Locating Vulnerabilities In Binaries Via Memory Layout Recovering,
2019
Singapore Management University
Locating Vulnerabilities In Binaries Via Memory Layout Recovering, Haijun Wang, Xiaofei Xie, Shang-Wei Lin, Yun Lin, Yuekang Li, Shengchao Qin, Yang Liu, Ting Liu
Research Collection School Of Computing and Information Systems
Locating vulnerabilities is an important task for security auditing, exploit writing, and code hardening. However, it is challenging to locate vulnerabilities in binary code, because most program semantics (e.g., boundaries of an array) is missing after compilation. Without program semantics, it is difficult to determine whether a memory access exceeds its valid boundaries in binary code. In this work, we propose an approach to locate vulnerabilities based on memory layout recovery. First, we collect a set of passed executions and one failed execution. Then, for passed and failed executions, we restore their program semantics by recovering fine-grained memory layouts based …
Multiagent Decision Making And Learning In Urban Environments,
2019
Singapore Management University
Multiagent Decision Making And Learning In Urban Environments, Akshat Kumar
Research Collection School Of Computing and Information Systems
Our increasingly interconnected urban environments provide several opportunities to deploy intelligent agents—from self-driving cars, ships to aerial drones—that promise to radically improve productivity and safety. Achieving coordination among agents in such urban settings presents several algorithmic challenges—ability to scale to thousands of agents, addressing uncertainty, and partial observability in the environment. In addition, accurate domain models need to be learned from data that is often noisy and available only at an aggregate level. In this paper, I will overview some of our recent contributions towards developing planning and reinforcement learning strategies to address several such challenges present in largescale urban …
Cerebro: Context-Aware Adaptive Fuzzing For Effective Vulnerability Detection,
2019
Singapore Management University
Cerebro: Context-Aware Adaptive Fuzzing For Effective Vulnerability Detection, Yuekang Li, Yinxing Xue, Hongxu Chen, Xiuheng Wu, Cen Zhang, Xiaofei Xie, Haijun Wang, Yang Liu
Research Collection School Of Computing and Information Systems
Existing greybox fuzzers mainly utilize program coverage as the goal to guide the fuzzing process. To maximize their outputs, coverage-based greybox fuzzers need to evaluate the quality of seeds properly, which involves making two decisions: 1) which is the most promising seed to fuzz next (seed prioritization), and 2) how many efforts should be made to the current seed (power scheduling). In this paper, we present our fuzzer, Cerebro, to address the above challenges. For the seed prioritization problem, we propose an online multi-objective based algorithm to balance various metrics such as code complexity, coverage, execution time, etc. To address …
Diffchaser: Detecting Disagreements For Deep Neural Networks,
2019
Singapore Management University
Diffchaser: Detecting Disagreements For Deep Neural Networks, Xiaofei Xie, Lei Ma, Haijun Wang, Yuekang Li, Yang Liu, Xiaohong Li
Research Collection School Of Computing and Information Systems
The platform migration and customization have become an indispensable process of deep neural network (DNN) development lifecycle. A highprecision but complex DNN trained in the cloud on massive data and powerful GPUs often goes through an optimization phase (e.g., quantization, compression) before deployment to a target device (e.g., mobile device). A test set that effectively uncovers the disagreements of a DNN and its optimized variant provides certain feedback to debug and further enhance the optimization procedure. However, the minor inconsistency between a DNN and its optimized version is often hard to detect and easily bypasses the original test set. This …
Let Me In: Guidelines For The Successful Onboarding Of Newcomers To Open Source Projects,
2019
Singapore Management University
Let Me In: Guidelines For The Successful Onboarding Of Newcomers To Open Source Projects, Igor Steinmacher, Christoph Treude, Marco Aurélio Gerosa
Research Collection School Of Computing and Information Systems
Many community-based open source software (OSS) projects depend on a continuous influx of newcomers for their survival and continuity, yet newcomers face many barriers to contributing to a project. We provide guidelines based on our previous work for both OSS communities and newcomers to OSS projects.
