首页 > 最新文献

2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)最新文献

英文 中文
A Framework for Regression Testing of Outdoor Mobile Applications 户外移动应用的回归测试框架
Carlo Bernaschina, Roman Fedorov, Darian Frajberg, P. Fraternali
Outdoor mobile applications are becoming popular in fields such as gaming, tourism and environment monitoring. They rely on the input of multiple, possibly noisy, sensors, such as the camera, GPS, compass and gyroscope. The regression testing of such applications requires the reproduction of the real conditions in which the application works, which are hard to reproduce without automated support. We present a capture replay framework that automates regression testing of mobile outdoor applications, by recording data streams in real-time on the field from multiple sensors, replays them in lab and computes quality metrics to trace regression errors.
户外移动应用在游戏、旅游和环境监测等领域越来越受欢迎。它们依赖于多个可能有噪声的传感器的输入,比如摄像头、GPS、指南针和陀螺仪。此类应用程序的回归测试需要再现应用程序工作的真实条件,如果没有自动化支持,这些条件很难再现。我们提出了一个捕获重放框架,通过在现场实时记录来自多个传感器的数据流,在实验室中重放数据,并计算质量指标来跟踪回归错误,从而自动化移动户外应用的回归测试。
{"title":"A Framework for Regression Testing of Outdoor Mobile Applications","authors":"Carlo Bernaschina, Roman Fedorov, Darian Frajberg, P. Fraternali","doi":"10.1109/MOBILESoft.2017.13","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.13","url":null,"abstract":"Outdoor mobile applications are becoming popular in fields such as gaming, tourism and environment monitoring. They rely on the input of multiple, possibly noisy, sensors, such as the camera, GPS, compass and gyroscope. The regression testing of such applications requires the reproduction of the real conditions in which the application works, which are hard to reproduce without automated support. We present a capture replay framework that automates regression testing of mobile outdoor applications, by recording data streams in real-time on the field from multiple sensors, replays them in lab and computes quality metrics to trace regression errors.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"34 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-05-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134638560","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Who Changed You? Obfuscator Identification for Android 谁改变了你?Android的混淆识别器
Yan Wang, A. Rountev
Android developers commonly use app obfuscation to secure their apps and intellectual property. Although obfuscation provides protection, it presents an obstacle for a number of legitimate program analyses such as detection of app cloning and repackaging, malware detection, identification of third-party libraries, provenance analysis for digital forensics, and reverse engineering for test generation and performance analysis. If the obfuscator used to create an app can be identified, and if some details of the obfuscation process can be inferred, subsequent analyses can exploit this knowledge. Thus, it is desirable to be able to automatically analyze a given app and determine (1) whether it was obfuscated, (2) which obfuscator was used, and (3) how the obfuscator was configured. We have developed novel techniques to identify the obfuscator of an Android app for several widely-used obfuscation tools and for a number of their configuration options. We define the obfuscator identification problem and propose a solution based on machine learning. To the best of our knowledge, this is the first work to formulate and solve this problem. We identify a feature vector that represents the characteristics of the obfuscated code. We then implement a tool that extracts this feature vector from Dalvik bytecode and uses it to identify the obfuscator provenance information. We evaluate the proposed approach on real-world Android apps obfuscated with different obfuscators, under several configurations. Our experiments indicate that the approach identifies the obfuscator with about 97% accuracy and recognizes the configuration with more than 90% accuracy.
