Binary code analysis allows analyzing binary without having access to the corresponding source code.A binary, after disassembly, is expressed in an assembly language.This inspires us approach by leveraging ideas and techniques from Natural Language Processing (NLP), a fruitful area focused on processing text of various natural languages.We notice that NLP share many analogical topics, such as semantics extraction, classification, code/text comparison.This work thus borrows address two...

Existing code similarity comparison methods, whether source or binary based, are mostly not resilient to obfuscations. In the case of software plagiarism, emerging obfuscation techniques have made automated detection increasingly difficult. this paper, we propose a binary-oriented, obfuscation-resilient method based on new concept, longest common subsequence semantically equivalent basic blocks, which combines rigorous program semantics with fuzzy matching. We model block by set symbolic...

Existing code similarity comparison methods, whether source or binary based, are mostly not resilient to obfuscations. Identifying similar identical fragments among programs is very important in some applications. For example, one application detect illegal reuse. In the theft cases, emerging obfuscation techniques have made automated detection increasingly difficult. Another identify cryptographic algorithms which widely employed by modern malware circumvent detection, hide network...

Given a closed-source program, such as most of proprietary software and viruses, binary code analysis is indispensable for many tasks, plagiarism detection malware analysis.Today, source very often compiled various architectures, making cross-architecture increasingly important.A binary, after being disassembled, expressed in an assembly language.Thus, recent work starts exploring Natural Language Processing (NLP) inspired analysis.In NLP, words are usually represented high-dimensional...

Secure pairing is key to trustworthy deployment and application of Internet Things (IoT) devices. However, IoT devices lack conventional user interfaces, such as keyboards displays, which makes many traditional approaches inapplicable. Proximity-based are very usable, but can be exploited by co-located malicious Approaches based on a user's physical operations more secure, typically require inertial sensors, while do not satisfy this requirement. A secure usable approach that applied...

Adversarial examples (AEs) are crafted by adding human-imperceptible perturbations to inputs such that a machine-learning based classifier incorrectly labels them. They have become severe threat the trustworthiness of machine learning. While AEs in image domain been well studied, audio less investigated. Recently, multiple techniques proposed generate AEs, which makes countermeasures against them urgent. Our experiments show that, given an AE, transcription results Automatic Speech...

Internet of Things (IoT) are densely deployed in smart environments, such as homes, factories and laboratories, where many people have physical access to IoT devices. How authenticate users operating on these devices is thus an important problem. usually lack conventional user interfaces, keyboards mice, which makes traditional authentication methods inapplicable. We present a virtual sensing technique that allows virtually sense 'petting' (in the form some very simple touches for about 2...

Given the massive difficulty in emulating IoT firmware, blackbox fuzzing of devices for vulnerability discovery has become an attractive option. However, existing fuzzers need much time and tedious effort to reverse engineer companion app (or manually collect test scripts) each device, which is unscalable when analyzing many devices. Moreover, through a impeded by input sanitization inside limited revealed functions. We notice that are typically able connect hub using standard wireless...

App repackaging has become a severe threat to theAndroid ecosystem. While various protection techniques, such as watermarking and detection, have been proposed, defense that stops repackaged apps from working on user devices, i.e., repackage-proofing, is missing. We propose technique builds reliable stealthy repackage-proofing capability into Android apps. A large number of detection nodes are inserted the original app without incurring much overhead, each woven surrounding code blur itself....

Energy Efficient Building (EEB) design requires many simulation tools to support making decisions for optimized building solutions, resulting in frequent interactions between computational tools. Information Modeling (BIM) server platforms can the storage, maintenance, and query of IFC-based information models. However, lack a unified interface exchange interoperability among different has become bottleneck EEB process. This paper describes an integrated approach at data level combine...

Application repackaging is a severe threat to Android users and the market. Existing countermeasures mostly detect based on app similarity measurement rely central party perform detection, which unscalable imprecise. We instead consider building detection capability into apps, such that user devices are made use of in decentralized fashion. The main challenge how protect code from attacks. propose creative logic bombs, regularly used malware, conquer challenge. A novel bomb structure...

Internet of Things (IoT) platforms enable users to deploy home automation applications.Meanwhile, privacy issues arise as large amounts sensitive device data flow out IoT platforms.Most the flowing a platform actually do not trigger actions, while homeowners currently have no control once devices are bound platform.We present PFIREWALL, customizable data-flow system enhance users.PFIREWALL automatically generates data-minimization policies, which only disclose minimum amount fulfill...

