The increasing penetration of renewable energy generation (REG) introduces significant uncertainty into power grids, posing heightened risks for cascading failures. In this paper, a Markov tree model is proposed to assess the risk of cascading failure in power grid with uncertain REG. The model captures the diverse failure paths caused by REG uncertainty, representing the cascading failure process as a sequence of state transitions with probabilities reflecting the likelihood of state transitions. To identify critical tripping branches during cascading failure propagation, a hybrid probability-interval method is introduced. Probabilistic power flow analysis identifies branches with overload risk, while interval positional relationships rank their severity. To improve the efficiency of risk assessment, a risk-based depth-first search (R-DFS) method is proposed. This method uses estimated risk indices to prioritize high-risk failure paths while pruning low-risk paths, significantly reducing simulation time while maintaining assessment accuracy. Compared with existing models, the proposed model balances simulation efficiency and accuracy, effectively identifying high-risk failure paths under REG uncertainty. Simulation results demonstrate the impact of threshold selection on the retention of high-risk paths and simulation performance, providing insights into managing cascading failure risks in power grid with high REG penetration.

Ever since its initial release in 2008, the Android OS has rapidly grown to become the world’s most widely used mobile OS. Mobile vendors extend the Android Open Source Project (AOSP) led by Google to customize their own Android variants. With the AOSP releasing new versions frequently, vendors need to periodically carry out Android upgrades that integrate the latest code changes from AOSP into their Android variants. Both the AOSP and Android variants independently undergo complex modifications. Consequently, Android upgrades often lead to merge conflicts caused by competing changes to the same code line. Vendors have devoted significant effort to understanding and resolving these problems. Despite extensive research on Android upgrades and merge conflicts, there is little understanding of the conflict-related activities performed in Android upgrade practice, and the corresponding challenges faced by practitioners . In this study, we employed a qualitative research methodology involving questionnaires with 120 practitioners and interviews with a leading Android vendor to explore the challenges and improvement opportunities. Our investigation demonstrates that the Android upgrade process is fundamentally an exercise in architectural evolution, necessitating the adoption of architectural thinking rather than relying on mere code-level patches to systematically address upgrade-induced challenges. We have identified challenges at different stages of Android upgrade implementation, including baseline analysis, conflict reason analysis, conflict resolution, and conflict impact analysis. Our findings indicate opportunities for enhancing the Android upgrade practice, particularly in documentation, management, refactoring activities, and team collaboration. Additionally, we outline future research directions from an architectural perspective. We envision that our study can benefit software ecosystems where customized downstream derivatives need to maintain co-evolution with their upstream core.

The architecture of software systems evolves along with their upgrades and maintenance, inevitably creating a gap between the defact architecture and the designed one. To perceive and fix the discrepancy, clustering-based architecture recovery methods have been developed to re-engineer the real-time system architecture from the code implementation. However, existing solutions still face several limitations. They underutilize both code-level and architecture-level semantics underlying the source code. Moreover, they overlook implicit structural dependencies that complement explicit ones to reflect code interactions. To address these challenges, we propose SemArc, an architecture recovery method that utilizes large language models to comprehend both implementation-level and architecture-level semantics, supported by well-established canonical architectural patterns as a knowledge base. SemArc also incorporates both implicit and explicit dependencies to complete the system behavior representations. Additionally, SemArc introduces a component-as-anchor guided clustering algorithm to improve the clustering process. We evaluated SemArc on 15 software systems written in C/C++, Java, and Python, using five different metrics. The results demonstrate that SemArc outperforms seven baseline methods by an average of 32 percentage points. We also examined how three factors—code semantics, architectural semantics, and implicit dependencies—as well as different levels of architectural semantic descriptions, influence recovery accuracy. A case study on the Bash project indicates that SemArc has the potential to yield even more precise recovery results than those labeled by humans.

Yu Wang, Shiwan Zhao, Zhihu Wang, Ming Fan, Xicheng Zhang, Yubo Zhang, Zhengfan Wang, Heyuan Huang, Ting Liu. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 2025.

Phone vendors customize their Android variants to enhance system functionalities based on the Android Open Source Project (AOSP). While independent development, Android variants have to periodically evolve with the upstream AOSP and merge code changes from AOSP. Vendors have invested great effort to maintain their variants and resolve merging conflicts. In this paper, we characterize the design smells with recurring patterns that break the design boundary between Android variants and AOSP. These smells are manifested as problematic dependencies across the boundary, hindering Android variants' maintainability and co-evolution with AOSP. We propose the DroidDS for automatically detecting design smells. We collect 22 Android variant versions and 22 corresponding AOSP versions, involving 4 open-source projects and 1 industrial project. Our results demonstrate that: files involved in design smells consume higher maintenance costs than other files; these infected files are not merely the files with large code size, increased complexity, and object-oriented smells; the infected files have been involved in more than half of code conflicts induced by re-applying AOSP's changes to Android variants; a substantial portion of design issues could be mitigable. Practitioners can utilize our DroidDS to pinpoint and prioritize design problems for Android variants. Refactoring these problems will help keep a healthy coupling between diverse variants and AOSP, potentially improving maintainability and reducing conflict risks.

With the advance application of blockchain technology in various fields, ensuring the security and stability of smart contracts has emerged as a critical challenge.Current security analysis methodologies in vulnerability detection can be categorized into static analysis and dynamic analysis methods.However, these existing traditional vulnerability detection methods predominantly rely on analyzing original contract code, not all smart contracts provide accessible code.We present ETrace, a novel event-driven vulnerability detection framework for smart contracts, which uniquely identifies potential vulnerabilities through LLM-powered trace analysis without requiring source code access.By extracting fine-grained event sequences from transaction logs, the framework leverages Large Language Models (LLMs) as adaptive semantic interpreters to reconstruct event analysis through chain-of-thought reasoning.ETrace implements patternmatching to establish causal links between transaction behavior patterns and known attack behaviors.Furthermore, we validate the effectiveness of ETrace through preliminary experimental results.

An increasing number of DeFi protocols are gaining popularity, facilitating transactions among multiple anonymous users.State Manipulation is one of the notorious attacks in DeFi smart contracts, with price variable being the most commonly exploited state variable-attackers manipulate token prices to gain illicit profits.In this paper, we propose PriceSleuth, a novel method that leverages the Large Language Model (LLM) and static analysis to detect Price Manipulation (PM) attacks proactively.PriceSleuth firstly identifies core logic function related to price calculation in DeFi contracts.Then it guides LLM to locate the price calculation code statements.Secondly, PriceSleuth performs backward dependency analysis of price variables, instructing LLM in detecting potential price manipulation.Finally, PriceSleuth utilizes propagation analysis of price variables to assist LLM in detecting whether these variables are maliciously exploited.We presented preliminary experimental results to substantiate the effectiveness of PriceSleuth.And we outline future research directions for PriceSleuth.

Multi-step attacks challenge security analysts in reconstructing attack sequences from extensive multi-host log data. Existing attack reconstruction approaches rely heavily on computationally intensive audit logs and provenance analysis, limiting their practicality in multi-host environments. We present MuSAR, a framework for real-time reconstruction of multi-step attacks in multi-host environments using lightweight security logs (network alarms and application logs). First, security logs are consolidated into inter-host and intra-host security events through semantic analysis, respectively. Then, these security events are mapped to unified attack lifecycle stages through MITRE ATT&CK framework integration. Finally, a heuristic algorithm is implemented to identify potential multi-step attacks and reconstruct complete attack sequences based on event-level semantic associations. Evaluation on the CPTC2018 dataset and a multi-step attack simulation dataset demonstrates MuSAR’s effectiveness in identifying attack-related traces and reconstructing multi-step attacks, achieving an average recall of $93.48 \%$ and F1-score of $94.39 \%$, respectively, outperforming state-of-the-art methods in attack investigation and reconstruction in multi-host environments.

Distribution grid with electric vehicle (EV) charging infrastructure can be modeled as a coupled network consisting of the cyber network, distribution grid and traffic network. The interconnection of the coupled network allows attackers to launch cyber attacks and control numerous EVs to cause severe load fluctuations, thereby affecting the normal operation of the distribution grid and the traffic flow. To evaluate the cyber-physical security of the coupled network, we present a security assessment model formulated as a coupled Discrete Event System Specification (DEVS). In this model, the evolution of the coupled network is represented as state transitions triggered by events in a discrete-time process, while the interaction is achieved through event transmission, reception and processing. To determine the redistribution of states influenced by the selection of EV charging stations and moving paths, we propose a spatial-temporal evolution mechanism. Based on the assessment model, we propose an event-triggered simulation method. The efficiency of the proposed simulation method is evaluated by comparing it with the multi-layer synchronous simulation method. Compared with the existing security assessment models, the simulation results of our model are more accurate.

The frequent blackouts around the world in the past 20 years have brought the security of the power grid to a head. Among various hazard situations, cascading failure is the one with critical threats due to its widespread propagation and long duration. An effective way to prevent cascading failure is to identify the vulnerable set, which is defined as the composition of transmission line combinations that can initialize the sequence of failures. In this paper, we first elaborate cascading failure model and its adaptation under the scenario of interest. Then a novel framework of data-driven identification model is developed to replace the traditional flow-based detection process, which is computationally heavy. Specifically, a method that seamlessly achieves the globally topological features embedding by designing a tailored messaging mechanism adjusted for the power grid is proposed, overcoming the otherwise problem of the constrained neighborhood in existing graph convolution networks (GCNs). Besides, with the proposed pruning optimization method, the sparsity of the vulnerable set can be naturally enforced and combinatorial explosion is readily alleviated. Numerical experiments are conducted on 30-bus, 200-bus, and 500-bus systems, including static and dynamic load scenarios. All of them verify the excellent performance of the identification model for both effectiveness and efficiency.Note to Practitioners—This paper is motivated by a practical need for mitigate the security threat of cascading failures to power grid through the vulnerable set identification. Existing methods for identifying the vulnerable set have limitations, including a limited number of vulnerabilities identified and challenges related to the high time complexity of cascading failure simulators and combinatorial explosion. To address this issue, we develop a data-driven identification model that integrates both the physical and topological features of the power grid. This model reduces the reliance on cascading failure simulators and enhances the efficiency of vulnerable set identification. Additionally, the pruning optimization method is proposed to further mitigate the high time complexity caused by combinatorial explosion. Simulative studies conduct in both dynamic and static load scenarios validate the performance of the developed data-driven model, demonstrating its ability to achieve rapid identification of the vulnerable set and thereby improve the overall robustness of the power grid against cascading failures.

Fieldbus is widely used for real-time distributed control in Industrial Control Systems (ICSs) due to its simplicity and stability. The real-world fieldbus network contains hundreds of interconnected devices, presenting a widespread network layout. Attackers can attach external intrusion devices to these communication lines to launch various attacks. In this paper, we model the fieldbus network’s channel fingerprint based on the signal’s amplitude and propose a detection method to identify potential attackers (silent intrusion devices that are eavesdropping) via channel fingerprint differences. Leveraging the passive fail-safe biasing voltage in the fieldbus network such as RS485, we can still detect the intrusion device when the fieldbus is idle (i.e., no devices are transmitting commands), which can significantly reduce the detection delay with lower sampling costs. Moreover, our method can adapt to environmental changes with little computational overhead by generating dynamic thresholds. Using a monitoring unit with stored channel fingerprints, our method can be easily deployed in fieldbus networks without occupying communication resources. The effectiveness and robustness of the proposed method have been demonstrated via extensive experiments on two real-world scenarios and one simulation scenario, where we can achieve 100% accuracy and 0% false alarm rates against various intrusion devices. Note to Practitioners—This paper is motivated by a practical need for detecting unauthorized intrusion devices in fieldbus networks. Existing detection methods face several challenges: active detection methods based on traffic analysis may disrupt normal bus communication, and it is hard to identify silent intrusion devices that are eavesdropping. Moreover, adapting these methods to changing environments is still challenging and costly. To address these issues, we leverage the inevitable amplitude differences in fail-safe biasing voltage signals and benign devices’ communication voltage signals to detect intrusion devices passively. Furthermore, to adapt to rapidly changing environments, we generate the detection thresholds dynamically based on the hypothesis testing theory. Extensive physical and simulation experiments demonstrate that the detection method against physical intrusion attacks is accurate and robust.

The increasing penetration of renewable energy generation (REG) introduces high levels of uncertainty into power grid, potentially causing significant impacts on the evolution of cascading failure. In this paper, we propose a failure tree model that encompasses all possible failure paths resulting from the uncertain power injections from REG to describe the dynamic process of cascading failure in power grid. In order to obtain the failure paths of cascading failure, we propose an interval overload tripping mechanism to model relay protection based on the uncertainty set of REG and dynamic interval power flow. On the basis of the proposed model, we design a forward-backward tree search to efficiently evaluate the impact of the uncertain REG on cascading failure. Compared with the probabilistic power flow (PPF) model and scenario-based model, the simulation results of our model are more accurate because the statistical distribution of demand loss in our model is closer to Monte Carlo simulation (MCS). The efficiency of the proposed simulation method is demonstrated by comparing our model with the MCS under various sample numbers and two existing models. Finally, we analyze the influence of REG uncertainty level and penetration level on cascading failure and simulation performance. Note to Practitioners—To achieve accurate and fast cascading failure analysis in power grid with renewable energy generation (REG), this paper develops a failure tree model that considers the impact of uncertain injected power of REG on the dynamic process of cascading failure. In the model, the dynamic interval power flow and interval overload tripping mechanism are proposed to simulate the physical responses during cascading failure, including power flow redistribution, transmission branch outage and frequency regulation. Therefore, the model is more accurate in describing the actual characteristics of cascading failure in power grid with REG. This will facilitate the development and evaluation of control strategies aimed at improving the stability of power grid. Meanwhile, the model provides a good example for researchers and engineers to simulate network systems without detailed information about the probability distribution of uncertain injection variables. Based on the proposed model, we develop a forward-backward tree search, which allows the decision-maker to make a satisfactory trade-off between accuracy and time consumption. This algorithm allows for fast control strategy implementation to prevent failure propagation.