Android开发者通常使用应用混淆来保护他们的应用和知识产权。虽然混淆提供了保护,但它为许多合法程序分析提供了障碍,例如检测应用程序克隆和重新包装,恶意软件检测,第三方库识别,数字取证的来源分析以及用于测试生成和性能分析的逆向工程。如果可以识别用于创建应用程序的混淆器,并且可以推断出混淆过程的一些细节,则后续分析可以利用这些知识。因此,希望能够自动分析给定的应用程序并确定(1)是否被混淆,(2)使用了哪个混淆器,以及(3)如何配置混淆器。我们开发了新的技术来识别Android应用程序的几个广泛使用的混淆工具及其配置选项的混淆器。我们定义了模糊识别问题,并提出了一种基于机器学习的解决方案。据我们所知,这是第一次提出并解决这个问题。我们确定一个特征向量,表示混淆代码的特征。然后我们实现了一个工具,从Dalvik字节码中提取这个特征向量,并用它来识别混淆器的来源信息。我们在几种配置下对使用不同混淆器混淆的真实Android应用程序评估了所提出的方法。实验表明,该方法识别混淆器的准确率约为97%,识别配置的准确率超过90%。
{"title":"Who Changed You? Obfuscator Identification for Android","authors":"Yan Wang, A. Rountev","doi":"10.1109/MOBILESoft.2017.18","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.18","url":null,"abstract":"Android developers commonly use app obfuscation to secure their apps and intellectual property. Although obfuscation provides protection, it presents an obstacle for a number of legitimate program analyses such as detection of app cloning and repackaging, malware detection, identification of third-party libraries, provenance analysis for digital forensics, and reverse engineering for test generation and performance analysis. If the obfuscator used to create an app can be identified, and if some details of the obfuscation process can be inferred, subsequent analyses can exploit this knowledge. Thus, it is desirable to be able to automatically analyze a given app and determine (1) whether it was obfuscated, (2) which obfuscator was used, and (3) how the obfuscator was configured. We have developed novel techniques to identify the obfuscator of an Android app for several widely-used obfuscation tools and for a number of their configuration options. We define the obfuscator identification problem and propose a solution based on machine learning. To the best of our knowledge, this is the first work to formulate and solve this problem. We identify a feature vector that represents the characteristics of the obfuscated code. We then implement a tool that extracts this feature vector from Dalvik bytecode and uses it to identify the obfuscator provenance information. We evaluate the proposed approach on real-world Android apps obfuscated with different obfuscators, under several configurations. Our experiments indicate that the approach identifies the obfuscator with about 97% accuracy and recognizes the configuration with more than 90% accuracy.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"184 2","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-05-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132623994","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 41
Cloud-Guided QoS and Energy Management for Mobile Interactive Web Applications 移动交互式Web应用的云导向QoS和能量管理
Wooseok Lee, Dam Sunwoo, A. Gerstlauer, L. John
In mobile interactive web applications, energy-efficient quality-of-service (QoS) scheduling involves setting a deadline for the best user experience and providing just enough performance to minimize energy. Such performance-slacking approaches require precise performance adjustment using execution time prediction. However, prior prediction approaches suffer from prohibitive training due to extensive input data and manual source code instrumentation. In this paper, we propose a cloud-guided QoS and energy management approach that eliminates the prediction overhead by offloading it to cloud resources. Our approach pre-computes per-input execution time models by profiling web applications on dedicated mobile devices in the cloud. When mobile web applications request data to servers, both the data and its execution time models are delivered to users' mobile devices. Based on the delivered models, a performance control agent on the mobile device selects an operating point to meet the response time requirement. Experimental results show that, by offloading modeling and prediction overheads, our performance-slacking approach can provide average energy savings of 22% and 39% (and up to 89%) for two different timing budgets compared to an industry-quality approach.
在移动交互式web应用程序中,节能的服务质量(QoS)调度包括为最佳用户体验设置最后期限,并提供足够的性能以最小化能耗。这种降低性能的方法需要使用执行时间预测进行精确的性能调整。然而,先前的预测方法由于大量的输入数据和手动源代码检测而受到训练的限制。在本文中,我们提出了一种以云为导向的QoS和能量管理方法,通过将其卸载到云资源来消除预测开销。我们的方法是通过分析云中的专用移动设备上的web应用程序来预先计算每次输入的执行时间模型。当移动web应用程序向服务器请求数据时,数据及其执行时间模型都被传送到用户的移动设备上。基于交付的模型,移动设备上的性能控制代理选择一个操作点来满足响应时间要求。实验结果表明,通过减少建模和预测开销,与行业质量方法相比,我们的性能松弛方法可以在两种不同的时间预算下平均节省22%和39%(最高可达89%)的能源。
