ABSTRACT The digital landscape and rapid advancement of Information and Communication Technology have significantly increased social interactions, but it has also led to a rise in harmful behaviours such as offensive language, cyberbullying, and HS. Addressing online harassment is critical due to its severe consequences. This study offers a comprehensive evaluation of existing studies that employed metaheuristic optimization algorithms for detecting textual harassment content across social media platforms, highlighting their strengths and limitations. Using the PRISMA methodology, we reviewed and analysed 271 research papers, ultimately narrowing down the selection to 36 papers based on specific inclusion and exclusion criteria. By analysing key factors such as optimization techniques, feature engineering strategies, and dataset characteristics, we identify crucial trends and challenges in the field. Finally, we offer practical recommendations to improve the accuracy of predictive models, including adopting hybrid approaches, enhancing multilingual capabilities, and expanding models to operate effectively across various social media platforms.

Many popular object-oriented (OO) programming languages, such as Java, do not provide explicit support for architecture-based development, i.e., do not provide programming-language constructs that are at the granularity of architectural constructs, such as components and ports. The gap between how engineers design their systems and how they implement them has been one of the leading causes of architectural drift—a situation in which the prescriptive architecture (the designed architecture) does not match the descriptive architecture (the implemented architecture). To mitigate this challenge, in its ninth iteration, Java introduced the concept of Java Platform Module System (JPMS), which for the first time provides explicit implementation-level support for well-known architectural constructs, such as components (called modules) and ports (called module directives). Despite this, the majority of existing Java applications (apps) are still purely OO programs that do not make use of the new constructs, because converting them to well-structured component-based (CB) programs is a tedious and error-prone task. In fact, prior research has shown that when engineers convert OO apps to CB apps, they tend to be highly over-privileged, i.e., components are granted more access privileges than they actually need. To mitigate these challenges, we have developed OO2CB, an approach for conversion of an OO Java app to a least-privilege CB Java app. OO2CB employs component recovery techniques to assist the developer in determining a given OO app’s components. It then statically analyzes the source code of the app to determine the dependencies among its recovered components and the required port types for facilitating their interaction. Finally, OO2CB generates a functionally equivalent CB app that satisfies the least-privilege security principle. Our experiments on several large real-world OO Java apps corroborate the effectiveness of OO2CB.

In the digitally connected world that we are living in, people expect to get answers to their questions spontaneously. This fact increased the burden on the Question/Answer platforms such as Stack Overflow and many others. A promising solution to this problem is to detect if a question being asked similar to a question in the database and present the answer of the detected question to the user. To address this challenge, we propose a novel Natural Language Processing (NLP) approach that detects if two Arabic questions are similar or not using their extracted morphological, syntactic, semantic, lexical features. Our approach involves several phases including Arabic text processing, novel feature extraction, and text classifications. To conduct our experiments, we used a real-world questions dataset consisting of 4,000 pairs of Arabic questions in which our approach achieved 78.2% accuracy using XGBoost model on the best features selected by the Random Forest feature selection technique. This high accuracy shows the ability of our approach to correctly detect the similarity between two Arabic questions.

The number of malicious Android apps has been and continues to increase rapidly. These malware can damage or alter other files or settings, install additional applications, obfuscate their behaviors, propagate quickly, and so on. To identify and handle such malware, a security analyst can significantly benefit from identifying the family to which a malicious app belongs rather than only detecting if an app is malicious. To address these challenges, we present a novel machine learning-based Android malware detection and family-identification approach, RevealDroid, that operates without the need to perform complex program analyses or extract large sets of features. RevealDroid's selected features leverage categorized Android API usage, reflection-based features, and features from native binaries of apps. We assess RevealDroid for accuracy, efficiency, and obfuscation resilience using a large dataset consisting of more than 54,000 malicious and benign apps. Our experiments show that RevealDroid achieves an accuracy of 98% in detection of malware and an accuracy of 95% in determination of their families. We further demonstrate RevealDroid's superiority against state-of-the-art approaches. [URL of original paper: https://dl.acm.org/citation.cfm?id=3162625]

The Android platform has been the dominant mobile platform in recent years resulting in millions of apps and security threats against those apps. Anti-malware products aim to protect smartphone users from these threats, especially from malicious apps. However, malware authors use code obfuscation on their apps to evade detection by anti-malware products. To assess the effects of code obfuscation on Android apps and anti-malware products, we have conducted a large-scale empirical study that evaluates the effectiveness of the top anti-malware products against various obfuscation tools and strategies. To that end, we have obfuscated 3,000 benign apps and 3,000 malicious apps and generated 73,362 obfuscated apps using 29 obfuscation strategies from 7 open-source, academic, and commercial obfuscation tools. The findings of our study indicate that (1) code obfuscation significantly impacts Android anti-malware products; (2) the majority of anti-malware products are severely impacted by even trivial obfuscations; (3) in general, combined obfuscation strategies do not successfully evade anti-malware products more than individual strategies; (4) the detection of anti-malware products depend not only on the applied obfuscation strategy but also on the leveraged obfuscation tool; (5) anti-malware products are slow to adopt signatures of malicious apps; and (6) code obfuscation often results in changes to an app's semantic behaviors.

