opcodes and their semantics is randomized in different ways in different segments. In this way, each bytecode instruction will be translated into different native code in different sections of the obfuscated code. This significantly increases the diversity of the program behavior. As a result, the knowledge of bytecode to native code mappings obtained from other programs will be less useful when targeting a new program. We evaluate our approach on a set of real-world applications and compare it against two state-of-the-art VM-based code obfuscation approaches. Experimental results show that our approach is effective, which provides stronger protection with comparable runtime overhead and code size.

Chinese calligraphy is a popular, highly esteemed art form in the Chinese cultural sphere and worldwide. Ink brushes are the traditional writing tool for Chinese calligraphy and the subtle nuances of brush movements have a great impact on the aesthetics of the written characters. However, mastering the brush movement is a challenging task for many calligraphy learners as it requires many years’ practice and expert supervision. This paper presents a novel approach to help Chinese calligraphy learners to quantify the quality of brush movements without expert involvement. Our approach extracts the brush trajectories from a video stream; it then compares them with example templates of reputed calligraphers to produce a score for the writing quality. We achieve this by first developing a novel neural network to extract the spatial and temporal movement features from the video stream. We then employ methods developed in the computer vision and signal processing domains to track the brush movement trajectory and calculate the score. We conducted extensive experiments and user studies to evaluate our approach. Experimental results show that our approach is highly accurate in identifying brush movements, yielding an average accuracy of 90%, and the generated score is within 3% of errors when compared to the one given by human experts.

We present CrossSense, a novel system for scaling up WiFi sensing to new environments and larger problems. To reduce the cost of sensing model training data collection, CrossSense employs machine learning to train, off-line, a roaming model that generates from one set of measurements synthetic training samples for each target environment. To scale up to a larger problem size, CrossSense adopts a mixture-of-experts approach where multiple specialized sensing models, or experts, are used to capture the mapping from diverse WiFi inputs to the desired outputs. The experts are trained offline and at runtime the appropriate expert for a given input is automatically chosen. We evaluate CrossSense by applying it to two representative WiFi sensing applications, gait identification and gesture recognition, in controlled single-link environments. We show that CrossSense boosts the accuracy of state-of-the-art WiFi sensing techniques from 20% to over 80% and 90% for gait identification and gesture recognition respectively, delivering consistently good performance - particularly when the problem size is significantly greater than that current approaches can effectively handle.

RFID-based positioning is emerging as a promising solution for inventory management in places like warehouses and libraries. However, existing solutions either are too sensitive to the environmental noise, or require deploying a large number of reference tags which incur expensive deployment cost and increase the chance of data collisions. This paper presents CSRP, a novel RFID based positioning system, which is highly accurate and robust to environmental noise, but relies on much less reference tags compared with the state-of-the-art. CSRP achieves this by employing an noise-resilient RFID fingerprint scheme and a compressive sensing based algorithm that can recover the target tag's position using a small number of signal measurements. This work provides a set of new analysis, algorithms and heuristics to guide the deployment of reference tags and to optimize the computational overhead. We evaluate CSRP in a deployment site with 270 commercial RFID tags. Experimental results show that CSRP can correctly identify 84.7% of the test items, achieving an accuracy that is comparable to the state-of-the-art, using an order of magnitude less reference tags.

Code virtualization built upon virtual machine (VM) technologies is emerging as a viable method for implementing code obfuscation to protect programs against unauthorized analysis. State-of-the-art VM-based protection approaches use a fixed scheduling structure where the program always follows a single, deterministic execution path for the same input. Such approaches, however, are vulnerable in certain scenarios where the attacker can reuse knowledge extracted from previously seen software to crack applications protected with the same obfuscation scheme. This paper presents Dsvmp, a novel VM-based code obfuscation approach for software protection. Dsvmp brings together two techniques to provide stronger code protection than prior VM-based approaches. Firstly, it uses a dynamic instruction scheduler to randomly direct the program to execute different paths without violating the correctness across different runs. By randomly choosing the program execution path, the application exposes diverse behavior, making it much more difficult for an attacker to reuse the knowledge collected from previous runs or similar applications to launch an attack. Secondly, it employs multiple VMs to further obfuscate the mapping from VM opcode to native machine instructions, so that the same opcode could be mapped to different native instructions at runtime, making code analysis even harder. We have implemented Dsvmp in a prototype system and evaluated it using a set of widely used applications. Experimental results show that Dsvmp provides stronger protection with comparable runtime overhead and code size, when it is compared to two commercial VM-based code obfuscation tools.