{"title":"Cloud-Guided QoS and Energy Management for Mobile Interactive Web Applications","authors":"Wooseok Lee, Dam Sunwoo, A. Gerstlauer, L. John","doi":"10.1109/MOBILESoft.2017.4","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.4","url":null,"abstract":"In mobile interactive web applications, energy-efficient quality-of-service (QoS) scheduling involves setting a deadline for the best user experience and providing just enough performance to minimize energy. Such performance-slacking approaches require precise performance adjustment using execution time prediction. However, prior prediction approaches suffer from prohibitive training due to extensive input data and manual source code instrumentation. In this paper, we propose a cloud-guided QoS and energy management approach that eliminates the prediction overhead by offloading it to cloud resources. Our approach pre-computes per-input execution time models by profiling web applications on dedicated mobile devices in the cloud. When mobile web applications request data to servers, both the data and its execution time models are delivered to users' mobile devices. Based on the delivered models, a performance control agent on the mobile device selects an operating point to meet the response time requirement. Experimental results show that, by offloading modeling and prediction overheads, our performance-slacking approach can provide average energy savings of 22% and 39% (and up to 89%) for two different timing budgets compared to an industry-quality approach.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"198 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-05-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121021639","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
On-Device Bug Reporting for Android Applications Android应用程序的设备Bug报告
Kevin Moran, R. Bonett, Carlos Bernal-Cárdenas, Brendan Otten, Daniel Park, D. Poshyvanyk
Bugs that surface in mobile applications can be difficult to reproduce and fix due to several confounding factors including the highly GUI-driven nature of mobile apps, varying contextual states, differing platform versions and device fragmentation. It is clear that developers need support in the form of automated tools that allow for more precise reporting of application defects in order to facilitate more efficient and effective bug fixes. In this paper, we present a tool aimed at supporting application testers and developers in the process of On-Device Bug Reporting. Our tool, called ODBR, leverages the uiautomator framework and low-level event stream capture to offer support for recording and replaying a series of input gesture and sensor events that describe a bug in an Android application.
手机应用中出现的漏洞可能很难重现和修复,原因包括手机应用的高度gui驱动特性、不同的上下文状态、不同的平台版本和设备碎片化。很明显,开发人员需要以自动化工具的形式提供支持,这些工具允许更精确地报告应用程序缺陷,以促进更高效和有效的错误修复。在本文中,我们提出了一个工具,旨在支持应用程序测试人员和开发人员在设备上的错误报告过程。我们的工具称为ODBR,它利用了uiautomator框架和低级事件流捕获,为记录和重放一系列描述Android应用程序bug的输入手势和传感器事件提供了支持。
{"title":"On-Device Bug Reporting for Android Applications","authors":"Kevin Moran, R. Bonett, Carlos Bernal-Cárdenas, Brendan Otten, Daniel Park, D. Poshyvanyk","doi":"10.1109/MOBILESoft.2017.36","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.36","url":null,"abstract":"Bugs that surface in mobile applications can be difficult to reproduce and fix due to several confounding factors including the highly GUI-driven nature of mobile apps, varying contextual states, differing platform versions and device fragmentation. It is clear that developers need support in the form of automated tools that allow for more precise reporting of application defects in order to facilitate more efficient and effective bug fixes. In this paper, we present a tool aimed at supporting application testers and developers in the process of On-Device Bug Reporting. Our tool, called ODBR, leverages the uiautomator framework and low-level event stream capture to offer support for recording and replaying a series of input gesture and sensor events that describe a bug in an Android application.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-05-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125954443","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 26
Using Parsing Agents as a Service for Data Privacy 使用解析代理作为数据隐私服务
Stephen Rodriguez
Storing data in the cloud is often a long and disputed process of ensuring that cloud service providers meet the clients minimum requirements. Often, this process can be costly, lack adequate results, and miss important security checks that are often overlooked. Therefore, I propose a new strategy for meeting cloud security requirements through using a dynamic parsing agent to encrypt outgoing data using a "multi-folded" encryption hierarchy. While there are limitations to being truly secure, such as those recognized by WhiteHat Security in their annual reports[1], I believe my unique architecture will prove to be ideal in allowing any mobile device (i.e. User) to define how their data is stored in the cloud. Although we have found this approach useful for the mobile space, we believe it can also be applied to a variety of different audiences in need of a cloud data encryption system.
