Classifying malware variants into their respective families is a key challenge in malware analysis. This task is especially difficult with IoT malware because of code reuse and a variety of instruction set architectures (ISAs). Adversaries often reuse code across malware families through the same library functions, leaked source code, or known exploits. This practice makes it difficult for traditional Machine Learning (ML) classifiers to be reliable for malware classification. Further, IoT malware targets diverse instruction set architectures (ISAs), where differences in opcodes and registers create variations that hinder effective malware analysis. We present Ciao, a tool that uses an architecture-agnostic instruction representation and graph representation learning that captures family-specific logic even under heavy code reuse. Our evaluation of Ciao on a dataset of 9,954 IoT malware samples achieves an accuracy of 98.50%, a macro precision of 99.01%, and a macro recall of 98.94% in malware classification under code reuse, which outperforms existing techniques. Furthermore, in cross-architecture classification, where samples from one architecture are underrepresented, Ciao outperforms a model that uses architecture-specific instruction representation.

Security for real-time systems is increasingly important with the growth of connected real-time systems in safety-critical domains such as automotive, medical, and avionics. A crucial aspect of securing such systems is to understand the attacks that the current techniques cannot effectively safeguard against. Especially relevant are vulnerabilities of real-time systems arising from their rigid temporal guarantees and attacks that exploit such vulnerabilities. Randomization-based defense techniques can reduce side-channel inference, but such techniques are limited due to the strict timing bounds of real-time systems. In this article, we design and analyze NosyNeighbor , an inter-partition side-channel attack that exploits the timing guarantees of real-time systems to infer the timing parameters of a safety-critical task in a hierarchical system. Using an adaptive technique, NosyNeighbor can improve its inference over time and evade randomization-based defense. Experimental results show that NosyNeighbor can infer victim task execution with a precision of roughly 73% under normal system load, and with a recall of about 35% using multiple malicious tasks across partitions. NosyNeighbor is also effective under the common attack model with two malicious tasks in the system, with a precision of 64%.

Due to hardware limitations and low cost, manufacturers often overlook security in widely deployed IoT devices, making them susceptible to attacks. Malware is one such attack that can cause extensive damage. In this work, we analyze a large corpus of IoT malware to extract features that emerge from the shared development and logistics in the malware development life cycle (MDLC), which we name operational features. We use these features to formulate a novel operational similarity concept for malware families and variants that complements existing code and behavior analysis.

Medical supply chains increasingly integrate AI-enabled IoT (AIoT) to improve operational efficiency, reduce waste, and cut costs. However, this digitalization brings new security risks that endanger sensitive patient information, as well as critical medical operations. Existing intrusion detection systems for these configurations either infringe upon patient privacy through data aggregation or rely on constrained resources that diminish the ecological advantages touted by green supply chain frameworks. We propose FLEMING-MS, a federated learning framework for green medical supply chains with AIoT-driven intrusion detection and medical security transfer efficiency optimization. Our system allows boundary intrusions to be detected collaboratively across health facilities without the need to exchange sensitive information and reduces environmental impact through intelligent resource management. FLEMING-MS creates (1) a node selection algorithm that captures medical data from healthcare facilities as nodes with high-quality information; (2) adaptive bandwidth allocation for network resource optimization; (3) transfer performance appraisal for quantifying each facilitys contribution to the global model; and (4) deep deterministic policy gradient algorithm to solve the transfer efficiency maximization problem. Experimental results on NSL-KDD and CIC IoT 2023 datasets demonstrate that FLEMING-MS reduces model training time by 74.3% compared to state-of-the-art approaches while maintaining superior detection performance. FLEMING-MS also achieved a 52.8% reduction in energy consumption and a 53.7% decrease in carbon emissions, offering an environmentally friendly, privacy-preserving, and secure solution to contemporary medical supply chains.

