Search

Person identification plays a critical role in a large range of applications. Recently, RF based person identification becomes a hot research topic due to the contact-free nature of RF sensing that is particularly appealing in current COVID-19 pandemic. However, existing systems still have multiple limitations: i) heavily rely on the gait patterns of users for identification; ii) require a large amount of data to train the model and also extensive retraining for new users and iii) require a large frequency bandwidth which is not available on most commodity RF devices for static person identification. This paper proposes RF-Identity, an RFID-based identification system to address the above limitations and the contribution is threefold. First, by integrating walking pattern features with unique body shape features (e.g., height), RF-Identity achieves a high accuracy in person identification. Second, RF-Identity develops a data augmentation scheme to expand the size of the training data set, thus reducing the human effort in data collection. Third, RF-Identity utilizes the tag diversity in spatial domain to identify static users without a need of large frequency bandwidth. Extensive experiments show an identification accuracy of 94.2% and 95.9% for 50 dynamic and static users, respectively.

This paper presents FUNDED (Flow-sensitive vUl-Nerability coDE Detection), a novel learning framework for building vulnerability detection models. Funded leverages the advances in graph neural networks (GNNs) to develop a novel graph-based learning method to capture and reason about the program’s control, data, and call dependencies. Unlike prior work that treats the program as a sequential sequence or an untyped graph, Funded learns and operates on a graph representation of the program source code, in which individual statements are connected to other statements through relational edges. By capturing the program syntax, semantics and flows, Funded finds better code representation for the downstream software vulnerability detection task. To provide sufficient training data to build an effective deep learning model, we combine probabilistic learning and statistical assessments to automatically gather high-quality training samples from open-source projects. This provides many real-life vulnerable code training samples to complement the limited vulnerable code samples available in standard vulnerability databases. We apply Funded to identify software vulnerabilities at the function level from program source code. We evaluate Funded on large real-world datasets with programs written in C, Java, Swift and Php, and compare it against six state-of-the-art code vulnerability detection models. Experimental results show that Funded significantly outperforms alternative approaches across evaluation settings.

Crowdsensing tasks are usually described by certain features or attributes, and the task assignment essentially performs a matching with respect to the worker or user’s preference on these features. However, the existing matching strategy could lead to a misaligned task coverage problem, i.e., some popular tasks tend to enter workers’ candidate task lists, while some less popular tasks could be always unsuccessfully assigned. To ensure task coverage after the assignment, the system may have to increase their biding costs to reassign such tasks, which causes a high operational cost of the crowdsensing system. To address this problem, we propose to migrate certain qualified workers to the less popular tasks for increasing the task coverage and meanwhile, optimize other performance factors. By doing this, other performance factors, such as task acceptance and quality, can be comparably achieved as recent designs, while the system cost can be largely reduced. Following this idea, this article presents cTaskMat , which learns and exploits workers’ task preferences to achieve coverage-ensured task assignments. We implement the cTaskMat design and evaluate its performance using both real-world experiments and data set-driven evaluations, also with the comparison with the state-of-the-art designs.

Plant sensing plays an important role in today's smart agriculture and intelligent forestry. However, existing plant sensing work based on wireless IoT mostly focuses on the environment that plants live like soil moisture and temperature of a greenhouse or a farm. The information about the surrounding environment does not reflect the physical condition of the plant itself. Taking ambient RF signal and commodity RFID tag as the fundamental sensing platform, we explore the Plant-Keeper, a real-time monitor system, which traces the physical state and biological activities of plants by perceiving Ion transmission in plants, like water content and the reaction of plants to an external stimulus such as Cut, Salt, Chilling, and Drought Stresses. We make the following technical contributions to achieve this goal. First, a theoretical model to verify that sensing the Ion transmission like Ca2+ channel and K+ channel by the low-power wireless backscatter technique are feasible; Second, a hardware-based non-invasive sensing system that can obtain the physical changes in plants by using the impedance-related RSS (Received Signal Strength); Third, a low-power low-cost implementation that based on a commercial RFID tag with the hardware structure we have proposed. Experimental results demonstrate that our system can monitor the ion channel changes of the whole plant systematically, and improve the detection accuracy to the millisecond level. The detection speed is 103 times that of the traditional patch-clamp technique, and the latter is not available for whole system inspection of plants in vivo.

JavaScript (JS) is a popular, platform-independent programming language. To ensure the interoperability of JS programs across different platforms, the implementation of a JS engine should conform to the ECMAScript standard. However, doing so is challenging as there are many subtle definitions of API behaviors, and the definitions keep evolving. We present COMFORT, a new compiler fuzzing framework for detecting JS engine bugs and behaviors that deviate from the ECMAScript standard. COMFORT leverages the recent advance in deep learning-based language models to automatically generate JS test code. As a departure from prior fuzzers, COMFORT utilizes the well-structured ECMAScript specifications to automatically generate test data along with the test programs to expose bugs that could be overlooked by the developers or manually written test cases. COMFORT then applies differential testing methodologies on the generated test cases to expose standard conformance bugs. We apply COMFORT to ten mainstream JS engines. In 200 hours of automated concurrent testing runs, we discover bugs in all tested JS engines. We had identified 158 unique JS engine bugs, of which 129 have been verified, and 115 have already been fixed by the developers. Furthermore, 21 of the Comfort-generated test cases have been added to Test262, the official ECMAScript conformance test suite., PLDI 2021

Deep learning is emerging as a promising technique for building predictive models to support code-related tasks like performance optimization and code vulnerability detection. One of the critical aspects of building a successful predictive model is having the right representation to characterize the model input for the given task. Existing approaches in the area typically treat the program structure as a sequential sequence but fail to capitalize on the rich semantics of data and control flow information, for which graphs are a proven representation structure. We present POEM, a novel framework that automatically learns useful code representations from graph-based program structures. At the core of POEM is a graph neural network (GNN) that is specially designed for capturing the syntax and semantic information from the program abstract syntax tree and the control and data flow graph. As a departure from existing GNN-based code modeling techniques, our network simultaneously learns over multiple relations of a program graph. This capability enables the learning framework to distinguish and reason about the diverse code relationships, be it a data or a control flow or any other relationships that may be important for the downstream processing task. We apply POEM to four representative tasks that require a strong ability to reason about the program structure: heterogeneous device mapping, parallel thread coarsening, loop vectorization and code vulnerability detection. We evaluate POEM on programs written in OpenCL, C, Java and Swift, and compare it against nine learning-based methods. Experimental results show that POEM consistently outperforms all competing methods across evaluation settings.

