We present CCA-Droid, a static analysis tool designed to detect cryptographic misuse related to chosen-ciphertext attacks (CCA) and chosen-plaintext attacks (CPA). CCA-Droid utilizes three key techniques: domain-specific slicing optimization to reduce analysis noise, crypto-state-aware call graph construction to capture indirect data flows via member variables, and conditional constant propagation for improved path sensitivity. Our evaluation demonstrates that CCA-Droid achieves 100% accuracy on CryptoAPI-Bench, surpassing CryptoGuard (72.3%), and maintains 94.8% accuracy on mutated code. Evaluations on the Ghera benchmark further confirm CCA-Droid's effectiveness, achieving 100% recall and 81.8% accuracy. On 16,284 real-world Android apps, CCA-Droid analyzed 96.4%, significantly outperforming existing tools such as CryptoGuard (80.4%) and QARK (40.0%). It identified cryptographic vulnerabilities in 12,678 apps (77.9%), with IV reuse, hardcoded keys, and missing authenticated encryption being the most prevalent issues.

Movie production and investment are associated with a high level of risk, motivating machine learning research to predict box-office revenue. Furthermore, identifying variables that have a significant influence on box-office revenue may aid in human decision-making. In this study, we collect a large movie dataset, including user-generated keywords and movie posters, and integrate these modalities to better predict box-office revenue. We utilize visual information from movie posters to visually ground the movie keywords, thereby acquiring more semantically precise text representations, resulting in a substantial 14.5% enhancement in box-office prediction accuracy. Also, we develop metrics to quantify content similarity based on the keywords, facilitating the identification of “copycat movies,” a term that can be extended beyond traditional sequels and franchise movies. Subsequently, we analyze the importance of copycat features in box-office revenue prediction using two explanatory methods: Attention Rollout and LIME. Our analyses show the importance of copycat features in box-office prediction and reveal a positive relationship between copycat movies and box-office revenues. However, this effect diminishes with an increase in the number of similar movies and the similarity of their content. Overall, our work establishes a comprehensive process of predicting movie box-office revenue by utilizing multi-modal data and providing valuable business insights.

Despite extensive research on text passwords, the security and memorability of verbal passwords-spoken rather than typed-remain underexplored. Verbal passwords hold significant potential for scenarios where keyboard input is impractical (e.g., smart speakers, wearables, vehicles) or users have motor impairments that make typing difficult. Through two large-scale user studies, we assessed the viability of verbal passwords. In our first study (N = 2,085), freely chosen verbal passwords were found to have a limited guessing space, with 39.76% cracked within 109guesses. However, in our second study (n = 600), applying word count and blocklist policies for verbal password creation significantly enhanced verbal password performance, achieving better memorability and security than traditional text passwords. Specifically, 65.6% of verbal password users (under the password creation policy using minimum word counts and a blocklist) successfully recalled their passwords in long-term tests, compared to 54.11% for text passwords. Additionally, verbal passwords with enforced policies exhibited a lower crack rate (6.5%) than text passwords (10.3%). These findings highlight verbal passwords as a practical and secure alternative for contexts where text passwords are infeasible, offering strong memorability with robust resistance to guessing attacks.

Investments in movie production are associated with a high level of risk as movie revenues have long-tailed and bimodal distributions [1]. Accurate prediction of box-office revenue may mitigate the uncertainty and encourage investment. However, learning effective representations for actors, directors, and user-generated content-related keywords remains a challenging open problem. In this work, we investigate the effects of self-supervised pretraining and propose visual grounding of content keywords in objects from movie posters as a pretraining objective. Experiments on a large dataset of 35,794 movies demonstrate significant benefits of self-supervised training and visual grounding. In particular, visual grounding pretraining substantially improves learning on movies with content keywords and achieves 14.5% relative performance gains compared to a finetuned BERT model with identical architecture.

Binary code similarity analysis (BCSA) is widely used for diverse security applications such as plagiarism detection, software license violation detection, and vulnerability discovery. Despite the surging research interest in BCSA, it is significantly challenging to perform new research in this field for several reasons. First, most existing approaches focus only on the end results, namely, increasing the success rate of BCSA by adopting uninterpretable machine learning. Moreover, they utilize their own benchmark sharing neither the source code nor the entire dataset. Finally, researchers often use different terminologies or even use the same technique without citing the previous literature properly, which makes it difficult to reproduce or extend previous work. To address these problems, we take a step back from the mainstream and contemplate fundamental research questions for BCSA. Why does a certain technique or a feature show better results than the others? Specifically, we conduct the first systematic study on the basic features used in BCSA by leveraging interpretable feature engineering on a large-scale benchmark. Our study reveals various useful insights on BCSA. For example, we show that a simple interpretable model with a few basic features can achieve a comparable result to that of recent deep learning-based approaches. Furthermore, we show that the way we compile binaries or the correctness of underlying binary analysis tools can significantly affect the performance of BCSA. Lastly, we make all our source code and benchmark public and suggest future directions in this field to help further research.

One approach to assess the security of embedded IoT devices is applying dynamic analysis such as fuzz testing to their firmware in scale. To this end, existing approaches aim to provide an emulation environment that mimics the behavior of real hardware/peripherals. Nonetheless, in practice, such approaches can emulate only a small fraction of firmware images. For example, Firmadyne, a state-of-the-art tool, can only run 183 (16.28%) of 1,124 wireless router/IP-camera images that we collected from the top eight manufacturers. Such a low emulation success rate is caused by discrepancy in the real and emulated firmware execution environment.