检索结果-内蒙古大学图书馆

KOP-Fuzzer: A key-Operation-based Fuzzer for Type Confusion Bugs in JavaScript Engines

学校读者我要写书评

暂无评论

KOP-Fuzzer: A Key-Operation-based Fuzzer for Type Confusion ...

IEEE Annual International computer Software and Applications Conference (COMPSAC)

作者： Lili Sun Chenggang Wu Zhe Wang Yan Kang Bowen Tang State Key Laboratory of Computer Architecture Chinese Academy of Sciences Institute of Computing Technology University of Chinese Academy of Sciences Beijing China

ISBN: (数字)9781665488105

ISBN: (纸本)9781665488112

JavaScript (JS) engines are a core component of a lot of software, such as web browsers, PDF readers and flash players. There has been much research on finding JS engine vulnerabilities. However, due to the fact that a JS engine's input space is infinite and the vulnerability triggering conditions are extremely strict, it is difficult to generate test cases that are able to trigger deep logic errors in fuzzing. This paper aims to explore an approach which incorporates the human experience into fuzzing. We propose a key-Operation-based Fuzzer (KOP-Fuzzer), to explore the type confusion vulnerabilities in JS engines. Based on human knowledge, we summarize a trigger model and extract key operations for type confusion vulnerabilities in JS engines. We use clustering to extract the key-operation methods from the engine's source code and develop a fuzzing system for key -operation mutation. Our experimental results demonstrate that the KOP-Fuzzer generates valid test cases with 1.5x fewer runtime errors, while also improving the edge coverage (2.082 %) and key-operation coverage (6.452 %), when compared with the state-of-the-art JS engine fuzzers. The KOP-Fuzzer discovered a total of 21 new bugs in ChakraCore and JavaScriptCore, where 16 of them are caused by the engine's incorrect handling of key operations and 5 of them are caused by type confusions.

关键词： Codes Runtime Conferences computer bugs Fuzzing Software Browsers

MFCLIP: Multi-modal Fine-grained CLIP for Generalizable Diffusion Face Forgery Detection

学校读者我要写书评

暂无评论

arXiv 2024年

作者： Zhang, Yaning Wang, Tianyi Yu, Zitong Gao, Zan Shen, Linlin Chen, Shengyong Jinan250353 China Nanyang Technological University 50 Nanyang Ave Block N 4 639798 Singapore School of Computing and Information Technology Great Bay University Dongguan523000 China National Engineering Laboratory for Big Data System Computing Technology Shenzhen University Shenzhen518060 China Jinan250014 China The Key Laboratory of Computer Vision and System Ministry of Education Tianjin University of Technology Tianjin300384 China Computer Vision Institute College of Computer Science and Software Engineering Shenzhen University Shenzhen518060 China National Engineering Laboratory for Big Data System Computing Technology Shenzhen University Shenzhen China Shenzhen Institute of Artificial Intelligence and Robotics for Society Shenzhen518129 China Guangdong Key Laboratory of Intelligent Information Processing Shenzhen University Shenzhen518060 China

The rapid development of photo-realistic face generation methods has raised significant concerns in society and academia, highlighting the urgent need for robust and generalizable face forgery detection (FFD) techniques. Although existing approaches mainly capture face forgery patterns using image modality, other modalities like fine-grained noises and texts are not fully explored, which limits the generalization capability of the model. In addition, most FFD methods tend to identify facial images generated by GAN, but struggle to detect unseen diffusion-synthesized ones. To address the limitations, we aim to leverage the cutting-edge foundation model, contrastive language-image pre-training (CLIP), to achieve generalizable diffusion face forgery detection (DFFD). In this paper, we propose a novel multi-modal fine-grained CLIP (MFCLIP) model, which mines comprehensive and fine-grained forgery traces across image-noise modalities via language-guided face forgery representation learning, to facilitate the advancement of DFFD. Specifically, we devise a fine-grained language encoder (FLE) that extracts fine global language features from hierarchical text prompts. We design a multi-modal vision encoder (MVE) to capture global image forgery embeddings as well as fine-grained noise forgery patterns extracted from the richest patch, and integrate them to mine general visual forgery traces. Moreover, we build an innovative plug-and-play sample pair attention (SPA) method to emphasize relevant negative pairs and suppress irrelevant ones, allowing cross-modality sample pairs to conduct more flexible alignment. Extensive experiments and visualizations show that our model outperforms the state of the arts on different settings like cross-generator, cross-forgery, and cross-dataset evaluations. Copyright © 2024, The Authors. All rights reserved.

