首页 > 最新文献

2014 IEEE Eighth International Conference on Software Security and Reliability-Companion最新文献

英文 中文
How Accurate Is Dynamic Program Slicing? An Empirical Approach to Compute Accuracy Bounds 动态程序切片有多准确?计算精度界限的经验方法
Siyuan Jiang, Raúl A. Santelices, Haipeng Cai, M. Grechanik
Dynamic program slicing attempts to find runtime dependencies among statements to support security, reliability, and quality tasks such as information-flow analysis, testing, and debugging. However, it is not known how accurately dynamic slices identify statements that really affect each other. We propose a new approach to estimate the accuracy of dynamic slices. We use this approach to obtain bounds on the accuracy of multiple dynamic slices in Java software. Early results suggest that dynamic slices suffer from some imprecision and, more critically, can have a low recall whose upper bound we estimate to be 60% on average.
动态程序切片试图找到语句之间的运行时依赖关系,以支持安全性、可靠性和质量任务,例如信息流分析、测试和调试。然而,动态切片如何准确地识别真正相互影响的语句并不为人所知。提出了一种估算动态切片精度的新方法。我们使用这种方法在Java软件中获得了多个动态切片的精度界限。早期的结果表明,动态切片存在一些不精确,更关键的是,它的召回率很低,我们估计其上限平均为60%。
{"title":"How Accurate Is Dynamic Program Slicing? An Empirical Approach to Compute Accuracy Bounds","authors":"Siyuan Jiang, Raúl A. Santelices, Haipeng Cai, M. Grechanik","doi":"10.1109/SERE-C.2014.14","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.14","url":null,"abstract":"Dynamic program slicing attempts to find runtime dependencies among statements to support security, reliability, and quality tasks such as information-flow analysis, testing, and debugging. However, it is not known how accurately dynamic slices identify statements that really affect each other. We propose a new approach to estimate the accuracy of dynamic slices. We use this approach to obtain bounds on the accuracy of multiple dynamic slices in Java software. Early results suggest that dynamic slices suffer from some imprecision and, more critically, can have a low recall whose upper bound we estimate to be 60% on average.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133711608","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A Proof System in Process Algebra for Demand and Supply 过程代数中需求与供给的证明系统
Xinghua Yao, Yixiang Chen
Process Algebra for Demand and Supply (shortly, PADS), proposed by Philippou et al., is a process algebra model for the formal analysis of hierarchical scheduling. They introduce a basic notion of supply simulation relation to characterize task's schedulability. In this paper, we first investigate some properties of supply simulation relation. And then based on these properties, we present a proof system for the supply simulation relation in a decomposing-composing way and prove its soundness and completeness with respect to the semantic definition of a supply simulation relation. The soundness and completeness guarantee that the proof system is used to determine whether a task is schedulable by a supply or not.
供不应求的过程代数(Process Algebra for Demand and Supply,简称PADS)是Philippou等人提出的用于形式化分析分层调度的过程代数模型。他们引入了供应仿真关系的基本概念来表征任务的可调度性。本文首先研究了供给模拟关系的一些性质。在此基础上,以分解组合的方式给出了供给仿真关系的证明体系,并从供给仿真关系的语义定义出发,证明了其完备性。证明系统的健全性和完备性保证了证明系统被用来确定一个任务是否可被一个供应商调度。
{"title":"A Proof System in Process Algebra for Demand and Supply","authors":"Xinghua Yao, Yixiang Chen","doi":"10.1109/SERE-C.2014.44","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.44","url":null,"abstract":"Process Algebra for Demand and Supply (shortly, PADS), proposed by Philippou et al., is a process algebra model for the formal analysis of hierarchical scheduling. They introduce a basic notion of supply simulation relation to characterize task's schedulability. In this paper, we first investigate some properties of supply simulation relation. And then based on these properties, we present a proof system for the supply simulation relation in a decomposing-composing way and prove its soundness and completeness with respect to the semantic definition of a supply simulation relation. The soundness and completeness guarantee that the proof system is used to determine whether a task is schedulable by a supply or not.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134565651","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Seeing Beyond Visibility: A Four Way Fusion of User Authentication for Efficient Usable Security on Mobile Devices 超越可见性:在移动设备上实现高效可用安全的用户认证的四向融合
F. Rahman, Md Osman Gani, G. Ahsan, Sheikh Iqbal Ahamed
Security and usability plays an important role in the success in today's computer, mobile, and technology based system. In these systems, security gets higher priority for high security measures ignoring the fact that the system may lead to an unusable one. However, everyday technology users need a system that is usable and also safe. In this paper, we propose a novel approach for usable security for mobile system i.e. a mobile system that will be usable and also secured. Traditional mobile device authentication techniques do not consider the combination of user biometrics, environmental information, and information provided by the sensors within the pervasive system. In this paper, we present a four way fusion of user authentication techniques for efficient usable security on mobile devices. In this approach user is not required to remember any alphanumeric password. The location traces, gait pattern, emotion of user and context of an image is used as metric for authentication. This system silently does authentication using location traces and gait pattern of its user. If the silent authentication fails then system authenticates its users based on user's emotion sequence and an image context previously stored by the user. Our proposed fusion based authentication technique can be useful for numerous real life scenarios where mobile device security is important.
