The widespread adoption of app hardening techniques in Android applications makes it more challenging for current analysis techniques to analyze hardened apps, leading to limited analysis coverage. This limitation is mainly due to the difficulties in obtaining detailed information about Intents, which is essential for component communication and the execution of specific events in Android applications.

Wi-Fi 7 introduces Multi-link operation (MLO) to enhance throughput and latency performance compared to previous Wi-Fi standards. MLO enables simultaneous transmission and reception through multiple links, departing from conventional single-link operations (SLO). To fully exploit MLO’s potential, it is essential to investigate Wi-Fi 7’s coexistence performance with legacy Wi-Fi devices. Existing approaches, however, have overlooked some crucial aspects of MLO, necessitating the development of a standards-compliant analytical framework to model the actual channel access mechanism of MLO. Therefore, this research aims to addresses this gap by constructing an accurate Markov chain model for MLO aligned with the backoff behaviors specified by the standard, and by deriving closed-form expressions for the throughput of each device type in the Wi-Fi 7 and legacy Wi-Fi coexistence scenario.

In this demo, we show MANIAC, a MAN-machIne collaborative system for malware Author Classification. It is developed to fight a number of author groups who have been generating lots of new malwares by sharing source code within a group and exploiting evasive schemes such as polymorphism and metamorphism. Notably, MANIAC allows users to intervene in the model's classification of malware authors with high uncertainty. It also provides effective interfaces and visualizations with users to achieve maximum classification accuracy with minimum human labor.

For these few decades malwares have been posing a major concern in the cyber security. Recently, a number of "author groups" have been generating lots of newmalwares by sharing source code within a group and exploiting evasive schemes such as polymorphism and metamorphism. This motivates us to study the problem of identifying the author group of a given malware, which would be able to work for not only blocking malwares but also legally punishing suspected malware authors. In this paper, we propose a human-machine collaborative approach for classifying author groups of malwares accurately. We also propose a visualization method for helping human experts to make the decision easily. We verify the superiority of our framework through extensive experiments using real-world malware data.

Packer identification is an essential process followed by further investigation on malware. For efficient packer identification, we introduce an SVM based automatized method, which uses kernel lifting with binary diffing measures for RBF kernels. According to the experimental results, we found that LCS, n-gram and other binary diffing measure serve kernels with better performance in packer identification than previous works, which has used traditional kernels or no kernel-lifting at all. In addition, Edit distance-based RBF kernels in previous works (e.g., [6]) do not show satisfying results compared to other binary diffing measure-based kernels.

A software birthmark means inherent characteristics that can be used to identify a program. In this paper, we propose a birthmark technique based on object traces of Java programs. Java is an object-oriented programming language that provides various predefined class libraries that help programmers to produce software easily. In order to utilize Java class libraries, we have to use Java object instructions. The Java object instructions are hard to replace or remove, and so a set of sequences of object instructions is a proper candidate to represent inherent characteristics of a program. We propose a new birthmark using the sequences of object instructions. We evaluate the proposed birthmark with open source programs and compare it with previous static birthmarks. Experiments show that the detection capability of our birthmark is much higher than that of other static birthmarks despite obfuscations by Smokescreen and ZKM.