Thermal energy equipment, a critical component for transferring and utilizing thermal energy derived from primary energy sources, is indispensable in Industrial Control Systems (ICSs). With the deep integration of information technologies, ICSs are threatened by new cyber-physical security risks, where the physical systems could be influenced by attacks from the cyber network. While cyber-physical security risks in ICSs have been well studied in various domains, such as power systems and smart structural systems, little attention has been paid to the cyber-physical security of thermal energy equipment. In this paper, we propose a novel cyber-physical threat against thermal energy equipment, namely the Network-Energy-Stress Threat (NEST), which reveals attacks from the cyber network could induce an inhomogeneous distribution of thermal energy, thus causing remarkable thermal stress that can induce physical damage to the thermal energy equipment. From the attacker’s perspective, we propose an inherent vulnerability-based algorithm to explore the threat space of potential attack strategies and find an approximately optimal attack strategy utilizing the nonlinear NEST model. Then, we propose a cyber-physical defense method to detect anomalous states stemming from the NEST. Experimental results on a simulated Solar Power Tower (SPT) plant have validated the existence of the NEST against thermal energy equipment and demonstrated the effectiveness of the proposed algorithm and the proposed detector. Note to Practitioners— This paper is motivated by the practical threat of physical damage to Industrial Control Systems (ICSs) caused by cyber-physical attacks. While cyber-physical security risks in ICSs have been well studied across plenty of types of ICS and physical infrastructures, there is a lack of a framework to describe cyber-physical threats to thermal energy equipment. To address this issue, we propose the Network-Energy-Stress Threat (NEST) to reveal how cyber attacks can induce abnormal thermal stress, causing physical damage to thermal energy equipment—a critical component widely deployed in ICSs. The existence of the NEST has been demonstrated through experimental results on a simulated Solar Power Tower (SPT) plant.

In the security operation center, false positive alerts generated by security devices overwhelm security operators, leading to alert fatigue and inefficiency in identifying real threats. This paper introduces DEEPDRAC, a disposition recommendation method for alert clusters that is based on security event patterns. Our main idea is to reconstruct isolated alerts into security events and capture their essential threat characteristics as patterns. By recommending pattern information, we enable batch interpretable disposal of alerts. First, DEEPDRAC aggregates correlated alerts to a graph, representing a security event. Then, it extracts the features of the security event from two aspects: basic features via statistical methods and detailed features via a carefully designed Graph Neural Network (GNN) that focuses on edge features. Since many false alerts triggered by the same cause often recur in a fixed pattern, DEEPDRAC translates basic features into interpretable descriptors to define the basic pattern, whereas GNN embeddings complement detailed semantic information, serving as the detailed pattern, together forming the pattern of the security event. The pattern describes the critical information of the security event, so security events with the same pattern are clustered for batch processing. Finally, with few manually labeled security events, DEEPDRAC can conduct automatic disposition recommendations for newly arrived alerts, significantly reducing the workload of alert analysis. We evaluate our approach on two benchmark datasets (i.e., DARPA 1999 and CIC-IDS2017) and a real-world dataset from a large power company. The extensive experimental results demonstrate that our approach can alleviate alert fatigue more efficiently and accurately than the two state-of-the-art defense approaches can.

Android, being one of the most widely used mobile systems, is facing pressing threats from malware. Despite the effectiveness of Android malware detection (AMD) systems, they are still vulnerable to state-of-the-art adversarial attacks. Existing defense methods require the knowledge of target adversaries, such as attack algorithms or obfuscation strategies, which is impractical in real-world scenarios. Additionally, these approaches may adversely affect the performance of the detection model and fail to defend against problem-space attacks, which not only deceive the detection models but also generate executable adversarial software. To address this research gap, we propose a novel interpretable Android guard system, named IADGuard, to help AMD defend against attacks. IADGuard first designs a novel graph explainable method, AGExplainer, to identify suspicious functions and invocations in adversarial malware. With the guidance of AGExplainer, IADGuard develops a rectifier to reverse adversarial modifications on apps’ function invocation relations, which facilitates the detection of adversarial malware by victim AMD. It is noteworthy that IADGuard requires zero knowledge of adversarial models and victim models, thereby preserves the performance of victim AMD. We validate IADGuard over three state-of-the-art problem space attacks that modify apps’ function invocation relations to deceive victim AMD. Experimental results show that IADGuard achieves over 90.5% defense success rate, i.e., helps victim AMD identify adversarial malware. Furthermore, AGExplainer surpasses representative interpreters in identifying essential modifications, helps IADGuard reduce false positives to 1.5%, and improves the detection efficiency by up to 10.4 times.

Over the past two decades, frequent blackouts have highlighted the critical importance of ensuring the security of power grid. The integration of cyber and physical domains through intelligent devices has increased the risk of asynchronous attacks that can trigger cascading failures. One effective approach to mitigating this threat is to identify vulnerable sequences, which are sequences of transmission lines that can cause large-scale failures in the power grid. This article proposes an event-triggered hybrid system model to characterize the generation and propagation mechanism of sequential cascading failures. In addition, the problem of identifying vulnerable sequences is formulated as a Markov decision process. To solve the sequential decision problem in approximately contiguous states, a vulnerable sequence identification method based on reinforcement learning is designed. Furthermore, a topological feature embedding algorithm based on matrix decomposition is proposed to improve identification performance. To evaluate the effectiveness of the proposed method, various numerical experiments are conducted on IEEE 30-bus and ACTIVSg 200-bus systems. The results of these experiments demonstrate the excellent performance of the proposed method.

Consensus-based distributed economic dispatch (ED) algorithms are promising solutions to the smart grid ED problem. However, distributed algorithms necessitate data sharing among system nodes, potentially compromising node privacy. This study proposes a privacy-preserving method based on state decomposition. By introducing random noises, the shared data of a node is decomposed into several parts, and each neighbor of the node receives only a random subset of the original data, thereby increasing the difficulty of inferring the node’s privacy from its shared data. It is theoretically proved that the method can preserve privacy without compromising the algorithm optimality. Compared to existing works, the method simultaneously achieves privacy preservation, optimality, low cost, and does not require extra communication. Moreover, the method is developed in a challenging scenario, where adversaries know the connection weights between each pair of nodes, ensuring no privacy is disclosed even if weight information is leaked. The effectiveness is validated on the IEEE 57-bus and IEEE 300-bus systems through comparisons with existing privacy-preserving methods.

In industrial control systems, terminal devices in fieldbus networks are vulnerable to physical intrusion attacks, where attackers can directly install external intrusion devices. Currently, the localization capabilities of existing methods for intrusion devices are limited. As the reflection signals in transmitted signals are imperceptible and difficult to extract, many methods focus on actively transmitting pulse signals to locate intrusion devices. In this article, we enhance the reflection signals in transmitted signals by parallel connection of an appropriate resistor with the gateway and propose a localization method based on the collaboration of multiple devices' reflection signals. This method can significantly improve localization precision while reducing the sampling rate and does not occupy communication bandwidth. Experimental results on a real-world controller area network testbed demonstrate that our method can achieve a localization precision of 5 cm when locating intrusion devices under a sampling rate of 50 MS/s.

Recent studies have proposed moving target defense (MTD) to detect false data injection (FDI) attacks in power grids. To hide the activation of MTD from attackers, a hidden MTD (HMTD) has been proposed, which keeps the system power flow after MTD unchanged. It has been proved that HMTD cannot detect all FDI attacks because of its stealthiness requirements. However, the mathematical mechanism of MTD's stealthiness has yet to be revealed. The maximum detection capability of HMTD is also unclear. To address the abovementioned issues, we first analyze the maximum detection capability of HMTD based on graph theory and propose the topological condition to achieve it. Moreover, we study the essential characteristics of HMTD and find that all HMTD schemes are in a space spanned by branch parameters. We further propose a multistage HMTD (MHMTD) method to select multiple HMTD schemes in this space to maximize the detection capability. Experiments show that the MHMTD can maximize the detection capability of HMTD in all test systems with high stealthy probability.

Binary function similarity detection plays an important role in a wide range of security applications. Existing works usually assume that the query function and target function share equal semantics and compare their full semantics to obtain the similarity. However, we find that the function mapping is more complex, especially when function inlining happens.

Dependency extraction based on static analysis lays the groundwork for a wide range of applications. However, dynamic language features in Python make code behaviors obscure and nondeterministic; consequently, it poses huge challenges for static analyses to resolve symbol-level dependencies. Although prosperous techniques and tools are adequately available, they still lack sufficient capabilities to handle object changes, first-class citizens, varying call sites, and library dependencies. To address the fundamental difficulty for dynamic languages, this work proposes an effective and practical method namely PyAnalyzer for dependency extraction. PyAnalyzer uniformly models functions, classes, and modules into first-class heap objects, propagating the dynamic changes of these objects and class inheritance. This manner better simulates dynamic features like duck typing, object changes, and first-class citizens, resulting in high recall results without compromising precision. Moreover, PyAnalyzer leverages optional type annotations as a shortcut to express varying call sites and resolve library dependencies on demand. We collected two micro-benchmarks (278 small programs), two macro-benchmarks (59 real-world applications), and 191 real-world projects (10MSLOC) for comprehensive comparisons with 7 advanced techniques (i.e., Understand, Sourcetrail, Depends, ENRE19, PySonar2, PyCG, and Type4Py). The results demonstrated that PyAnalyzer achieves a high recall and hence improves the F1 by 24.7% on average, at least 1.4x faster without an obvious compromise of memory efficiency. Our work will benefit diverse client applications.

In the field of software development, the application of code quality check tools has become a key factor in improving product quality and development efficiency. While many existing tools are effective at detecting common problems in code, there are still some limitations. Firstly, these tools rely on predefined rules that may not fully encompass real-world coding challenges. Secondly, a lack of consideration of dependencies leads to failure to report violations occurring across files or modules. Third, the metrics used by these tools primarily focus on object-oriented programming, limiting their ability to assess software quality from the perspective of nationalized standards. To address these issues, this work proposes a dependency-enhanced method namely ERD-CQC for code quality detection and measurement. ERD-CQC provides 88 detection rules and 45 metrics, supplementing checking rules in categories such as Circuit Breaking, Serializable, and Security. ERD-CQC constructs an infused graph by integrating abstract syntax trees (ASTs), entities, and dependencies for violation detection. Based on the detection results, ERD-CQC provides a code quality measurement system with 4 nationalized standard dimensions for the purpose of measuring code quality from multiple perspectives. To validate the effectiveness of ERD-CQC, we manually examined 647 compliant and 528 non-compliant code snippets. ERD-CQC achieves the recall and F1 score exceeding 98%. We also collected open-source projects and closed-source projects in the real world, containing a total of 4,319 non-compliant code snippets. On this real-world benchmark, the average F1 score of ERD-CQC is 11.44% higher than the advanced tool SonarQube. Finally, we visualized the quality measurement results based on metrics and found that open-source and closed-source projects have certain patterns in metric performance. Our work will benefit developers in checking, evaluating, and monitoring their software quality comprehensively.

Malicious Android applications often employ covert behaviors to exfiltrate sensitive data, thereby compromising user privacy. Traditional detection techniques predominantly utilize static analysis of the source code to detect such sensitive behaviors, yet they are frequently plagued by elevated false positive rates. While dynamic analysis methods offer greater precision, they contend with the challenge of limited coverage. This paper introduces LIReDroid, a hybrid testing approach that aims to replicate sensitive behaviors identified in static analysis call chains. LIReDroid firstly analyze the application’s static invocation chain. Then LIReDroid devises a prompt word model for the generation of test instructions and injection script code. Ultimately, sensitive API call chains are dynamically invoked through code injection, with their activation being meticulously recorded. We presented preliminary experimental results to substantiate the efficacy of LIReDroid. Given these results, we outline future research directions for LIReDroid.

Mobile apps often access personal information to meet business needs, raising concerns about privacy breaches. Compliance detection methods are proposed to check for inconsistencies between program code and privacy policies. However, existing methods face challenges with the low efficiency of static data flow analysis tools and often neglect physical data transmission destinations.

