There has been a significant rise in the use of Internet of Things (IoT) devices in recent years, but along with the increase in usage, there’s also a rise in security vulnerabilities in the IoT software. The security vulnerabilities are difficult to find, and even more difficult to exploit dynamically. The software technologies, particularly used in the Samsung SmartThings environment, have a huge gap in terms of deprecated language usage, having a good testing environment and a security vulnerability scanning. This paper introduces a new tool, SmartTinkerer , filling these gaps by employing LLMs to translate deprecated language to new APIs, creating a digital twin simulating a virtual smart home device system for a testing environment and using reinforcement learning on the digital simulation to better scan for vulnerabilities.

We introduce KASTroid1, a static taint analysis framework designed to detect information leakage vulnerabilities in Kotlin-based Android applications, with a focus on insecure usage of broadcasts. As Kotlin increasingly replaces Java as the preferred language for Android development, ensuring the security of inter-component communication, particularly through broadcasts, is critical. KASTroid employs a novel static analysis approach to identify tainted flows arising from unsafe broadcast practices, such as the use of implicit broadcasts via sendBroadcast, which can expose sensitive user data to unauthorized applications. We evaluated KASTroid on a dataset of 1,716 Kotlin Android applications and found that over 70% of broadcasts are implicit, posing significant privacy risks. To demonstrate the framework’s effectiveness, we present a case study on a previous version of AndroidAPS, a medical application, where KASTroid identified unsafe broadcast usage that could leak sensitive information to other local applications. Our findings highlight the importance of secure broadcast practices and demonstrate KASTroid’s ability to assist developers in detecting and remedying such vulnerabilities.

As we increase our reliance upon Internet of Things (IoT) systems, we increase our convenience and efficiency, but we also expose ourselves to significant safety challenges, particularly in home automation platforms like openHAB. openHAB’s rule-based trigger-condition-action (TCA) paradigm allows for extensive flexibility in designing one’s home system, but increases the risk of unintended rule interactions, leading to unpredictable or unsafe behaviors. This paper presents oHIT, a novel framework for detecting Rule Interaction Threats in openHAB systems. oHIT systematically analyzes openHAB rules files, identifies foundational threat categories — including Action Contradiction, Trigger Cascade, and Condition Cascade — and differentiates between strong and weak variations of these threats. The framework leverages static analysis, transformation techniques, and symbolic reasoningto enable efficient threat detection. Evaluations show that oHIT achieves overall precision of 79% with a recall of 100% in detecting Rule Interaction threats on two real-world datasets, demonstrating oHIT’s effectiveness. This research addresses a critical gap in IoT safety analysis, paving the way for safer and more reliable automation in interconnected environments.

The safety and privacy of medical devices is critical, as they directly affect the health of users and handle sensitive personal data. Ensuring that these devices meet safety and security standards is essential, especially with the rise of do-it-yourself solutions such as open-source artificial pancreas systems (APSs) for insulin delivery. In this work, we study AndroidAPS, an APS controller written in Kotlin, and propose an approach to detect safety and security issues. We develop a modeling and analysis framework for Kotlin applications that extracts a structural model and supports detecting logging vulnerabilities and ensuring the application of safety constraints. We conduct two experiments. The first examines logging behavior to check for privacy risks. Out of $\mathbf{3, 0 5 9 ~ l o g g i n g}$ instances, our tool identified 48 sinks that received 144 sensitive flows, with $68 \%$ precision due to coarse-grained flagging. The second experiment verifies that calculation-related values are validated against safety constraints before being set to the profile. We show that AndroidAPS generally adheres to its safety design properties, but it has one calculation-related value that is not explicitly validated at the plugin level and only partially validated earlier in the flow.

Innovative Internet of Things (IoT) technologies promise to automate users' routines, thereby improving their daily lives. With the rapid increase in IoT-connected devices, unexpected behaviors resulting from unplanned or unanticipated interactions between numerous IoT applications pose significant risks, particularly in critical domains like healthcare systems, automotive, manufacturing, and smart cities. This thesis proposes a Model-Driven Engineering (MDE) approach to support the verification of safety and security properties in interacting heterogeneous IoT applications. The proposed method intends to apply to both existing IoT applications and those under development, ensuring these apps operate safely and securely in their interactions.