Industrial control system (ICS) protocols face the threat of adversaries launching cyber-physical attacks against protocol endpoints. Vulnerability discovery approaches such as fuzzing can be effective at reducing the risk of such threats. In this paper, we present MCFICS, a coverage-guided greybox fuzzing framework that uses (1) active automata learning for stochastic reactive systems to infer the state machine of a stateful ICS protocol server implementation, and (2) guided fuzzing to explore the state space using this learned state machine. During fuzzing, new input sequences that increase code coverage are used to improve the state space exploration of the ICS protocol implementations. We implemented and tested MCFICS with six example server implementations spanning three widely used ICS protocol implementations. Experimental results show that MCFICS achieves higher branch coverage than the AFLNwe, AFLNet and StateAFL fuzzers by an average (mean of means) of 15.82%, 1.99%, and 37.52%, respectively, with an overall average of 18.44% increased branch coverage. Furthermore, using MCFICS we discovered a new bug in a protocol implementation that we have reported to its upstream maintainer.

Automated malware classification assigns unknown malware to known families. Most research in malware classification assumes that the defender has access to the malware for analysis. Unfortunately, malware can delete itself after execution. As a result, analysts are only left with digital residue, such as network logs or remnant artifacts of malware in memory or on the file system. In this paper, a novel malware classification method based on the Windows prefetch mechanism is presented and evaluated, enabling analysts to classify malware without a corresponding executable. The approach extracts features from Windows prefetch files, a file system artifact that contains historical process information such as loaded libraries and process dependencies. Results show that classification using these features with two different algorithms garnered F-Scores between 0.80 and 0.82, offering analysts a viable option for forensic analysis.

Network intrusion detection systems (NIDS) today must quickly provide visibility into anomalous behavior on a growing amount of data. Meanwhile different data models have evolved over time, each providing a different set of features to classify attacks. Defenders have limited time to retrain classifiers, while the scale of data and feature mismatch between data models can affect the ability to periodically retrain. Much work has focused on classification accuracy yet feature selection is a key part of machine learning that, when optimized, reduces the training time and can increase accuracy by removing poorly performing features that introduce noise. With a larger feature space, the pursuit of more features is not as valuable as selecting better features. In this paper, we use an ensemble approach of filter methods to rank features followed by a voting technique to select a subset of features. We evaluate our approach using three datasets to show that, across datasets and network topologies, similar features have a trivial effect on classifier accuracy after removal. Our approach identifies poorly performing features to remove in a classifier-agnostic manner that can significantly save time for periodic retraining of production NIDS.

Machine learning approaches to classify malware by family save analysts valuable time during incident response. A key challenge for these approaches is selecting features that are robust against concept drift, which describes the change in malware over time. In this paper, we evaluate a dynamic feature set based on Windows handles (e.g., files, registry keys) for malware family classification. Specifically, we examine the features' vulnerabilities and evaluate their robustness against concept drift. We curated a novel dataset that simulates the manipulations that attackers may invoke on malware samples. We demonstrate improved robustness to concept drift over traditional API call-based features by training machine learning classifiers on malware collected in the wild, and testing the classifiers against samples that underwent manipulations. Further, we investigate time decay due to concept drift using temporally consistent evaluations that do not assume access to newer information. The evaluation shows that our features are robust against malware obfuscation. Furthermore, we empirically demonstrate how malware labeling conventions (malware type or family) can affect results, and make recommendations for dataset construction.

In this paper, we present an experimental study in which an electroencephalogram (EEG) device was used to measure cognitive load in programmers as they attempted to predict the output of C code snippets. Our goal was to see if particular patterns within the snippet induced higher levels of cognitive load, and if the collected EEG data might provide more detailed insights than performance measures. Our results suggest that while cognitive load can be an influence on code comprehension performance, other human factors, such as a tendency to forget certain programming rules or to misread what the code is asking them to do may also play a role, particularly for novice programmers. We conclude that: (1) different types of code patterns can affect programmers' cognitive processes in disparate ways, (2) neither self-reported data nor brainwave activity alone is a reliable indicator of programmers' level of comprehension for all types of code snippets, (3) EEG techniques could be useful to better understand the relationships between program comprehension, code patterns and cognitive processes, and (4) tests like ours could be useful to identify crucial learning gaps in novice programmers, which, in turn can be leveraged to improve programming tools and teaching strategies.