The rising popularity of mini-programs deployed on super-app platforms has drawn significant attention due to their convenience. However, developers' improper handling of data permission application in mini-programs has raised concerns about non-compliance and violations. Unfortunately, existing tools lack the capability to support the construction of a universal function call graph for the mini-program and the literature lacks a comprehensive and systematic study of the abusive issues. To bridge this gap, this paper introduces an automated tool, MiniChecker, to uncover the abusive permission request behavior in mini-programs. It defines five primary categories of abusive issues, namely homepage pop-up, overlaying pop-up, bothering pop-up, repeating pop-up, and looping pop-up, based on the request behavior features. MiniChecker achieves a detection precision rate of 82.4% and a recall rate of 95.3% on our benchmark, and identifies 3,866 risky mini-programs out of 20,000 real-world mini-programs. Our analysis reveals inherent design flaws in the mini-program permission mechanism, and we have shared our findings with several mini-program platforms.

Smart contracts are susceptible to various vulnerabilities that can be exploited by hackers via developing adversarial contracts. Existing vulnerability detection techniques often concentrate solely on vulnerable contracts, neglecting adversarial contracts, which may weaken the effectiveness of vulnerability detection and fail to meet practical needs.

Smart contracts are prone to vulnerabilities, with reentrancy attacks posing significant risks due to their destructive potential. While various methods exist for detecting reentrancy vulnerabilities in smart contracts, such as static analysis, these approaches often suffer from high false positive rates and lack the ability to directly illustrate how vulnerabilities can be exploited in attacks.

Icons are ubiquitous visual elements in graphic design, yet their creation is often complex and time-consuming. To resolve this problem, we draw inspiration from the booming text-to-image field and propose Text-Guided Icon Set Expansion, a novel task that helps users design high-quality icons using textual descriptions. Besides, users can control the style consistency of the created icons by inputting a few hand-crafted icons as style reference. Despite its practicality, the task poses two unique challenges. (i) Abstract Concept Visualization. Abstract concepts like technology and health are frequently encountered in icon creation, but their visualization is not straightforward and requires a grounding process that translates them into physical, easy-to-depict objects. (ii) Fine-grained Style Transfer. Unlike ordinary images, icons exhibit richer fine-grained stylistic elements, including tones, line widths, shapes, shadow effects, etc., which puts higher demands on capturing and preserving detailed styles during icon generation.

Cascading failures pose a significant security threat to networked systems, with recent global incidents underscoring their destructive potential. The security threat of cascading failures has always existed, but the evolution of cyber-physical systems (CPSs) has introduced novel dimensions to cascading failures, intensifying their threats owing to the intricate fusion of cyber and physical domains. Addressing these threats requires a nuanced understanding achieved through failure modeling and vulnerability analysis. By analyzing the historical failures in different CPSs, the cascading failure in CPSs is comprehensively defined as a complicated propagation process in coupled cyber and physical systems, initialized by natural accidents or human interference, which exhibits a progressive evolution within the networked structure and ultimately results in unexpected large-scale systemic failures. Subsequently, this study advances the development of instructions for modeling cascading failures and conducting vulnerability analyses within CPSs. The examination also delves into the core challenges inherent in these methodologies. Moreover, a comprehensive survey and classification of extant research methodologies and solutions are undertaken, accompanied by a concise evaluation of their advancements and limitations. To validate the performance of these methodologies, numerical experiments are conducted to ascertain their distinct features. In conclusion, this article advocates for future research initiatives, particularly emphasizing the exploration of uncertainty analysis, defense strategies, and verification platforms. By addressing these areas, the resilience of CPSs against cascading failures can be significantly enhanced.

The rapid development of distributed control technologies has made Fieldbus networks widely used in industrial control systems (ICSs). Meanwhile, the weak security protection of Fieldbus networks exposes potential attack paths for attackers. Attackers can tap covert and unauthorized external devices (i.e., intrusion devices) into the network to launch attacks. As the intrusion device can remain silent when eavesdropping, there is no detectable abnormal traffic in the network to detect the intrusion device. In this paper, we analytically prove that the observed signals sent from any benign device will inevitably change when the intrusion device is tapped into the Fieldbus network. With this knowledge, we construct the channel-state group fingerprint from the communication signals of each benign device and propose a collaborative intrusion detection mechanism for physical access, PhyCID, to passively detect the covert intrusion device. Detection results on a real power distribution cabinet, an RS485 bus testbed, and a controller area network (CAN) bus testbed indicate that PhyCID is purely passive, environmentally adaptive, and protocol-independent in most Fieldbus networks, including RS485 and CAN. Furthermore, extensive experiments under different scenarios demonstrate the effectiveness and robustness of PhyCID.

Deep neural networks (DNNs) and natural language processing (NLP) systems have developed rapidly and have been widely used in various real-world fields. However, they have been shown to be vulnerable to backdoor attacks. Specifically, the adversary injects a backdoor into the model during the training phase, so that input samples with backdoor triggers are classified as the target class. Some attacks have achieved high attack success rates on the pre-trained language models (LMs), but there have yet to be effective defense methods. In this work, we propose a defense method based on deep model mutation testing. Our main justification is that backdoor samples are much more robust than clean samples if we impose random mutations on the LMs and that backdoors are generalizable. We first confirm the effectiveness of model mutation testing in detecting backdoor samples and select the most appropriate number of mutants and mutation operators. We then systematically defend against three extensively studied backdoor attack levels (i.e., char-level, word-level, and sentence-level) by detecting backdoor samples. We also make the first attempt to defend against the latest style-level backdoor attacks. We evaluate our approach on three benchmark datasets (i.e., IMDB, Yelp, and AG news) and three style transfer datasets (i.e., SST-2, Hate-speech, and AG news). The extensive experimental results demonstrate that our approach can detect backdoor samples more efficiently and accurately than the three state-of-the-art defense approaches.

The estimation of the nodal admittance matrix is an important problem for the power grid operation and computing tasks. Some studies have shown that the admittance matrix can be fuzzily estimated only by the injection power measurements. Nevertheless, the estimation results of most existing efforts are not ideal because of the problem's nonconvex properties, and the effects of measurement observability on the accuracy of estimation methods are not clear either. In this article, we establish an ill-posed inverse dc power flow (IDCPF) problem model and propose an admittance matrix estimation method based on multimeasurements of the power grid, including measurements of injection power and voltage phasor. Our approach converts the original problem into solvable linear subproblems and improves the estimation models by considering various physical mechanisms of the power grid. Additionally, we develop an optimization algorithm that leverages alternating least-square and alternating direction methods of multipliers for solving the IDCPF problem. We also demonstrate the detailed analysis and proof of the effects of phasor measurement observability on the accuracy of the estimation. The effectiveness and performance of our method are verified based on experiments using IEEE 30-bus and 118-bus systems.

Consensus-based distributed energy management (DEM) algorithm is a promising approach to manage distributed energy resources in microgrids. However, it introduces new risks of cyber-attacks to microgrids. This article proposes a new data integrity attack against consensus-based DEM algorithm, which enables the attacker to manipulate the power scheduling result of the attacked node and ultimately compromise its economic benefits. Specifically, we design a method to infer the privacy data of the attacked node from its broadcast information, and then use the inferred privacy data to design the false data that can manipulate the power scheduling result of the attacked node. The proposed method includes an analysis of the relationship between the difficulty of launching such an attack and the system topology, some findings contribute to designing a more secure communication topology. The attack offers higher stealthiness as it does not break power balance and the consistency of consensus variables, its effectiveness is verified on a 16-node microgird.

As software continues to evolve and business functions become increasingly complex, architectural inconsistency arises when the implementation architecture deviates from the expected architecture design. This architectural problem makes maintenance difficult and requires significant effort to refactor. To assist labor-intensive refactoring, automated refactoring has received much attention such as searching for optimal refactoring solutions. However, there are still three limitations: The recommended refactorings are insufficiently effective in addressing architectural consistency; the search process for refactoring solution is inefficient; and there is a lack of executable refactoring solutions. To address these limitations, we propose an effective, efficient, and executable refactoring recommendation approach namely the 3Erefactor for software architectural consistency. To achieve effective refactoring, 3Erefactor uses NSGA-II to generate refactoring solutions that minimize architectural inconsistencies at module level and entity level. To achieve efficient refactoring, 3Erefactor leverages architecture recovery technique to locate files requiring refactoring, helping accelerate the convergence of refactoring algorithm. To achieve executable refactoring, 3Erefactor designs a set of refactoring executability constraint strategies during the refactoring solution search and generation, including improving refactoring pre-conditions and removing invalid operations in refactoring solutions. We evaluated our approach on six open source systems. Statistical analysis of our experiments shows that, the refactoring solution generated by 3Erefactor performed significantly better than 3 state-of-the-art approaches in terms of reducing the number of architectural inconsistencies, improving the efficiency of the refactoring algorithm and improving the executability of refactorings.

Mini-app is an emerging form of mobile application that combines web technology with native capabilities. Its features, e.g., no need to download and no installation, have made it popular rapidly. However, privacy issues that violate the laws or regulations are breeding in the swiftly expanding mini-app ecosystem. Ensuring consistency between the mini-app's data practices embedded in its program code behavior and privacy policy description is crucial. But no work has systematically investigated the privacy problem of the mini-app before. To achieve this purpose, there are two main challenges. Firstly, the mini-app represents a novel application form, and a deficiency exists in information-sensitive code analysis tools capable of accurately discerning data practices from the code. Secondly, previous studies focusing on consistency have exhibited granularity issues related to data types and consistency patterns. This paper introduces MiniDetector, a novel approach for identifying consistency issues in mini-apps. MiniDetector employs data flow analysis to pinpoint data practices within the program code and utilizes a two-stage prompt engineering process to extract data practices from privacy policies. The results from both analyses are then compared to establish a consistency match. The proposed method undergoes sufficiency evaluations on a dataset comprising 70 mini-apps. Additionally, we conduct a comprehensive analysis of 100,000 mini-apps on the WeChat client in the wild, extracting 3,369 with privacy policies. Astonishingly, only 11 of these meet the consistency requirements, while 3,358 exhibit inconsistencies, resulting in an alarming inconsistency rate of 99.7%.

Creating layouts is a fundamental step in graphic design. In this work, we propose to use text as the guidance to create graphic layouts, i.e., Text-to-Layout, aiming to lower the design barriers. Text-to-Layout is a challenging task, because it needs to consider the implicit, combined, and incomplete layout constraints from text, each of which has not been studied in previous work. To address this, we present a two-stage approach, named parse-then-place. The approach introduces an intermediate representation (IR) between text and layout to represent diverse layout constraints. With IR, Text-to-Layout is decomposed into a parse stage and a place stage. The parse stage takes a textual description as input and generates an IR, in which the implicit constraints from the text are transformed into explicit ones. The place stage generates layouts based on the IR. To model combined and incomplete constraints, we use a Transformer-based layout generation model and carefully design a way to represent constraints and layouts as sequences. Besides, we adopt the pretrain-then-finetune strategy to boost the performance of the layout generation model with large-scale unlabeled layouts. To evaluate our approach, we construct two Text-to-Layout datasets and conduct experiments on them. Quantitative results, qualitative analysis, and user studies demonstrate our approach’s effectiveness.

Mobile device vendors develop their customized Android OS (termed downstream) based on Google Android (termed upstream) to support new features. During daily independent development, the downstream also periodically merges changes of a new release from the upstream into its development branches, keeping in sync with the upstream. Due to a large number of commits to be merged, heavy code conflicts would be reported if auto-merge operations failed. Prior work has studied conflicts in this scenario. However, it is still unclear about the coupling between the downstream and the upstream (We term this coupling as the dependency facade), as well as how merge conflicts are related to this coupling. To address this issue, we first propose the DepFCD to reveal the dependency facade from three aspects, including interface-level dependencies that indicate a clear design boundary, intrusion-level dependencies which blur the boundary, and dependency constraints imposed by the upstream non-SDK restrictions. We then empirically investigate these three aspects (RQ1, RQ2, RQ3) and merge conflicts (RQ4) on the dependency facade. To support the study, we collect four open-source downstream projects and one industrial project, with 15 downstream and 15 corresponding upstream versions. Our study reveals interesting observations and suggests earlier mitigation of merge conflicts through a well-managed dependency facade. Our study will benefit the research about the coupling between upstream and downstream as well as the downstream maintenance practice.

During long-term software evolution, it is inevitable that an accumulation of changes leads to architectural erosion and debt. Diverse metric-based methods have been developed to identify architectural problems that violate design principles and degrade software maintainability. However, there still exists a gap between the implementation-level metrics and architecture-level metrics. Consequently, it hinders the comprehensibility, interpretability, and indicative(-bility) of the measurement results. To fill this gap, we propose the dbMIT to identify potential code changes that make architecture decay. Our dbMIT first integrates popular metrics such as the CK suite. Then dbMIT constructs a forest structure of metrics, serving as a knowledge base to relate the metrics across levels together. The forest aims to link the architecture-level metrics and implementation-level metrics. Via pre-defined rules using the forest structure, our dbMIT identifies code changes that potentially cause the architecture decay. The usage of forest structure of metrics makes it easy for developers to understand detection results, explain why the detected code changes are potential contributors to the decay, and indicate the code scope for resolution. We also contribute a web-based tool to integrate our dbMIT. Our experiments on the collected projects demonstrate the effectiveness of dbMIT against a history-based ground-truth.