在当今的计算机、移动和基于技术的系统中,安全性和可用性在成功中起着重要作用。在这些系统中,由于采取了高安全性的措施,安全得到了更高的优先级,而忽略了系统可能导致不可用的事实。然而,日常技术用户需要一个可用且安全的系统。在本文中,我们提出了一种新的移动系统可用性安全方法,即移动系统既可用又安全。传统的移动设备身份验证技术不考虑用户生物特征、环境信息和普适性系统中传感器提供的信息的组合。在本文中,我们提出了一种四路融合的用户认证技术,以提高移动设备的可用安全性。在这种方法中,用户不需要记住任何字母数字密码。使用位置痕迹、步态模式、用户情感和图像上下文作为认证的度量。该系统使用用户的位置痕迹和步态模式静默地进行身份验证。如果静默认证失败,则系统根据用户的情感序列和用户先前存储的图像上下文对其用户进行身份验证。我们提出的基于融合的身份验证技术对于移动设备安全性很重要的许多现实场景都很有用。
{"title":"Seeing Beyond Visibility: A Four Way Fusion of User Authentication for Efficient Usable Security on Mobile Devices","authors":"F. Rahman, Md Osman Gani, G. Ahsan, Sheikh Iqbal Ahamed","doi":"10.1109/SERE-C.2014.30","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.30","url":null,"abstract":"Security and usability plays an important role in the success in today's computer, mobile, and technology based system. In these systems, security gets higher priority for high security measures ignoring the fact that the system may lead to an unusable one. However, everyday technology users need a system that is usable and also safe. In this paper, we propose a novel approach for usable security for mobile system i.e. a mobile system that will be usable and also secured. Traditional mobile device authentication techniques do not consider the combination of user biometrics, environmental information, and information provided by the sensors within the pervasive system. In this paper, we present a four way fusion of user authentication techniques for efficient usable security on mobile devices. In this approach user is not required to remember any alphanumeric password. The location traces, gait pattern, emotion of user and context of an image is used as metric for authentication. This system silently does authentication using location traces and gait pattern of its user. If the silent authentication fails then system authenticates its users based on user's emotion sequence and an image context previously stored by the user. Our proposed fusion based authentication technique can be useful for numerous real life scenarios where mobile device security is important.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133901964","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
A-R Exploit: An Automatic ROP Exploit Based on Long Sequence A-R漏洞:基于长序列的自动ROP漏洞
Chao Yang, Tao Zheng, Zhitian Lin
More attention has been paid to program security since ROP had been proposed. An ROP defence scheme based on detecting frequent set sequences was designed in 2009 and it was proved an useful way to defend most ROP attacks. However, this scheme was bypassed by Lgadget, which makes use of long ret sequences and was proposed by J Cao in 2013. Based on J Cao's work, this paper improves the Lgadgets and designs a frame work automatically distributing gadgets addresses into the stack to trigger an ROP exploit. Our work includes turing-complete gadgets gathering, definition and compilation of upper level language, and automated linking and chaining of the gadgets in the stack. We demonstrate the viability and effectiveness of this kind of automatic exploit.