Pattern lock is widely used for identification and authentication on Android devices. This article presents a novel video-based side channel attack that can reconstruct Android locking patterns from video footage filmed using a smartphone. As a departure from previous attacks on pattern lock, this new attack does not require the camera to capture any content displayed on the screen. Instead, it employs a computer vision algorithm to track the fingertip movement trajectory to infer the pattern. Using the geometry information extracted from the tracked fingertip motions, the method can accurately infer a small number of (often one) candidate patterns to be tested by an attacker. We conduct extensive experiments to evaluate our approach using 120 unique patterns collected from 215 independent users. Experimental results show that the proposed attack can reconstruct over 95% of the patterns in five attempts. We discovered that, in contrast to most people’s belief, complex patterns do not offer stronger protection under our attacking scenarios. This is demonstrated by the fact that we are able to break all but one complex patterns (with a 97.5% success rate) as opposed to 60% of the simple patterns in the first attempt. We demonstrate that this video-side channel is a serious concern for not only graphical locking patterns but also PIN-based passwords, as algorithms and analysis developed from the attack can be easily adapted to target PIN-based passwords. As a countermeasure, we propose to change the way the Android locking pattern is constructed and used. We show that our proposal can successfully defeat this video-based attack. We hope the results of this article can encourage the community to revisit the design and practical use of Android pattern lock.

Apps repackaged through reverse engineering pose a significant security threat to the Android smart phone ecosystem. Previous solutions have mostly focused on the detection and identification of repackaged apps. Nevertheless, current app anti-repackaging services can only protect applications at a coarse level and get a significant performance overhead. These approaches can neither meet the performance requirements of Android nor achieve fine-grained protection against cumulative attack 1 at the same time. Specifically, these solutions rely on a fix-structure detecting engine and then will execute the same path at different times, which lead to the entire protection performs poorly when faced with dynamic cumulative attack, which is typical in real-world attack. This paper introduces AppIS, a reinforced anti-repackaging immune system, that is robust to app-repackaging attack scenarios. Unlike prior work, which mostly focuses on simple protection only from just one respect, our design exploits an interlocking guarding net with time diversity for the tamper-proofing of Android applications. The intuition underlying our design is that a dynamic and static combining method can provide a multi-level protection for the codes, core algorithm and sensitive data. We analyze and classify the existing threats on Android platform and furthermore abstract then model the repackaging attack scenarios. We then adopt a random controller used by the dispatcher to randomly construct guarding net with different structure every time. We have built a prototype of our design using Java Native Interface cross-layer calling mechanism for performance requirement. Results from a deployment of AppIS on several kinds of popular apps demonstrate that the new design can prevent our apps from cumulative attack without extra performance cost.

Many emerging applications driven the fast development of the device-free localization (DfL) technique, which does not require the target to carry any wireless devices. Most current DfL approaches have two main drawbacks in practical applications. First, as the pre-calibrated received signal strength (RSS) in each location (i.e., radio-map) of a specific area cannot be directly applied to the new areas, the manual calibration for different areas will lead to a high human effort cost. Second, a large number of RSS are needed to accurately localize the targets, thus causes a high communication cost and the areas variety will further exacerbate this problem. This paper proposes FitLoc, a fine-grained and low cost DfL approach that can localize multiple targets over various areas, especially in the outdoor environment and similar furnitured indoor environment. FitLoc unifies the radio-map over various areas through a rigorously designed transfer scheme, thus greatly reduces the human effort cost. Furthermore, benefiting from the compressive sensing theory, FitLoc collects a few RSS and performs a fine-grained localization, thus reduces the communication cost. Theoretical analyses validate the effectivity of the problem formulation and the bound of localization error is provided. Extensive experimental results illustrate the effectiveness and robustness of FitLoc.

Device-free localization (DfL) techniques, which can localize targets without carrying any wireless devices, have attracting an increasing attentions. Most current DfL approaches, however, have two main drawbacks hindering their practical applications. First, one needs to collect large number of measurements to achieve a high localization accuracy, inevitably causing a high deployment cost, and the areas variety will further exacerbate this problem. Second, as the pre-obtained Received Signal Strength (RSS) from each location (i.e., radio-map) in a specific area cannot be directly applied to new areas for localization, the calibration process of different areas will lead to the high human effort cost. In this paper, we propose, FitLoc, a fine-grained and low cost DfL approach that can localize multiple targets in various areas. By taking advantage of the compressive sensing (CS) theory, FitLoc decreases the deployment cost by collecting only a few of RSS measurements and performs a fine-grained localization. Further, FitLoc employs a rigorously designed transfer scheme to unify the radio-map over various areas, thus greatly reduces the human effort cost. Theoretical analysis about the effectivity of the problem formulation is provided. Extensive experimental results illustrate the effectiveness of FitLoc.