Summary The difficulty of obtaining reliable individual identification of animals has limited researcher's ability to obtain quantitative data to address important ecological, behavioral, and conservation questions. Traditional marking methods placed animals at undue risk. Machine learning approaches for identifying species through analysis of animal images has been proved to be successful. But for many questions, there needs a tool to identify not only species but also individuals. Here, we introduce a system developed specifically for automated face detection and individual identification with deep learning methods using both videos and still-framed images that can be reliably used for multiple species. The system was trained and tested with a dataset containing 102,399 images of 1,040 individuals across 41 primate species whose individual identity was known and 6,562 images of 91 individuals across four carnivore species. For primates, the system correctly identified individuals 94.1% of the time and could process 31 facial images per second., Graphical Abstract, Highlights • The Tri-AI system can rapidly detect and identify individuals from videos and images • Tri-AI had an ID identification accuracy of 94% for 41 primates and 4 carnivores • The system could individually recognize 31 animals/s with images taken day or night • Systems like Tri-AI make around-the-clock monitoring and behavior analysis possible, Zoology; Ethology; Artificial Intelligence

Code obfuscation built upon code virtualization technology is one of the viable means for protecting sensitive algorithms and data against code reverse engineering attacks. Code virtualization has been successfully applied to programming languages like C, C++, and Java. However, it remains an outstanding challenge to apply this promising technique to JavaScript, a popular web programming language. This is primarily due to the open visibility of JavaScript code and the expensive runtime overhead associated with code virtualization. This paper presents JSPro , a novel code virtualization system for JavaScript. JSPro is the first JavaScript code obfuscation tool that builds upon the emerging WebAssembly language standard. It is designed to provide more secure code protection but without incurring a significant runtime penalty, explicitly targeting numerical JavaScript kernels. We achieve this by first automatically translating the target JavaScript code into WebAssembly and then performing code obfuscation on the compiled WebAssembly binary. Our design has two advantages over existing solutions: (1) it increases the code reverse entering complexity by implementing code obfuscation at a lower binary level and (2) it significantly reduces the performance impact of code virtualization over the native JavaScript code by using the performance-tuned WebAssembly language. We evaluate JSPro on a set of numerical JavaScript algorithms widely used in many applications. To test the performance, we apply JSPro to four mainstream web browsers running on three distinct mobile devices. Compared to state-of-the-art JavaScript obfuscation tools, JSPro not only provides stronger protection but also reduces the runtime overhead by at least 15% (up to 38.2%) and the code size by 28.2% on average.

Text-based CAPTCHAs remains a popular scheme for distinguishing between a legitimate human user and an automated program. This article presents a novel genetic text captcha solver based on the generative adversarial network. As a departure from prior text captcha solvers that require a labor-intensive and time-consuming process to construct, our scheme needs significantly fewer real captchas but yields better performance in solving captchas. Our approach works by first learning a synthesizer to automatically generate synthetic captchas to construct a base solver. It then improves and fine-tunes the base solver using a small number of labeled real captchas. As a result, our attack requires only a small set of manually labeled captchas, which reduces the cost of launching an attack on a captcha scheme. We evaluate our scheme by applying it to 33 captcha schemes, of which 11 are currently used by 32 of the top-50 popular websites. Experimental results demonstrate that our scheme significantly outperforms four prior captcha solvers and can solve captcha schemes where others fail. As a countermeasure, we propose to add imperceptible perturbations onto a captcha image. We demonstrate that our countermeasure can greatly reduce the success rate of the attack.

Code virtualization built upon virtual machine (VM) technologies is emerging as a viable method for implementing code obfuscation to protect programs against unauthorized analysis. State-of-the-art VM-based protection approaches use a fixed scheduling structure where the program always follows a single, deterministic execution path for the same input. Such approaches, however, are vulnerable in certain scenarios where the attacker can reuse knowledge extracted from previously seen software to crack applications protected with the same obfuscation scheme. This paper presents Dsvmp, a novel VM-based code obfuscation approach for software protection. Dsvmp brings together two techniques to provide stronger code protection than prior VM-based approaches. Firstly, it uses a dynamic instruction scheduler to randomly direct the program to execute different paths without violating the correctness across different runs. By randomly choosing the program execution path, the application exposes diverse behavior, making it much more difficult for an attacker to reuse the knowledge collected from previous runs or similar applications to launch an attack. Secondly, it employs multiple VMs to further obfuscate the mapping from VM opcode to native machine instructions, so that the same opcode could be mapped to different native instructions at runtime, making code analysis even harder. We have implemented Dsvmp in a prototype system and evaluated it using a set of widely used applications. Experimental results show that Dsvmp provides stronger protection with comparable runtime overhead and code size, when it is compared to two commercial VM-based code obfuscation tools.