Blocks' Network: Redesign Architecture Based On Blockchain Technology,
2019
Embry-Riddle Aeronautical University
Blocks' Network: Redesign Architecture Based On Blockchain Technology, Moataz Hanif
Doctoral Dissertations and Master's Theses
The Internet is a global network that uses communication protocols. It is considered the most important system reached by humanity, which no one can abandon. However, this technology has become a weapon that threatens the privacy of users, especially in the client-server model, where data is stored and managed privately. Additionally, users have no power over their data that store in a private server, which means users’ data may interrupt by government or might be sold via service provider for-profit purposes. Furthermore, blockchain is a technology that we can rely on to solve issues related to client-server model if appropriately …
Synthetic, Yet Natural: Properties Of Wordnet Random Walk Corpora And The Impact Of Rare Words On Embedding Performance,
2019
Technological University Dublin
Synthetic, Yet Natural: Properties Of Wordnet Random Walk Corpora And The Impact Of Rare Words On Embedding Performance, Filip Klubicka, Alfredo Maldonado, Abhijit Mahalunkar, John D. Kelleher
Conference papers
Creating word embeddings that reflect semantic relationships encoded in lexical knowledge resources is an open challenge. One approach is to use a random walk over a knowledge graph to generate a pseudo-corpus and use this corpus to train embeddings. However, the effect of the shape of the knowledge graph on the generated pseudo-corpora, and on the resulting word embeddings, has not been studied. To explore this, we use English WordNet, constrained to the taxonomic (tree-like) portion of the graph, as a case study. We investigate the properties of the generated pseudo-corpora, and their impact on the resulting embeddings. We find …
Safe Automated Refactoring For Intelligent Parallelization Of Java 8 Streams,
2019
CUNY Hunter College
Safe Automated Refactoring For Intelligent Parallelization Of Java 8 Streams, Raffi Khatchadourian, Yiming Tang, Mehdi Bagherzadeh, Syed Ahmed
Publications and Research
Streaming APIs are becoming more pervasive in mainstream Object-Oriented programming languages and platforms. For example, the Stream API introduced in Java 8 allows for functional-like, MapReduce-style operations in processing both finite, e.g., collections, and infinite data structures. However, using this API efficiently involves subtle considerations such as determining when it is best for stream operations to run in parallel, when running operations in parallel can be less efficient, and when it is safe to run in parallel due to possible lambda expression side-effects. Also, streams may not run all operations in parallel depending on particular collectors used in reductions. In …
Tests As Maintainable Assets Via Auto-Generated Spies: A Case Study Involving The Scala Collections Library's Iterator Trait,
2019
Loyola University Chicago
Tests As Maintainable Assets Via Auto-Generated Spies: A Case Study Involving The Scala Collections Library's Iterator Trait, Konstantin Läufer, John O'Sullivan, George K. Thiruvathukal
Computer Science: Faculty Publications and Other Works
In testing stateful abstractions, it is often necessary to record interactions, such as method invocations, and express assertions over these interactions. Following the Test Spy design pattern, we can reify such interactions programmatically through additional mutable state. Alternatively, a mocking framework, such as Mockito, can automatically generate test spies that allow us to record the interactions and express our expectations in a declarative domain-specific language. According to our study of the test code for Scala’s Iterator trait, the latter approach can lead to a significant reduction of test code complexity in terms of metrics such as code size (in some …
Practical And Effective Sandboxing For Linux Containers,
2019
Singapore Management University
Practical And Effective Sandboxing For Linux Containers, Zhiyuan Wan, David Lo, Xin Xia, Liang Cai
Research Collection School Of Computing and Information Systems
A container is a group of processes isolated from other groups via distinct kernel namespaces and resource allocation quota. Attacks against containers often leverage kernel exploits through the system call interface. In this paper, we present an approach that mines sandboxes and enables fine-grained sandbox enforcement for containers. We first explore the behavior of a container by running test cases and monitor the accessed system calls including types and arguments during testing. We then characterize the types and arguments of system call invocations and translate them into sandbox rules for the container. The mined sandbox restricts the container’s access to …
