Open Access. Powered by Scholars. Published by Universities.®

Computer and Systems Architecture Commons™

Open Access. Powered by Scholars. Published by Universities.®

Software Engineering

Institution
Keyword
Publication Year
Publication
Publication Type

Articles 31 - 60 of 94

Full-Text Articles in Computer and Systems Architecture

Deception In Finitely Repeated Security Games, Thanh H. Nguyen, Yongzhao Wang, Arunesh Sinha, Michael P. Wellman Feb 2019

Deception In Finitely Repeated Security Games, Thanh H. Nguyen, Yongzhao Wang, Arunesh Sinha, Michael P. Wellman

Research Collection School Of Computing and Information Systems

Allocating resources to defend targets from attack is often complicated by uncertainty about the attacker’s capabilities, objectives, or other underlying characteristics. In a repeated interaction setting, the defender can collect attack data over time to reduce this uncertainty and learn an effective defense. However, a clever attacker can manipulate the attack data to mislead the defender, influencing the learning process toward its own benefit. We investigate strategic deception on the part of an attacker with private type information, who interacts repeatedly with a defender. We present a detailed computation and analysis of both players’ optimal strategies given the attacker may …


Person Re-Identification Over Encrypted Outsourced Surveillance Videos, Hang Cheng, Huaxiong Wang, Ximeng Liu, Yan Fang, Meiqing Wang, Xiaojun Zhang Jan 2019

Person Re-Identification Over Encrypted Outsourced Surveillance Videos, Hang Cheng, Huaxiong Wang, Ximeng Liu, Yan Fang, Meiqing Wang, Xiaojun Zhang

Research Collection School Of Computing and Information Systems

Person re-identification (Re-ID) has attracted extensive attention due to its potential to identify a person of interest from different surveillance videos. With the increasing amount of the surveillance videos, high computation and storage costs have posed a great challenge for the resource-constrained users. In recent years, the cloud storage services have made a large volume of video data outsourcing become possible. However, person Re-ID over outsourced surveillance videos could lead to a security threat, i.e., the privacy leakage of the innocent person in these videos. Therefore, we propose an efFicient privAcy-preseRving peRson Re-ID Scheme (FARRIS) over outsourced surveillance videos, which …


A Topic Modeling Approach For Code Clone Detection, Mohammed Salman Khan Jan 2019

A Topic Modeling Approach For Code Clone Detection, Mohammed Salman Khan

UNF Graduate Theses and Dissertations

In this thesis work, the potential benefits of Latent Dirichlet Allocation (LDA) as a technique for code clone detection has been described. The objective is to propose a language-independent, effective, and scalable approach for identifying similar code fragments in relatively large software systems. The main assumption is that the latent topic structure of software artifacts gives an indication of the presence of code clones. It can be hypothesized that artifacts with similar topic distributions contain duplicated code fragments and to prove this hypothesis, an experimental investigation using multiple datasets from various application domains were conducted. In addition, CloneTM, an LDA-based …


Open Source Foundations For Spatial Decision Support Systems, Jochen Albrecht Dec 2018

Open Source Foundations For Spatial Decision Support Systems, Jochen Albrecht

Publications and Research

Spatial Decision Support Systems (SDSS) were a hot topic in the 1990s, when researchers tried to imbue GIS with additional decision support features. Successful practical developments such as HAZUS or CommunityViz have since been built, based on commercial desktop software and without much heed for theory other than what underlies their process models. Others, like UrbanSim, have been completely overhauled twice but without much external scrutiny. Both the practical and the theoretical foundations of decision support systems have developed considerably over the past 20 years. This article presents an overview of these developments and then looks at what corresponding tools …


Early Prediction Of Merged Code Changes To Prioritize Reviewing Tasks, Yuanrui Fan, Xin Xia, David Lo, Shanping Li Dec 2018

Early Prediction Of Merged Code Changes To Prioritize Reviewing Tasks, Yuanrui Fan, Xin Xia, David Lo, Shanping Li

Research Collection School Of Computing and Information Systems

Modern Code Review (MCR) has been widely used by open source and proprietary software projects. Inspecting code changes consumes reviewers much time and effort since they need to comprehend patches, and many reviewers are often assigned to review many code changes. Note that a code change might be eventually abandoned, which causes waste of time and effort. Thus, a tool that predicts early on whether a code change will be merged can help developers prioritize changes to inspect, accomplish more things given tight schedule, and not waste reviewing effort on low quality changes. In this paper, motivated by the above …


Criticality Assessments For Improving Algorithmic Robustness, Thomas B. Jones Nov 2018

Criticality Assessments For Improving Algorithmic Robustness, Thomas B. Jones

Computer Science ETDs

Though computational models typically assume all program steps execute flawlessly, that does not imply all steps are equally important if a failure should occur. In the "Constrained Reliability Allocation" problem, sufficient resources are guaranteed for operations that prompt eventual program termination on failure, but those operations that only cause output errors are given a limited budget of some vital resource, insufficient to ensure correct operation for each of them.