In recent studies, moving target defense (MTD) has been applied to detect false data injection (FDI) attacks using distributed flexible ac transmission system (D-FACTS) devices. However, the inherent conflict between the security goals of MTD (i.e., detecting FDI attacks) and the economic goals of D-FACTS devices (i.e., reducing power losses) would impede the application of MTD in real systems. Moreover, the detection capabilities of existing MTDs are often insufficient. This article proposes a multistage MTD (MMTD) approach to resolve these two issues by adding a group of designed security-oriented schemes before D-FACTS’ economy-oriented scheme to detect FDI attacks. We keep these security-oriented schemes for a very short time interval and then revert to the economy-oriented scheme for the remaining time to ensure the economic requirements. We prove that a designed MMTD can significantly improve the detection capability compared to existing one-stage MTDs. We find the supremum of MMTD’s detection capability and study its relationship with system topology and D-FACTS deployment. Meanwhile, a greedy algorithm is proposed to search the MMTD strategy to reach this supremum. Simulation results show that the proposed MMTD can achieve the supremum against FDI attacks while outperforming current MTD strategies on economic indicators.

Deep Neural Networks are well known to be vulnerable to adversarial attacks and backdoor attacks, where minor modifications on the input are able to mislead the models to give wrong results. Although defenses against adversarial attacks have been widely studied, investigation on mitigating backdoor attacks is still at an early stage. It is unknown whether there are any connections and common characteristics between the defenses against these two attacks. We conduct comprehensive studies on the connections between adversarial examples and backdoor examples of Deep Neural Networks to seek to answer the question: can we detect backdoor using adversarial detection methods. Our insights are based on the observation that both adversarial examples and backdoor examples have anomalies during the inference process, highly distinguishable from benign samples. As a result, we revise four existing adversarial defense methods for detecting backdoor examples. Extensive evaluations indicate that these approaches provide reliable protection against backdoor attacks, with a higher accuracy than detecting adversarial examples. These solutions also reveal the relations of adversarial examples, backdoor examples and normal samples in model sensitivity, activation space and feature space. This is able to enhance our understanding about the inherent features of these two attacks and the defense opportunities.

Past 20 years has witnessed some exorbitant fallout and large-scale blackouts in power system, particularly due to cascading failures and their propagation in the crucial yet complex and networked infrastructure. A pivotal prevention measure to steer clear from cascading events is the identification of vulnerable set, defined as the composition of specific line combinations that can trigger sequence of errors. By nature, the identification problem is NP-hard and a resort to approximation algorithms is necessary. In this article, we first construct a general yet rigorous formalism for the mathematical analysis of cascading failure in networked systems. With a tailored treatment of the propagation mechanism, a fast identification algorithm (FIA) for vulnerable set is then designed based on a key observation revealing the correlation structure among different N-kcontingencies. By analyzing the monotonic nondecreasing, quasi-submodular property of the propagation process, a theoretical lower bound of our algorithm is given in specific order. Besides, we show that the optimization framework of our algorithm can be readily extended to incorporate prior information. Numerical experiments on IEEE 30-, 118-, and 200-bus systems are performed to verify the effectiveness and efficiency of both FIA and its optimization framework.

It is hard to conduct cyberattacks in industrial control systems (ICSs) because most underlying networks of ICS like the field bus network are isolated from the internet. However, attackers can physically connect the intrusive device into the target network to launch various attacks, which bypasses the security protection mechanisms between the ICS and the internet. Currently, no effective measures could defend against such unauthorized physical access attacks. In this article, a reflection-based channel fingerprint is proposed to detect and locate these physically intrusive devices in the field bus network. We theoretically analyze the signal reflection characteristics and utilize inevitable changes in the channel fingerprint to detect the intrusive device. Besides, the detected anomaly features could be used to accurately estimate the intrusive device's location. In the end, the proposed method's effectiveness is validated through extensive simulation experiments.

Binary similarity analysis is critical to many code-reuse-related issues, where function matching is its fundamental task. “ 1-to-1 ” mechanism has been applied in most binary similarity analysis works, in which one function in a binary file is matched against one function in a source file or binary file. However, we discover that the function mapping is a more complex problem of “ 1-to-n ” (one binary function matches multiple source functions or binary functions) or even “ n-to-n ” (multiple binary functions match multiple binary functions) due to the existence of function inlining , different from traditional understanding. In this article, we investigate the effect of function inlining on binary similarity analysis. We carry out three studies to investigate the extent of function inlining, the performance of existing works under function inlining, and the effectiveness of existing inlining-simulation strategies. Firstly, a scalable and lightweight identification method is designed to recover function inlining in binaries. 88 projects (compiled in 288 versions and resulting in 32,460,156 binary functions) are collected and analyzed to construct four inlining-oriented datasets for four security tasks in the software supply chain, including code search, OSS (Open Source Software) reuse detection, vulnerability detection, and patch presence test. Datasets reveal that the proportion of function inlining ranges from 30–40% when using O3 and sometimes can reach nearly 70%. Then, we evaluate four existing works on our dataset. Results show most existing works neglect inlining and use the “1-to-1” mechanism. The mismatches cause a 30% loss in performance during code search and a 40% loss during vulnerability detection. Moreover, most inlined functions would be ignored during OSS reuse detection and patch presence test, thus leaving these functions risky. Finally, we analyze two inlining-simulation strategies on our dataset. It is shown that they miss nearly 40% of the inlined functions, and there is still a large space for promotion. By precisely recovering when function inlining happens, we discover that inlining is usually cumulative when optimization increases. Thus, conditional inlining and incremental inlining are recommended to design a low-cost and high-coverage inlining-simulation strategy.

Software vulnerabilities are now reported unprecedentedly due to the recent development of automated vulnerability hunting tools. However, fixing vulnerabilities still mainly depends on programmers’ manual efforts. Developers need to deeply understand the vulnerability and affect the system’s functions as little as possible. In this paper, with the advancement of Neural Machine Translation (NMT) techniques, we provide a novel approach called SeqTrans to exploit historical vulnerability fixes to provide suggestions and automatically fix the source code. To capture the contextual information around the vulnerable code, we propose to leverage data-flow dependencies to construct code sequences and feed them into the state-of-the-art transformer model. The fine-tuning strategy has been introduced to overcome the small sample size problem. We evaluate SeqTrans on a dataset containing 1,282 commits that fix 624 CVEs in 205 Java projects. Results show that the accuracy of SeqTrans outperforms the latest techniques and achieves 23.3% in statement-level fix and 25.3% in CVE-level fix. In the meantime, we look deep inside the result and observe that the NMT model performs very well in certain kinds of vulnerabilities like CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization).

Dependencies among software entities are the foundation for much of the research on software architecture analysis and architecture analysis tools. Dynamically typed languages, such as Python, JavaScript and Ruby, tolerate the lack of explicit type references, making certain dependencies indiscernible by a purely syntactic analysis of source code. We call thesepossible dependencies, in contrast with theexplicit dependenciesthat are directly manifested in source code. We find that existing architecture analysis tools have not taken possible dependencies into consideration. An important question therefore is:to what extent will these missing possible dependencies impact architecture analysis?To answer this question, we conducted a study of 499 open-source Python projects, employing type inference techniques and type hint practices to discern possible dependencies. We investigated the consequences of possible dependencies in three software maintenance contexts, including capturing co-change relations recorded in revision history, measuring architectural maintainability, and detecting architecture anti-patterns that violate design principles and impact maintainability. Our study revealed that the impact of possible dependencies on architecture-level maintainability is substantial—higher than that of explicit dependencies. Our findings suggest that architecture analysis and tools should take into account, assess, and highlight the impacts of possible dependencies caused by dynamic typing.

Software vulnerabilities are easily propagated through code reuses, which pose dire threats to software system security. Automatic patch presence test offers an effective way to detect whether vulnerabilities have been patched, which is significant for large-scale software system maintenance. However, most existing approaches cannot handle binary codes. They suffer from low accuracy and poor efficiency. None of them are resilient to version gap, function size, and patch size. To tackle the above problems, we proposePatchDiscovery, a patch presence test approach to identify binary vulnerabilities by extracting key basic blocks of patch and vulnerability as their signatures for patch discovery. We propose an efficient and accurate basic block matching method over the normalized and simplified control flow graphs (CFGs) of a vulnerable function (VF) and its patched function (PF) to precisely locate a vulnerability and a patch. Then, we conduct fine-grained patch-level analysis on the patch and the vulnerability to gain their key basic blocks as the signatures of PF and VF for patch presence test. Concretely, the key basic blocks of PF and VF are separately searched in a target function (TF) to identify whether the TF is more similar to PF or VF, i.e., patched or not. Extensive experiments based on two real-world binary datasets that contain 524 common vulnerabilities and exposures (CVEs) with 11607 target functions reveal thatPatchDiscoveryis very effective and efficient. It achieves$92.2\%$F-measure and takes only 0.091s on average to test a target function. It is also resilient to version gap, patch size, and function size to a good extent. Moreover, it is outperforming the state-of-the-art works and has a much faster testing speed for large-scale patch detection. Moreover,PatchDiscoveryachieves good performance in firmware vulnerability discovery scenario.

During the creation of graphic designs, individuals inevitably spend a lot of time and effort on adjusting visual attributes (e.g., positions, colors, and fonts) of elements to make them more aesthetically pleasing. It is a trial-and-error process, requires repetitive edits, and relies on good design knowledge. In this work, we seek to alleviate such difficulty by automatically suggesting aesthetic improvements, i.e., taking an existing design as the input and generating a refined version with improved aesthetic quality as the output. This goal presents two challenges: proposing a refined design based on the user-given one, and assessing whether the new design is better aesthetically. To cope with these challenges, we propose a design principle-guided candidate generation stage and a data-driven candidate evaluation stage. In the candidate generation stage, we generate candidate designs by leveraging design principles as the guidance to make changes around the existing design. In the candidate evaluation stage, we learn a ranking model upon a dataset that can reflect humans' aesthetic preference, and use it to choose the most aesthetically pleasing one from the generated candidates. We implement a prototype system on presentation slides and demonstrate the effectiveness of our approach through quantitative analysis, sample results, and user studies.

The fairness characteristic is a critical attribute of trusted AI systems. A plethora of research has proposed diverse methods for individual fairness testing. However, they are suffering from three major limitations, i.e., low efficiency, low effectiveness, and model-specificity. This work proposes ExpGA, an explanation-guided fairness testing approach through a genetic algorithm (GA). ExpGA employs the explanation results generated by interpretable methods to collect high-quality initial seeds, which are prone to derive discriminatory samples by slightly modifying feature values. ExpGA then adopts GA to search discriminatory sample candidates by optimizing a fitness value. Benefiting from this combination of explanation results and GA, ExpGA is both efficient and effective to detect discriminatory individuals. Moreover, ExpGA only requires prediction probabilities of the tested model, resulting in a better generalization capability to various models. Experiments on multiple real-world benchmarks, including tabular and text datasets, show that ExpGA presents higher efficiency and effectiveness than four state-of-the-art approaches.

The black-box nature of the Deep Neural Network (DNN) makes it difficult for people to understand why it makes a specific decision, which restricts its applications in critical tasks. Recently, many interpreters (interpretation methods) are proposed to improve the transparency of DNNs by providing relevant features in the form of a saliency map. However, different interpreters might provide different interpretation results for the same classification case, which motivates us to conduct the robustness evaluation of interpreters.

The development of Industrial Internet of Things has made industrial control systems more vulnerable to cyber attacks. Many defense measures have been proposed to prevent attacks in upper IP-based networks. However, the security of underlying field bus networks has not received enough attention. Adversaries could tap intrusive devices into the field bus network via unauthorized physical access. As adversaries’ behaviors could be highly concealed when they are eavesdropping or camouflaging, it is challenging and costly to identify these inactive intrusive devices through the network traffic. However, inevitable changes in channel state caused by intrusive devices could be leveraged to detect unauthorized physical access. This article theoretically proves that the transmitted signal’s voltage amplitude would vary after tapping intrusive devices into the field bus network. Leveraging the signal’s variation, we propose an unauthorized physical access detection method via fingerprinting the channel state. Specifically, we adopt weak signal processing technologies to recover the signal’s weak variation and extract its features for detection. The effectiveness of the proposed detection method is validated based on a real testbed. Moreover, simulation experiments with diverse settings demonstrate that the proposed detection method could successfully detect intrusive devices under different scenarios.

Task-oriented virtual assistants are software systems that provide users with a natural language interface to complete domain-specific tasks. With the recent technological advances in natural language processing and machine learning, an increasing number of task-oriented virtual assistants have been developed. However, due to the well-known complexity and difficulties of the natural language understanding problem, it is challenging to manage a task-oriented virtual assistant software project. Meanwhile, the management and experience related to the development of virtual assistants are hardly studied or shared in the research community or industry, to the best of our knowledge. To bridge this knowledge gap, in this paper, we share our experience and the lessons that we have learned at managing a task-oriented virtual assistant software project at Microsoft. We believe that our practices and the lessons learned can provide a useful reference for other researchers and practitioners who aim to develop a virtual assistant system. Finally, we have developed a requirement management tool, named SpecSpace, which can facilitate the management of virtual assistant projects.