To protect programs from unauthorized analysis, virtualize the code based on Virtual Machine (VM) technologies is emerging as a feasible method for accomplishing code obfuscation. However, in some State-of-the-art VM-based protection approaches, the set of virtual instructions and bytecode interpreters are fixed across the whole programs. This means an experienced attacker could extract the mapping information between virtual instructions and native code from programs, and use this knowledge to uncover the mapping relationships in similar protecting applications. To address this problem, we present CoDiver (Code Virtualization Protection with Diversity), a novel VM-based code obfuscation system in this paper. The main idea of our approach is to obfuscate the mapping between the opcodes of bytecode instructions and their semantics. To achieve this goal, we first turn every protected code region into multiple parts by partition proceeding, randomize the mapping of opcodes and their semantics of each part. By this way, we could translate the bytecode instruction into different native code in different sections of the obfuscated code. This method could increase the diversity of program behavior significantly. As a result, it will be useless to learn the mapping relationship between bytecode and native code of some other programs, then migrate it into a new program. We build a prototype of CoDiver and tested it on a set of real-world applications. Experimental results show that as compared with two state-of-the-art VM-based code obfuscation approaches, our approach is more effective and could provide stronger protection with comparable runtime overhead and code size.

Application repackaging is a severe problem for Android systems. Many Android malware programs pass the mobile platform fundamental security barriers through repackaging other legitimate apps. Most of the existing anti-repackaging schemes only work at the Android DEX bytecode level, but not for the shared object files consisting of native ARM-based machine instructions. Lacking the protection at the native machine code level opens a door for attackers to launch repackaging attacks on the shared libraries that are commonly used on Android apps. This paper presents CodeCloak, a novel anti-repackaging system to protect Android apps at the native code level. CodeCloak employs binary-level code virtualization techniques to protect the target application. At the native machine code level, it uses a newly designed stack-based virtualization structure to obfuscate and protect critical algorithm implementations that have been compiled into native instructions. It leverages multiple dynamic code protection schemes to increase the diversity of the program behavior at runtime, aiming to increase the difficulties for performing code reverse engineering. We evaluate CodeCloak under typical app repackaging scenarios. Experimental results show that CodeCloak can effectively protect apps against repackaging attacks at the cost of minimum overhead.

Passive localization is fundamental for many applications such as activity monitoring and real-time tracking. Existing received signal strength (RSS)-based passive localization approaches have been proposed in the literature, which depend on dense deployment of wireless communication nodes to achieve high accuracy. Thus, they are not cost-effective and scalable. This paper proposes the RSS distribution-based localization (RDL) technique, which can achieve high localization accuracy without dense deployment. In essence, RDL leverages the RSS and the diffraction theory to enable RSS-based passive localization in sensor networks. Specifically, we analyze the fine-grained RSS distribution properties at a variety of node distances and reveal that the structure of the triangle is efficient for low-cost passive localization. We further construct a unit localization model aiming at high accuracy localization. Experimental results show that RDL can improve the localization accuracy by up to 50%, compared to existing approaches when the error tolerance is less than 1.5 m. In addition, we apply RDL to facilitate the application of moving trajectory identification. Our moving trajectory identification includes two phases: an offline phase where the possible locations can be estimated by RDL and an online phase where we precisely identify the moving trajectory. We conducted extensive experiments to show its effectiveness for this application—the estimated trajectory is close to the ground truth.

By restoring the program into an easier understandable form, deobfuscation is an important technique for detecting and analyzing malicious software. To enable deobfuscation, one must know if the target program is obfuscated and what types of obfuscation schemes may be used. However, obtaining such information is challenging without having access to the original program source code. This paper presents a new way to estimate the obfuscation scheme of a compiled binary. It achieves this by using semantic information of the disassembled binary to predict if the program has been obfuscated and if so, what type of obfuscation scheme may be used. At the core of our approach is a set of deep neural networks that can effectively characterize and leverage the contextual information available in the assembly code. Our models are first trained offline, and the learned models can then be applied to new previously unseen obfuscated binaries. We evaluate our approach by applying it to a large dataset of over 277,000 obfuscated samples with different individual obfuscation schemes and their combinations. Experimental results show that our approach is highly effective in identifying the obfuscation scheme, with a prediction accuracy of at least 83% (up to 98%).

Infringing intellectual property by reverse analysis is a severe threat to Android applications. By replacing the program instructions with virtual instructions that an adversary is unfamiliar with, code obfuscation based on virtualization is a promising way of protecting Android applications against reverse engineering. However, the current code virtualization approaches for Android only target at the DEX bytecode level. The DEX file with the open file format and more semantic information makes the decode-dispatch pattern easier to expose, which has been identified as a severe vulnerability of security and can be exploited by various attacks. Further, decode-dispatch interpretation frequently uses indirect branches in this structure to introduce extra overhead. This paper presents a novel approach to transfer code virtualization from DEX level to native level, which possesses strong security strength and good stealth, with only modest cost. Our approach contains two components: pre-compilation and compile-time virtualization. Pre-compilation is designed for performance improvement by identifying and decompiling the critical functions which consume a significant fraction of execution time. Compile-time virtualization builds upon the widely used LLVM compiler framework. It automatically translates the DEX bytecode into the common LLVM intermediate representations where a unified code virtualization pass can be applied for DEX code. We have implemented a working prototype Dex2VM of our technique and applied it to eight representative Android applications. Our experimental results show that the proposed approach can effectively protect the target code against a state-of-the-art code reverse engineering tool that is specifically designed for code virtualization, and it achieves good stealth with only modest cost.

Recently, channel state information (CSI) is shown to be an effective side-channel to perform attacks in public environments. Prior work has demonstrated that by analyzing how the CSI measurements of the wireless signal are affected by the mobile user's finger movements or gestures, an attacker can recover the user's input with a high success rate. Furthermore, the setup of this new attack is trivial, where the adversary only needs to place one or two malicious wireless devices near the target user. It would be difficult for many users to identify the nearby malicious devices while they want to continue to use mobile applications in public places. This dilemma makes protection of CSI-based attacks an urgent need. This article presents the first countermeasure for CSI-based attacks. Our key insight is that the success of any CSI-based attack requires high-quality CSI measurements; and we can significantly reduce the risk of information leakage by directing the user to a nearby location where the CSI readings are inherently noisy. To this end, we develop a regression based method to assess the risk of CSI-based attacks and exploit a well-established localization technique to identify potential malicious wireless devices. We then use this information to guide the user to a safe zone. We evaluate our approach by applying it to protect pattern lock and keystrokes in various indoor and outdoor environments. Experimental results show that our approach can effectively protect mobile users against CSI-based attacks.