自ROP被提出以来,程序安全性受到了越来越多的关注。2009年设计了一种基于检测频繁集序列的ROP防御方案,并被证明是防御大多数ROP攻击的有效方法。然而,该方案被Lgadget绕过,该方案利用了长ret序列,由J Cao在2013年提出。在曹俊的基础上,改进了lgadget,设计了一个框架,将gadget地址自动分配到堆栈中,从而触发ROP攻击。我们的工作包括图完整的小工具收集,上层语言的定义和编译,以及堆栈中小工具的自动链接和链接。我们证明了这种自动攻击的可行性和有效性。
{"title":"A-R Exploit: An Automatic ROP Exploit Based on Long Sequence","authors":"Chao Yang, Tao Zheng, Zhitian Lin","doi":"10.1109/SERE-C.2014.22","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.22","url":null,"abstract":"More attention has been paid to program security since ROP had been proposed. An ROP defence scheme based on detecting frequent set sequences was designed in 2009 and it was proved an useful way to defend most ROP attacks. However, this scheme was bypassed by Lgadget, which makes use of long ret sequences and was proposed by J Cao in 2013. Based on J Cao's work, this paper improves the Lgadgets and designs a frame work automatically distributing gadgets addresses into the stack to trigger an ROP exploit. Our work includes turing-complete gadgets gathering, definition and compilation of upper level language, and automated linking and chaining of the gadgets in the stack. We demonstrate the viability and effectiveness of this kind of automatic exploit.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129796955","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Analysis of System Reliability for Cache Coherence Scheme in Multi-processor 多处理器缓存一致性方案的系统可靠性分析
Sizhao Li, Shan Lin, Deming Chen, W. Wong, Donghui Guo
In this paper, a cache coherence scheme in multi-processor is introduced. There is a specific model in each kind of software, cache coherence can be solved in AHB bus by these models. First, we use dynamic address mapping policy to realize data cache. Second, according to the randomness of application environment that set up shared cache adaptive configuration and management mechanism in the finite state machine timing sequence model of each kind of software, to ensure the system reliability. In order to support multi-tasking and multi-user operator system - Linux, the multi-processor must use shared memory technology, so this paper also introduced the memory management unit, and base on these, it focuses on how multi-processor and the AHB bus cooperate to ensure cache coherence of the whole system. We can use software execution model and hardware design to achieve instruction or data coherence between each cache and main memory.
本文介绍了一种多处理器缓存一致性方案。每种软件都有一个特定的模型,通过这些模型可以解决AHB总线上的缓存一致性问题。首先,采用动态地址映射策略实现数据缓存。其次,根据应用环境的随机性,在各类软件的有限状态机时序模型中建立共享缓存的自适应配置和管理机制,保证系统的可靠性。为了支持多任务和多用户操作系统Linux,多处理器必须采用共享内存技术,因此本文还介绍了内存管理单元,并在此基础上重点研究了多处理器与AHB总线如何协同工作以保证整个系统的缓存一致性。我们可以使用软件执行模型和硬件设计来实现每个缓存和主存之间的指令或数据一致性。
{"title":"Analysis of System Reliability for Cache Coherence Scheme in Multi-processor","authors":"Sizhao Li, Shan Lin, Deming Chen, W. Wong, Donghui Guo","doi":"10.1109/SERE-C.2014.47","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.47","url":null,"abstract":"In this paper, a cache coherence scheme in multi-processor is introduced. There is a specific model in each kind of software, cache coherence can be solved in AHB bus by these models. First, we use dynamic address mapping policy to realize data cache. Second, according to the randomness of application environment that set up shared cache adaptive configuration and management mechanism in the finite state machine timing sequence model of each kind of software, to ensure the system reliability. In order to support multi-tasking and multi-user operator system - Linux, the multi-processor must use shared memory technology, so this paper also introduced the memory management unit, and base on these, it focuses on how multi-processor and the AHB bus cooperate to ensure cache coherence of the whole system. We can use software execution model and hardware design to achieve instruction or data coherence between each cache and main memory.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"108 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122658741","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
A Predictive Runtime Verification Framework for Cyber-Physical Systems 网络物理系统的预测运行时验证框架
Kang Yu, Zhenbang Chen, Wei Dong
Runtime verification with a predictive semantics defines how to monitor a temporal property in a predictive manner. In this paper, we propose a predictive runtime verification framework for Cyber-Physical Systems (CPS), which are usually open embedded systems, aiming to predict the runtime failures of CPS before the failure really happen. We present the method for online predications based on the program information and the runtime information. We have implemented a prototype framework based on JavaMOP. The experimental results demonstrate that our framework is generally applicable.