In this dissertation, I present a novel representation of failures based on a combination of their timing and location combined with criticality assessments---a method used to predict the behavior of systems …


Visforum: A Visual Analysis System For Exploring User Groups In Online Forums, Siwei Fu, Yong Wang, Yi Yang, Qingqing Bi, Fangzhou Guo, Huamin Qu Oct 2018

Visforum: A Visual Analysis System For Exploring User Groups In Online Forums, Siwei Fu, Yong Wang, Yi Yang, Qingqing Bi, Fangzhou Guo, Huamin Qu

Research Collection School Of Computing and Information Systems

User grouping in asynchronous online forums is a common phenomenon nowadays. People with similar backgrounds or shared interests like to get together in group discussions. As tens of thousands of archived conversational posts accumulate, challenges emerge for forum administrators and analysts to effectively explore user groups in large-volume threads and gain meaningful insights into the hierarchical discussions. Identifying and comparing groups in discussion threads are nontrivial, since the number of users and posts increases with time and noises may hamper the detection of user groups. Researchers in data mining fields have proposed a large body of algorithms to explore user …


Exploring Experiential Learning Model And Risk Management Process For An Undergraduate Software Architecture Course, Eng Lieh Ouh, Yunghans Irawan Oct 2018

Exploring Experiential Learning Model And Risk Management Process For An Undergraduate Software Architecture Course, Eng Lieh Ouh, Yunghans Irawan

Research Collection School Of Computing and Information Systems

This paper shares our insights on exploring theexperiential learning model and risk management process todesign an undergraduate software architecture course. The keychallenge for undergraduate students to appreciate softwarearchitecture design is usually their limited experience in thesoftware industry. In software architecture, the high-level designprinciples are heuristics lacking the absoluteness of firstprinciples which for inexperienced undergraduate students, thisis a frustrating divergence from what they used to value. From aneducator's perspective, teaching software architecture requirescontending with the problem of how to express this level ofabstraction practically and also make the learning realistic. Inthis paper, we propose a model adapting the concepts ofexperiential learning …


Teaching Adult Learners On Software Architecture Design Skills, Eng Lieh Ouh, Yunghans Irawan Oct 2018

Teaching Adult Learners On Software Architecture Design Skills, Eng Lieh Ouh, Yunghans Irawan

Research Collection School Of Computing and Information Systems

Software architectures present high-level views ofsystems, enabling developers to abstract away the unnecessarydetails and focus on the overall big picture. Designing a softwarearchitecture is an essential skill in software engineering and adultlearners are seeking this skill to further progress in their career.With the technology revolution and advancements in this rapidlychanging world, the proportion of adult learners attendingcourses for continuing education are increasing. Their learningobjectives are no longer to obtain good grades but the practicalskills to enable them to perform better in their work and advancein their career. Teaching software architecture to upskill theseadult learners requires contending with the problem of …


Implementation Of Secure Dnp3 Architecture Of Scada System For Smart Grids, Uday Bhaskar Boyanapalli Oct 2018

Implementation Of Secure Dnp3 Architecture Of Scada System For Smart Grids, Uday Bhaskar Boyanapalli

Master of Science in Computer Science Theses

With the recent advances in the power grid system connecting to the internet, data sharing, and networking enables space for hackers to maliciously attack them based on their vulnerabilities. Vital stations in the smart grid are the generation, transmission, distribution, and customer substations are connected and controlled remotely by the network. Every substation is controlled by a Supervisory Control and Data Acquisition (SCADA) system which communicates on DNP3 protocol on Internet/IP which has many security vulnerabilities. This research will focus on Distributed Network Protocol (DNP3) communication which is used in the smart grid to communicate between the controller devices. We …