Cascading failure models are important for understanding the mechanism of blackouts and evaluating the control strategies to prevent the failure propagation. The evolution of cascading failure in actual power grid is a continuous dynamic process triggered by discrete events, such as initial disturbances and physical responses. In this paper, we develop an event-triggered hybrid system model to describe the dynamic process of cascading failure. In the model, the evolution of continuous states of power grid is described by differential algebraic equations and the discrete events are defined as transitions between discrete states of power grid. The model also integrates multiple physical responses including relay protection, frequency regulation and dispatching action. Based on the developed model, we propose an event-triggered simulation method of cascading failure to accelerate the simulation process. Compared with the DC power flow model, hidden failure model and topological model, the simulation results of our model are more accurate because the statistical distribution of demand loss in our model is closer to historical blackouts data. The efficiency of the proposed event-triggered method is demonstrated by comparing our model with the time-driven model and three existing models. The experimental results show that our model can trade off the simulation accuracy and time consumption.Note to Practitioners—This paper focuses on modeling the dynamic process of cascading failure with multiple physical responses in power grid. We develop an event-triggered hybrid system model for cascading failure. In the model, the continuous dynamics of power grid and discrete events triggering the evolution of cascading failure are all described by the framework of hybrid system, which is a good example of modeling the hybrid system for automation researchers and engineers. By this way, the model is more accurate in describing the actual characteristics of cascading failure in power grid, and thus supporting the design and evaluation of control strategies for improving the stability of power grid. Based on the developed model, we propose an event-triggered simulation method of cascading failure, which aims to improve simulation accuracy while potentially reducing time consumption. In practice, the model can make fast control strategies to prevent the failure propagation.

Advances in unmanned aerial vehicle (UAV) technology provide an opportunity for geohazards monitoring in harsh environments, thereby reducing man-hours and corresponding risks. Due to the limited duration, UAV can hardly visit all the scattered geohazard sites (GSs) in one trip. Therefore, GSs with higher emergency priorities should be monitored first in earlier trips. In this article, we formulate a multiperiod UAVs path planning problem with dynamic emergency priorities for monitoring GSs, in which the emergency levels of GSs change dynamically according to the latest disaster information. An effective solution strategy for this problem selects GSs that must be monitored and accesses more optional GSs within the limited UAV's duration time, after distinguishing them according to emergency priorities. We therefore propose a heuristic algorithm based on the adaptive large neighborhood search. We finally present a real-world case for demonstration and validation.

Concurrent programs with multiple threads executing in parallel are widely used to unleash the power of multicore computing systems. Owing to their complexity, a lot of research focuses on testing and debugging concurrent programs. Besides correctness, we find that security can also be compromised by concurrency. In this article, we present concurrent program spectre (ConcSpectre), a new security threat that hides malware in nondeterministic thread interleavings. To demonstrate such threat, we have developed a stealth malware technique called concurrent logic bomb by partitioning a piece of malicious code and injecting its components separately into a concurrent program. The malicious behavior can be triggered by certain thread interleavings that rarely happen (e.g.,$< $1%) under a normal execution environment. However, with a new technique called controllable probabilistic activation, we can activate such ConcSpectre malware with a very high probability (e.g.,$>$90%) by remotely disturbing thread scheduling. In the evaluation, more than 1000 ConcSpectre samples are generated, which bypassed most of the antivirus engines in VirusTotal and four well-known online dynamic malware analysis systems. We also demonstrate how to remotely trigger a ConcSpectre sample on a web server and control its activation probability. Our work shows an urgent need for new malware analysis methods for concurrent programs.

Jiaqi Guo, Ziliang Si, Yu Wang, Qian Liu, Ming Fan, Jian-Guang Lou, Zijiang Yang, Ting Liu. Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers). 2021.

Software reuse, especially partial reuse, poses legal and security threats to software development. Since its source codes are usually unavailable, software reuse is hard to be detected with interpretation. On the other hand, current approaches suffer from poor detection accuracy and efficiency, far from satisfying practical demands. To tackle these problems, in this paper, we propose ISRD, an interpretation-enabled software reuse detection approach based on a multi-level birthmark model that contains function level, basic block level, and instruction level. To overcome obfuscation caused by cross-compilation, we represent function semantics with Minimum Branch Path (MBP) and perform normalization to extract core semantics of instructions. For efficiently detecting reused functions, a process for "intent search based on anchor recognition" is designed to speed up reuse detection. It uses strict instruction match and identical library call invocation check to find anchor functions (in short anchors) and then traverses neighbors of the anchors to explore potentially matched function pairs. Extensive experiments based on two real-world binary datasets reveal that ISRD is interpretable, effective, and efficient, which achieves 97.2% precision and 94.8% recall. Moreover, it is resilient to cross-compilation, outperforming state-of-the-art approaches.

Dynamic programming languages have been embracing gradual typing, which supports optional type annotations in source code. Type-annotating a complex and long-lasting codebase is indeed a gradual and expensive process, where two issues have troubled developers. First, there is few guidance about how to implement type annotations due to the existence of non-trivial type practices; second, there is few guidance about which portion of a codebase should be type-annotated first. To address these issues, this paper investigates the patterns of non-trivial type-annotation practices and features of type-annotated code files. Our study detected six patterns of type-annotation practices, which involve recovering and expressing design concerns. Moreover, we revealed three complementary features of type-annotated files. Besides, we implemented a tool for studying optional typing practice. We suggest that: 1) design concerns should be considered to improve type annotation implementation by following at least six patterns; 2) files critical to software architecture could be type-annotated in priority. We believe these guidelines would promote a better type annotation practice for dynamic languages.

When a small portion of the decision makers hold the correct information and the majority hold the opposite, the correct ranking of the alternatives for the group decision-making cannot be obtained with the current methods. A novel method is thus developed to tackle this challenge in this article. The priori probabilities of each alternative can be calculated via the opinions of the group decision makers, which are presented as the pairwise comparisons of the alternatives in the form of the linguistic preference relation. Based on the aggregated probabilities of the alternatives in the group of the decision makers, the normalized-prediction selection rate (NPSR) is defined and calculated accordingly. The alternative with maximal NPSR is selected as the correct answer, whereas the accuracy of the correct alternative selection (CAS) is guaranteed by two propositions. The iterative algorithm is first devised to determine the ranking of the alternatives depending on the CAS. For the proposed method, the decision makers require no modification of the opinions as can avoid the consensus problem, and the CAS can be obtained under the circumstances that the correct information is held by the minority of the group. Finally, the experiment has been conducted to demonstrate the efficacy of the proposed method to obtain the CAS, and the main limitations of proposed method are carefully addressed as well.

Deep neural networks (DNNs) are known to be inherently vulnerable to malicious attacks such as the adversarial attack and the backdoor attack. The former is crafted by adding small perturbations to benign inputs so as to fool a DNN. The latter generally embeds a hidden pattern in a DNN by poisoning the dataset during the training process, which causes the infected model to misbehave on predefined inputs with a specific trigger and normally perform for others. Much work has been conducted on defending against the adversarial samples, while the backdoor attack received much less attention, especially in recurrent neural networks (RNNs), which play an important role in the text processing field. Two main limitations make it hard to directly apply existing image backdoor detection approaches to RNN-based text classification systems. First, a layer in an RNN does not preserve the same feature latent space function for different inputs, making it impossible to map the inserted specific pattern with the neural activations. Second, the text data is inherently discrete, making it hard to optimize the text like image pixels. In this work, we propose a novel backdoor detection approach named InterRNN for RNN-based text classification systems from the interpretation perspective. Specifically, we first propose a novel RNN interpretation technique by constructing a nondeterministic finite automaton (NFA) based abstract model, which can effectively reduce the analysis complexity of an RNN while preserving its original logic rules. Then, based on the abstract model, we can obtain interpretation results that explain the fundamental reason behind the decision for each input. We then detect trigger words by leveraging the differences between the behaviors in the backdoor sentences and those in the normal sentences. The extensive experiment results on four benchmark datasets demonstrate that our approach can generate better interpretation results compared to state-of-the-art approaches and effectively detect backdoors in RNNs.

With the rapid growth of Android malware, many machine learning-based malware analysis approaches are proposed to mitigate the severe phenomenon. However, such classifiers are opaque, non-intuitive, and difficult for analysts to understand the inner decision reason. For this reason, a variety of explanation approaches are proposed to interpret predictions by providing important features. Unfortunately, the explanation results obtained in the malware analysis domain cannot achieve a consensus in general, which makes the analysts confused about whether they can trust such results. In this work, we propose principled guidelines to assess the quality of five explanation approaches by designing three critical quantitative metrics to measure their stability, robustness, and effectiveness. Furthermore, we collect five widely-used malware datasets and apply the explanation approaches on them in two tasks, including malware detection and familial identification. Based on the generated explanation results, we conduct a sanity check of such explanation approaches in terms of the three metrics. The results demonstrate that our metrics can assess the explanation approaches and help us obtain the knowledge of most typical malicious behaviors for malware analysis.

Monolithic systems increasingly suffer from maintainability and scalability issues as they grow in functionality, size, and complexity. It is widely believed that (micro)service-based architectures can alleviate these problems as each service is supposed to have the following characteristics: clearly defined functionality, sufficient modularity, and the ability to evolve independently. Industrial practices show that service extraction from a legacy monolithic system is labor-intensive and complex. Existing work on service candidate identification aims to group entities of a monolithic system into potential service candidates, but this process has two major challenges: first, it is difficult to extract service candidates with consistent quality; second, it is hard to evaluate the identified service candidates regarding the above three characteristics. To address these challenges, this paper proposes the Functionality-oriented Service Candidate Identification (FoSCI) framework to identify service candidates from a monolithic system. Our approach is to record the monolith's execution traces, and extract services candidates using a search-based functional atom grouping algorithm. We also contribute a comprehensive service candidate evaluation suite that uses interface information, structural/conceptual dependency, and commit history. This evaluation system consists of 8 metrics, measuring functionality, modularity, and evolvability respectively of identified service candidates. We compare FoSCI with three existing methods, using 6 widely-used open-source projects as our evaluation subjects. Our results show that FoSCI outperforms existing methods in most measures.

In recent years, Complex Network theory and graph algorithms have been proved to be effective in predicting software bugs. On the other hand, as a widely-used algorithm in Complex Network theory, k-core decomposition has been used in software engineering domain to identify key classes. Intuitively, key classes are more likely to be buggy since they participate in more functions or have more interactions and dependencies. However, there is no existing research uses k-core decomposition to analyze software bugs. To fill this gap, we first use k-core decomposition on Class Dependency Networks to analyze software bug distribution from a new perspective. An interesting and widely existed tendency is observed: for classes in k-cores with larger k values, there is a stronger possibility for them to be buggy. Based on this observation, we then propose a simple but effective equation named as top-core which improves the order of classes in the suspicious class list produced by effort-aware bug prediction models. Based on an empirical study on 18 open-source Java systems, we show that the bug prediction models' performances are significantly improved in 85.2 percent experiments in the cross-validation scenario and in 80.95 percent experiments in the forward-release scenario, after using top-core. The models' average performances are improved by 11.5 and 12.6 percent, respectively. It is concluded that the proposed top-core equation can help the testers or code reviewers locate the real bugs more quickly and easily in software bug prediction practices.

Regression faults, which make working code stop functioning, are often introduced when developers make changes to the software. Many regression fault localization techniques have been proposed. However, issues like inaccuracy and lack of explanation are still obstacles for their practical application. In this work, we propose a trace-based approach to identifying not only where the root cause of a regression bug lies, but also how the defect is propagated to its manifestation as the explanation. In our approach, we keep the trace of original correct version as reference and infer the faulty steps on the trace of regression version so that we can build a causality graph of how the defect is propagated. To this end, we overcomes two technical challenges. First, we align two traces derived from two program versions by extending state-of-the-art trace alignment technique for regression fault with novel relaxation technique. Second, we construct causality graph (i.e., explanation) by adopting a technique calledalignment slicing and mendingto isolate the failure-inducing changes and explain the failure. Our comparative experiment with the state-of-the-art techniques including dynamic slicing, delta-debugging, and symbolic execution on 24 real-world regressions shows that (1) our approach is more accurate on isolating the failure-inducing changes, (2) the generated explanation requires acceptable manual effort to inspect, and (3) our approach requires lower runtime overhead. In addition, we also conduct an applicability experiment based on Defects4J bug repository, showing the potential limitations of our trace-based approach and providing guidance for its practical use.

Meaning representation is an important component of semantic parsing.Although researchers have designed a lot of meaning representations, recent work focuses on only a few of them.Thus, the impact of meaning representation on semantic parsing is less understood.Furthermore, existing work's performance is often not comprehensively evaluated due to the lack of readily-available execution engines.Upon identifying these gaps, we propose UNIMER, a new unified benchmark on meaning representations, by integrating existing semantic parsing datasets, completing the missing logical forms, and implementing the missing execution engines.The resulting unified benchmark contains the complete enumeration of logical forms and execution engines over three datasets × four meaning representations.A thorough experimental study on UNIMER reveals that neural semantic parsing approaches exhibit notably different performance when they are trained to generate different meaning representations.Also, program alias and grammar rules heavily impact the performance of different meaning representations.Our benchmark, execution engines and implementation can be found on: https

In Industrial Control Systems, isolated proprietary networks are widely used to prevent cyber attacks from Internet. However, the attack can bypass it by connecting external devices into networks, named as device-connected attack. In field bus networks, this attack is hard to be prevented but easy to be implemented. In this paper, the physical intrusion detection is proposed against the device-connected attack. Rather than the network traffic in network intrusion detection, the impedance of whole system and voltage signals are applied to detect the device-connected attack, which would be slightly changed when the external devices are connected. The demo system is implemented on RS485 bus network to demonstrate the effectiveness of proposed method.