使用预测语义的运行时验证定义了如何以预测的方式监视时态属性。本文针对网络物理系统(CPS)这类开放式嵌入式系统,提出了一种预测运行时验证框架,旨在对CPS的运行时故障进行预测。提出了一种基于程序信息和运行时信息的在线预测方法。我们已经实现了一个基于JavaMOP的原型框架。实验结果表明,该框架具有普遍的适用性。
{"title":"A Predictive Runtime Verification Framework for Cyber-Physical Systems","authors":"Kang Yu, Zhenbang Chen, Wei Dong","doi":"10.1109/SERE-C.2014.43","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.43","url":null,"abstract":"Runtime verification with a predictive semantics defines how to monitor a temporal property in a predictive manner. In this paper, we propose a predictive runtime verification framework for Cyber-Physical Systems (CPS), which are usually open embedded systems, aiming to predict the runtime failures of CPS before the failure really happen. We present the method for online predications based on the program information and the runtime information. We have implemented a prototype framework based on JavaMOP. The experimental results demonstrate that our framework is generally applicable.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121842635","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
MicroApp: Architecting Web Application for Non-uniform Trustworthiness in Cloud Computing Environment MicroApp:云计算环境下面向非统一可信的Web应用架构
Yen-Chun Hsu, Yu-Sung Wu, Tsung-Han Tsai, Yi Pin Chiu, Chihhung Lin, Zhi-Wei Chen
An increasing number of web applications are now hosted in cloud infrastructures such as Amazon Web Services. Cloud infrastructures generally lack a uniform guarantee on security, reliability, performance, and cost. A privately owned cloud infrastructure may be considered more secure but less performant than a third-party public cloud infrastructure. Infrastructures that span across geographical regions may further incur complications on the trustworthiness of infrastructures due to the varying power of jurisdiction. Application developers have to be aware of the non-uniformity of infrastructure trustworthiness when deploying applications in the cloud. We propose the MicroApp architecture that help address the difficulty in dealing with the non-uniformity. MicroApp splits a web application into multiple micro applications. Each micro application encapsulates a port of the code and data with the same level of security and integrity requirement. The micro applications will then be deployed to corresponding infrastructures that satisfy the respective requirements. MicroApp provides an RPC mechanism to allow control flows across micro applications. The architecture can be transparently applied to existing web applications and allows an application to effectively adapt to the cloud environment.
越来越多的web应用程序现在托管在云基础设施中,比如Amazon web Services。云基础设施通常在安全性、可靠性、性能和成本方面缺乏统一的保证。私有云基础设施可能被认为比第三方公共云基础设施更安全,但性能较差。由于管辖权的不同,跨地理区域的基础设施可能会进一步导致基础设施可信度的复杂化。在云中部署应用程序时,应用程序开发人员必须意识到基础设施可靠性的不一致性。我们提出了MicroApp架构来帮助解决处理非均匀性的困难。MicroApp将一个web应用程序拆分为多个微应用程序。每个微应用程序都封装了一个端口的代码和数据,具有相同级别的安全性和完整性要求。然后将微应用程序部署到满足各自需求的相应基础设施中。MicroApp提供了一个RPC机制来允许跨微应用程序的控制流。该架构可以透明地应用于现有的web应用程序,并允许应用程序有效地适应云环境。
{"title":"MicroApp: Architecting Web Application for Non-uniform Trustworthiness in Cloud Computing Environment","authors":"Yen-Chun Hsu, Yu-Sung Wu, Tsung-Han Tsai, Yi Pin Chiu, Chihhung Lin, Zhi-Wei Chen","doi":"10.1109/SERE-C.2014.27","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.27","url":null,"abstract":"An increasing number of web applications are now hosted in cloud infrastructures such as Amazon Web Services. Cloud infrastructures generally lack a uniform guarantee on security, reliability, performance, and cost. A privately owned cloud infrastructure may be considered more secure but less performant than a third-party public cloud infrastructure. Infrastructures that span across geographical regions may further incur complications on the trustworthiness of infrastructures due to the varying power of jurisdiction. Application developers have to be aware of the non-uniformity of infrastructure trustworthiness when deploying applications in the cloud. We propose the MicroApp architecture that help address the difficulty in dealing with the non-uniformity. MicroApp splits a web application into multiple micro applications. Each micro application encapsulates a port of the code and data with the same level of security and integrity requirement. The micro applications will then be deployed to corresponding infrastructures that satisfy the respective requirements. MicroApp provides an RPC mechanism to allow control flows across micro applications. The architecture can be transparently applied to existing web applications and allows an application to effectively adapt to the cloud environment.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"49 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115977111","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