Cultivating Third Party Development In Platform-Centric Software Ecosystems: Extended Boundary Resources Model, Brown C. Msiska Sep 2018

Cultivating Third Party Development In Platform-Centric Software Ecosystems: Extended Boundary Resources Model, Brown C. Msiska

The African Journal of Information Systems

Software ecosystems provide an effective way through which software solutions can be constructed by composing software components, typically applications, developed by internal and external developers on top of a software platform. Third party development increases the potential of a software ecosystem to effectively and quickly respond to context-specific software requirements. The boundary resources model gives a theoretical account for cultivation of third party development premised on the role of platform boundary resources such as application programming interfaces (API). However, from a longitudinal case study of the DHIS2 software ecosystem, this paper observes that no matter how good the boundary resources …


Code Smells For Model-View-Controller Architectures, Maurício Aniche, Gabriele Bavota, Christoph Treude, Marco Aurélio Gerosa, Arie Van Deursen Aug 2018

Code Smells For Model-View-Controller Architectures, Maurício Aniche, Gabriele Bavota, Christoph Treude, Marco Aurélio Gerosa, Arie Van Deursen

Research Collection School Of Computing and Information Systems

Previous studies have shown the negative effects that low-quality code can have on maintainability proxies, such as code change- and defect-proneness. One of the symptoms of low-quality code are code smells, defined as sub-optimal implementation choices. While this definition is quite general and seems to suggest a wide spectrum of smells that can affect software systems, the research literature mostly focuses on the set of smells defined in the catalog by Fowler and Beck, reporting design issues that can potentially affect any kind of system, regardless of their architecture (e.g., Complex Class). However, systems adopting a specific architecture (e.g., the …


Entagrec(++): An Enhanced Tag Recommendation System For Software Information Sites, Shawei Wang, David Lo, Bogdan Vasilescu, Alexander Serebrenik Apr 2018

Entagrec(++): An Enhanced Tag Recommendation System For Software Information Sites, Shawei Wang, David Lo, Bogdan Vasilescu, Alexander Serebrenik

Research Collection School Of Computing and Information Systems

Software engineers share experiences with modern technologies using software information sites, such as Stack Overflow. These sites allow developers to label posted content, referred to as software objects, with short descriptions, known as tags. Tags help to improve the organization of questions and simplify the browsing of questions for users. However, tags assigned to objects tend to be noisy and some objects are not well tagged. For instance, 14.7% of the questions that were posted in 2015 on Stack Overflow needed tag re-editing after the initial assignment. To improve the quality of tags in software information sites, we propose EnTagRec …


An Analysis Of Multi-Domain Command And Control And The Development Of Software Solutions Through Devops Toolsets And Practices, Mason R. Bruza Mar 2018

An Analysis Of Multi-Domain Command And Control And The Development Of Software Solutions Through Devops Toolsets And Practices, Mason R. Bruza

Theses and Dissertations

Multi-Domain Command and Control (MDC2) is the exercise of command and control over forces in multiple operational domains (namely air, land, sea, space, and cyberspace) in order to produce synergistic effects in the battlespace, and enhancing this capability has become a major focus area for the United States Air Force (USAF). In order to meet demands for MDC2 software, solutions need to be acquired and/or developed in a timely manner, information technology infrastructure needs to be adaptable to new software requirements, and user feedback needs to drive iterative updates to fielded software. In commercial organizations, agile software development methodologies and …


A New Revocable And Re-Delegable Proxy Signature And Its Application, Shengmin Xu, Guomin Yang, Yi Mu Mar 2018

A New Revocable And Re-Delegable Proxy Signature And Its Application, Shengmin Xu, Guomin Yang, Yi Mu

Research Collection School Of Computing and Information Systems

With the popularity of cloud computing and mobile Apps, on-demand services such as on-line music or audio streaming and vehicle booking are widely available nowadays. In order to allow efficient delivery and management of the services, for large-scale on-demand systems, there is usually a hierarchy where the service provider can delegate its service to a top-tier (e.g., countrywide) proxy who can then further delegate the service to lower level (e.g., region-wide) proxies. Secure (re-)delegation and revocation are among the most crucial factors for such systems. In this paper, we investigate the practical solutions for achieving re-delegation and revocation utilizing proxy …


Process Models Discovery And Traces Classification: A Fuzzy-Bpmn Mining Approach., Kingsley Okoye Dr, Usman Naeem Dr, Syed Islam Dr, Abdel-Rahman H. Tawil Dr, Elyes Lamine Dr Dec 2017

