Software Engineering Commons^™

Black Box Analysis Of Android Malware Detectors, Guruswamy Nellaivadivelu, Fabio Di Troia, Mark Stamp

Faculty Publications, Computer Science

If a malware detector relies heavily on a feature that is obfuscated in a given malware sample, then the detector will likely fail to correctly classify the malware. In this research, we obfuscate selected features of known Android malware samples and determine whether these obfuscated samples can still be reliably detected. Using this approach, we discover which features are most significant for various sets of Android malware detectors, in effect, performing a black box analysis of these detectors. We find that there is a surprisingly high degree of variability among the key features used by popular malware detectors.

Incorporating Digital Ethics Throughout The Software Development Process, Michael Collins, Damian Gordon, Anna Becevel, William O'Mahony

Conference papers

The media is reporting scandals associated with computer companies with increasing regularity; whether it is the misuse of user data, breach of privacy concerns, the use of biased artificial intelligence, or the problems of automated vehicles. Because of these complex issues, there is a growing need to equip computer science students with a deep appreciation of ethics, and to ensure that in the future they will develop computer systems that are ethically-based. One particularly useful strand of their education to incorporate ethics into is when teaching them about the formal approaches to developing computer systems.

There are a number of …

Network Traffic Analysis Framework For Cyber Threat Detection, Meshesha K. Cherie

Masters Theses & Doctoral Dissertations

The growing sophistication of attacks and newly emerging cyber threats requires advanced cyber threat detection systems. Although there are several cyber threat detection tools in use, cyber threats and data breaches continue to rise. This research is intended to improve the cyber threat detection approach by developing a cyber threat detection framework using two complementary technologies, search engine and machine learning, combining artificial intelligence and classical technologies.

In this design science research, several artifacts such as a custom search engine library, a machine learning-based engine and different algorithms have been developed to build a new cyber threat detection framework based …

Understanding Wikipedia As A Resource For Opportunistic Learning Of Computing Concepts, Martin P. Robillard, Christoph Treude

Research Collection School Of Computing and Information Systems

Posts on on-line forums where programmers look for information often include links to Wikipedia when it can be assumed the reader will not be familiar with the linked terms. A Wikipedia article will thus often be the first exposure to a new computing concept for a novice programmer. We conducted an exploratory study with 18 novice programmers by asking them to read a Wikipedia article on a common computing concept that was new to them, while using the think-aloud protocol. We performed a qualitative analysis of the session transcripts to better understand the experience of the novice programmer learning a …

Securing Bring-Your-Own-Device (Byod) Programming Exams, Oka Kurniawan, Norman Lee, Christopher M. Poskitt

Research Collection School Of Computing and Information Systems

Traditional pen and paper exams are inadequate for modern university programming courses as they are misaligned with pedagogies and learning objectives that target practical coding ability. Unfortunately, many institutions lack the resources or space to be able to run assessments in dedicated computer labs. This has motivated the development of bring-your-own-device (BYOD) exam formats, allowing students to program in a similar environment to how they learnt, but presenting instructors with significant additional challenges in preventing plagiarism and cheating. In this paper, we describe a BYOD exam solution based on lockdown browsers, software which temporarily turns students' laptops into secure workstations …

W8-Scope: Fine-Grained, Practical Monitoring Of Weight Stack-Based Exercises, Meeralakshmi Radhakrishnan, Archan Misra, Rajesh Krishna Balan

Research Collection School Of Computing and Information Systems

Fine-grained, unobtrusive monitoring of gym exercises can help users track their own exercise routines and also provide corrective feedback. We propose W8-Scope, a system that uses a simple magnetic-cum-accelerometer sensor, mounted on the weight stack of gym exercise machines, to infer various attributes of gym exercise behavior. More specifically, using multiple machine learning models, W8-Scope helps identify who is exercising, what exercise she is doing, how much weight she is lifting, and whether she is committing any common mistakes. Real world studies, conducted with 50 subjects performing 14 different exercises over 103 distinct sessions in two gyms, show that W8-Scope …

Pokeme: Applying Context-Driven Notifications To Increase Worker Engagement In Mobile Crowd-Sourcing, Thivya Kandappu, Abhinav Mehrotra, Archan Misra, Mirco Musolesi, Shih-Fen Cheng, Lakmal Buddika Meegahapola