CRAXDroid: Automatic Android System Testing by Selective Symbolic Execution CRAXDroid:通过选择性符号执行自动Android系统测试
Chao-Chun Yeh, Han-Lin Lu, Chun-Yen Chen, Kee Kiat Khor, Shih-Kun Huang
Mobile devices such as smart phones and tablet PCs are becoming common personal devices. The business model of a central software market is also thriving and turning into a major distribution source of software packages on those devices. However, these devices often contain personal private information and can be used to conduct operations involving data leakage and payment events like sending SMS. As a result, the quality of software on mobile devices becomes a critical issue. We aim at checking whether software off the shelf contains defective behavior or potential vulnerabilities, and aiding the official APP or third party markets to ensure their software without privacy issues. We have built a platform for android APP testing, by revising our software quality assurance and exploit generation platform, called CRAX, to apply in the Android platform. It is called the CRAXDroid that allows any inputs to be the testing sources to the APP without source code. These approaches are based on the symbolic execution technique and android emulator. By automatically exploring execution paths, we can find potential software defects. We perform several experiments on Android applications to prove the feasibility of our method.
智能手机和平板电脑等移动设备正在成为常见的个人设备。中央软件市场的商业模式也在蓬勃发展,并成为这些设备上软件包的主要分发来源。然而,这些设备通常包含个人隐私信息,可以用来进行涉及数据泄露和发送短信等支付事件的操作。因此,移动设备上的软件质量成为一个关键问题。我们的目标是检查现成的软件是否存在缺陷行为或潜在漏洞,帮助官方APP或第三方市场确保其软件不存在隐私问题。我们通过修改我们的软件质量保证和漏洞生成平台CRAX,构建了一个android APP测试平台,应用于android平台。它被称为CRAXDroid,它允许任何输入作为APP的测试源,而不需要源代码。这些方法基于符号执行技术和android仿真器。通过自动探索执行路径,我们可以发现潜在的软件缺陷。我们在Android应用程序上进行了几个实验来证明我们的方法的可行性。
{"title":"CRAXDroid: Automatic Android System Testing by Selective Symbolic Execution","authors":"Chao-Chun Yeh, Han-Lin Lu, Chun-Yen Chen, Kee Kiat Khor, Shih-Kun Huang","doi":"10.1109/SERE-C.2014.32","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.32","url":null,"abstract":"Mobile devices such as smart phones and tablet PCs are becoming common personal devices. The business model of a central software market is also thriving and turning into a major distribution source of software packages on those devices. However, these devices often contain personal private information and can be used to conduct operations involving data leakage and payment events like sending SMS. As a result, the quality of software on mobile devices becomes a critical issue. We aim at checking whether software off the shelf contains defective behavior or potential vulnerabilities, and aiding the official APP or third party markets to ensure their software without privacy issues. We have built a platform for android APP testing, by revising our software quality assurance and exploit generation platform, called CRAX, to apply in the Android platform. It is called the CRAXDroid that allows any inputs to be the testing sources to the APP without source code. These approaches are based on the symbolic execution technique and android emulator. By automatically exploring execution paths, we can find potential software defects. We perform several experiments on Android applications to prove the feasibility of our method.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"100 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115129232","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 14
A Parameters Tuning Algorithm in Wireless Networks 无线网络中的参数调优算法
Hua-Ching Chen, Hsuan-Ming Feng, Benbin Chen, Donghui Guo
The arbitration inter frame space, Contention window minimum and Contention window maximum are some of the most important parameters of 802.11e, and the enhanced parameters tuning algorithm is applied for their adjustment. To achieve the high quality of service (QoS), priority combinations strategy with simpleness and effectiveness is proposed. In such a strategy, the internal competition of business analysis methods is used to detect the channel busy probability. Via different settings of the above parameters, the EPT reduces the conflict probability to complete the performance analysis while retreating the traffic business to the idle and zero states. Simulation environments are built for test and validation the better adapted regulation mechanism with the parameters.