Process Models Discovery And Traces Classification: A Fuzzy-Bpmn Mining Approach., Kingsley Okoye Dr, Usman Naeem Dr, Syed Islam Dr, Abdel-Rahman H. Tawil Dr, Elyes Lamine Dr

Journal of International Technology and Information Management

The discovery of useful or worthwhile process models must be performed with due regards to the transformation that needs to be achieved. The blend of the data representations (i.e data mining) and process modelling methods, often allied to the field of Process Mining (PM), has proven to be effective in the process analysis of the event logs readily available in many organisations information systems. Moreover, the Process Discovery has been lately seen as the most important and most visible intellectual challenge related to the process mining. The method involves automatic construction of process models from event logs about any domain …


Graphmp: An Efficient Semi-External-Memory Big Graph Processing System On A Single Machine, Peng Sun, Yonggang Wen, Nguyen Binh Duong Ta, Xiaokui Xiao Dec 2017

Graphmp: An Efficient Semi-External-Memory Big Graph Processing System On A Single Machine, Peng Sun, Yonggang Wen, Nguyen Binh Duong Ta, Xiaokui Xiao

Research Collection School Of Computing and Information Systems

Recent studies showed that single-machine graph processing systems can be as highly competitive as clusterbased approaches on large-scale problems. While several outof-core graph processing systems and computation models have been proposed, the high disk I/O overhead could significantly reduce performance in many practical cases. In this paper, we propose GraphMP to tackle big graph analytics on a single machine. GraphMP achieves low disk I/O overhead with three techniques. First, we design a vertex-centric sliding window (VSW) computation model to avoid reading and writing vertices on disk. Second, we propose a selective scheduling method to skip loading and processing unnecessary edge …


Reengineering A 2-Tier Database Application With Software Architecture, Hong G. Jung Nov 2017

Reengineering A 2-Tier Database Application With Software Architecture, Hong G. Jung

ASA Multidisciplinary Research Symposium

The purpose of this research is to demonstrate how to reengineer a legacy Database Application using to a target system with MVC and 3-layered architecture. A Coffee Inventory Management database application is used for legacy application. The benefits of the reengineering are discussed.


Audiosense: Sound-Based Shopper Behavior Analysis System, Amit Sharma, Youngki Lee Sep 2017

Audiosense: Sound-Based Shopper Behavior Analysis System, Amit Sharma, Youngki Lee

Research Collection School Of Computing and Information Systems

This paper presents AudioSense, the system to monitor user-item interactions inside a store hence enabling precisely customized promotions. A shopper's smartwatch emits sound every time the shopper picks up or touches an item inside a store. This sound is then localized, in 2D space, by calculating the angles of arrival captured by multiple microphones deployed on the racks. Lastly, the 2D location is mapped to specific items on the rack based on the rack layout information. In our initial experiments conducted with a single rack with 16 compartments, we could localize the shopper's smartwatch with a median estimation error of …


Sugarmate: Non-Intrusive Blood Glucose Monitoring With Smartphones, Weixi Gu, Yuxun Zhou, Zimu Zhou, Xi Liu, Han Zou, Pei Zhang, Costas J. Spanos, Lin Zhang Sep 2017

Sugarmate: Non-Intrusive Blood Glucose Monitoring With Smartphones, Weixi Gu, Yuxun Zhou, Zimu Zhou, Xi Liu, Han Zou, Pei Zhang, Costas J. Spanos, Lin Zhang

Research Collection School Of Computing and Information Systems

Inferring abnormal glucose events such as hyperglycemia and hypoglycemia is crucial for the health of both diabetic patients and non-diabetic people. However, regular blood glucose monitoring can be invasive and inconvenient in everyday life. We present SugarMate, a first smartphone-based blood glucose inference system as a temporary alternative to continuous blood glucose monitors (CGM) when they are uncomfortable or inconvenient to wear. In addition to the records of food, drug and insulin intake, it leverages smartphone sensors to measure physical activities and sleep quality automatically. Provided with the imbalanced and often limited measurements, a challenge of SugarMate is the inference …


Webapirec: Recommending Web Apis To Software Projects Via Personalized Ranking, Ferdian Thung, Richard J. Oentaryo, David Lo, Yuan Tian Jun 2017

Webapirec: Recommending Web Apis To Software Projects Via Personalized Ranking, Ferdian Thung, Richard J. Oentaryo, David Lo, Yuan Tian