Modern vehicles are equipped with vehicular sensors for smart navigation, vehicle state awareness, and other intelligent operations. Despite the previous belief that the sensor operations stay within a vehicle, as it is designed to be, we study information leakage through the tire pressure monitoring system (TPMS) sensors and the corresponding privacy breach. We demonstrate that, using a low-cost and off-the-shelf software defined radio (SDR), an unauthorized attacker can track uniquely-identifiable sensor IDs up to 40 meters away from the vehicle. To address the issue and protect vehicular privacy, we also propose an effective and lightweight TPMS ID randomization scheme and analyze its security and the implementation costs.

In a lockstep system, errors induced by single-point and common-mode failures could cause catastrophic fatality without proper error detection or write-protection circuitries. In this paper, we design and implement a dual lockstep processor using a two pipelined assembly that executes two virtual cores each, in an interleaved fashion. Such an approach could overcome common-mode failures (CMFs). Furthermore, by running the same code in a secondary pipeline, our system can detect a single-point-of-failure (SPOF). Our technique easily maintains the synchronization between the two virtual cores and omits other fabric that binds a typical dual-core lockstep processor. This reduces the die size and provides early error detection before an error becomes unrecoverable. We achieve our goal by incorporating the lockstep function in the micro-architecture and employing fine-grained multitasking to increase a system's fail-safe capabilities. Finally, we validate our lockstep processor using the RISC-V 32IM ISA test benches, Dhrystones and Coremark benchmarks, and ModelSim. Our results show a 100% self-checking coverage for stuck-at faults and complete error containment. Since our framework operates fine-grained multitasking, we achieve two lockstep processors instead of one, which saves hardware costs.

A radiation-induced single-event upset (SEU) is a major disruption to electronics operating in satellites. If not rectified, a single-bit-error can become uncorrectable. In this paper, we present two interleaved Double-Adjacent-Error-Corrections (DAECs) for Error Detection and Correction (EDAC), using the Hsiao Code and Cyclic Redundancy Code (CRC). From our results, both EDACs can correct 100% of the single-bit-errors, double-adjacent-bit-errors, and detect double-bit-errors and up to four-adjacent-bit-errors. The Hsiao Code EDAC encoder design requires less bit-weight than the CRC EDAC, which is an attribute of a high-speed EDAC. The CRC EDAC, in contrast, has a higher error detection rate for both three- and four-bit-errors, at 96.25% and 91.92%, respectively. We also propose two storage formats and algorithm designs that can manage and store the 48-bit codeword in 8-bit and 16-bit memory devices, a typical satellite scenario where board space is scarce. We used Verilog HDL, C++, and ModelSim to create and test our designs.

Network testbeds are essential research tools that have been responsible for valuable network measurements and major advances in distributed systems research. However, no single testbed can satisfy the requirements of every research project, prompting continual efforts to develop new testbeds. The common practice is to re-implement functionality anew for each testbed. This work introduces a set of ready-to-use software components and interfaces called Tsumiki to help researchers to rapidly prototype custom networked testbeds without substantial effort. We derive Tsumiki's design using a set of component and interface design principles, and demonstrate that Tsumiki can be used to implement new, diverse, and useful testbeds. We detail a few such testbeds: a testbed composed of Android devices, a testbed that uses Docker for sandboxing, and a testbed that shares computation and storage resources among Facebook friends. A user study demonstrated that students with no prior experience with networked testbeds were able to use Tsumiki to create a testbed with new functionality and run an experiment on this testbed in under an hour. Furthermore, Tsumiki has been used in production in multiple testbeds, resulting in installations on tens of thousands of devices and use by thousands of researchers.