Intermittent connection of wireless links, caused by low duty-cycle radio operation, harsh working environment, movement of sensor nodes, etc., makes clock synchronization a challenging task. Prior synchronization approaches in wireless sensor networks (WSNs) typically require that nodes exchange time messages frequently with the reference clock, which is difficult in networks with low or intermittent connectivity. This poster presents RobSync, a robust design for clock synchronization in intermittent-connected wireless networks. Having recognized that clock skew is highly correlated to the voltage supply, we use the local voltage information as a reference for clock self-calibration, which helps reduce the frequency of time-stamp exchanges. To prevent a misuse of the voltage information, leading to error accumulation, a re-synchronization interval adjustment design is developed to make a trade-off between accuracy and energy consumption. We present the theory behind RobSync, and provide preliminary results by experiments to compare our approach and the recent approach.

This poster introduces JRD, a novel device-free localization system which can achieve high accuracy with low cost and little human effort, and is even robust to different scenarios. Unlike the previous Radio Signal Strength (RSS)-based systems which depend on the dense deployment to provide high accuracy, JRD extracts the fine-grained RSS distributions of a single link and presents a voting algorithm based on multi-link to identify the object location accurately while maintaining a low-cost deployment. Furthermore, JRD is flexible to different scenarios by using the transferring technique with less time-consuming and human effort. Experimental results show that JRD can improve the localization accuracy by up to 50% with less cost as compared with the existing RSS approaches.

For a long history, stampede is one of the high potential disaster when thousands of people gathered. Current monitoring systems, however, can only detect the presence of a small number of sparsely located targets, rather than to monitor the change of people flow where there are large number of dense crowd in the environment. This paper presents DanSen, a low-cost people flow monitoring system for sensing the potential danger using the existing wifi infrastructures. Inspired by the dynamic light scattering (DLS) theory, the designed DanSen calculates the correlations between the initial channel state information (CSI) data and all the history CSI data to monitor the changes of people flow and also estimates the sharpness of the changes. By doing so, DanSen can be utilised to perceive the potential danger. Real-world experimental results illustrate the advantage and effectiveness of DanSen.

Many emerging applications and the ubiquitous wireless signals have accelerated the development of Device Free localization (DFL) techniques, which can localize objects without the need to carry any wireless devices. Most traditional DFL methods have a main drawback that as the pre-obtained Received Signal Strength (RSS) measurements (i.e., fingerprint) in one area cannot be directly applied to the new area for localization, and the calibration process of each area will result in the human effort exhausting problem. In this paper, we propose FALE, a fine-grained transferring DFL method that can adaptively work in different areas with little human effort and low energy consumption. FALE employs a rigorously designed transferring function to transfer the fingerprint into a projected space, and reuse it across different areas, thus greatly reduce the human effort. On the other hand, FALE can reduce the data volume and energy consumption by taking advantage of the compressive sensing (CS) theory. Extensive real-word experimental results also illustrate the effectiveness of FALE.

Utilizing a modified PPCT structure, a tamper-proof software watermark solution with code-based encryption is proposed. The General Chinese Remainder Theorem is exploited to split the watermark which is represented as a big number into pieces to enhance stealth. Changes to the source and object code are made to embed the watermark, and according to certain policies some parts of object code are encrypted with an en/decryption key which is highly coupled with object code to increase robustness and tamper-proof capability.

This paper presents a new approach to detect unknown worms on local networks. We propose a worm detection model based on propagation behavior of unknown worms within an intranet. The model firstly describes propagation behavior with a binary model vector structure. Then, it uses three-tier security filters to detect unknown worms. In contrast to traditional research which only focuses on how to detect the scanning behavior, the binary model vector also concerns the response behavior of the worm host. Comparison results show that it can remarkably improve the integrality of description of unknown wormspsila propagation behavior. Experimental results indicate that it is more accurately and efficiently in detecting local-network-worm-intrusion than traditional schemes.