关键词： Alignment

Provably Secure Authenticated key-Management Mechanism for e-Healthcare Environment

学校读者我要写书评

暂无评论

IEEE Internet of Things Journal 2025年

作者： Saleem, Muhammad Asad Li, Xiong Mahmood, Khalid Ghaffar, Zahid Xie, Yong Wang, Guijuan University of Electronic Science and Technology of China School of Computer Science and Engineering Sichuan Chengdu611731 China National Yunlin University of Science and Technology Graduate School of Intelligent Data Science Yunlin Douliu64002 Taiwan National Yunlin University of Science and Technology Graduate School of Engineering Science and Technology Douliu64002 Taiwan Qinghai Institute of Technology School of Computer and Information Science China Qinghai Provincial Laboratory for Intelligent Computing and Application China Key Laboratory of Computing Power Network and Information Security Jinan250353 China Shandong Provincial Key Laboratory of Industrial Network and Information System Security China Shandong Fundamental Research Center for Computer Science Jinan250353 China

The Internet of Things (IoT) is rapidly permeating all aspects of human life, involving a network of devices that share sensitive data. A notable application is the e-healthcare systems, which employ connected sensors, medical servers, and wearable devices. However, the public nature of communication in e-healthcare systems poses challenges such as security, privacy, and authentication of participating entities. Recently, many authentication protocols have been introduced to address these challenges. However, most of these protocols remain vulnerable to various security attacks, including device or medical server impersonation, denial of service, physical or cloning, and de-synchronization attacks. Therefore, we introduce an authenticated key-management protocol utilizing hash functions and Cipher-Block Chaining-Advanced Encryption Standard encryption (CBC-AES) encryption. The proposed protocol also employs the Physical Unclonable Function (PUF), which makes it more robust and efficient in resisting physical or cloning attacks. Additionally, the proposed scheme resists various security threats, including impersonation, session key leakage, ephemeral secret leakage, and de-synchronization attacks. We analyze the scheme’s security and reliability through formal and informal analysis. The informal analysis demonstrates that the scheme encompasses crucial security features, while the formal analysis substantiates. Moreover, performance analysis of the proposed protocol with various competing results indicates that our protocol achieves an average reduction in communication and computation overheads by 36.03.% and 41.79%, respectively. © 2014 IEEE.

关键词： Electronic health record

$k$k-TEVS: A $ k$k-Times E-Voting Scheme on Blockchain With Supervision

学校读者我要写书评

暂无评论

IEEE Transactions on Dependable and Secure computing 2024年第3期22卷 2326-2337页

作者： Yang Liu Debiao He Min Luo Lianhai Wang Cong Peng School of Cyber Science and Engineering Wuhan University Wuhan China Institute of Information Technology Shenzhen Institute of Information Technology Shenzhen China Key Laboratory of Computing Power Network and Information Security Ministry of Education Shandong Computer Science Center Qilu University of Technology (Shandong Academy of Sciences) Jinan China Shanghai Technology Innovation Centre of Distributed Privacy-Preserving Artificial Intelligence Matrix Elements Technologies Shanghai China Shandong Provincial Key Laboratory of Industrial Network and Information System Security Shandong Fundamental Research Center for Computer Science Jinan China

The e-vote is regarded as a way to express the opinion that the voters ask for. Actually, the e-vote could be applied wildly like questionnaire, survey and feedback. Moreover, the coexistences of efficiency and security as well as transparency and privacy could be considered as building blocks in the e-vote system. The blockchain could provide a public access board to reduce the storage costs for the field consisted of the vote group manager (GM) with its vote assistants (VA). Particularly the $k$ -times anonymous authentication ( $k$ -TAA) could also be a practical approach to preserve voters’ privacy and reduce the computation costs during the vote process. However, the e-vote scheme with pure $k$ -TAA strategy could damage either the supervision of voting or the efficiency and consistency of authentication process. What’s more, the impacts of dishonest voters couldn’t be stopped until the vote end. To tackle these problems, we apply the accumulator technology to add or revoke the voters at any time and extend the framework of $k$ -TAA with the update process for the e-vote on blockchain for supervision ( $ k$ -TEVS). In our scheme, the voter updates his membership witness and proves the fact that he is still a valid member with respective VA under the latest accumulator value. What’s more, this witness update operation is not contained in the authentication process, which means that the authentication process is still constant and efficient. Moreover, our add or delete update process with signature of knowledge needs only one pairing operation. For the security, we prove that the relaxed anonymity still holds in the $ k$ -TEVS framework. Finally, We implement $ k$ -TEVS scheme, the Emura’s work [1] and the Huang’s work [2] for comparison. Then we make time cost and communication cost experiments, which present the feasibility and practicality of this scheme.