The Ethereum blockchain’s smart contract is a programmable transaction that performs general-purpose computations and can be executed automatically on the blockchain. Leveraging this component, blockchain technology (BT) has grown beyond the scope of cryptocurrencies and can now be applicable in various industries other than finance. In this paper, we investigated the current trends in Ethereum-based decentralized applications (DApps) to be able to categorize and analyze the DApps to measure the complexity of smart contracts behind them, their level of security and their correlation to the maintainability of the DApps. We leveraged the source code analysis, security analysis, and the developmental metadata of the DApps to infer this correlation. Based on our findings, we concluded that the maintainability of Ethereum DApps is proportional to the code size, number of functions, and, most importantly, the number of outgoing invocations and statements in the smart contracts.

Summary With the growing and widespread use of Internet of Things (IoT) in our daily life, its security is becoming more crucial. To ensure information security, we require better security analysis tools for IoT applications. Hence, this paper presents an automated framework to evaluate taint‐flow analysis tools in the domain of IoT applications. First, we propose a set of mutational operators tailored to evaluate three types of sensitivity analysis, flow, path and context sensitivity. Then we developed mutators to automatically generate mutants for those types. We demonstrated the framework on a subset of mutational operators to evaluate three taint‐flow analysers, SaINT, Taint‐Things and FlowsMiner. Our framework and experiments ranked the taint analysis tools according to precision and recall as follows: Taint‐Things (99% recall, 100% precision), FlowsMiner (100% recall, 87.6% precision) and SaINT (100% recall, 56.8% precision). To the best of our knowledge, our framework is the first framework to address the need for evaluating taint‐flow analysis tools and specifically those developed for IoT SmartThings applications.

The advancements in the digitization world has revolutionized the automotive industry. Today's modern cars are equipped with internet, computers that can provide autonomous driving functionalities as well as infotainment systems that can run mobile operating systems, like Android Auto and Apple CarPlay. Android Automotive is Google's android operating system tailored to run natively on vehicle's infotainment systems, it allows third party apps to be installed and run on vehicle's infotainment systems. Such apps may raise security concerns related to user's safety, security and privacy. This paper investigates security concerns of in-vehicle apps, specifically, those related to inter component communication (ICC) among these apps. ICC allows apps to share information via inter or intra apps components through a messaging object called intent. In case of insecure communication, Intent can be hijacked or spoofed by malicious apps and user's sensitive information can be leaked to hacker's database. We investigate the attack surface and vulnerabilities in these apps and provide a static analysis approach and a tool to find data leakage vulnerabilities. The approach can also provide hints to mitigate these leaks. We evaluate our approach by analyzing a set of Android Auto apps downloaded from Google Play store, and we report our validated results on vulnerabilities identified on those apps.

This paper presents an approach for the identification of vulnerable IoT applications using deep learning algorithms. The approach focuses on a category of vulnerabilities that leads to sensitive information leakage which can be identified using taint flow analysis. First, we analyze the source code of IoT apps in order to recover tokens along their frequencies and tainted flows. Second, we develop, Token2Vec, which transforms the source code tokens into vectors. We have also developed Flow2Vec, which transforms the identified tainted flows into vectors. Third, we use the recovered vectors to train a deep learning algorithm to build a model for the identification of tainted apps. We have evaluated the approach on two datasets and the experiments show that the proposed approach of combining tainted flows features with the base benchmark that uses token frequencies only, has improved the accuracy of the prediction models from 77.78% to 92.59% for Corpus1 and 61.11% to 87.03% for Corpus2.

In this paper, we present an automated framework to evaluate taint flow analysis tools in the domain of IoT (Internet of things) apps. First, we propose a set of mutational operators tailored to evaluate flow-sensitive analysis tools. Then we developed mutators to automatically generate mutants for this type of sensitivity analysis. We demonstrated the framework on flow- sensitivity mutational operators to evaluate two taint flow analyzers, SaINT and Taint-Things. To the best of our knowledge, our framework is the first framework to address the need for evaluating taint flow analysis tools specifically developed for IoT SmartThings apps.