Research Collection School Of Computing and Information Systems

Application programming interfaces (APIs) offer a plethora of functionalities for developers to reuse without reinventing the wheel. Identifying the appropriate APIs given a project requirement is critical for the success of a project, as many functionalities can be reused to achieve faster development. However, the massive number of APIs would often hinder the developers' ability to quickly find the right APIs. In this light, we propose a new, automated approach called WebAPIRec that takes as input a project profile and outputs a ranked list of web APIs that can be used to implement the project. At its heart, WebAPIRec employs …


Deepmon: Mobile Gpu-Based Deep Learning Framework For Continuous Vision Applications, Nguyen Loc Huynh, Youngki Lee, Rajesh Krishna Balan Jun 2017

Deepmon: Mobile Gpu-Based Deep Learning Framework For Continuous Vision Applications, Nguyen Loc Huynh, Youngki Lee, Rajesh Krishna Balan

Research Collection School Of Computing and Information Systems

The rapid emergence of head-mounted devices such as the Microsoft Holo-lens enables a wide variety of continuous vision applications. Such applications often adopt deep-learning algorithms such as CNN and RNN to extract rich contextual information from the first-person-view video streams. Despite the high accuracy, use of deep learning algorithms in mobile devices raises critical challenges, i.e., high processing latency and power consumption. In this paper, we propose DeepMon, a mobile deep learning inference system to run a variety of deep learning inferences purely on a mobile device in a fast and energy-efficient manner. For this, we designed a suite of …


Android Drone: Remote Quadcopter Control With A Phone, Aubrey John Russell Dec 2016

Android Drone: Remote Quadcopter Control With A Phone, Aubrey John Russell

Computer Engineering

The purpose of the “Android Drone” project was to create a quadcopter that can be controlled by user input sent over the phone’s Wi-Fi connection or 4G internet connection. Furthermore, the purpose was also to be able to receive live video feedback over the internet connection, thus making the drone an inexpensive option compared to other, equivalent drones that might cost thousands of dollars. Not only that, but the Android phone also has a host of other useful features that could be utilized by the drone: this includes GPS, pathing, picture taking, data storage, networking and TCP/IP, a Java software …


Just In Time Assembly (Jita) - A Run Time Interpretation Approach For Achieving Productivity Of Creating Custom Accelerators In Fpgas, Sen Ma Dec 2016

Just In Time Assembly (Jita) - A Run Time Interpretation Approach For Achieving Productivity Of Creating Custom Accelerators In Fpgas, Sen Ma

Graduate Theses and Dissertations

The reconfigurable computing community has yet to be successful in allowing programmers to access FPGAs through traditional software development flows. Existing barriers that prevent programmers from using FPGAs include: 1) knowledge of hardware programming models, 2) the need to work within the vendor specific CAD tools and hardware synthesis. This thesis presents a series of published papers that explore different aspects of a new approach being developed to remove the barriers and enable programmers to compile accelerators on next generation reconfigurable manycore architectures. The approach is entitled Just In Time Assembly (JITA) of hardware accelerators. The approach has been defined …


Towards Learning And Verifying Invariants Of Cyber-Physical Systems By Code Mutation, Yuqi Chen, Christopher M. Poskitt, Jun Sun Nov 2016

Towards Learning And Verifying Invariants Of Cyber-Physical Systems By Code Mutation, Yuqi Chen, Christopher M. Poskitt, Jun Sun

Research Collection School Of Computing and Information Systems

Cyber-physical systems (CPS), which integrate algorithmic control with physical processes, often consist of physically distributed components communicating over a network. A malfunctioning or compromised component in such a CPS can lead to costly consequences, especially in the context of public infrastructure. In this short paper, we argue for the importance of constructing invariants (or models) of the physical behaviour exhibited by CPS, motivated by their applications to the control, monitoring, and attestation of components. To achieve this despite the inherent complexity of CPS, we propose a new technique for learning invariants that combines machine learning with ideas from mutation testing. …


Towards Concolic Testing For Hybrid Systems, Pingfan Kong, Yi Li, Xiaohong Chen, Jun Sun, Meng Sun, Jingyi Wang Nov 2016

Towards Concolic Testing For Hybrid Systems, Pingfan Kong, Yi Li, Xiaohong Chen, Jun Sun, Meng Sun, Jingyi Wang