仲裁帧间空间、竞争窗口最小值和竞争窗口最大值是802.11e中最重要的参数,采用增强型参数调优算法对其进行调整。为了实现高服务质量,提出了简单有效的优先级组合策略。在该策略中,利用业务分析方法的内部竞争来检测信道繁忙概率。通过上述参数的不同设置,EPT降低冲突概率完成性能分析,同时将流量业务退回到空闲和零状态。建立了仿真环境来测试和验证与参数相适应的调节机制。
{"title":"A Parameters Tuning Algorithm in Wireless Networks","authors":"Hua-Ching Chen, Hsuan-Ming Feng, Benbin Chen, Donghui Guo","doi":"10.1109/SERE-C.2014.49","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.49","url":null,"abstract":"The arbitration inter frame space, Contention window minimum and Contention window maximum are some of the most important parameters of 802.11e, and the enhanced parameters tuning algorithm is applied for their adjustment. To achieve the high quality of service (QoS), priority combinations strategy with simpleness and effectiveness is proposed. In such a strategy, the internal competition of business analysis methods is used to detect the channel busy probability. Via different settings of the above parameters, the EPT reduces the conflict probability to complete the performance analysis while retreating the traffic business to the idle and zero states. Simulation environments are built for test and validation the better adapted regulation mechanism with the parameters.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130284508","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A Multi-function Error Detection Policy to Enhance Communication Integrity in Critical Embedded Systems 增强关键嵌入式系统通信完整性的多功能错误检测策略
Amira Zammali, A. D. Bonneval, Y. Crouzet
We present, in this paper, ongoing work that investigates a new error detection policy aiming at enhancing the system safety level particularly communication integrity in the presence of permanent errors (single and multiple). We consider critical embedded systems which are based on complex networks including active interstage nodes. This property increases the occurrence probability of permanent errors. The novelty of the proposed policy lies in the fact that unlike classical policies using a single error detection function, it is based rather on a set of different error detection functions. The different used functions must be complementary in terms of detection capability in order to increase the resultant error detection capability. Our reference application to illustrate the proposed concepts is the Flight Control System (FCS). However, our objective is also to apply the proposed approach to other application domains sharing similar features and characteristics.
在本文中,我们提出了一项正在进行的工作,研究一种新的错误检测策略,旨在提高系统安全水平,特别是在存在永久性错误(单个和多个)时的通信完整性。我们考虑了基于复杂网络的关键嵌入式系统,包括活跃的阶段间节点。此属性增加了永久性错误发生的概率。该策略的新颖之处在于,与使用单个错误检测函数的传统策略不同,它基于一组不同的错误检测函数。不同的使用函数必须在检测能力方面是互补的,以增加最终的错误检测能力。我们的参考应用来说明所提出的概念是飞行控制系统(FCS)。然而,我们的目标也是将所提出的方法应用到其他共享类似特性和特征的应用程序领域。
{"title":"A Multi-function Error Detection Policy to Enhance Communication Integrity in Critical Embedded Systems","authors":"Amira Zammali, A. D. Bonneval, Y. Crouzet","doi":"10.1109/SERE-C.2014.18","DOIUrl":"https://doi.org/10.1109/SERE-C.2014.18","url":null,"abstract":"We present, in this paper, ongoing work that investigates a new error detection policy aiming at enhancing the system safety level particularly communication integrity in the presence of permanent errors (single and multiple). We consider critical embedded systems which are based on complex networks including active interstage nodes. This property increases the occurrence probability of permanent errors. The novelty of the proposed policy lies in the fact that unlike classical policies using a single error detection function, it is based rather on a set of different error detection functions. The different used functions must be complementary in terms of detection capability in order to increase the resultant error detection capability. Our reference application to illustrate the proposed concepts is the Flight Control System (FCS). However, our objective is also to apply the proposed approach to other application domains sharing similar features and characteristics.","PeriodicalId":373062,"journal":{"name":"2014 IEEE Eighth International Conference on Software Security and Reliability-Companion","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-06-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128996220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
期刊
2014 IEEE Eighth International Conference on Software Security and Reliability-Companion
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1