Network-Clustered Multi-Modal Bug Localization,
2019
Singapore Management University
Network-Clustered Multi-Modal Bug Localization, Thong Hoang, Richard J. Oentaryo, Tien-Duy B. Le, David Lo
Research Collection School Of Computing and Information Systems
Developers often spend much effort and resources to debug a program. To help the developers debug, numerous information retrieval (IR)-based and spectrum-based bug localization techniques have been devised. IR-based techniques process textual information in bug reports, while spectrum-based techniques process program spectra (i.e., a record of which program elements are executed for each test case). While both techniques ultimately generate a ranked list of program elements that likely contain a bug, they only consider one source of information—either bug reports or program spectra— which is not optimal. In light of this deficiency, this paper presents a new approach dubbed Network-clustered …
Towards Lakosian Multilingual Software Design Principles,
2019
Fordham University
Towards Lakosian Multilingual Software Design Principles, Damian Lyons, Saba Zahra, Thomas Marshall
Faculty Publications
Large software systems often comprise programs written in different programming languages. In the case when cross-language interoperability is accomplished with a Foreign Function Interface (FFI), for example pybind11, Boost.Python, Emscripten, PyV8, or JNI, among many others, common software engineering tools, such as call-graph analysis, are obstructed by the opacity of the FFI. This complicates debugging and fosters potential inefficiency and security problems. One contributing issue is that there is little rigorous software design advice for multilingual software. In this paper, we present our progress towards a more rigorous design approach to multilingual software. The approach is based on the existing …
An Empirical Study Of User Support Tools In Open Source Software,
2019
Confederation College of Applied Arts and Technology
An Empirical Study Of User Support Tools In Open Source Software, Arif Raza, Luiz Fernando Capretz, Shuib Basri
Electrical and Computer Engineering Publications
End users’ positive response is essential for the success of any software. This is true for both commercial and Open Source Software (OSS). OSS is popular not only because of its availability, which is usually free but due to the user support it provides, generally through public platforms. The study model of this research establishes a relationship between OSS user support and available support tools. To conduct this research, we used a dataset of 100 OSS projects in different categories and examined five user support tools provided by different OSS projects. The results show that project trackers, user mailing lists, …
Eugene: Towards Deep Intelligence As A Service,
2019
University of Illinois at Urbana-Champaign
Eugene: Towards Deep Intelligence As A Service, Shuochao Yao, Yifan Hao, Yiran Zhao, Ailing Piao, Huajie Shao, Dongxin Liu, Shengzhong Liu, Shaohan Hu, Dulanga Weerakoon, Kasthuri Jayarajah, Archan Misra, Tarek Abdelzaher
Research Collection School Of Computing and Information Systems
The paper discusses an emerging suite of machine intelligence services that are of increasing importance in the highly instrumented world of the Internet of Things (IoT). The suite, called Eugene, would offer a form of intelligent behavior (based on deep neural networks) to otherwise simple embedded devices; the clients of the service. These devices would benefit from service resources to learn from data and to perform intelligent inference, classification, prediction, and estimation tasks that they are too limited to carry out on their own. The paper discusses the taxonomy of such services and the state of implementation, as well as …
Sensitive Behavior Analysis Of Android Applications On Unrooted Devices In The Wild,
2019
Singapore Management University
Sensitive Behavior Analysis Of Android Applications On Unrooted Devices In The Wild, Xiaoxiao Tang
Dissertations and Theses Collection (Open Access)
Dynamic analysis is widely used in malware detection, taint analysis, vulnerability detection, and other areas for enhancing the security of Android. Compared to static analysis, dynamic analysis is immune to common code obfuscation techniques and dynamic code loading. Existing dynamic analysis techniques rely on in-lab running environment (e.g., modified systems, rooted devices, or emulators) and require automatic input generators to execute the target app. However, these techniques could be bypassed by anti-analysis techniques that allow apps to hide sensitive behavior when an in-lab environment is detected through predefined heuristics (e.g., IMEI number of the device is invalid). Meanwhile, current input …