Program comprehension is a common task in software development. Programmers perform program comprehension at different stages of the software development life cycle. Detecting when a programmer experiences problems or confusion can be difficult. Self-reported data may be useful, but not reliable. More importantly, it is hard to use the self-reported feedback in real time. In this study, we use an inexpensive, non-invasive EEG device to record 8 subjects' brain activity in short program comprehension. Subjects were presented either confusing or non-confusing C/C++ code snippets. Paired sample t-tests are used to compare the average magnitude in alpha and theta frequency bands. The results show that the differences in the average magnitude in both bands are significant comparing confusing and non-confusing questions. We then use ANOVA to detect whether such difference also presented in the same type of questions. We found that there is no significant difference across questions of the same difficulty level. Our outcome, however, shows alpha and theta band powers both increased when subjects are under the heavy cognitive workload. Other research studies reported a negative correlation between (upper) alpha and theta band powers.

Humans often mistake the meaning of source code, and so misjudge a program's true behavior. These mistakes can be caused by extremely small, isolated patterns in code, which can lead to significant runtime errors. These patterns are used in large, popular software projects and even recommended in style guides. To identify code patterns that may confuse programmers we extracted a preliminary set of `atoms of confusion' from known confusing code. We show empirically in an experiment with 73 participants that these code patterns can lead to a significantly increased rate of misunderstanding versus equivalent code without the patterns. We then go on to take larger confusing programs and measure (in an experiment with 43 participants) the impact, in terms of programmer confusion, of removing these confusing patterns. All of our instruments, analysis code, and data are publicly available online for replication, experimentation, and feedback.

Despite the security community's emphasis on the importance of building secure software, the number of new vulnerabilities found in our systems is increasing. In addition, vulnerabilities that have been studied for years are still commonly reported in vulnerability databases. This paper investigates a new hypothesis that software vulnerabilities are blind spots in developer's heuristic-based decision-making processes. Heuristics are simple computational models to solve problems without considering all the information available. They are an adaptive response to our short working memory because they require less cognitive effort. Our hypothesis is that as software vulnerabilities represent corner cases that exercise unusual information flows, they tend to be left out from the repertoire of heuristics used by developers during their programming tasks.

The security community spares no effort in emphasizing security awareness and the importance of building secure software. However, the number of new vulnerabilities found in today's systems is still increasing. Furthermore, old and well-studied vulnerability types such as buffer overflows and SQL injections, are still repeatedly reported in vulnerability databases. Historically, the common response has been to blame the developers for their lack of security education. This paper discusses a new hypothesis to explain this problem by introducing a new security paradigm where software vulnerabilities are viewed as developers' blind spots in their decision making. We argue that such a flawed mental process is heuristic-based, where humans solve problems without considering all the information available, just like taking shortcuts. This paper's thesis is that security thinking tends to be left out by developers during their programming, as vulnerabilities usually exist in corner cases with unusual information flows. Leveraging this paradigm, this paper introduces a novel methodology for capturing and understanding security-related blind spots in Application Programming Interfaces (APIs). Finally, it discusses how this methodology can be applied to the design and implementation of the next generation of automated diagnosis tools.

Distributed platforms are now a de facto standard in modern software and application development. Although the ACM/IEEE Curriculum 2013 introduces Parallel and Distributed Computing as a first class knowledge area for the first time, the right level of abstraction to teach these concepts is still an important question that needs to be explored. This work presents our findings in teaching cloud computing by exposing upper-level students to testbeds in use by the distributed systems research community. The possibility of giving students practical and relevant experience was explored in the context of new course assignment objectives. Furthermore, students were able to significantly contribute to a pilot class project with medium-scale computation based on satellite data. However, the software engineering challenges in these environments proved to be daunting. In particular, these challenges were exacerbated by a lack of debugging support relative to the environments students were more familiar with---requiring development practices that out-stripped typical course experiences. Our proposed set of experiments and project provide a basis for an evaluation of the trade-offs of teaching cloud and distributed systems on the wild side. We hope that these findings provide insight into some of the possibilities to consider when preparing the next generation of computer scientists to engage with software practices and paradigms that are already fundamental in today's highly distributed systems.