IPTV provides a variety of services to users, e.g., Live TV, Video on Demand (VOD), and Catch-up TV, which allows users to freely select from a huge pool of program genres. A high-quality program recommendation system that can well predict users' dynamic preferences is desirable to improve user satisfaction. In this paper, we make the first attempt to design a personalized TV program recommendation system based on tensor learning that leverages temporal context information and implicit feedback. We establish the user preference model by carefully analyzing the influence of program genres and time context on users' viewing behavior in IPTV viewing logs. To obtain the optimal program recommendation, we adopt tensor decomposition to mine the latent relationship among users, program genres and the time contexts, while address issues of data sparsity and missing information. Our extensive experimental results on a real dataset from a major IPTV service provider in China have confirmed the superiority of our proposed recommendation algorithm over baseline algorithms in achieving a higher recommendation accuracy and covering a wider range of programs.

Code virtualization built upon virtual machine (VM)technologies is emerging as a viable method for implementing code obfuscation to protect programs against unauthorized analysis. State-of-the-art VM-based protection approaches use a fixed set of virtual instructions and bytecode interpreters across programs. This, however, exposes a security vulnerability where an experienced attacker can use knowledge extracted from other programs to quickly uncover the mapping between virtual instructions and native code for applications protected under the same scheme. In this paper, we propose a novel VM-based code obfuscation system to address this problem. The core idea of our approach is to obfuscate the mapping between the opcodes of bytecode instructions and their semantics. We achieve this by partitioning each protected code region into multiple segments where the mapping of opcodes and their semantics is randomized in different ways in different segments. In this way, each bytecode instruction will be translated into different native code in different sections of the obfuscated code. This significantly increases the diversity of the program behavior. As a result, the knowledge of bytecode to native code mappings obtained from other programs will be less useful when targeting a new program. We evaluate our approach on a set of real-world applications and compare it against two state-of-the-art VM-based code obfuscation approaches. Experimental results show that our approach is effective, which provides stronger protection with comparable runtime overhead and code size.

This paper presents DeepAid, a mobile system assisting cognitive decline patients. Existing designs of such systems suffer low accuracies for the recognition and long latencies for the interaction two major issues. DeepAid leverages deep learning to solve both issues at the same time. Deep learning naturally leads to high-accuracy object recognition. If it can further execute on the local device directly, the latency can be satisfied as well since frequent data transmission to the server in prior approaches can be avoided. The major contribution of this paper is to instrument the possibility that deep learning can be compact so as to achieve a good trade-off between accuracy and resource consumption, with the design of task decomposition and network scale minimization. To validate the effectiveness of DeepAid, we implement a series of experiments and compare with other related work. In the final, the DeepAid can achieve about 97% accuracy in object recognition with about 90ms time delay.

Channel state information (CSI) has been recently shown to be useful in performing security attacks in public WiFi environments. By analyzing how CSI is affected by finger motions, CSI-based attacks can effectively reconstruct text-based passwords and locking patterns. This paper presents WiGuard, a novel system to protect sensitive on-screen input information in a public place. Our approach carefully exploits WiFi channel interference to introduce noise to attacker’s CSI measurements to reduce the success rate of CSI-based attacks. Our approach automatically detects when a CSI-based attack happens. We evaluate our approach by applying it to protect text-based passwords and pattern locks on mobile devices. Experimental results show that our approach is able to reduce the success rate of CSI-based attacks from 92–42% for text-based passwords and from 82–22% for pattern lock.

RFID-based positioning is emerging as a promising solution for inventory management in places like warehouses and libraries. However, existing solutions either are too sensitive to the environmental noise, or require deploying a large number of reference tags which incur expensive deployment cost and increase the chance of data collisions. This paper presents CSRP, a novel RFID based positioning system, which is highly accurate and robust to environmental noise, but relies on much less reference tags compared with the state-of-the-art. CSRP achieves this by employing an noise-resilient RFID fingerprint scheme and a compressive sensing based algorithm that can recover the target tag's position using a small number of signal measurements. This work provides a set of new analysis, algorithms and heuristics to guide the deployment of reference tags and to optimize the computational overhead. We evaluate CSRP in a deployment site with 270 commercial RFID tags. Experimental results show that CSRP can correctly identify 84.7% of the test items, achieving an accuracy that is comparable to the state-of-the-art, using an order of magnitude less reference tags.

Wireless localization technology has become an important research area of pervasive computing applications. This paper presents $$DE ^{2 }$$DE2 (direction estimation and distance estimation), a wireless localization approach that is responsive to the scenario where only a single beacon is available to locate multiple position-unknown targets. Unlike the previous work which needs a priori knowledge of the scenario during the training phase by manual recording (taking significant human efforts), or uses a certain number of beacons during the localization phase to reach a certain accuracy (leading to high energy consumption and reducing network lifecycle), $$DE ^{2 }$$DE2 leverages a single beacon without many prior human efforts to locate multiple targets. The intuition underlying $$DE ^{2 }$$DE2 is that, direction and distance constraints between an unknown position and the single beacon are adequate to determine the unknown position. When a person rotates around an RF receiver (the single beacon), the human body acts as a signal-blocking obstacle. It causes the signal from a transmitter (position-unknown) to the single receiver to attenuate in a certain scope. The blocking effect caused by human body can be utilized to obtain the direction constraint between the unknown position and the single beacon. And we call the signal strength which is perceived by the receiver during the person's rotation as rotating received signal strength (RSS). Moreover, a corresponding distance constraint is also concluded in the rotating RSS according to the RF propagation model. $$DE ^{2 }$$DE2 pushes the limit of minimum beacons needed for localization without much pre-configuration effort. To demonstrate the utility of $$DE ^{2 }$$DE2, we implement $$DE ^{2 }$$DE2 in real-world single beacon wireless networks. The results show that these applications can significantly benefit from $$DE ^{2 }$$DE2.