关键词： Blockchains Authentication Costs Protocols Security Privacy Surveys Electronic voting computer science Information security

Boosting the Restoring Performance of Deduplication Data by Classifying Backup Metadata

学校读者我要写书评

暂无评论

ACM/IMS Transactions on Data Science 2021年第2期2卷 1–16页

作者： Yang, Ru Deng, Yuhui Zhou, Yi Huang, Ping Department of Computer Science Jinan University Guangzhou510632 China Department of Computer Science Jinan University China State Key Laboratory of Computer Architecture Institute of Computing Technology Chinese Academy of Sciences China TSYS School of Computer Science Columbus State University Doimukh Georgia College of Engineering Temple University United States

Restoring data is the main purpose of data backup in storage systems. The fragmentation issue, caused by physically scattering logically continuous data across a variety of disk locations, poses a negative impact on the restoring performance of a deduplication system. Rewriting algorithms are used to alleviate the fragmentation problem by improving the restoring speed of a deduplication system. However, rewriting methods give birth to a big sacrifice in terms of deduplication ratio, leading to a huge storage space waste. Furthermore, traditional backup approaches treat file metadata and chunk metadata as the same, which causes frequent on-disk metadata accesses. In this article, we start by analyzing storage characteristics of backup metadata. An intriguing finding shows that with 10 million files, the file metadata merely takes up approximately 340 MB. Motivated by this finding, we propose a Classified-Metadata based Restoring method (CMR) that classifies backup metadata into file metadata and chunk metadata. Because the file metadata merely takes up a meager amount of space, CMR maintains all file metadata in memory, whereas chunk metadata are aggressively prefetched to memory in a greedy manner. A deduplication system with CMR in place exhibits three salient features: (i) It avoids rewriting algorithms' additional overhead by reducing the number of disk reads in a restoring process, (ii) it increases the restoring throughput without sacrificing the deduplication ratio, and (iii) it thoroughly leverages the hardware resources to boost the restoring performance. To quantitatively evaluate the performance of CMR, we compare our CMR against two state-of-the-art approaches, namely, a history-aware rewriting method (HAR) and a context-based rewriting scheme (CAP). The experimental results show that compared to HAR and CAP, CMR reduces the restoring time by 27.2% and 29.3%, respectively. Moreover, the deduplication ratio is improved by 1.91% and 4.36%, respectively. © 2

关键词： Metadata

Fence Theorem: Towards Dual-Objective Semantic-Structure Isolation in Preprocessing Phase for 3D Anomaly Detection

学校读者我要写书评

暂无评论

arXiv 2025年

作者： Liang, Hanzhe Zhou, Jie Chen, Xuanxin Dai, Tao Wang, Jinbao Gao, Can College of Computer Science and Software Engineering Shenzhen University China Shenzhen Audencia Financial Technology Institute Shenzhen University China National Engineering Laboratory for Big Data System Computing Technology Shenzhen University China Faculty of Education Shenzhen University China Guangdong Provincial Key Laboratory of Intelligent Information Processing China

3D anomaly detection (AD) is prominent but difficult due to lacking a unified theoretical foundation for preprocessing design. We establish the Fence Theorem, formalizing preprocessing as a dual-objective semantic isolator: (1) mitigating cross-semantic interference to the greatest extent feasible and (2) confining anomaly judgements to aligned semantic spaces wherever viable, thereby establishing intra-semantic comparability. Any preprocessing approach achieves this goal through a two-stage process of Semantic-Division and Spatial-Constraints stage. Through systematic deconstruction, we theoretically and experimentally subsume existing preprocessing methods under this theorem via tripartite evidence: qualitative analyses, quantitative studies, and mathematical proofs. Guided by the Fence Theorem, we implement Patch3D, consisting of Patch-Cutting and Patch-Matching modules, to segment semantic spaces and consolidate similar ones while independently modeling normal features within each space. Experiments on Anomaly-ShapeNet and Real3D-AD with different settings demonstrate that progressively finer-grained semantic alignment in preprocessing directly enhances point-level AD accuracy, providing inverse validation of the theorem’s causal logic. Copyright © 2025, The Authors. All rights reserved.

关键词： Fences

AutoQNN: An End-to-End Framework for Automatically Quantizing Neural Networks

学校读者我要写书评

暂无评论

arXiv 2023年

作者： Gong, Cheng Lu, Ye Dai, Surong Qian, Deng Du, Chenkun Li, Tao College of Software Nankai University Tianjin300350 China College of Computer Science Nankai University Tianjin300350 China State Key Laboratory of Computer Architecture Institute of Computing Technology Chinese Academy of Sciences Beijing100190 China