Uncontrolled memory consumption is a kind of critical software security weaknesses. It can also become a security-critical vulnerability when attackers can take control of the input to consume a large amount of memory and launch a Denial-of-Service attack. However, detecting such vulnerability is challenging, as the state-of-the-art fuzzing techniques focus on the code coverage but not memory consumption. To this end, we propose a memory usage guided fuzzing technique, named MemLock, to generate the excessive memory consumption inputs and trigger uncontrolled memory consumption bugs. The fuzzing process is guided with memory consumption information so that our approach is general and does not require any domain knowledge. We perform a thorough evaluation for MemLock on 14 widely-used real-world programs. Our experiment results show that MemLock substantially outperforms the state-of-the-art fuzzing techniques, including AFL, AFLfast, PerfFuzz, FairFuzz, Angora and QSYM, in discovering memory consumption bugs. During the experiments, we discovered many previously unknown memory consumption bugs and received 15 new CVEs.

The maintenance of software architecture is challenged by fast-delivery code changes since developers are rarely aware of the architectural impacts of their code changes. To ease the burdens of architects, in this work, we proposed a light-weight framework to identify changes in architectures from code commits automatically. The framework identifies architectural changes without heavy architecture recovery techniques. Instead, it only takes a code commit as input. The framework, on the one hand, can be integrated into prevalent continuous integration systems to monitor architectural changes. On the other hand, it can be plugged into code review systems to help developers realize the architectural changes they introduce. Based on the framework, we further conducted a large-scale empirical study on 368,847 commits of 16 Apache open projects to study architectural changes. Our study reveals several new findings regarding the frequency of architectural change commits, the common and risky intents under which developers introduce architectural changes, and the correlations of architectural changes with lines of code and number of modified source files in commits. Our findings provide practical implications for software contributors and shed light on potential research directions on architecture maintenance.

The purpose of the General Data Protection Regulation (GDPR) is to provide improved privacy protection. If an app controls personal data from users, it needs to be compliant with GDPR. However, GDPR lists general rules rather than exact step-by-step guidelines about how to develop an app that fulfills the requirements. Therefore, there may exist GDPR compliance violations in existing apps, which would pose severe privacy threats to app users. In this paper, we take mobile health applications (mHealth apps) as a peephole to examine the status quo of GDPR compliance in Android apps. We first propose an automated system, named HPDROID, to bridge the semantic gap between the general rules of GDPR and the app implementations by identifying the data practices declared in the app privacy policy and the data relevant behaviors in the app code. Then, based on HPDROID, we detect three kinds of GDPR compliance violations, including the incompleteness of privacy policy, the inconsistency of data collections, and the insecurity of data transmission. We perform an empirical evaluation of 796 mHealth apps. The results reveal that 189 (23.7%) of them do not provide complete privacy policies. Moreover, 59 apps collect sensitive data through different measures, but 46 (77.9%) of them contain at least one inconsistent collection behavior. Even worse, among the 59 apps, only 8 apps try to ensure the transmission security of collected data. However, all of them contain at least one encryption or SSL misuse. Our work exposes severe privacy issues to raise awareness of privacy protection for app users and developers.

In Search-based Software Testing (SBST), test generation is guided by fitness functions that estimate how close a test case is to reach an uncovered test goal (e.g., branch). A popular fitness function estimates how close conditional statements are to evaluating to true or false, i.e., the branch distance. However, when conditions read Boolean variables (e.g., if(x && y)), the branch distance provides no gradient for the search, since a Boolean can either be true or false. This flag problem can be addressed by transforming individual procedures such that Boolean flags are replaced with numeric comparisons that provide better guidance for the search. Unfortunately, defining a semantics-preserving transformation that is applicable in an interprocedural case, where Boolean flags are passed around as parameters and return values, is a daunting task. Thus, it is not yet supported by modern test generators.

The binary-level function matching has been widely used to detect whether there are 1-day vulnerabilities in released programs. However, the high false positive is a challenge for current function matching solutions, since the vulnerable function is highly similar to its corresponding patched version. In this paper, the Binary X-Ray (BinXray), a patch based vulnerability matching approach, is proposed to identify the specific 1-day vulnerabilities in target programs accurately and effectively. In the preparing step, a basic block mapping algorithm is designed to extract the signature of a patch, by comparing the given vulnerable and patched programs. The signature is represented as a set of basic block traces. In the detection step, the patching semantics is applied to reduce irrelevant basic block traces to speed up the signature searching. The trace similarity is also designed to identify whether a target program is patched. In experiments, 12 real software projects related to 479 CVEs are collected. BinXray achieves 93.31% accuracy and the analysis time cost is only 296.17ms per function, outperforming the state-of-the-art works.

Dependencies among software entities are the basis for many software analytic research and architecture analysis tools. Dynamically typed languages, such as Python, JavaScript and Ruby, tolerate the lack of explicit type references, making certain syntactic dependencies indiscernible in source code. We call these possible dependencies, in contrast with the explicit dependencies that are directly referenced in source code. Type inference techniques have been widely studied and applied, but existing architecture analytic research and tools have not taken possible dependencies into consideration. The fundamental question is, to what extent will these missing possible dependencies impact the architecture analysis? To answer this question, we conducted an empirical study with 105 Python projects, using type inference techniques to manifest possible dependencies. Our study revealed that the architectural impact of possible dependencies is substantial---higher than that of explicit dependencies: (1) file-level possible dependencies account for at least 27.93% of all file-level dependencies, and create different dependency structures than that of explicit dependencies only, with an average difference of 30.71%; (2) adding possible dependencies significantly improves the precision (0.52%~14.18%), recall(31.73%~39.12%), and F1 scores (22.13%~32.09%) of capturing co-change relations; (3) on average, a file involved in possible dependencies influences 28% more files and 42% more dependencies within architectural sub-spaces than a file involved in just explicit dependencies; (4) on average, a file involved in possible dependencies consumes 32% more maintenance effort. Consequently, maintainability scores reported by existing tools make a system written in these dynamic languages appear to be better modularized than it actually is. This evidence strongly suggests that possible dependencies have a more significant impact than explicit dependencies on architecture quality, that architecture analysis and tools should assess and even emphasize the architectural impact of possible dependencies due to dynamic typing.

The great influence of Bitcoin has promoted the rapid development of blockchain-based digital currencies, especially the altcoins, since 2013. However, most altcoins share similar source codes, resulting in concerns about code innovations. In this paper, an empirical study on existing altcoins is carried out to offer a thorough understanding of various aspects associated with altcoin innovations. Firstly, we construct the dataset of altcoins, including source code repositories, GitHub fork relations, and market capitalizations (cap). Then, we analyze the altcoin innovations from the perspective of source code similarities. The results demonstrate that more than 85% of altcoin repositories present high code similarities. Next, a temporal clustering algorithm is proposed to mine the inheritance relationship among various altcoins. The family pedigrees of altcoin are constructed, in which the altcoin presents similar evolution features as biology, such as power-law in family size, variety in family evolution, etc. Finally, we investigate the correlation between code innovations and market capitalization. Although we fail to predict the price of altcoins based on their code similarities, the results show that altcoins with higher innovations reflect better market prospects.

Software plagiarism seriously impedes the healthy development of open source software. To fight against code obfuscation and inherent non-determinism of thread scheduling applied against software plagiarism detection, we proposed a new dynamic birthmark called DYnamic Key Instruction Sequence (DYKIS) and a framework called Thread-oblivious dynamic Birthmark (TOB) for the purpose of reviving the existing birthmarks and a thread-aware dynamic birthmark called Thread-related System call Birthmark (TreSB). Though many approaches have been proposed for software plagiarism detection, they are still limited to satisfy the following highly desired requirements: the applicability to handle binary, the capability to detect partial plagiarism, the resiliency to code obfuscation, the interpretability on detection results, and the scalability to process large-scale software. In this position paper, we discuss and outline the research opportunities and challenges in the field of software plagiarism detection in order to stimulate brilliant innovations and direct our future research efforts.

With the development of demand response technologies, the pricing scheme in smart grids is moving from flat pricing to multiple pricing (MP), which facilitates the energy saving at the consumer side. However, the flexible pricing policy may be exploited for the stealthy reduction of utility bills. In this paper, we present a hidden electricity theft (HET) attack by exploiting the emerging MP scheme. The basic idea is that attackers can tamper with smart meters to cheat the utility that some electricity is consumed under a lower price. To construct the HET attack, we propose an optimization problem aiming at maximizing the attack profits while evading current detection methods, and design two algorithms to conduct the attack on smart meters. Moreover, we disclose and exploit several new vulnerabilities of smart meters to demonstrate the feasibility of HET attacks. To protect smart grids against HET attacks, we propose several defense and detection countermeasures, including selective protection on smart meters, limiting the attack cycle, and updating the billing mechanism. Extensive experiments on a real data set demonstrate that the attack could cause high economic losses, and the proposed countermeasures could effectively mitigate the attack's impact at a low cost.

The rapid growth of Android malware results in a large body of approaches devoted to malware analysis by leveraging machine learning algorithms. However, the effectiveness of these approaches primarily depends on the manual feature engineering process, which is time-consuming and labor-intensive based on expert knowledge and intuition. In this paper, we propose an automatic approach that engineers informative features from a corpus of Android malware related technical blogs, which are written in a way that mirrors the human feature engineering process. However, there are two main challenges. First, it is difficult to recognize useful knowledge in the magnanimity information of thousands of blogs. To this end, we leverage natural language processing techniques to process the blogs and extract a set of sensitive behaviors that might do harmful activities to users potentially. Second, there exists a semantic gap between the extracted sensitive behaviors and the programming language. To this end, we propose two semantic matching rules to match the behaviors with concrete code snippets such that the apps can be tested experimentally. We design and implement a system called CTDroid for malware analysis, including malware detection (MD) and familial classification (FC). After the evaluation of CTDroid on a large scale of real malware and benign apps, the experimental results demonstrate that CTDroid can achieve 95.8% true positive rate with only 1% false positive rate for MD and 97.9% accuracy for FC. Furthermore, our proposed features are more informative than those of state-of-the-art approaches.

With the advent of multicore processors, there is a great need to write parallel programs to take advantage of parallel computing resources. However, due to the nondeterminism of parallel execution, the malware behaviors sensitive to thread scheduling are extremely difficult to detect. Dynamic taint analysis is widely used in security problems. By serializing a multithreaded execution and then propagating taint tags along the serialized schedule, existing dynamic taint analysis techniques lead to under-tainting with respect to other possible interleavings under the same input. In this paper, we propose an approach called DSTAM that integrates symbolic analysis and guided execution to systematically detect tainted instances on all possible executions under a given input. Symbolic analysis infers alternative interleavings of an executed trace that cover new tainted instances, and computes thread schedules that guide future executions. Guided execution explores new execution traces that drive future symbolic analysis. We have implemented a prototype as part of an educational tool that teaches secure C programming, where accuracy is more critical than efficiency. To the best of our knowledge, DSTAM is the first algorithm that addresses the challenge of taint analysis for multithreaded program under fixed inputs.

We present a neural approach called IRNet for complex and cross-domain Text-to-SQL.IR-Net aims to address two challenges: 1) the mismatch between intents expressed in natural language (NL) and the implementation details in SQL; 2) the challenge in predicting columns caused by the large number of outof-domain words.Instead of end-to-end synthesizing a SQL query, IRNet decomposes the synthesis process into three phases.In the first phase, IRNet performs a schema linking over a question and a database schema.Then, IRNet adopts a grammar-based neural model to synthesize a SemQL query which is an intermediate representation that we design to bridge NL and SQL.Finally, IRNet deterministically infers a SQL query from the synthesized SemQL query with domain knowledge.On the challenging Text-to-SQL benchmark Spider, IRNet achieves 46.7% accuracy, obtaining 19.5% absolute improvement over previous state-of-the-art approaches.At the time of writing, IRNet achieves the first position on the Spider leaderboard. * Equal Contributions. Work done during an internship at MSRA.NL: Show the names of students who have a grade higher than 5 and have at least 2 friends. SQL: SELECT T1.name FROM friend AS T1 JOIN highschooler AS T2ON T1.student_id = T2.idWHERE T2

The methods with consensus reaching process can obtain a collective solution which is supported by most of decision makers in larger-scale group decision making. However, in case decision makers who could give correct opinions are from the minority, the conventional methods with consensus reaching process can not obtain the correct answer. In this paper, a novel method is developed to tackle this challenge. The decision makers give the opinions utilizing pairwise comparisons of the alternatives from positive and negative views based on intuitionistic fuzzy preference relation. The obtained opinions are translated into intuitionistic fuzzy numbers, and are further grouped and aggregated according to the alternatives. Based on the aggregated intuitionistic fuzzy numbers, the prediction normalized rate is defined and calculated for each alternative, the alternative with the minimal prediction normalized rate is selected as correct one. The experimental results show that the proposed method can obtain the correct answer even when the actual correct opinions are reflected by a small number of decision makers.