Research Collection School Of Computing and Information Systems

Hybrid systems exhibit both continuous and discrete behavior. Analyzing hybrid systems is known to be hard. Inspired by the idea of concolic testing (of programs), we investigate whether we can combine random sampling and symbolic execution in order to effectively verify hybrid systems. We identify a sufficient condition under which such a combination is more effective than random sampling. Furthermore, we analyze different strategies of combining random sampling and symbolic execution and propose an algorithm which allows us to dynamically switch between them so as to reduce the overall cost. Our method has been implemented as a web-based checker named …


Designing Minimal Effective Normative Systems With The Help Of Lightweight Formal Methods, Jianye Hao, Eunsuk Kang, Jun Sun, Daniel Jackson Nov 2016

Designing Minimal Effective Normative Systems With The Help Of Lightweight Formal Methods, Jianye Hao, Eunsuk Kang, Jun Sun, Daniel Jackson

Research Collection School Of Computing and Information Systems

Normative systems are an important approach to achieving effective coordination among (often an arbitrary number of) agents in multiagent systems. A normative system should be effective in ensuring the satisfaction of a desirable system property, and minimal (i.e., not containing norms that unnecessarily over-constrain the behaviors of agents). Designing or even automatically synthesizing minimal effective normative systems is highly non-trivial. Previous attempts on synthesizing such systems through simulations often fail to generate normative systems which are both minimal and effective. In this work, we propose a framework that facilitates designing of minimal effective normative systems using lightweight formal methods. Given …


Repmatch: Robust Feature Matching And Pose For Reconstructing Modern Cities, Wen-Yan Lin, Siying Liu, Minh N. Do, Ping Tan, Jiangbo Lu Oct 2016

Repmatch: Robust Feature Matching And Pose For Reconstructing Modern Cities, Wen-Yan Lin, Siying Liu, Minh N. Do, Ping Tan, Jiangbo Lu

Research Collection School Of Computing and Information Systems

A perennial problem in recovering 3-D models from images is repeated structures common in modern cities. The problem can be traced to the feature matcher which needs to match less distinctive features (permitting wide-baselines and avoiding broken sequences), while simultaneously avoiding incorrect matching of ambiguous repeated features. To meet this need, we develop RepMatch, an epipolar guided (assumes predominately camera motion) feature matcher that accommodates both wide-baselines and repeated structures. RepMatch is based on using RANSAC to guide the training of match consistency curves for differentiating true and false matches. By considering the set of all nearest-neighbor matches, RepMatch can …


Developers’ Perceptions On Object-Oriented Design And Architectural Roles, Maurício Aniche, Marco Aurélio Gerosa, Christoph Treude Sep 2016

Developers’ Perceptions On Object-Oriented Design And Architectural Roles, Maurício Aniche, Marco Aurélio Gerosa, Christoph Treude

Research Collection School Of Computing and Information Systems

Software developers commonly rely on well-known software architecture patterns, such as MVC, to build their applications. In many of these patterns, classes play specific roles in the system, such as Controllers or Entities, which means that each of these classes has specific characteristics in terms of object-oriented class design and implementation. Indeed, as we have shown in a previous study, architectural roles are different from each other in terms of code metrics. In this paper, we present a study in a software development company in which we captured developers’ perceptions on object-oriented design aspects of the architectural roles in their …


All Your Sessions Are Belong To Us: Investigating Authenticator Leakage Through Backup Channels On Android, Guangdong Bai, Jun Sun, Jianliang Wu, Quanqi Ye, Li Li, Jin Song Dong, Shanqing Guo Dec 2015

All Your Sessions Are Belong To Us: Investigating Authenticator Leakage Through Backup Channels On Android, Guangdong Bai, Jun Sun, Jianliang Wu, Quanqi Ye, Li Li, Jin Song Dong, Shanqing Guo

Research Collection School Of Computing and Information Systems

Security of authentication protocols heavily relies on the confidentiality of credentials (or authenticators) like passwords and session IDs. However, unlike browser-based web applications for which highly evolved browsers manage the authenticators, Android apps have to construct their own management. We find that most apps simply locate their authenticators into the persistent storage and entrust underlying Android OS for mediation. Consequently, these authenticators can be leaked through compromised backup channels. In this work, we conduct the first systematic investigation on this previously overlooked attack vector. We find that nearly all backup apps on Google Play inadvertently expose backup data to any …