Using mobile elements (MEs) as mechanical carriers to collect data brings many opportunities to wireless sensor networks, such as improving the energy efficiency of sensor nodes and prolonging network lifetime. However, the limited travel speed of MEs leads to a higher data transfer latency, which in turn degrades the performance of the data collection task. The optimal use of the limited mobility of MEs is thus critical to the overall performance optimization. Considering the data-rate constraints of wireless communications, and by following a progressive optimization approach, we propose a sweeping tour optimization scheme with active skipping (SAS) in this paper. The performance of the proposed scheme is evaluated by investigating the tour length and the data collection latency. Through extensive simulations, our scheme is shown to outperform the best known heuristic algorithms in terms of the data collection latency.

Node locations and distances are of profound importance for the operation of any communication networks. With the fundamental inter-node distance captured in a random network, one can build probabilistic models for characterizing network performance metrics such as k-th nearest neighbor and traveling distances, as well as transmission power and path loss in wireless networks. For the first time in the literature, a unified approach is developed to obtain the closed-form distributions of inter-node distances associated with hexagons. This approach can be degenerated to elementary geometries such as squares and rectangles. By the formulation of a quadratic product, the proposed approach can characterize general statistical distances when node coordinates are interdependent. Hence, our approach applies to both elementary and complex geometric topologies, and the corresponding probabilistic distance models go beyond the approximations and Monte Carlo simulations. Analytical models based on hexagon distributions are applied to the analysis of the nearest neighbor distribution in a sparse network for improving energy efficiency, and the farthest neighbor distribution in a dense network for minimizing routing overhead. Both the models and simulations demonstrate the high accuracy and promising potentials of this approach, whereas the current best approximations are not applicable in many scenarios. This geometrical probability approach thus provides accurate information essential to the successful network protocol and system design.

Cognitive radio users are allowed to utilize the unused portions of the licensed spectrum, which leads to performance enhancement. However, they need to carefully inspect the environment and make intelligent decisions. Secondary Users (SUs) are required to vacate the channel when a Primary User (PU) appears on the same licensed channel. This may cause interruptions in secondary network transmissions. In this paper we propose a distributed channel assignment scheme for cognitive radio networks. We consider a multi-radio node architecture in order to better utilize the multiple available channels. Our RIMCA (Robust Interference Minimizing Channel Assignment) scheme includes a collaborative sensing mechanism as well as channel assignment. We also consider channel reclaim by a primary user. When making decisions, secondary users consider the interference imposed on primary users as well as the total interference in the secondary network. Simulation results show that our RIMCA outperforms the most related channel assignment schemes. Moreover, our channel assignment scheme is robust to PU activities.

Performance metrics in cellular systems, such as per-user link capacity and co-channel interference, are dependent on the statistical distances between communicating nodes. An analytical model based on geometric probability in cellular systems is presented here for capacity analysis and interference estimation. We first derive the closed-form distance distribution between cellular base stations and mobile users, giving the explicit probability density functions of the distance from a base station to an arbitrary user in the same hexagonal cell, or to the users in adjacent cells. Different from numerical methods or approximation, and the existing approaches in geometric probability, this unified approach provides explicit distribution functions that can lead to all statistical moments, and is not limited by coordinate distributions, either of base stations or subscribers. Analytical results on per-user link capacity and co-channel interference are derived and validated through simulation, which shows the high accuracy and promising potentials of this approach.