The current security mechanisms for Android apps, both static and dynamic analysis approaches, are insufficient for detection and prevention of the increasingly dynamic and sophisticated security attacks. Static analysis approaches suffer from false positives whereas dynamic analysis approaches suffer from false negatives. Moreover, they all lack the ability to efficiently analyze systems with incremental changes—such as adding/removing apps, granting/revoking permissions, and dynamic components’ communications. Each time the system changes, the entire analysis needs to be repeated, making the existing approaches inefficient for practical use. To mitigate their shortcomings, we have developed SALMA, a novel self-protecting Android software system that monitors itself and adapts its behavior at runtime to prevent a wide-range of security risks. SALMA maintains a precise architectural model, represented as a Multiple-Domain-Matrix, and incrementally and efficiently analyzes an Android system in response to incremental system changes. The maintained architecture is used to reason about the running Android system. Every time the system changes, SALMA determines (1) the impacted part of the system, and (2) the subset of the security analyses that need to be performed, thereby greatly improving the performance of the approach. Our experimental results on hundreds of real-world apps corroborate SALMA’s scalability and efficiency as well as its ability to detect and prevent security attacks at runtime with minimal disruption.

The number of malicious Android apps is increasing rapidly. Android malware can damage or alter other files or settings, install additional applications, and so on. To determine such behaviors, a security analyst can significantly benefit from identifying the family to which an Android malware belongs rather than only detecting if an app is malicious. Techniques for detecting Android malware, and determining their families, lack the ability to handle certain obfuscations that aim to thwart detection. Moreover, some prior techniques face scalability issues, preventing them from detecting malware in a timely manner. To address these challenges, we present a novel machine-learning-based Android malware detection and family identification approach, RevealDroid, that operates without the need to perform complex program analyses or to extract large sets of features. Specifically, our selected features leverage categorized Android API usage, reflection-based features, and features from native binaries of apps. We assess RevealDroid for accuracy, efficiency, and obfuscation resilience using a large dataset consisting of more than 54,000 malicious and benign apps. Our experiments show that RevealDroid achieves an accuracy of 98% in detection of malware and an accuracy of 95% in determination of their families. We further demonstrate RevealDroid’s superiority against state-of-the-art approaches.

Modern mobile platforms rely on a permission model to guard the system's resources and apps. In Android, since the permissions are granted at the granularity of apps, and all components belonging to an app inherit those permissions, an app's components are typically over-privileged, i.e., components are granted more privileges than they need to complete their tasks. Systematic violation of least-privilege principle in Android has shown to be the root cause of many security vulnerabilities. To mitigate this issue, we have developed DELDROID, an automated system for determination of least privilege architecture in Android and its enforcement at runtime. A key contribution of our approach is the ability to limit the privileges granted to apps without the need to modify them. DELDROID utilizes static program analysis techniques to extract the exact privileges each component needs for providing its functionality. A Multiple-Domain Matrix representation of the system's architecture is then used to automatically analyze the security posture of the system and derive its least-privilege architecture. Our experiments on hundreds of real world apps corroborate DELDROID's ability in effectively establishing the least-privilege architecture and its benefits in alleviating the security threats.

Although a wide variety of approaches identify vulnerabilities in Android apps, none attempt to determine exploitability of those vulnerabilities. Exploitability can aid in reducing false positives of vulnerability analysis, and can help engineers triage bugs. Specifically, one of the main attack vectors of Android apps is their inter-component communication interface, where apps may receive messages called Intents. In this paper, we provide the first approach for automatically generating exploits for Android apps, called LetterBomb, relying on a combined path-sensitive symbolic execution-based static analysis, and the use of software instrumentation and test oracles. We run LetterBomb on 10,000 Android apps from Google Play, where we identify 181 exploits from 835 vulnerable apps. Compared to a state-of-the-art detection approach for three ICC-based vulnerabilities, LetterBomb obtains 33%-60% more vulnerabilities at a 6.66 to 7 times faster speed.