在云中存储数据通常是一个漫长而有争议的过程,以确保云服务提供商满足客户的最低要求。通常,此过程可能代价高昂,缺乏足够的结果,并错过经常被忽视的重要安全检查。因此,我提出了一种新的策略,通过使用动态解析代理来使用“多折叠”加密层次结构加密传出数据,从而满足云安全需求。虽然真正的安全是有限制的,比如白帽安全公司在他们的年度报告[1]中承认的那些限制,但我相信我独特的架构将被证明是理想的,它允许任何移动设备(即用户)定义他们的数据如何存储在云中。虽然我们发现这种方法对移动领域很有用,但我们相信它也可以应用于需要云数据加密系统的各种不同受众。
{"title":"Using Parsing Agents as a Service for Data Privacy","authors":"Stephen Rodriguez","doi":"10.1109/MOBILESoft.2017.26","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.26","url":null,"abstract":"Storing data in the cloud is often a long and disputed process of ensuring that cloud service providers meet the clients minimum requirements. Often, this process can be costly, lack adequate results, and miss important security checks that are often overlooked. Therefore, I propose a new strategy for meeting cloud security requirements through using a dynamic parsing agent to encrypt outgoing data using a \"multi-folded\" encryption hierarchy. While there are limitations to being truly secure, such as those recognized by WhiteHat Security in their annual reports[1], I believe my unique architecture will prove to be ideal in allowing any mobile device (i.e. User) to define how their data is stored in the cloud. Although we have found this approach useful for the mobile space, we believe it can also be applied to a variety of different audiences in need of a cloud data encryption system.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-05-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127880349","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Predicting Android Application Security and Privacy Risk with Static Code Metrics 用静态代码度量预测Android应用安全和隐私风险
A. Rahman, Priysha Pradhan, Asif Partho, L. Williams
Android applications pose security and privacy risks for end-users. These risks are often quantified by performing dynamic analysis and permission analysis of the Android applications after release. Prediction of security and privacy risks associated with Android applications at early stages of application development, e.g. when the developer (s) are writing the code of the application, might help Android application developers in releasing applications to end-users that have less security and privacy risk. The goal of this paper is to aid Android application developers in assessing the security and privacy risk associated with Android applications by using static code metrics as predictors. In our paper, we consider security and privacy risk of Android application as how susceptible the application is to leaking private information of end-users and to releasing vulnerabilities. We investigate how effectively static code metrics that are extracted from the source code of Android applications, can be used to predict security and privacy risk of Android applications. We collected 21 static code metrics of 1,407 Android applications, and use the collected static code metrics to predict security and privacy risk of the applications. As the oracle of security and privacy risk, we used Androrisk, a tool that quantifies the amount of security and privacy risk of an Android application using analysis of Android permissions and dynamic analysis. To accomplish our goal, we used statistical learners such as, radial-based support vector machine (r-SVM). For r-SVM, we observe a precision of 0.83. Findings from our paper suggest that with proper selection of static code metrics, r-SVM can be used effectively to predict security and privacy risk of Android applications.
Android应用程序会给终端用户带来安全和隐私风险。这些风险通常通过在Android应用发布后执行动态分析和权限分析来量化。在应用程序开发的早期阶段(例如,当开发人员编写应用程序代码时)预测与Android应用程序相关的安全和隐私风险,可能有助于Android应用程序开发人员向最终用户发布安全性和隐私风险较低的应用程序。本文的目标是通过使用静态代码度量作为预测器,帮助Android应用程序开发人员评估与Android应用程序相关的安全和隐私风险。在本文中,我们将Android应用程序的安全和隐私风险视为应用程序泄露最终用户隐私信息和发布漏洞的易感程度。我们研究了从Android应用程序源代码中提取的静态代码指标如何有效地用于预测Android应用程序的安全和隐私风险。我们收集了1407个Android应用程序的21个静态代码指标,并使用收集到的静态代码指标来预测应用程序的安全和隐私风险。作为安全与隐私风险的预言者,我们使用了andrisisk,这是一个通过分析Android权限和动态分析来量化Android应用程序的安全和隐私风险的工具。为了实现我们的目标,我们使用了统计学习器,如基于径向的支持向量机(r-SVM)。对于r-SVM,我们观察到精度为0.83。本文的研究结果表明,通过适当选择静态代码度量,r-SVM可以有效地用于预测Android应用程序的安全和隐私风险。