Device-free localization (DFL) plays an important role in many applications, such as wildlife population and migration tracking. Most of current DFL systems leverage the distorted received signal strength (RSS) changes to localize the target(s). However, they assume a fixed distribution of the RSS change measurements, although they are distorted by different types of targets. It inevitably causes the localization to fail if the targets for modeling and testing belong to different categories. This paper presents TLCS—a transferring compressive sensing based DFL approach—which employs a rigorously designed transferring function to transfer the distorted RSS changes across different categories of targets into a latent feature space, where the distributions of the distorted RSS change measurements from different categories of targets are unified. A benefit of this approach is that the same transferred sensing matrix can be shared by different categories of targets, leading to a substantial reduction in the human efforts. The results of experiments illustrate the efficacy of the TLCS.

Apps repackaged through reverse engineering pose a significant security threat to the Android smart phone ecosystem. Previous solutions have mostly focused on the detection and identification of repackaged apps. Nevertheless, current app anti-repackaging services can only protect applications at a coarse level and get a significant performance overhead. These approaches can neither meet the performance requirements of Android nor achieve fine-grained protection against cumulative attack 1 at the same time. Specifically, these solutions rely on a fix-structure detecting engine and then will execute the same path at different times, which lead to the entire protection performs poorly when faced with dynamic cumulative attack, which is typical in real-world attack. This paper introduces AppIS, a reinforced anti-repackaging immune system, that is robust to app-repackaging attack scenarios. Unlike prior work, which mostly focuses on simple protection only from just one respect, our design exploits an interlocking guarding net with time diversity for the tamper-proofing of Android applications. The intuition underlying our design is that a dynamic and static combining method can provide a multi-level protection for the codes, core algorithm and sensitive data. We analyze and classify the existing threats on Android platform and furthermore abstract then model the repackaging attack scenarios. We then adopt a random controller used by the dispatcher to randomly construct guarding net with different structure every time. We have built a prototype of our design using Java Native Interface cross-layer calling mechanism for performance requirement. Results from a deployment of AppIS on several kinds of popular apps demonstrate that the new design can prevent our apps from cumulative attack without extra performance cost.

Target material identification plays an important role in many real-life applications. This paper introduces a system that can identify the material type with cheap commercial off-the-shelf (COTS) RFID devices. The key intuition is that different materials cause different amounts of phase and RSS (Received Signal Strength) changes when radio frequency (RF) signal penetrates through the target. However, without knowing either material type, trying to obtain the information is challenging. We propose a method to address this challenge and evaluate the method's performance in real-world environment. The results show that we achieve higher than 94% material identification accuracies for 10 liquids and differentiate even very similar objects such as Coke and Pepsi.

Target material identification plays an important role in many real-life applications. This paper introduces a system that can identify the material type with cheap commercial off-the-shelf (COTS) RFID devices. The key intuition is that different materials cause different amounts of phase and RSS (Received Signal Strength) changes when radio frequency (RF) signal penetrates through the target. However, without knowing either material type, trying to obtain the information is challenging. We propose a method to address this challenge and evaluate the method's performance in real-world environment. The results show that we achieve higher than 94% material identification accuracies for 10 liquids and differentiate even very similar objects such as Coke and Pepsi.

Target imaging and material identification play an important role in many real-life applications. This paper introduces TagScan, a system that can identify the material type and image the horizontal cut of a target simultaneously with cheap commercial off the-shelf (COTS) RFID devices. The key intuition is that different materials and target sizes cause different amounts of phase and RSS (Received Signal Strength) changes when radio frequency (RF) signal penetrates through the target. Multiple challenges need to be addressed before we can turn the idea into a functional system including (i) indoor environments exhibit rich multipath which breaks the linear relationship between the phase change and the propagation distance inside a target; (ii) without knowing either material type or target size, trying to obtain these two information simultaneously is challenging; and (iii) stitching pieces of the propagation distances inside a target for an image estimate is non-trivial. We propose solutions to all the challenges and evaluate the system's performance in three different environments. TagScan is able to achieve higher than 94% material identification accuracies for 10 liquids and differentiate even very similar objects such as Coke and Pepsi. TagScan can accurately estimate the horizontal cut images of more than one target behind a wall.

Increasingly sophisticated code obfuscation techniques are quickly adopted by malware developers to escape from malware detection and to thwart the reverse engineering effort of security analysts. State-of-the-art de-obfuscation approaches rely on dynamic analysis, but face the challenge of low code coverage as not all software execution paths and behavior will be exposed at specific profiling runs. As a result, these approaches often fail to discover hidden malicious patterns. This paper introduces SEEAD, a novel and generic semantic-based de-obfuscation system. When building SEEAD, we try to rely on as few assumptions about the structure of the obfuscation tool as possible, so that the system can keep pace with the fast evolving code obfuscation techniques. To increase the code coverage, SEEAD dynamically directs the target program to execute different paths across different runs. This dynamic profiling scheme is rife with taint and control dependence analysis to reduce the search overhead, and a carefully designed protection scheme to bring the program to an error free status should any error happens during dynamic profile runs. As a result, the increased code coverage enables us to uncover hidden malicious behaviors that are not detected by traditional dynamic analysis based de-obfuscation approaches. We evaluate SEEAD on a range of benign and malicious obfuscated programs. Our experimental results show that SEEAD is able to successfully recover the original logic from obfuscated binaries.

