The widespread adoption of third-party libraries (TPLs) in software development has significantly accelerated the creation of modern software. However, this convenience comes with potential legal risks. Developers may inadvertently violate the licenses of TPLs, leading to legal issues. While existing studies have explored software licenses and potential incompatibilities, these studies often focus on a limited set of licenses or rely on low-quality license data, which may affect their conclusions. To address this gap, there is an urgent need for a high-quality license dataset that encompasses a broad range of mainstream licenses and provides accurate terms and conflict information, to help developers navigate the complex landscape of software licenses, avoid potential legal pitfalls, and guide more informed and effective solutions for managing license compliance and compatibility in software development. To this end, we conduct the first work to understand the mainstream software licenses based on term granularity and obtain a high-quality dataset of 453 SPDX licenses with well-labeled terms and conflicts. Specifically, we first conduct a differential analysis of the mainstream platforms that provide license data to understand the terms and attitudes of each license. N ext, we further propose a standardized set of license terms to capture and label existing mainstream licenses with high quality. Moreover, we improve the existing license conflict mode to include copyleft conflicts and conclude the three major types of license conflicts among the 453 SPDX licenses. Based on the dataset, we carry out two empirical studies to reveal the concerns and threats from the perspectives of both licensors and licensees. One study provides an in-depth analysis of the similarities, differences, and conflicts among SPDX licenses, and the other revisits the usage and conflicts of licenses in the NPM ecosystem and draws conclusions that differ from previous work. Our studies reveal some insightful findings and disclose relevant analytical data, which set the stage for further research into the complexities of license compliance and compatibility.

The cross-correlation between two maximum length sequences ($m$-sequences) of the same period has been studied since the end of 1960s. One open conjecture by Helleseth states that the cross-correlation between any two$p$-ary$m$-sequences takes on the value −1 for at least one shift provided that the decimation$d$obeys$d\equiv 1\,({\mathrm{ mod}}\, p-1)$. This was known as the −1 conjecture. Up to now, the −1 conjecture was confirmed for the following decimations: (1) Niho-type decimations, i.e.,$d=s(p^{n/{2}}-1)+1$, where$s$is an integer; (2) all the complete permutation polynomial (CPP) exponents$d$satisfying$d\equiv 1\, ({\mathrm{ mod}}\, p-1) $; and (3) the additional families of decimations tabulated in this paper. In this paper, we first discuss the connection between the −1 conjecture on cross-correlation of$m$-sequences and CPP exponents, then we confirm the −1 conjecture for a new type of decimations by giving a new class of CPP exponents. The decimations are of the type$d=1+l{(p^{rtm}-1)}/{(r+1)}$over${\mathbb F}_{p^{rtm}}$, where$p$is a prime,$r+1$is an odd prime satisfying$p^{r/{2}} \equiv -1\,({\mathrm{ mod}}\, r+1)$,$t$is an odd integer ($t>2$if$p=2$) with$\gcd (t,r)=1$, and$m$is a positive integer. We transform the problem of determining whether$d$is a CPP exponent into that of investigating the existence of irreducible polynomials over$\mathbb {F}_{p}$with degree$t$satisfying a congruence equation. By a theorem given by Rosen that considered the number of irreducible polynomials with a special congruence relation, we prove that$d$is a CPP exponent over${\mathbb F}_{p^{rtm}}$for sufficiently large$t$. When$m$is odd, our new CPP exponents are of Niho type; thus, we give a new class of CPP exponents of Niho type. When$m$is even, we obtain a new class of CPP exponents which are not of Niho type. As a consequence, we show that the −1 conjecture is true for$d=1+l{(p^{rtm}-1)}/{(r+1)}$when$t$is a sufficiently large integer.

Vehicular Ad Hoc Networks (VANETs) bring many benefits and conveniences to road safety and drive comfort in future transportation systems. However, VANETs suffer from almost all security issues as same as wireless networks. Sybil attack is one of the most risky threats since it violates the fundamental assumption of VANETs-based applications that all received information are correct and trusted. Sybil attacker can generate multiple fake identities to disseminate false messages. In this paper, we propose a novel Sybil attack detection method based on Received Signal Strength Indicator (RSSI), Voiceprint, to conduct a widely applicable, lightweight and full-distributed detection for VANETs. Unlike most of previous RSSI-based methods that compute the absolute position or relative distance according to RSSI values, or make statistic testing based on RSSI distributions, Voiceprint adopts RSSI time series as the vehicular speech and compares the similarity among all received series. Voiceprint does not rely on any predefined radio propagation model, and conducts independent detection without support of the centralized node. Moreover, we improve Voiceprint by allowing it to conduct detection on Service Channel (SCH) to shorten observation time. Furthermore, we extend Voiceprint with change-points detection to identify those illegitimate nodes performing power control. Extensive simulations and real-world experiments demonstrate that Voiceprint is an effective method considering the cost, complexity, and performance.

Vehicular Ad Hoc Networks (VANETs) enable vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications that bring many benefits and conveniences to improve the road safety and drive comfort in future transportation systems. Sybil attack is considered one of the most risky threats in VANETs since a Sybil attacker can generate multiple fake identities with false messages to severely impair the normal functions of safety-related applications. In this paper, we propose a novel Sybil attack detection method based on Received Signal Strength Indicator (RSSI), Voiceprint, to conduct a widely applicable, lightweight and full-distributed detection for VANETs. To avoid the inaccurate position estimation according to predefined radio propagation models in previous RSSI-based detection methods, Voiceprint adopts the RSSI time series as the vehicular speech and compares the similarity among all received time series. Voiceprint does not rely on any predefined radio propagation model, and conducts independent detection without the support of the centralized infrastructure. It has more accurate detection rate in different dynamic environments. Extensive simulations and real-world experiments demonstrate that the proposed Voiceprint is an effective method considering the cost, complexity and performance.

In this paper, some questions on the distribution of the peak-to-mean envelope power ratio (PMEPR) of standard binary Golay sequences are solved. For n odd, we prove that the PMEPR of each standard binary Golay sequence of length 2nis exactly 2, and determine the location(s), where peaks occur for each sequence. For n even, we prove that the envelope power of such sequences can never reach 2n+1at time points t ∈ {(v/2u)|0 ≤ v ≤ 2u, v,u ∈ N}. We further identify eight sequences of length 24and eight sequences of length 26that have PMEPR exactly 2, and raise the question whether, asymptotically, it is possible for standard binary Golay sequences to have PMEPR less than 2 - ϵ, where, ϵ > 0.