{"title":"Predicting Android Application Security and Privacy Risk with Static Code Metrics","authors":"A. Rahman, Priysha Pradhan, Asif Partho, L. Williams","doi":"10.1109/MOBILESoft.2017.14","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.14","url":null,"abstract":"Android applications pose security and privacy risks for end-users. These risks are often quantified by performing dynamic analysis and permission analysis of the Android applications after release. Prediction of security and privacy risks associated with Android applications at early stages of application development, e.g. when the developer (s) are writing the code of the application, might help Android application developers in releasing applications to end-users that have less security and privacy risk. The goal of this paper is to aid Android application developers in assessing the security and privacy risk associated with Android applications by using static code metrics as predictors. In our paper, we consider security and privacy risk of Android application as how susceptible the application is to leaking private information of end-users and to releasing vulnerabilities. We investigate how effectively static code metrics that are extracted from the source code of Android applications, can be used to predict security and privacy risk of Android applications. We collected 21 static code metrics of 1,407 Android applications, and use the collected static code metrics to predict security and privacy risk of the applications. As the oracle of security and privacy risk, we used Androrisk, a tool that quantifies the amount of security and privacy risk of an Android application using analysis of Android permissions and dynamic analysis. To accomplish our goal, we used statistical learners such as, radial-based support vector machine (r-SVM). For r-SVM, we observe a precision of 0.83. Findings from our paper suggest that with proper selection of static code metrics, r-SVM can be used effectively to predict security and privacy risk of Android applications.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-05-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115155318","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
Towards Architectural Styles for Android App Software Product Lines Android应用软件产品线的架构风格
Tobias Dürschmid, Matthias Trapp, J. Döllner
Software product line development for Android apps is difficult due to an inflexible design of the Android framework. However, since mobile applications become more and more complex, increased code reuse and thus reduced time-to-market play an important role, which can be improved by software product lines. We propose five architectural styles for developing software product lines of Android apps: (1) activity extensions, (2) activity connectors, (3) dynamic preference entries, (4) decoupled definition of domain-specific behavior via configuration files, (5) feature model using Android resources. We demonstrate the benefits in an early case study using an image processing product line which enables more than 90% of code reuse.
由于Android框架的不灵活设计,Android应用程序的软件产品线开发非常困难。然而,由于移动应用程序变得越来越复杂,增加代码重用从而缩短上市时间发挥了重要作用,这可以通过软件产品线来改进。我们提出了开发Android应用软件产品线的五种架构风格:(1)活动扩展,(2)活动连接器,(3)动态偏好项,(4)通过配置文件解耦定义领域特定行为,(5)使用Android资源的特征模型。我们在早期的案例研究中展示了使用图像处理产品线的好处,该产品线支持90%以上的代码重用。
{"title":"Towards Architectural Styles for Android App Software Product Lines","authors":"Tobias Dürschmid, Matthias Trapp, J. Döllner","doi":"10.1109/MOBILESoft.2017.12","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.12","url":null,"abstract":"Software product line development for Android apps is difficult due to an inflexible design of the Android framework. However, since mobile applications become more and more complex, increased code reuse and thus reduced time-to-market play an important role, which can be improved by software product lines. We propose five architectural styles for developing software product lines of Android apps: (1) activity extensions, (2) activity connectors, (3) dynamic preference entries, (4) decoupled definition of domain-specific behavior via configuration files, (5) feature model using Android resources. We demonstrate the benefits in an early case study using an image processing product line which enables more than 90% of code reuse.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"41 5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117244064","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Automatically Locating Malicious Packages in Piggybacked Android Apps 自动定位恶意软件包在搭载Android应用程序
Li Li, Daoyuan Li, Tegawendé F. Bissyandé, Jacques Klein, Haipeng Cai, D. Lo, Yves Le Traon
To devise efficient approaches and tools for detecting malicious packages in the Android ecosystem, researchers are increasingly required to have a deep understanding of malware. There is thus a need to provide a framework for dissecting malware and locating malicious program fragments within app code in order to build a comprehensive dataset of malicious samples. Towards addressing this need, we propose in this work a tool-based approach called HookRanker, which provides ranked lists of potentially malicious packages based on the way malware behaviour code is triggered. With experiments on a ground truth set of piggybacked apps, we are able to automatically locate the malicious packages from piggybacked Android apps with an accuracy of 83.6% in verifying the top five reported items.