Unauthorized code modification based on reverse engineering is a serious threat for software industry. Virtual machine based code obfuscation is emerging as a powerful technique for software protection. However, the current Virtual machine code protection are vulnerable under semantic attacks which use dynamic profiling to transform an obfuscated program to construct a simpler program that is functionally equivalent to the obfuscated program but easier to analyze. This paper presents DSA-VMP, a novel VM-based code obfuscation technique, to address the issue of semantic attacks. Our design goal is to exploit dynamic data flows to increase the diversity of the program behaviour. Our approach uses multiple bytecode handlers to interpret a single bytecode and hides the logics that determine the program execution path (it is difficult for the attacker to anticipate the program execution flow). These two techniques greatly increase the diversity of the program execution where the protected code regions exhibit a complex data flow across multiple runs, making it harder and more time consuming to trace the program execution through profiling. Our approach is evaluated using a set of real-world applications. Experimental results show that DSA-VMP can well protect software against semantic attacks at the cost of little extra runtime overhead when compared to two commercial VM-based code obfuscation tools.

Channel state information (CSI) has been recently shown to be useful in performing security attacks in public WiFi environments. By analyzing how CSI is affected by the finger motions, CSI-based attacks can effectively reconstruct text-based passwords and locking patterns. This paper presents WiGuard, a novel system to protect sensitive on-screen gestures in a public place. Our approach carefully exploits the WiFi channel interference to introduce noise into the attacker's CSI measurement to reduce the success rate of the attack. Our approach automatically detects when a CSI-based attack happens. We evaluate our approach by applying it to protect text-based passwords and pattern locks on mobile devices. Experimental results show that our approach is able to reduce the success rate of CSI attacks from 92% to 42% for text-based passwords and from 82% to 22% for pattern lock.

While most existing indoor localization techniques are device-based, many emerging applications such as intruder detection and elderly monitoring drive the needs of device-free localization, in which the target can be localized without any device attached. Among the diverse techniques, received signal strength (RSS) fingerprint-based methods are popular because of the wide availability of RSS readings in most commodity hardware. However, current fingerprint-based systems suffer from high human labor cost to update the fingerprint database and low accuracy due to the large degree of RSS variations. In this paper, we propose a fingerprint-based device-free localization system named iUpdater to significantly reduce the labor cost and increase the accuracy. We present a novel self-augmented regularized singular value decomposition (RSVD) method integrating the sparse attribute with unique properties of the fingerprint database. iUpdater is able to accurately update the whole database with RSS measurements at a small number of reference locations, thus reducing the human labor cost. Furthermore, iUpdater observes that although the RSS readings vary a lot, the RSS differences between both the neighboring locations and adjacent wireless links are relatively stable. This unique observation is applied to overcome the short-term RSS variations to improve the localization accuracy. Extensive experiments in three different environments over 3 months demonstrate the effectiveness and robustness of iUpdater.

Smartphone theft is a non-negligible problem that causes serious concerns on personal property, privacy, and public security. The existing solutions to this problem either provide only functions like retrieving a phone, or require dedicated hardware to detect thefts. How to protect smartphones from being stolen at all times is still an open problem. In this paper, we propose iGuard, a real-time anti-theft system for smartphones. iGuard utilizes only the inertial sensing data from the smartphone. The basic idea behind iGuard is to distinguish different people holding a smartphone, by identifying the order of the motions during the ‘take-out’ behavior and how each motion is performed. For this purpose, we design a motion segmentation algorithm to detect the transition between two motions from the noisy sensing data. We then leverage the distinct feature contained in each sub-segment of a motion, instead of the entire motion, to estimate the probability that the motion is performed by the smartphone owner himself/herself. Based on such pre-processed data, we propose a Markov Chain based model to track the behavior of a smartphone user. According to this model, iGuard instantly alarms once the tracked data deviate from the smartphone owner's usual habit. We implement iGuard on Android and evaluate its performance in real environments. The experimental results show that iGuard is accurate and robust in various scenarios.

Unauthorized code modification through reverse engineering is a major concern for Android application developers. Code reverse engineering is often used by adversaries to remove the copyright protection or advertisements from the app, or to inject malicious code into the program. By making the program difficult to analyze, code obfuscation is a potential solution to the problem. However, there is currently little work on applying code obfuscation to compiled Android bytecode. This paper presents DexPro, a novel bytecode level code obfuscation system for Android applications. Unlike prior approaches, our method performs on the Android Dex bytecode and does not require access to high-level program source or modification of the compiler or the VM. Our approach leverages the fact all except floating operands in Dex are stored in a 32-bit register to pack two 32-bit operands into a 64-bit operand. In this way, any attempt to decompile the bytecode will result in incorrect information. Meanwhile, our approach obfuscates the program control flow by inserting opaque predicates before the return instruction of a function call, which makes it harder for the attacker to trace calls to protected functions. Experimental results show that our approach can deter sophisticate reverse engineering and code analysis tools, and the overhead of runtime and memory footprint is comparable to existing code obfuscation methods.

Pattern lock is widely used as a mechanism for authentication and authorization on Android devices. This paper presents a novel video-based attack to reconstruct Android lock patterns from video footage filmed using a mobile phone camera. Unlike prior attacks on pattern lock, our approach does not require the video to capture any content displayed on the screen. Instead, we employ a computer vision algorithm to track the fingertip movements to infer the pattern. Using the geometry information extracted from the tracked fingertip motions, our approach is able to accurately identify a small number of (often one) candidate patterns to be tested by an adversary. We thoroughly evaluated our approach using 120 unique patterns collected from 215 independent users, by applying it to reconstruct patterns from video footage filmed using smartphone cameras. Experimental results show that our approach can break over 95% of the patterns in five attempts before the device is automatically locked by the Android operating system. We discovered that, in contrast to many people’s belief, complex patterns do not offer stronger protection under our attacking scenarios. This is demonstrated by the fact that we are able to break all but one complex patterns (with a 97.5% success rate) as opposed to 60% of the simple patterns in the first attempt. Since our threat model is common in day-to-day life, this paper calls for the community to revisit the risks of using Android pattern lock to protect sensitive information.