Making Sense Of Crowd-Generated Content In Domain-Specific Settings,
2019
Singapore Management University
Making Sense Of Crowd-Generated Content In Domain-Specific Settings, Agus Sulistya
Dissertations and Theses Collection (Open Access)
The rapid advances of the Web have changed the ways information is distributed and exchanged among individuals and organizations. Various content from different domains are generated daily and contributed by users' daily activities, such as posting messages in a microblog platform, or collaborating in a question and answer site. To deal with such tremendous volume of user generated content, there is a need for approaches that are able to handle the mass amount of available data and to extract knowledge hidden in the user generated content. This dissertation attempts to make sense of the generated content to help in three …
Stressmon: Large Scale Detection Of Stress And Depression In Campus Environment Using Passive Coarse-Grained Location Data,
2019
Singapore Management University
Stressmon: Large Scale Detection Of Stress And Depression In Campus Environment Using Passive Coarse-Grained Location Data, Camellia Zakaria
Dissertations and Theses Collection (Open Access)
The rising mental health illnesses of severe stress and depression is of increasing concern worldwide. Often associated by similarities in symptoms, severe stress can take a toll on a person’s productivity and result in depression if the stress is left unmanaged. Unfortunately, depression can occur without any feelings of stress. With depression growing as a leading cause of disability in economic productivity, there has been a sharp rise in mental health initiatives to improve stress and depression management. To offer such services conveniently and discreetly, recent efforts have focused on using mobile technologies. However, these initiatives usually require users to …
Applying Case-Based Learning For A Postgraduate Software Architecture Course,
2019
Singapore Management University
Applying Case-Based Learning For A Postgraduate Software Architecture Course, Eng Lieh Ouh, Yunghans Irawan
Research Collection School Of Computing and Information Systems
Software architecture remains a difficult subject for learners to grasp and for educators to teach given its level of abstraction. On the other hand, case-based learning (CBL) is a popular teaching approach used across disciplines especially in business, medicine and law where students work in groups apply their knowledge to solve real-world case studies, or scenarios using their reasoning skills and existing theoretical knowledge. In this paper, we provide how we apply case-based learning to address the challenge in teaching a postgraduate software architecture course. Our learners are postgraduate students taking a master’s program in software engineering. We first describe …
Decentralizing Air Traffic Flow Management With Blockchain Based Reinforcement Learning,
2019
Singapore Management University
Decentralizing Air Traffic Flow Management With Blockchain Based Reinforcement Learning, Nguyen Binh Duong Ta, Umang Chaudhary, Hong-Linh Truong
Research Collection School Of Computing and Information Systems
We propose and implement a decentralized, intelligent air traffic flow management (ATFM) solution to improve the efficiency of air transportation in the ASEAN region as a whole. Our system, named BlockAgent, leverages the inherent synergy between multi-agent reinforcement learning (RL) for air traffic flow optimization; and the rising blockchain technology for a secure, transparent and decentralized coordination platform. As a result, BlockAgent does not require a centralized authority for effective ATFM operations. We have implemented several novel distributed coordination approaches for RL in BlockAgent. Empirical experiments with real air traffic data concerning regional airports have demonstrated the feasibility and effectiveness …
Resource Constrained Deep Reinforcement Learning,
2019
Singapore Management University
Resource Constrained Deep Reinforcement Learning, Abhinav Bhatia, Pradeep Varakantham, Akshat Kumar
Research Collection School Of Computing and Information Systems
In urban environments, resources have to be constantly matched to the “right” locations where customer demand is present. For instance, ambulances have to be matched to base stations regularly so as to reduce response time for emergency incidents in ERS (Emergency Response Systems); vehicles (cars, bikes among others) have to be matched to docking stations to reduce lost demand in shared mobility systems. Such problems are challenging owing to the demand uncertainty, combinatorial action spaces and constraints on allocation of resources (e.g., total resources, minimum and maximum number of resources at locations and regions). Existing systems typically employ myopic and …