为了设计有效的方法和工具来检测Android生态系统中的恶意软件包,研究人员越来越需要对恶意软件有深入的了解。因此,有必要提供一个框架来剖析恶意软件,并在应用程序代码中定位恶意程序片段,以便建立一个全面的恶意样本数据集。为了解决这一需求,我们在这项工作中提出了一种基于工具的方法,称为HookRanker,它根据恶意软件行为代码的触发方式提供潜在恶意软件包的排名列表。通过对搭载应用程序的地面真相集进行实验,我们能够自动定位搭载Android应用程序的恶意软件包,在验证前5个报告项目方面的准确率为83.6%。
{"title":"Automatically Locating Malicious Packages in Piggybacked Android Apps","authors":"Li Li, Daoyuan Li, Tegawendé F. Bissyandé, Jacques Klein, Haipeng Cai, D. Lo, Yves Le Traon","doi":"10.1109/MOBILESoft.2017.6","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.6","url":null,"abstract":"To devise efficient approaches and tools for detecting malicious packages in the Android ecosystem, researchers are increasingly required to have a deep understanding of malware. There is thus a need to provide a framework for dissecting malware and locating malicious program fragments within app code in order to build a comprehensive dataset of malicious samples. Towards addressing this need, we propose in this work a tool-based approach called HookRanker, which provides ranked lists of potentially malicious packages based on the way malware behaviour code is triggered. With experiments on a ground truth set of piggybacked apps, we are able to automatically locate the malicious packages from piggybacked Android apps with an accuracy of 83.6% in verifying the top five reported items.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132498811","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 29
Generating Predicate Callback Summaries for the Android Framework 为Android框架生成谓词回调摘要
Danilo Dominguez Perez, Wei Le
One of the challenges of analyzing, testing and debugging Android apps is that the potential execution orders of callbacks are missing from the apps' source code. However, bugs, vulnerabilities and refactoring transformations have been found to be related to callback sequences. Existing work on control flow analysis of Android apps have mainly focused on analyzing GUI events. GUI events, although being a key part of determining control flow of Android apps, do not offer a complete picture. Our observation is that orthogonal to GUI events, the Android API calls also play an important role in determining the order of callbacks. In the past, such control flow information has been modeled manually. This paper presents a complementary solution of constructing program paths for Android apps. We proposed a specification technique, called Predicate Callback Summary (PCS), that represents the callback control flow information (including callback sequences as well as the conditions under which the callbacks are invoked) in Android API methods and developed static analysis techniques to automatically compute and apply such summaries to construct apps' callback sequences. Our experiments show that by applying PCSs, we are able to construct Android apps' control flow graphs, including inter callback relations, and also to detect infeasible paths involving multiple callbacks. Such control flow information can help program analysis and testing tools to report more precise results. Our detailed experimental data is available at: http://www.cs.iastate.edu/~weile/toolsdata/SummarizeAndroidFramework/lithium.html.
分析、测试和调试Android应用程序的挑战之一是,应用程序的源代码中缺少回调的潜在执行顺序。然而,bug、漏洞和重构转换已经被发现与回调序列有关。现有的Android应用程序控制流分析工作主要集中在GUI事件分析上。GUI事件虽然是决定Android应用程序控制流的关键部分,但并不能提供一个完整的画面。我们的观察是,与GUI事件正交,Android API调用在确定回调顺序方面也起着重要作用。在过去,这种控制流信息是手工建模的。本文提出了一种构建Android应用程序路径的补充解决方案。我们提出了一种规范技术,称为谓词回调摘要(PCS),它代表了Android API方法中的回调控制流信息(包括回调序列以及调用回调的条件),并开发了静态分析技术来自动计算和应用这些摘要来构建应用程序的回调序列。我们的实验表明,通过应用PCSs,我们能够构建Android应用程序的控制流图,包括内部回调关系,并且还可以检测涉及多个回调的不可行的路径。这样的控制流信息可以帮助程序分析和测试工具报告更精确的结果。我们详细的实验数据可在:http://www.cs.iastate.edu/~weile/toolsdata/SummarizeAndroidFramework/lithium.html。
{"title":"Generating Predicate Callback Summaries for the Android Framework","authors":"Danilo Dominguez Perez, Wei Le","doi":"10.1109/MOBILESoft.2017.28","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.28","url":null,"abstract":"One of the challenges of analyzing, testing and debugging Android apps is that the potential execution orders of callbacks are missing from the apps' source code. However, bugs, vulnerabilities and refactoring transformations have been found to be related to callback sequences. Existing work on control flow analysis of Android apps have mainly focused on analyzing GUI events. GUI events, although being a key part of determining control flow of Android apps, do not offer a complete picture. Our observation is that orthogonal to GUI events, the Android API calls also play an important role in