When we encounter a malicious rumor or an infectious disease outbreak, immunizing k nodes of the relevant network with limited resources is always treated as an extremely effective method. The key challenge is how we can insulate limited nodes to minimize the propagation of those contagious things. In previous works, the best k immunised nodes are selected by learning the initial status of nodes and their strategies even if there is no feedback in the propagation process, which eventually leads to ineffective performance of their solutions. In this paper, we design a novel vaccines placement strategy for protecting much more healthy nodes from being infected by infectious nodes. The main idea of our solution is that we are not only utilizing the status of changing nodes as auxiliary knowledge to adjust our scheme, but also comparing the performance of vaccines in various transmission slots. Thus, our solution has a better chance to get more benefit from these limited vaccines. Extensive experiments have been conducted on several real-world data sets and the results have shown that our algorithm has a better performance than previous works.

In order to defense software reverse attacks, lots of researches have been done in software security area, whereas few works were focused on the effectiveness evaluation of those protection methods. This paper includes two contents: 1 Introduction and analysis of existing methods evaluating the effectiveness of software protection, 2 discuss the condition needed to evaluate effectiveness in theory.

Device-free localization of people and objects indoors not equipped with radios is playing a critical role in many emerging applications. This paper presents an accurate model-based device-free localization system LiFS, implemented on cheap commercial off-the-shelf (COTS) Wi-Fi devices. Unlike previous COTS device-based work, LiFS is able to localize a target accurately without offline training. The basic idea is simple: channel state information (CSI) is sensitive to a target's location and by modelling the CSI measurements of multiple wireless links as a set of power fading based equations, the target location can be determined. However, due to rich multipath propagation indoors, the received signal strength (RSS) or even the fine-grained CSI can not be easily modelled. We observe that even in a rich multipath environment, not all subcarriers are affected equally by multipath reflections. Our pre-processing scheme tries to identify the subcarriers not affected by multipath. Thus, CSIs on the "clean" subcarriers can be utilized for accurate localization. We design, implement and evaluate LiFS with extensive experiments in three different environments. Without knowing the majority transceivers' locations, LiFS achieves a median accuracy of 0.5 m and 1.1 m in line-of-sight (LoS) and non-line-of-sight (NLoS) scenarios respectively, outperforming the state-of-the-art systems. Besides single target localization, LiFS is able to differentiate two sparsely-located targets and localize each of them at a high accuracy.

Device-free localization of people and objects indoors not equipped with radios is playing a critical role in many emerging applications. This paper presents a novel channel state information (CSI) pre-processing scheme that enables accurate device-free localization indoors. The basic idea is simple: CSI is sensitive to a target's location and by modelling the CSI measurements of multiple wireless links as a set of power fading based equations, the target location can be determined. However, due to rich multipaths in indoor environment, the received signal strength (RSS) or even the fine-grained CSI can not be easily modelled. We observe that even in a rich multipath environment, not all subcarriers are equally affected by multipath reflections. Our preprocessing scheme tries to identify the subcarriers not affected by multipath. Thus, CSIs on the "clean" subcarriers can be modelled and utilized for accurate localization. Extensive experiments demonstrate the effectiveness of the proposed pre-processing scheme.

Chinese calligraphy is a unique visual art, and is still emitting fascinating artistic brilliance and charm. The artistic beauty of Chinese calligraphy is constituted by two elements, i.e., form and spirit, which attract continual attentions by calligraphy artists. In this paper, we present Shear-Guided filter to extract the artistic information. Shear-Guided filter is designed by combining the shear transformation and the guided filter. It has both the edge-preserving smoothing property from the guided filter and the linear multidirectional property from the shear transformation. Shear-Guided filter can extract more spirit information from the calligraphy images, especially in the half-dry strokes. Furthermore, the previous evaluation parameters consider all pixels equally, which is against the truth. Here we put forward three new parameters to solve this issue. Finally, experiments show that Shear-Guided filter can extract the information of form and spirit more accurately, and the new evaluation parameters have better performances in evaluation.

Code virtualization built upon virtual machine (VM) technologies is emerging as a viable method for implementing code obfuscation to protect programs against unauthorized analysis. State-of-the-art VM-based protection approaches use a fixed scheduling structure where the program follows a single, static execution path for the same input. Such approaches, however, are vulnerable to certain scenarios where the attacker can reuse knowledge extracted from previously seen software to crack applications using similar protection schemes. This paper presents DSVMP, a novel VM-based code obfuscation approach for software protection. DSVMP brings together two techniques to provide stronger code protection than prior VM-based schemes. Firstly, it uses a dynamic instruction scheduler to randomly direct the program to execute different paths without violating the correctness across different runs. By randomly choosing the program execution paths, the application exposes diverse behavior, making it much more difficult for an attacker to reuse the knowledge collected from previous runs or similar applications to perform attacks. Secondly, it employs multiple VMs to further obfuscate the relationship between VM bytecode and their interpreters, making code analysis even harder. We have implemented DSVMP in a prototype system and evaluated it using a set of widely used applications. Experimental results show that DSVMP provides stronger protection with comparable runtime overhead and code size when compared to two commercial VM-based code obfuscation tools.

Applying mobile sink to collect data in wireless sensor networks can avoid the energy hole problem and lengthen the networks' life time. Current related researches have achieved significant improvements on reducing the data collection latency in the scenario where the mobile sink has enough or limited energy. However, it will lead to waste of network resource if not taking the spatial and temporal correlation of data into consideration during the collection because of the high similarity and low quality in the collected data. In this paper, we first propose a method named Dynamic Estimation of Data Value (DEDV) to estimate the value of data stored in the nodes dynamically. Furthermore, we define a heuristic method that drives the mobile sink to collect data from the nodes to maximize the value of the collected data in a power-limited mobile sink scenario. Both simulation and experiments results show that our method can achieve at most over 85% of the theoretical maximum data value determined by the OPT model.