Exploring the expected quantizing scheme with suitable mixed-precision policy is the key point to compress deep neural networks (DNNs) in high efficiency and accuracy. This exploration implies heavy workloads for domain experts, and an automatic compression method is needed. However, the huge search space of the automatic method introduces plenty of computing budgets that make the automatic process challenging to be applied in real scenarios. In this paper, we propose an end-to-end framework named AutoQNN, for automatically quantizing different layers utilizing different schemes and bitwidths without any human labor. AutoQNN can seek desirable quantizing schemes and mixed-precision policies for mainstream DNN models efficiently by involving three techniques: quantizing scheme search (QSS), quantizing precision learning (QPL), and quantized architecture generation (QAG). QSS introduces five quantizing schemes and defines three new schemes as a candidate set for scheme search, and then uses the differentiable neural architecture search (DNAS) algorithm to seek the layer- or model-desired scheme from the set. QPL is the first method to learn mixed-precision policies by reparameterizing the bitwidths of quantizing schemes, to the best of our knowledge. QPL optimizes both classification loss and precision loss of DNNs efficiently and obtains the relatively optimal mixed-precision model within limited model size and memory footprint. QAG is designed to convert arbitrary architectures into corresponding quantized ones without manual intervention, to facilitate end-to-end neural network quantization. We have implemented AutoQNN and integrated it into Keras. Extensive experiments demonstrate that AutoQNN can consistently outperform state-of-the-art quantization. For 2-bit weight and activation of AlexNet and ResNet18, AutoQNN can achieve the accuracy results of 59.75% and 68.86%, respectively, and obtain accuracy improvements by up to 1.65% and 1.74%, respectively, compared

关键词： Deep neural networks

NavG: Risk-Aware Navigation in Crowded Environments Based on Reinforcement Learning with Guidance Points

学校读者我要写书评

暂无评论

arXiv 2025年

作者： Zhang, Qianyi Luo, Wentao Liu, Boyi Zhang, Ziyang Wang, Yaoyuan Liu, Jingtai Institute of Robotics and Automatic Information System Nankai University Tianjin Key Laboratory of Intelligent Robotics Tianjin China Advanced Computing and Storage Lab Huawei 2012 Lab China Department of Electronic and Computer Engineering The Kong Kong University of Science and Technology Hong Kong

Motion planning in navigation systems is highly susceptible to upstream perceptual errors, particularly in human detection and tracking. To mitigate this issue, the concept of guidance points—a novel directional cue within a reinforcement learning-based framework—is introduced. A structured method for identifying guidance points is developed, consisting of obstacle boundary extraction, potential guidance point detection, and redundancy elimination. To integrate guidance points into the navigation pipeline, a perception-to-planning mapping strategy is proposed, unifying guidance points with other perceptual inputs and enabling the RL agent to effectively leverage the complementary relationships among raw laser data, human detection and tracking, and guidance points. Qualitative and quantitative simulations demonstrate that the proposed approach achieves the highest success rate and near-optimal travel times, greatly improving both safety and efficiency. Furthermore, real-world experiments in dynamic corridors and lobbies validate the robot’s ability to confidently navigate around obstacles and robustly avoid pedestrians. © 2025, CC BY.

关键词： Travel time

On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities

学校读者我要写书评

暂无评论

arXiv 2024年

作者： Li, Zhen Wang, Ning Zou, Deqing Li, Yating Zhang, Ruqian Xu, Shouhuai Zhang, Chao Jin, Hai School of Cyber Science and Engineering Huazhong University of Science and Technology Wuhan China Department of Computer Science University of Colorado Colorado Springs Colorado SpringsCO United States Institute for Network Sciences and Cyberspace Tsinghua University Beijing China School of Computer Science and Technology Huazhong University of Science and Technology Wuhan China National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Key Laboratory of Distributed System Security Hubei Engineering Research Center on Big Data Security Cluster and Grid Computing Lab China JinYinHu Laboratory Wuhan China

Software vulnerabilities are a major cyber threat and it is important to detect them. One important approach to detecting vulnerabilities is to use deep learning while treating a program function as a whole, known as function-level vulnerability detectors. However, the limitation of this approach is not understood. In this paper, we investigate its limitation in detecting one class of vulnerabilities known as inter-procedural vulnerabilities, where the to-be-patched statements and the vulnerability-triggering statements belong to different functions. For this purpose, we create the first Inter-Procedural Vulnerability Dataset (InterPVD) based on C/C++ open-source software, and we propose a tool dubbed VulTrigger for identifying vulnerability-triggering statements across functions. Experimental results show that VulTrigger can effectively identify vulnerability-triggering statements and inter-procedural vulnerabilities. Our findings include: (i) inter-procedural vulnerabilities are prevalent with an average of 2.8 inter-procedural layers;and (ii) function-level vulnerability detectors are much less effective in detecting to-be-patched functions of inter-procedural vulnerabilities than detecting their counterparts of intra-procedural vulnerabilities. Copyright © 2024, The Authors. All rights reserved.

关键词： Open source software