The permission system in the SmartThings platform governs how apps access devices. The system was designed to protect devices from third-party apps, by forcing apps to access devices through their capabilities. Design flaws in the system result in apps being over-privileged with unauthorized capabilities. This vulnerability represents serious security challenges to this platform and its users. In this paper, we present an automated tool that can identify over-privilege vulnerability in SmartThings apps. We have identified common patterns, and we have used this knowledge to design our automated over-privilege detection tool. We have evaluated the effectiveness of our tool on 222 official and third-party apps, and we have found that approximately 5.5% of defined devices were misused with 76 identified instances of over-privilege.

SimNav is a graphical user interface designed for displaying and navigating clone classes of Simulink models detected by the model clone detector Simone. As an embedded Simulink interface tool, SimNav allows model developers to explore detected clones directly in their own model development environment rather than a separate research tool interface. SimNav allows users to open selected models for side-by-side comparison, in order to visually explore clone classes and view the differences in the clone instances, as well as to explore the context in which the clones exist. This tool paper describes the motivation, implementation, and use cases for SimNav.

This paper presents a semi-automated framework for identifying and representing different kinds of variability in Simulink models. Based on the observed variants found in similar subsystem patterns inferred using Simone, a text-based model clone detection tool, we propose a set of variability operators for Simulink models. By applying these operators to six example systems, we are able to represent the variability in their similar subsystem patterns as a single subsystem template directly in the Simulink environment. The product of our framework is a single consolidated subsystem model capable of expressing the observed variability across all instances of each inferred pattern. The process of pattern inference and variability analysis is largely automated and can be easily applied to other collections of Simulink models. The framework is aimed at providing assistance to engineers to identify, understand, and visualize patterns of subsystems in a large model set. This understanding may help in reducing maintenance effort and bug identification at an early stage of the software development.

Model-clone detection is a relatively new area and there are a number of different approaches in the literature. As the area continues to mature, it becomes necessary to evaluate and compare these approaches and validate new ones that are introduced. We present a mutation-analysis based model-clone detection framework that attempts to automate and standardize the process of comparing multiple Simulink model-clone detection tools or variations of the same tool. By having such a framework, new research directions in the area of model-clone detection can be facilitated as the framework can be used to validate new techniques as they arise. We begin by presenting challenges unique to model-clone tool comparison including recall calculation, the nature of the clones, and the clone report representation. We propose our framework, which we believe addresses these challenges. This is followed by a presentation of the mutation operators that we plan to inject into our Simulink models that will introduce variations of all the different model clone types that can then be searched for by each respective model-clone detector.

While graph-based techniques show good results in finding exactly similar subgraphs in graphical models, they have great difficulty in finding near-miss matches. Text-based clone detectors, on the other hand, do very well with near-miss matching in source code. In this paper we introduce SIMONE, an adaptation of the mature text-based code clone detector NICAD to the efficient identification of structurally meaningful near-miss subsystem clones in graphical models. By transforming graph-based models to normalized text form, SIMONE extends NICAD to identify near-miss subsystem clones in Simulink models, uncovering important model similarities that are difficult to find in any other way.

Software teams, as they communicate throughout the life-cycle of their projects, generate a substantial stream of textual data. Through emails and chats, developers discuss the requirements of their software system, they negotiate the distribution of tasks among them, and they make decisions about the system design, and the internal structure and functionalities of its code modules. The software research community has long recognized the importance and potential usefulness of such textual information. In this paper, we discuss our recent work on systematically analyzing several textual streams collected through our WikiDev2.0 tool. We use two different text-analysis methods to examine five different sources of textual data. We report on our experience using our method on analyzing the communications of a nine-member team over four months.

Abstract Models are considered an essential step in capturing different system behaviours and simplifying the analysis required to check or improve the quality of software. Verification and testing of web software requires effective modelling techniques that address the specific challenges of web applications. In this study we survey 24 different modelling methods used in web site verification and testing. Based on a short catalogue of desirable properties of web applications that require analysis, two different views of the methods are presented: a general categorization by modelling level, and a detailed comparison based on property coverage. Copyright © 2008 John Wiley & Sons, Ltd.