Many emerging applications driven the fast development of the device-free localization (DfL) technique, which does not require the target to carry any wireless devices. Most current DfL approaches have two main drawbacks in practical applications. First, as the pre-calibrated received signal strength (RSS) in each location ( i.e. , radio-map) of a specific area cannot be directly applied to the new areas, the manual calibration for different areas will lead to a high human effort cost. Second, a large number of RSS are needed to accurately localize the targets, thus causes a high communication cost and the areas variety will further exacerbate this problem. This paper proposes FitLoc, a fine-grained and low cost DfL approach that can localize multiple targets over various areas, especially in the outdoor environment and similar furnitured indoor environment. FitLoc unifies the radio-map over various areas through a rigorously designed transfer scheme, thus greatly reduces the human effort cost. Furthermore, benefiting from the compressive sensing theory, FitLoc collects a few RSS and performs a fine-grained localization, thus reduces the communication cost. Theoretical analyses validate the effectivity of the problem formulation and the bound of localization error is provided. Extensive experimental results illustrate the effectiveness and robustness of FitLoc.

Process-level virtual machine (PVM) based code obfuscation is a viable means for protecting software against runtime code tampering and unauthorized code reverse engineering. PVM-based approaches rely on a VM to determine how instructions of the protected code region are scheduled and executed. Therefore, it is crucial to protect the VM against runtime code tampering that alters the instructions and behavior of the VM. This paper presents VMGuards, a novel PVM-based code protection system that puts the security of VM as the first class design concern. Our approach advances prior work by promoting security of the VM as the first class design constraint. We achieve this by introducing two new instruction sets to protect the internal implementations of critical code segments and the host runtime environment where the VM runs in. Our new instruction sets not only have an identical code structure as standard virtual instructions, but also provide additional information to allow the VM to check whether the critical internal implementation or the runtime environment is affected. We evaluate our approach by using a set of real-life applications. Experimental results show that our approach provides stronger and more fine-grained protection when compared to the state-of-the-art with little extra overhead.

This paper focuses on a data cleaning method to denoise and detect outliers of earthen site monitoring data with wireless sensor network (WSN). A data cleaning method, named DC_ESVS is proposed, which is based on the temporal and spatial characteristics of monitoring data with WSN. Using the cubic exponential smoothing algorithm and voting strategy, it can denoise and detect outliers of earthen site monitoring data based on the decision rule. We conduct various experiments on the dataset of the monitoring data of Xi’an Tang Hanguangmen city wall site with WSN to show detection accuracy of the presented method. Experimental results on anther dataset of the monitoring data of the Ming Great Wall in Shaanxi also show good performance of the proposed method.

Wireless localization technology has become more and more important in our life. Many applications would benefit from such device-free localization, e.g. intruder detection, privacy-enhanced monitoring, etc. This paper presents a system, named Pilm, for localizing a moving target based on the detection probability model. It aims to enable a device-free localization technology in the outdoors that is low-cost, compact and strong theoretical supported. In traditional devicefree methods, the transceiver collects a large number of the received signal strength (RSS) changing distorted by target, which is high cost for resource-constraint networks, such as wireless sensor networks (WSNs). Unlink past works, which need to process the RSS values from each communication link of networks during the localization, our design exploits the minimum number of links to detect and localize a moving target. We evaluate its performance through real-world deployment and simulation experiments. Empirical measurements with a prototype show that Pilm can use the minimum number of links to localize a moving target with low energy consumption.

Many emerging applications and the ubiquitous wireless signals have accelerated the development of WiFi-based indoor localization techniques. However, there is one primary issue, that is the environmental dynamics will greatly undermine the fingerprint stability over time, hindering these techniques to be fully practical. Although many researchers dedicated to deal with the fingerprint adaptation problem, it still remains an open problem without a wholesome approach. In this study, we propose TaLc, a time adaptive and low cost indoor localization approach that fortifies the indoor localization to be a fully practical service. TaLc can automatically identify the time to update the fingerprint without the need of any extra devices. Then by collecting the fresh RSS measurements of only a few of reference locations, which are at most equal to the number of APs and much less than the number of locations, to update the fingerprint and thus reduce the human effort for fingerprint calibrating. Finally TaLc utilizes the Compressive sensing (CS) based localization to reduce the data volume and energy consumption, which can achieve an fine-grained localization accuracy with only a few of RSS measurements. Extensive real-word experiments over 3 months illustrate that TaLc can effectively update the fingerprint with the average error of less than 3.6dBm and improves the localization accuracy of about 50%.

The device-free localization (DFL), i.e., localizing target without requiring target attached any devices, is attractive. Current localization methods, however, query a significant degree of pre-deployment effort, such as the transceivers' locations, the transmission power, which cost huge human effort. In this paper, we present Alico, an accurate and low human cost DFL method that does not require any pre-deployment effort, such as building the detailed fingerprints or requiring the prior knowledge of deployment. The key intuition is that (i) the distorted wireless links caused by the target, even the many from unknown locations, are constrained the presence of the target; (ii) with the increase of the number of unknown targets and transceivers, the constraints grows in a quadratic fashion, while the unknown locations of targets and transceivers grows linearly. This suggests that given enough measurements, there will be eventually enough constraints to make the every target uniquely localizable. Alico leverages these constraints and model them as a set of equations. By using a hybrid gradient descent and genetic algorithms, Alico can solve the equations and estimate the target locations accurately based just on the Received Signal Strength (RSS) measurements. Despite the absence of any explicit pre-deployment calibration effort, Alico achieves the 60th and 80th percentile errors of 1m and 1.4m in real-world experiments, respectively, which is better than the three state-of-the-art algorithms.