Over the past decades, numerous approaches were proposed to help practitioner to predict or locate defective files. These techniques often use syntactic dependency, history co-change relation, or semantic similarity. The problem is that, it remains unclear whether these different dependency relations will present similar accuracy in terms of defect prediction and localization. In this paper, we present our systematic investigation of this question from the perspective of software architecture. Considering files involved in each dependency type as an individual design space, we model such a design space using one DRSpace. We derived 3 DRSpaces for each of the 117 Apache open source projects, with 643,079 revision commits and 101,364 bug reports in total, and calculated their interactions with defective files. The experiment results are surprising: the three dependency types present significantly different architectural views, and their interactions with defective files are also drastically different. Intuitively, they play completely different roles when used for defect prediction/localization. The good news is that the combination of these structures has the potential to improve the accuracy of defect prediction/localization. In summary, our work provides a new perspective regarding to which type(s) of relations should be used for the task of defect prediction/localization. These quantitative and qualitative results also advance our knowledge of the relationship between software quality and architectural views formed using different dependency types.

The rapid growth of Android malware has posed severe security threats to smartphone users. On the basis of the familial trait of Android malware observed by previous work, the familial analysis is a promising way to help analysts better focus on the commonalities of malware samples within the same families, thus reducing the analytical workload and accelerating malware analysis. The majority of existing approaches rely on supervised learning and face three main challenges, i.e., low accuracy, low efficiency, and the lack of labeled dataset. To address these challenges, we first construct a fine-grained behavior model by abstracting the program semantics into a set of subgraphs. Then, we propose SRA, a novel feature that depicts the similarity relationships between the Structural Roles of sensitive API call nodes in subgraphs. An SRA is obtained based on graph embedding techniques and represented as a vector, thus we can effectively reduce the high complexity of graph matching. After that, instead of training a classifier with labeled samples, we construct malware link network based on SRAs and apply community detection algorithms on it to group the unlabeled samples into groups. We implement these ideas in a system called GefDroid that performs Graph embedding based familial analysis of AnDroid malware using unsupervised learning. Moreover, we conduct extensive experiments to evaluate GefDroid on three datasets with ground truth. The results show that GefDroid can achieve high agreements (0.707-0.883 in term of NMI) between the clustering results and the ground truth. Furthermore, GefDroid requires only linear run-time overhead and takes around 8.6s to analyze a sample on average, which is considerably faster than the previous work.

Record-and-replay tools are indispensable for quality assurance of mobile applications. Due to its importance, an increasing number of tools are being developed to record and replay user interactions for Android. However, by conducting an empirical study of various existing tools in industrial settings, researchers have revealed a gap between the characteristics requested from industry and the performance of publicly available record-and-replay tools. The study concludes that no existing tools under evaluation are sufficient for industrial applications. In this paper, we present a record-and-replay tool called SARA towards bridging the gap and targeting a wide adoption. Specifically, a dynamic instrumentation technique is used to accommodate rich sources of inputs in the application layer satisfying various constraints requested from industry. A self-replay mechanism is proposed to record more information of user inputs for accurate replaying without degrading user experience. In addition, an adaptive replay method is designed to enable replaying events on different devices with diverse screen sizes and OS versions. Through an evaluation on 53 highly popular industrial Android applications and 265 common usage scenarios, we demonstrate the effectiveness of SARA in recording and replaying rich sources of inputs on the same or different devices.

Architecture degradation has a strong negative impact on software quality and can result in significant losses. Severe software degradation does not happen overnight. Software evolves continuously, through numerous issues, fixing bugs and adding new features, and architecture flaws emerge quietly and largely unnoticed until they grow in scope and significance when the system becomes difficult to maintain. Developers are largely unaware of these flaws or the accumulating debt as they are focused on their immediate tasks of address individual issues. As a consequence, the cumulative impacts of their activities, as they affect the architecture, go unnoticed. To detect these problems early and prevent them from accumulating into severe ones we propose to monitor software evolution by tracking the interactions among files revised to address issues. In particular, we propose and show how we can automatically detect active hotspots, to reveal architecture problems. We have studied hundreds of hotspots along the evolution timelines of 21 open source projects and showed that there exist just a few dominating active hotspots per project at any given time. Moreover, these dominating active hotspots persist over long time periods, and thus deserve special attention. Compared with state-of-the-art design and code smell detection tools we report that, using active hotspots, it is possible to detect signs of software degradation both earlier and more precisely.

Locating vulnerabilities is an important task for security auditing, exploit writing, and code hardening. However, it is challenging to locate vulnerabilities in binary code, because most program semantics (e.g., boundaries of an array) is missing after compilation. Without program semantics, it is difficult to determine whether a memory access exceeds its valid boundaries in binary code. In this work, we propose an approach to locate vulnerabilities based on memory layout recovery. First, we collect a set of passed executions and one failed execution. Then, for passed and failed executions, we restore their program semantics by recovering fine-grained memory layouts based on the memory addressing model. With the memory layouts recovered in passed executions as reference, we can locate vulnerabilities in failed execution by memory layout identification and comparison. Our experiments show that the proposed approach is effective to locate vulnerabilities on 24 out of 25 DARPA’s CGC programs (96%), and can effectively classifies 453 program crashes (in 5 Linux programs) into 19 groups based on their root causes.

Test case prioritization is widely used in testing with the purpose of detecting faults as early as possible. Most existing techniques exploit coverage to prioritize test cases based on the hypothesis that a test case with higher coverage is more likely to catch bugs. Statement coverage and function coverage are the two widely used coverage granularity. The former typically achieves better test case prioritization in terms of fault detection capability, while the latter is more efficient because it incurs less overhead. In this paper we argue that static information such as statement and function coverage may not be the best criteria for guiding dynamic executions. Executions that cover the same set of statements /functions can may exhibit very different behavior. Therefore, the abstraction that reduces program behavior to statement/function coverage can be too simplistic to predicate fault detection capability. We propose a new approach that exploits function call sequences to prioritize test cases. This is based on the observation that the function call sequences rather than the set of executed functions is a better indicator of program behavior. Test cases that reveal unique function call sequences may have better chance to encounter faults. We choose function instead of statement sequences due to the consideration of efficiency. We have developed and implemented a new prioritization strategy AGC (Additional Greedy method Call sequence), that exploit function call sequences. We compare AGC against existing test case prioritization techniques on eight real-world open source Java projects. Our experiments show that our approach outperforms existing techniques on large programs (but not on small programs) in terms of bug detection capability. The performance shows a growth trend when the size of program increases.

Convolutional Neural Network (CNN) has achieved success in Android malware detection and many other fields. However, the empirical evaluation of previous studies have shown that no single machine learning classifier is capable to provide the best accuracy in any context. In this paper, a new method for Android malware detection is proposed, we replace the single machine learning classifier in CNN with Adaptive Selection of Classifiers (ASC) to improve the performance of malware classification. We test our method on 1746 apk samples with 1000 malware, the result shows the accuracy of our approach performs 4.27% better than the state-of-art CNN model used in the current research.

Recent research proposes syntax-based approaches to address the problem of generating programs from natural language specifications.These approaches typically train a sequence-to-sequence learning model using a syntax-based objective: maximum likelihood estimation (MLE).Such syntax-based approaches do not effectively address the goal of generating semantically correct programs, because these approaches fail to handle Program Aliasing, i.e., semantically equivalent programs may have many syntactically different forms.To address this issue, in this paper, we propose a semantics-based approach named SemRegex.SemRegex provides solutions for a subtask of the program-synthesis problem: generating regular expressions from natural language.Different from the existing syntax-based approaches, SemRegex trains the model by maximizing the expected semantic correctness of the generated regular expressions.The semantic correctness is measured using the DFA-equivalence oracle, random test cases, and distinguishing test cases.The experiments on three public datasets demonstrate the superiority of SemRegex over the existing state-of-the-art approaches.

Crowd intelligence opens up new ways for decision making in open environments, traditional decision making is unable to effectively make correct decisions in open environments. In this paper, positive and negative comparing method using linguistic scale is proposed to make decisions in the open environments with crowd intelligence. Firstly, the crowd participants compare the alternative with the corresponding positive and negative assessment points, and give their evaluations using linguistic scales form positive and negative views. The crowd participants' evaluations can be translated into Intuitionistic Fuzzy Numbers (IFNs). In the proposed methods, the evaluations given by the crowd participants do not depend on the pairwise comparisons of the alternatives, the consistent problem can be avoided. Secondly, the consensus measures between aggregating results and IFNs are proposed. Based on these concepts, the aggregating methods that without discarding any IFNs are proposed and studied. The studying results show that the proposed methods can improve the consensus measures between the aggregating result and evaluations given by crowd participants.

The main task of microservice extraction is to find which software entities (e.g., methods, classes) should be grouped together from existing monolithic software as candidate microservices, responsible for specific functionalities and evolving independently. Current methods extract microservices by analyzing source code and following the assumption that "classes with strong relation should be in the same service", which originates from software structure analysis. We find that 1) many program behaviors cannot be explicitly reflected in the source code, and 2) the relation at code-level is not equivalent to the same functionality. Thus, we propose a functionality-oriented microservice extraction (FoME) method in this study by monitoring program dynamic behavior and clustering execution traces. Instead of source code analysis, the execution traces of a program are applied to group source code entities that are dedicated to the same functionality. We also construct a systematic measurement of microservice by integrating five complementary metrics of service cohesion and coupling. These metrics measure Functional Independence of microservices. That is, it qualifies whether a microservices can have its own responsibilities independently. In the experiment, our method is compared with three state-of-the-art methods on four open-source projects. The microservice candidates generated using our method present similar functional cohesion to the services produced using the other methods, but have considerably looser coupling measurements (dramatically reducing measurements of IRN and OPN).

Network measures have been proved to be useful in predicting software defects. Leveraging the dependency relationships between software modules, network measures can capture various structural features of software systems. However, existing studies have relied on user-defined network measures (e.g., degree statistics or centrality metrics), which are inflexible and require high computation cost, to describe the structural features. In this paper, we propose a new method called node2defect which uses a newly proposed network embedding technique, node2vec, to automatically learn to encode dependency network structure into low-dimensional vector spaces to improve software defect prediction. Specifically, we firstly construct a program's Class Dependency Network. Then node2vec is used to automatically learn structural features of the network. After that, we combine the learned features with traditional software engineering features, for accurate defect prediction. We evaluate our method on 15 open source programs. The experimental results show that in average, node2defect improves the state-of-the-art approach by 9.15% in terms of F-measure.

The rapid increase in the number of Android malware poses great challenges to anti-malware systems, because the sheer number of malware samples overwhelms malware analysis systems. The classification of malware samples into families, such that the common features shared by malware samples in the same family can be exploited in malware detection and inspection, is a promising approach for accelerating malware analysis. Furthermore, the selection of representative malware samples in each family can drastically decrease the number of malware to be analyzed. However, the existing classification solutions are limited because of the following reasons. First, the legitimate part of the malware may misguide the classification algorithms because the majority of Android malware are constructed by inserting malicious components into popular apps. Second, the polymorphic variants of Android malware can evade detection by employing transformation attacks. In this paper, we propose a novel approach that constructs frequent subgraphs (fregraphs) to represent the common behaviors of malware samples that belong to the same family. Moreover, we propose and develop FalDroid, a novel system that automatically classifies Android malware and selects representative malware samples in accordance with fregraphs. We apply it to 8407 malware samples from 36 families. Experimental results show that FalDroid can correctly classify 94.2% of malware samples into their families using approximately 4.6 sec per app. FalDroid can also dramatically reduce the cost of malware investigation by selecting only 8.5% to 22% representative samples that exhibit the most common malicious behavior among all samples.

As multithreaded programs become increasingly popular, plagiarism of multithreaded programs starts to plague the software industry. Although there has been tremendous progress on software plagiarism detection technology, existing dynamic birthmark approaches are applicable only to sequential programs, due to the fact that thread scheduling nondeterminism severely perturbs birthmark generation and comparison. We propose a framework called TOB (Thread-oblivious dynamic Birthmark) that revives existing techniques so they can be applied to detect plagiarism of multithreaded programs. This is achieved by thread-oblivious algorithms that shield the influence of thread schedules on executions. We have implemented a set of tools collectively called TOB-PD (TOB based Plagiarism Detection tool) by applying TOB to three existing representative dynamic birthmarks, including SCSSB (System Call Short Sequence Birthmark), DYKIS (DYnamic Key Instruction Sequence birthmark) and JB (an API based birthmark for Java). Our experiments conducted on large number of binary programs show that our approach exhibits strong resilience against state-of-the-art semantics-preserving code obfuscation techniques. Comparisons against the three existing tools SCSSB, DYKIS and JB show that the new framework is effective for plagiarism detection of multithreaded programs. The tools, the benchmarks and the experimental results are all publicly available.

With the advent of multicore processors, there is a trend towards multithreading to take advantage of parallel computing resources. Due to greatly increased complexity, programmers need effective testing methodology that can thoroughly test multithreaded programs. There has been significant progress based on symbolic execution that attempts to exhaustively explore all the intra-thread paths and inter-thread interleavings. However, such testing approach faces two insuperable challenges. Firstly, exploring an astronomically large number of paths and interleavings limits its scalability. Secondly, a path itself does not directly help programmers understand program behavior. In this paper, we propose an alternate testing methodology that focuses on definition-use data flow instead of paths/interleavings. Such approach not only leads to orders of magnitude reduction in testing complexity, but also gives programmers direct help on examining the shared variable usage in a multithreaded program.