Android Application Framework is an integral and foundational part of the system. Each 1.4 billion devices relies on system services to manage applications resources. Given its critical role, a vulnerability in framework can be exploited launch large-scale cyber attacks cause severe harms user security privacy. Recently, many vulnerabilities were exposed, showing that it vulnerable exploitable. However, most existing research has been limited analyzing applications, while there are very few...

Application repackaging is a severe threat to Android users and the market. Not only does it infringe on intellectual property, but also one of most common ways propagating mobile malware. Existing countermeasures mostly detect based app similarity measurement, which tends be imprecise when obfuscations are applied repackaged apps. Moreover, they rely central party, typically hosting store, perform detection, many stores fail commit proper effort piracy detection. We consider building...

Android Application Framework is an integral and foundational part of the system. Each two billion (as 2017) devices relies on system services to manage applications resources. Given its critical role, a vulnerability in framework can be exploited launch large-scale cyber attacks cause severe harms user security privacy. Recently, many vulnerabilities were exposed, showing that it indeed vulnerable exploitable. While there large body studies application analysis, research analysis very...

Given a programming problem, because of variety data structures and algorithms that can be applied different tradeoffs, such as space-time, to considered, there may many distinct solutions. By comparing his/her solution against others' learning from the solutions, learner quickly improve skills gain experience in making trade-offs. Meanwhile, on Internet websites provide venues for practice contests. Popular receive hundreds thousands submissions daily novices well advanced learners. While...

Binary code analysis has immense importance in the research domain of software security. Today, is very often compiled for various Instruction Set Architectures (ISAs). As a result, cross-architecture binary become an emerging problem. Recently, deep learning-based shown promising success. It widely known that training learning model requires massive amount data. However, some low-resource ISAs, adequate data hard to find, preventing from being adopted analysis. To overcome scarcity problem...

Emerging Internet of Thing (IoT) platforms provide a convenient solution for integrating heterogeneous IoT devices and deploying home automation applications. However, serious privacy threats arise as device data now flow out to the platforms, which may be subject various attacks. We observe two privacy-unfriendly practices in emerging systems: first, majority flowed platform are superfluous sense that they do not trigger any automation; second, owners currently have nearly zero control over...

Existing symbolic execution typically assumes the analyzer can control I/O environment and/or access library code, which, however, is not case when programs run on a remote proprietary managed by another party. For example, SmartThings, one of most popular IoT platforms, such cloud-based environment. programmers who write automation applications to be deployed cloud it raises significant challenges they want systematically test their code and find bugs. We propose fuzzing-assisted dynamic...

Because of its cost effectiveness and timeliness, package delivery using unmanned aerial vehicles (UAVs), called drone delivery, is drawing growing attention. Authentication critical for ensuring that a not picked up by an attacker's or delivered to attacker. As drones are costly may carry sensitive expensive packages, should get very close person unless she authenticated; thus, conventional authentication approaches require human-drone physical contact do work. Existing methods suffer from...

The augmented reality (AR) Metaverse environment combines the physical and virtual world together. Privacy is a major concern in AR since cameras use to capture can also other images that may potentially violate user or by-stander privacy. Advances deep learning process videos have exacerbated such privacy risks. This paper presents new technique protect systems by combining idea of visual saliency together with privacy-sensitive object detection. We show our able provide additional context...

Given a permission-based framework, its permission specification, which is mapping between API methods of the framework and permissions they require, important for software developers analysts. In case Android Framework, contains millions lines code, static analysis promising analyzing such large codebase to derive specification. One common building blocks generation global call graph. However, as object-oriented languages, target virtual function depends on runtime type receiving object,...

Binary code analysis has immense importance in the research domain of software security. Today, is very often compiled for various Instruction Set Architectures (ISAs). As a result, cross-architecture binary become an emerging problem. Recently, deep learning-based shown promising success. It widely known that training learning model requires massive amount data. However, some low-resource ISAs, adequate data hard to find, preventing from being adopted analysis. To overcome scarcity problem...

Implicit authentication for traditional objects, such as doors and dumbbells, has rich applications but is rarely studied. An ongoing trend that objects are retrofitted to smart environments; instance, a contact sensor attached door detect opening (but cannot tell "who the door"). We present first accurate implicit-authentication system everyday named MoMatch. It makes an decision based on single natural object use, unlike prior work requires shaking objects. MoMatch built observation motion...

Given a closed-source program, such as most of proprietary software and viruses, binary code analysis is indispensable for many tasks, plagiarism detection malware analysis. Today, source very often compiled various architectures, making cross-architecture increasingly important. A binary, after being disassembled, expressed in an assembly languages. Thus, recent work starts exploring Natural Language Processing (NLP) inspired In NLP, words are usually represented high-dimensional vectors...