Research Collection School Of Computing and Information Systems

In mobile crowd-sourcing systems, simply relying on people to opportunistically select and perform tasks typically leads to drawbacks such as low task acceptance/completion rates and undesirable spatial skews. In this paper, we utilize data from "Smart Campus", a campus-based mobile crowd-sourcing platform, to empirically study and discover whether and how various context-aware notification strategies can help overcome such drawbacks. We first study worker interactions, in the absence of any notifications, to discover some spatio-temporal properties of task acceptance and completion. Based on these insights, we then experimentally demonstrate the effectiveness of two novel, non-personal, context-driven notification strategies, comparing the outcomes …

Automated Synthesis Of Local Time Requirement For Service Composition, Étienne André, Tian Huat Tan, Manman Chen, Shuang Liu, Jun Sun, Yang Liu, Jin Song Dong

Research Collection School Of Computing and Information Systems

Service composition aims at achieving a business goal by composing existing service-based applications or components. The response time of a service is crucial, especially in time-critical business environments, which is often stated as a clause in service-level agreements between service providers and service users. To meet the guaranteed response time requirement of a composite service, it is important to select a feasible set of component services such that their response time will collectively satisfy the response time requirement of the composite service. In this work, we use the BPEL modeling language that aims at specifying Web services. We extend it …

S2n2: An Interpretive Semantic Structure Attention Neural Network For Trajectory Classification, Canghong Jin, Ting Tao, Xianzhe Luo, Zemin Liu, Minghui Wu

Research Collection School Of Computing and Information Systems

We have witnessed a rapid growth over past decades in sensor data mining (SDM), which aims at extracting valuable information automatically from large repositories of moving activity data. One of the significant SDM tasks is identifying humans through their transit modes using a variety of user-tracking systems. However, to the best of our knowledge, distinguishing traces of users and understanding their behaviors are difficult tasks in most real-life cases for the following reasons: 1) activity data containing both temporal and spatial contexts are of high order and sparse; 2) living patterns are not as regular as expected, and the route …

A Virtual Machine Introspection Based Multi-Service, Multi-Architecture, High-Interaction Honeypot For Iot Devices, Cory A. Nance

Masters Theses & Doctoral Dissertations

Internet of Things (IoT) devices are quickly growing in adoption. The use case for IoT devices runs the gamut from household applications (such as toasters, lighting, and thermostats) to medical, battlefield, or Industrial Control System (ICS) applications used in life or death situations. A disturbing trend is that for IoT devices is that they are not developed with security in mind. This lack of security has led to the creation of massive botnets that conduct nefarious acts. A clear understanding of the threat landscape IoT devices face is needed to address these security issues. One technique used to understand threats …

Iot-Hass: A Framework For Protecting Smart Home Environment, Tarig Mudawi

Masters Theses & Doctoral Dissertations

While many solutions have been proposed for smart home security, the problem that no single solution fully protects the smart home environment still exists. In this research we propose a security framework to protect the smart home environment. The proposed framework includes three engines that complement each other to protect the smart home IoT devices. The first engine is an IDS/IPS module that monitors all traffic in the home network and then detects, alerts users, and/or blocks packets using anomaly-based detection. The second engine works as a device management module that scans and verifies IoT devices in the home network, …

Heartquake: Accurate Low-Cost Non-Invasive Ecg Monitoring Using Bed-Mounted Geophones, Jaeyeon Park, Hyeon Cho, Rajesh Krishna Balan, Jeonggil Ko

Research Collection School Of Computing and Information Systems

This work presents HeartQuake, a low cost, accurate, non-intrusive, geophone-based sensing system for extracting accurate electrocardiogram (ECG) patterns using heartbeat vibrations that penetrate through a bed mattress. In HeartQuake, cardiac activity-originated vibration patterns are captured on a geophone and sent to a server, where the data is filtered to remove the sensor's internal noise and passed on to a bidirectional long short term memory (Bi-LSTM) deep learning model for ECG waveform estimation. To the best of our knowledge, this is the first solution that can non-intrusively provide accurate ECG waveform characteristics instead of more basic abstract features such as the …

Capacitor-Based Activity Sensing For Kinetic-Powered Wearable Iots, Guohao Lan, Dong Ma, Weitao Xu, Mahbub Hassan, Wen Hu