With the exponential growth of smartphone adoption, malware attacks on smartphones have resulted in serious threats to users, especially those on popular platforms, such as Android. Most Android malware is generated by piggybacking malicious payloads into benign applications (apps), which are called piggybacked apps. In this paper, we propose DAPASA, an approach to detect Android piggybacked apps through sensitive subgraph analysis. Two assumptions are established to reflect the different invocation patterns of sensitive APIs in the injected malicious payloads (rider) of a piggybacked app and in its host app (carrier). With these two assumptions, DAPASA generates a sensitive subgraph (SSG) to profile the most suspicious behavior of an app. Five features are constructed from SSG to depict the invocation patterns. The five features are fed into the machine learning algorithms to detect whether the app is piggybacked or benign. DAPASA is evaluated on a large real-world data set consisting of 2551 piggybacked apps and 44 921 popular benign apps. Extensive evaluation results demonstrate that the proposed approach exhibits an impressive detection performance compared with that of three baseline approaches even with only five numeric features. Furthermore, the proposed approach can complement permission-based approaches and API-based approaches with the combination of our five features from a new perspective of the invocation structure.

Symbolic execution is a powerful technique for systematically exploring the paths of a program and generating the corresponding test inputs. However, its practical usage is often limited by thepath explosionproblem, that is, the number of explored paths usually grows exponentially with the increase of program size. In this paper, we argue that for the purpose of fault detection it is not necessary to systematically explore the paths, and propose a new symbolic execution approach to mitigate the path explosion problem by predicting and eliminating the redundant paths based on symbolic value. Our approach can achieve the equivalent fault detection capability as traditional symbolic execution without exhaustive path exploration. In addition, we develop a practical implementation called Dependence Guided Symbolic Execution (DGSE) to soundly approximate our approach. Through exploiting program dependence, DGSE can predict and eliminate the redundant paths at a reasonable computational cost. Our empirical study shows that the redundant paths are abundant and widespread in a program. Compared with traditional symbolic execution, DGSE only explores 6.96 to 96.57 percent of the paths and achieves a speedup of 1.02$\times$to 49.56$\times$. We have released our tool and the benchmarks used to evaluate DGSE$^\ast$.

Aggregation operators for intuitionistic fuzzy information, the popular methods in group decision, face the challenge in this area - counter-intuitive result (the decision result is conflict with people's intuition under specific inputs). In this paper, the Mixed Intuitionistic Fuzzy Aggregation Operators (MIFAOs) are proposed to relieve this problem. Firstly, the Bivariate Mixed Intuitionistic Fuzzy Aggregation Operators (BMIFAOs) are introduced based on the proposed extensions of t-conorms and t-norms. Some basic operational laws are proposed for Archimedean t-conorms and t-norms. Thus, the effects of unusual Intuitionistic Fuzzy Numbers (IFNs) would be decreased on final aggregating results. Secondly, the Multivariate Mixed Intuitionistic Fuzzy Aggregation Operators (MMIFAOs) are proposed, by extending BMIFAOs to higher dimensions. The basic operators are deduced for the Algebraic t-conorms and t-norms. Finally, an illustrative example is utilized to demonstrate the process of aggregating the IFNs by utilizing the proposed MMIFAOs in this paper. The results show that the proposed MIFAOs can relieve the counter-intuitive results for aggregation operators on unusual IFNs.

The rapid growth of Android malware poses great challenges to anti-malware systems because the sheer number of malware samples overwhelm malware analysis systems. A promising approach for speeding up malware analysis is to classify malware samples into families so that the common features in malwares belonging to the same family can be exploited for malware detection and inspection. However, the accuracy of existing classification solutions is limited because of two reasons. First, since the majority of Android malware is constructed by inserting malicious components into popular apps, the malware's legitimate part may misguide the classification algorithms. Second, the polymorphic variants of Android malware could evade the detection by employing transformation attacks. In this paper, we propose a novel approach that constructs frequent subgraph (fregraph) to represent the common behaviors of malwares in the same family for familial classification of Android malware. Moreover, we propose and develop FalDroid, an automatic system for classifying Android malware according to fregraph, and apply it to 6,565 malware samples from 30 families. The experimental results show that FalDroid can correctly classify 94.5% malwares into their families using around 4.4s per app.

Linguistic pairwise comparison matrices are widely used in decision-making procedures. However, the matrices often give conflicting results when there are multiple criteria under consideration. Despite intensive research, achieving consistency of such matrices remains a daunting task. In this paper, a novel approach based on linguistic discrete region is proposed to address the challenge. Unlike existing methods that require a single value for each comparison, our approach allows a comparison to be expressed by a discrete region with multiple linguistic terms. Such front-end gives users more freedom to express their opinions. In the back-end, we propose an iterative searching algorithm that is able to achieve approximate optimal consistency for the comparison matrices with discrete region values. The final results are single-value matrices that not only guarantee approximate optimal consistency but comply with evaluators' intentions a well, as our approach does not modify any linguistic values like many existing methods. We have conducted extensive evaluations, and our empirical study confirms that the linguistic discrete region-based approach significantly improves the consistency of linguistic pairwise comparison matrices.

Intuitionistic Fuzzy Set (IFS) is considered as a nature solution for information fusion. How to transform the information with non-uniform distribution into IFS? In this paper, the authors proposed an approach to deal with this challenge. First, the intensive region (IR) of non-uniform distribution data is searched. Second, the evaluation grades are assigned to IR and other regions. IR is assigned to more grades, because of the higher data rate in it. Finally, the non-uniform data is translated into IFS based on the suitable grades assignment. The experiment is conducted to study the effectiveness and advantage of this approach.

A software birthmark is a unique characteristic of a program. Thus, comparing the birthmarks between the plaintiff and defendant programs provides an effective approach for software plagiarism detection. However, software birthmark generation faces two main challenges: the absence of source code and various code obfuscation techniques that attempt to hide the characteristics of a program. In this paper, we propose a new type of software birthmark called DYnamic Key Instruction Sequence (DYKIS) that can be extracted from an executable without the need for source code. The plagiarism detection algorithm based on our new birthmarks is resilient to both weak obfuscation techniques such as compiler optimizations and strong obfuscation techniques implemented in tools such as SandMark, Allatori and Upx. We have developed a tool called DYKIS-PD (DYKIS Plagiarism Detection tool) and conducted extensive experiments on large number of binary programs. The tool, the benchmarks and the experimental results are all publicly available.

H. Zhang, Q. Zheng, and T. Liu et al. proposed a discrete region based approach to improve the consistency of the pair-wise comparison matrix. The approach is able to significantly improve the consistency of pair-wise comparison matrix without to revise the decision maker's opinion. In the approach, a discrete region matrix is transformed into a set-matrix in which the elements are the real number set. In this paper, a discrete region matrix is transformed into a reciprocal interval matrix. A new iterative searching algorithm (NISA) is proposed to find the pair-wise comparison matrix with approximate optimum consistency from the reciprocal interval matrix. Based on the similarly principle, a new algorithm is proposed to derive the interval weight vector for the reciprocal interval matrix. The key character of this algorithm is that the derived interval weight vector includes the weight vector got by NISA for the same reciprocal interval matrix. In the experiment, five experimental strategies are designed, and the experimental results show that H. Zhang et al. proposed approach and NISA can get approximately similar weight vector according to the same pair-wise comparison matrix used the discrete region.

The availability of inexpensive multicore hardware presents a turning point in software development. In order to benefit from the continued exponential throughput advances in new processors, the software applications must be multithreaded programs. As multithreaded programs become increasingly popular, plagiarism of multithreaded programs starts to plague the software industry. Although there has been tremendous progress on software plagiarism detection technology, existing dynamic approaches remain optimized for sequential programs and cannot be applied to multithreaded programs without significant redesign. This paper fills the gap by presenting two dynamic birthmark based approaches. The first approach extracts key instructions while the second approach extracts system calls. Both approaches consider the effect of thread scheduling on computing software birthmarks. We have implemented a prototype based on the Pin instrumentation framework. Our empirical study shows that the proposed approaches can effectively detect plagiarism of multithread programs and exhibit strong resilience to various semantic-preserving code obfuscations.

The consistency of pair-wise comparison matrix is a serious challenge for the multiple-criteria decision-making problem. However, existing methods are either too complicated to be applied in the revising process of the inconsistent comparison matrix or are difficult to preserve most of the original comparison information due to the use of a new pairwise comparison matrix. In this paper, a discrete region-based approach is proposed to improve the consistency of the pair-wise comparison matrix. When the decision makers feel confused or uncertain, they could express their evaluation as a discrete region containing multiple judgments, instead of a single result. A new data structure, named as set-matrix, is designed to store the combinations of those multiple judgments. An iterative searching algorithm is designed to find the pair-wise comparison matrix with approximate optimal consistency from the set-matrix. The experiments show that: 1) the consistency is significantly improved when the experts apply the discrete region evaluation instead of the single evaluation; and 2) the users can find the matrix with approximate optimal consistency quickly exploiting the iterative searching algorithm.

Bad Data Injection (BDI) in Smart Grid is considered to be the most dangerous cyber attack, as it might lead to energy theft on the end users, false dispatch on the distribution process, and device breakdown on the power generation. State Estimation and Bad Data Detection, which are applied to reduce the observation errors and detect false data in the traditional power grid, could not detect the bad data in smart grid. In this paper, three BDI attack cases in IEEE 14-bus system are designed to bypass the traditional bad data detection. The potential risks on economy and security are analyzed exploiting the MATPOWER. A new method based on Distributed State Estimation (DSE) is proposed to detect BDI, named as DSE-based bad data detection. The power system is divided into several subsystems, and a Chi-squares test is applied to detect the bad data respectively in each subsystem. Simulation results demonstrate that the DSE-based bad data detection can detect all bad data in three attack cases. Moreover, it can locate the bad data in specific subsystem which is helpful for the further identification.

Bad data injection is one of most dangerous attacks in smart grid, as it might lead to energy theft on the end users and device breakdown on the power generation. The attackers can construct the bad data evading the bad data detection mechanisms in power system. In this paper, a novel method, named as Adaptive Partitioning State Estimation (APSE), is proposed to detect bad data injection attack. The basic ideas are: 1) the large system is divided into several subsystems to improve the sensitivity of bad data detection; 2) the detection results are applied to guide the subsystem updating and re-partitioning to locate the bad data. Two attack cases are constructed to inject bad data into an IEEE 39-bus system, evading the traditional bad data detection mechanism. The experiments demonstrate that all bad data can be detected and located within a small area using APSE.

Numerous smart devices are deployed in smart grid for state measurement, decision-making and remote control. The security issues of smart devices attract more and more attention. In our work, the communication protocol, storage mechanism and authentication of smart devices are analyzed and a toolbox is developed to evaluate the security risks of smart devices. In this demo, our toolbox is applied to scan 3 smart meters/power monitor systems. A potential risk list is generated and the vulnerabilities are further verified.

In the identity authentication, many advanced encryption techniques are applied to confirm and protect the user identity. Although the identity information is transmitted as cipher text in the Internet, the attackers can theft and fraud the identity by eavesdropping, cryptanalysis and forging. In this paper, a new identity authentication mechanism is proposed, which exploits the Timing Covert Channel (TCC) to transmit the identity information. TCC was originally a hacker technique to leak information under supervising, which uses the sending time of packets to indicate the information. In our method, the intervals between packets are applied to indicate the authentication tags. It is difficult for the attackers to eavesdrop, crack and forge the TCC identity, since the packets are too huge to analyze and the noise is different between the users and the attackers. A platform is designed to verify our proposed method. The experiment shows that the intervals and the thresholds are the key factors on the accuracy and efficiency. And it also proves our method is a secure way for identity information, which could be implanted on various network applications.

SUMMARY Millions of new malicious programs are produced by the mature industry of malware production. These programs have tremendous challenges on the signature‐based antivirus products. Machine learning techniques are applicable for detecting unknown malicious programs without knowing their signatures. In this paper, a layered classification method is developed to detect malwares with a two‐layer framework. The low‐level‐classifier is employed to identify whether the programs perform any malicious functions according to the API‐calls of the programs; the up‐level‐classifier is applied to detect malwares according to the function identification. A hybrid structure called Type‐Function, constituting of the classification results of low‐level‐classifier and up‐level‐classifier, is proposed to describe the malware. This method is compared with Naive Bayes, decision tree, and boosting using a comprehensive test dataset containing 16,135 malwares and 1800 benign programs. The experiments demonstrate that our method outperforms other algorithms in terms of detection accuracy. Moreover, the Type‐Function structure is proved as an unprejudiced and effective method for malware description. Copyright © 2011 John Wiley & Sons, Ltd.

This paper presents a novel Trojan detection and defense system. The prototype searches the important files which contain users' confidential information on the disk. And then, these files will be monitored to find which processes will access them by capturing and analyzing the IRPs (I/O request packets). The processes of Trojans will be distinguished from regular ones by evaluating their API-calls with several machine-learning models, rather than traditional signature-based mechanism. Testing results show that this prototype could detect and defend the unknown Trojans quickly and accurately.