Vehicular ad hoc networks have attracted a lot of attention in recent years, in either vehicle-to-vehicle or vehicle-to-infrastructure scenarios. In this paper, we focus on the latter, particularly for vehicles to upload to roadside units, the so-called drive-thru Internet, in a secure and efficient manner. Due to the ad hoc nature and wireless communications, traditional certificate-based security schemes are either infeasible or inefficient in this scenario. Thus we propose a certificateless approach to secure upload in a drive-thru Internet. We discuss the attack model and the desired security properties, and how to achieve these properties through the proposed certificateless scheme. We implement and evaluate the proposed scheme, and also investigate how to mitigate the security overhead through the separation of security association and data transfer in a drive-thru Internet.

One promise of Vehicular Ad-hoc Networks (VANET) is to considerably increase road safety and travel comfort by enabling inter-vehicle communications. Among a vast array of potential applications, emergency message (EM) dissemination has attracted a lot of attention in the literature. In this paper, we propose a time/location-critical (TLC) framework for EM dissemination and use our scalable modulation and coding (SMC) scheme to achieve the goal. In specific, vehicles near the accident site (or the point-of-interest location) receive guaranteed, detailed messages to take proper reaction immediately (e.g., slow down or change lanes), and vehicles further away have a high probability to be informed and make location-aware decisions accordingly (e.g., detour or reroute), with the assistance of reverse traffic when possible and necessary. The efficacy of the proposed framework is analyzed and validated by extensive numerical and simulation results. The TLC framework and the use of the SMC scheme are shown to be able to disseminate EMs effectively and efficiently by taking both the time and location criticality into account, while simplifying the design of radio transceivers and media access control protocols for VANET.

Due to limited energy supplies, reducing power consumption is an important goal in wireless sensor networks. Clustering techniques are used to reduce power consumption and prolong network lifetime in many existing research efforts, among which grid-based ones are often used due to their simplicity and scalability. However, most existing work uses average distance as a simplification in calculating distance-related power consumption, which leads to a large underestimation of the actual energy depletion rate. In this paper, we propose an energy optimization model based on probabilistic distance distributions, which captures the distance-induced power consumption with high accuracy. We further analyze the uneven traffic distribution in wireless sensor networks and propose a nonuniform griding scheme to balance the energy depletion in all grids. Through our analysis, we are able to obtain the optimal grid size ratio that minimizes the energy consumption. Analytical results are validated through simulation, which shows the promising potentials of our method and the nonuniform griding technique.

Minimizing energy consumption in wireless sensor networks has been a challenging issue, and grid-based clustering and routing schemes have attracted a lot of attention due to their simplicity and feasibility. Thus how to determine the optimal grid size in order to minimize energy consumption and prolong network lifetime becomes an important problem during the network planning and dimensioning phase. So far most existing work uses the average distances within a grid and between neighbor grids to calculate the average energy consumption, which we found largely underestimates the real value. In this paper, we propose, analyze and evaluate the energy consumption models in wireless sensor networks with probabilistic distance distributions. These models have been validated by numerical and simulation results, which shows that they can be used to optimize grid size and minimize energy consumption accurately. We also use these models to study variable-size grids, which can further improve the energy efficiency by balancing the relayed traffic in wireless sensor networks.

Exploring mobility to accomplish the data collection in wireless sensor networks (WSNs) has become the focus of recent studies, which can improve the energy efficiency of sensor nodes by shifting the data forwarding task from them to mobile elements (MEs). However, the data collection latency in this case can be much higher. We consider an on-demand data collection scenario in this paper, in which sensor nodes broadcast service requests when their buffer is about to be full. On receiving such requests, the ME moves toward the sensor nodes to collect data, and uploads the data to the sink when possible. An M/G/1 queue-based analytical model is presented, and analytical results on several important system performance metrics are derived. Furthermore, we propose an improved service scheme, which combines requests whenever they are in proximity. The work is evaluated through extensive simulations, which validate the accuracy of our model. The efficacy of the proposed service scheme to improve the system performance is also verified.