software and system development is complex and diverse, and a multitude of development approaches is used and combined with each other to address the manifold challenges companies face today. To study the current stat...
详细信息
In a computer-aided engineering design optimization problem that involves notoriously complex and time-consuming simulator, the prevalent approach is to replace these simulations with a data-driven surrogate that appr...
详细信息
This paper addresses the need to enhance the integrity and transparency of aircraft maintenance records in the aviation industry by using blockchain technologies. A physical aircraft maintenance logbook is susceptible...
详细信息
Uncertainties in Deep Neural Network (DNN)-based perception and vehicle's motion pose challenges to the development of safe autonomous driving vehicles. In this paper, we propose a safe motion planning framework f...
详细信息
Ternary Content Addressable Memory (TCAM) is a kind of extraordinary memory which is used to search operations in routers, firewalls, network address translators, and entire content in a single clock cycle. It is a sp...
详细信息
Recently there has been a rapid increase in the advancements and use of Small Unmanned Aerial systems (sUAS) for a wide range of applications ranging from precision agriculture, to environmental monitoring, and to the...
详细信息
In Ocean of Things, information prediction is an important part of marine data processing. Due to a variety of marine acquisition devices, the distribution of marine information is discrete. The marine area is wide, a...
详细信息
To complete tasks faster, developers often have to sacrifice the quality of the software. Such compromised practice results in the increasing burden to developers in future development. The metaphor, technical debt, d...
详细信息
The Android system manages access to sensitive APIs by permission enforcement. An application (app) must declare proper permissions before invoking specific Android APIs. However, there is no official documentation pr...
详细信息
The Android system manages access to sensitive APIs by permission enforcement. An application (app) must declare proper permissions before invoking specific Android APIs. However, there is no official documentation providing the complete list of permission-protected APIs and the corresponding permissions to date. Researchers have spent significant efforts extracting such API protection mapping from the Android API framework, which leverages static code analysis to determine if specific permissions are required before accessing an API. Nevertheless, none of them has attempted to analyze the protection mapping in the native library (i.e., code written in C and C++), an essential component of the Android framework that handles communication with the lower-level hardware, such as cameras and sensors. While the protection mapping can be utilized to detect various security vulnerabilities in Android apps, such as permission over-privilege and component hijacking, imprecise mapping will lead to false results in detecting such security vulnerabilities. To fill this gap, we thereby propose to construct the protection mapping involved in the native libraries of the Android framework to present a complete and accurate specification of Android API protection. We develop a prototype system, named NATIDROID, to facilitate the cross-language static analysis to benchmark against two state-of-the-art tools, termed AXPLORER [1] and ARCADE [2]. We evaluate NATIDROID on more than 11,000 Android apps, including system apps from custom Android ROMs and third-party apps from the Google Play. Our NATIDROID can identify up to 464 new API-permission mappings, in contrast to the worst-case results derived from both AXPLORER and ARCADE, where approximately 71% apps have at least one false positive in permission over-privilege and up to 3.6% apps have at least one false negative in component hijacking. Additionally, we identify that 24 components with at least one Native-triggered component hij
暂无评论