determining the order of callbacks. In the past, such control flow information has been modeled manually. This paper presents a complementary solution of constructing program paths for Android apps. We proposed a specification technique, called Predicate Callback Summary (PCS), that represents the callback control flow information (including callback sequences as well as the conditions under which the callbacks are invoked) in Android API methods and developed static analysis techniques to automatically compute and apply such summaries to construct apps' callback sequences. Our experiments show that by applying PCSs, we are able to construct Android apps' control flow graphs, including inter callback relations, and also to detect infeasible paths involving multiple callbacks. Such control flow information can help program analysis and testing tools to report more precise results. Our detailed experimental data is available at: http://www.cs.iastate.edu/~weile/toolsdata/SummarizeAndroidFramework/lithium.html.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-03-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121612870","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 14
Towards the Quality Improvement of Cross-Platform Mobile Applications 面向跨平台移动应用的质量提升
Matias Martinez, S. Lecomte
During last ten years, the number of smartphonesand mobile applications has been constantly growing. Android, iOS and Windows Mobile are three mobile platforms that coveralmost all smartphones in the world in 2017. Developing a mobileapp involves first to choose the platforms the app will run, andthen to develop specific solutions (i.e., native apps) for eachchosen platform using platform-related toolkits such as AndroidSDK. A cross-platform mobile application is an app that runs ontwo or more mobile platforms. Several frameworks have beenproposed to simplify the development of cross-platform mobileapplications and to reduce development and maintenance costs. They are called cross-platform mobile app development frameworks. However, to our knowledge, the life-cycle and the quality of cross-platformsmobile applications built using those frameworks havenot been studied in depth. Our main goal is to first study theprocesses of development and maintenance of mobile applicationsbuilt using cross-platform mobile app development frameworks, focusing particularly on the bug-fixing activity. Then, we aim atdefining tools for automated repairing bugs from cross-platformmobile applications.
在过去的十年里,智能手机和移动应用程序的数量一直在不断增长。2017年,Android、iOS和Windows Mobile这三个移动平台几乎覆盖了全球所有的智能手机。开发移动应用程序首先需要选择应用程序运行的平台,然后使用与平台相关的工具包(如AndroidSDK)为每个选择的平台开发特定的解决方案(即本机应用程序)。跨平台移动应用程序是在两个或多个移动平台上运行的应用程序。已经提出了几个框架来简化跨平台移动应用程序的开发,并降低开发和维护成本。它们被称为跨平台移动应用开发框架。然而,据我们所知,使用这些框架构建的跨平台移动应用程序的生命周期和质量尚未得到深入研究。我们的主要目标是首先研究使用跨平台移动应用程序开发框架构建的移动应用程序的开发和维护过程,特别关注bug修复活动。然后,我们的目标是定义用于自动修复跨平台移动应用程序错误的工具。
{"title":"Towards the Quality Improvement of Cross-Platform Mobile Applications","authors":"Matias Martinez, S. Lecomte","doi":"10.1109/MOBILESoft.2017.30","DOIUrl":"https://doi.org/10.1109/MOBILESoft.2017.30","url":null,"abstract":"During last ten years, the number of smartphonesand mobile applications has been constantly growing. Android, iOS and Windows Mobile are three mobile platforms that coveralmost all smartphones in the world in 2017. Developing a mobileapp involves first to choose the platforms the app will run, andthen to develop specific solutions (i.e., native apps) for eachchosen platform using platform-related toolkits such as AndroidSDK. A cross-platform mobile application is an app that runs ontwo or more mobile platforms. Several frameworks have beenproposed to simplify the development of cross-platform mobileapplications and to reduce development and maintenance costs. They are called cross-platform mobile app development frameworks. However, to our knowledge, the life-cycle and the quality of cross-platformsmobile applications built using those frameworks havenot been studied in depth. Our main goal is to first study theprocesses of development and maintenance of mobile applicationsbuilt using cross-platform mobile app development frameworks, focusing particularly on the bug-fixing activity. Then, we aim atdefining tools for automated repairing bugs from cross-platformmobile applications.","PeriodicalId":281934,"journal":{"name":"2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-01-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121447725","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 45
期刊
2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1