Research Collection School Of Computing and Information Systems

We propose the use of the conventional energy storage component, i.e., capacitor, in the kinetic-powered wearable IoTs as the sensor to detect human activities. Since activities accumulate energy in the capacitor at different rates, the charging rate of the capacitor can be used to detect the activities. The key advantage of the proposed capacitor-based activity sensing mechanism, called CapSense, is that it obviates the need for sampling the motion signal at a high rate, and thus, significantly reduces power consumption of the wearable device. The challenge we face is that capacitors are inherently non-linear energy accumulators, which leads to significant …

Predicting Student Performance In Interactive Online Question Pools Using Mouse Interaction Features, Huan Wei, Haotian Li, Meng Xia, Yong Wang, Huamin Qu

Research Collection School Of Computing and Information Systems

Modeling student learning and further predicting the performance is a well-established task in online learning and is crucial to personalized education by recommending different learning resources to different students based on their needs. Interactive online question pools (e.g., educational game platforms), an important component of online education, have become increasingly popular in recent years. However, most existing work on student performance prediction targets at online learning platforms with a well-structured curriculum, predefined question order and accurate knowledge tags provided by domain experts. It remains unclear how to conduct student performance prediction in interactive online question pools without such well-organized question …

Ifix: Fixing Concurrency Bugs While They Are Introduced, Zan Wang, Haichi Wang, Shuang Liu, Jun Sun, Haoyu Wang, Junjie Chen

Research Collection School Of Computing and Information Systems

Concurrency bugs are notoriously hard to identify and fix. A systematic way of avoiding concurrency bugs is to design and implement a locking policy that consistently guards all shared variables. Concurrency bugs thus can be viewed as the result of an illy-designed or poorly implemented locking policy. The trouble is that the locking policy is often not documented, which makes debugging concurrency bugs clueless. We argue that it is too late to debug concurrency bugs after programming is done and we instead detect and fix them while they are being implemented. In this work, we propose an approach named IFIX …

An Empirical Study On Correlation Between Coverage And Robustness For Deep Neural Networks, Yizhen Dong, Peixin Zhang, Jingyi Wang, Shuang Liu, Jun Sun, Jianye Hao, Xinyu Wang, Li Wang, Jinsong Dong, Ting Dai

Research Collection School Of Computing and Information Systems

Deep neural networks (DNN) are increasingly applied in safety-critical systems, e.g., for face recognition, autonomous car control and malware detection. It is also shown that DNNs are subject to attacks such as adversarial perturbation and thus must be properly tested. Many coverage criteria for DNN since have been proposed, inspired by the success of code coverage criteria for software programs. The expectation is that if a DNN is well tested (and retrained) according to such coverage criteria, it is more likely to be robust. In this work, we conduct an empirical study to evaluate the relationship between coverage, robustness and …

Learning Fault Models Of Cyber Physical Systems, Teck Ping Khoo, Jun Sun, Sudipta Chattopadhyay

Research Collection School Of Computing and Information Systems

Cyber Physical Systems (CPSs) comprise sensors and actuators which interact with the physical environment over a computer network to achieve some control objective. Bugs in CPSs can have severe consequences as CPSs are increasingly deployed in safety-critical applications. Debugging CPSs is therefore an important real world problem. Traces from a CPS can be lengthy and are usually linked to different parts of the system, making debugging CPSs a complex and time-consuming undertaking. It is challenging to isolate a component without running the whole CPS. In this work, we propose a model-based approach to debugging a CPS. For each CPS property, …

Five Challenges In Cloud-Enabled Intelligence And Control, Tarek Abdelzaher, Yifan Hao, Kasthuri Jayarajah, Archan Misra, Per Skarin, Shuochao Yao, Dulanga Kaveesha Weerakoon Weerakoon Mudiyanselage, Karl-Erik Arzen

Research Collection School Of Computing and Information Systems

The proliferation of connected embedded devices, or the Internet of Things (IoT), together with recent advances in machine intelligence, will change the profile of future cloud services and introduce a variety of new research problems, both in cloud applications and infrastructure layers. These problems are centered around empowering individually resource-limited devices to exhibit intelligent behavior, both in sensing and control, thanks to a judicious utilization of cloud resources. Cloud services will enable learning from data, performing inference, and executing control, all with assurances on outcomes. The paper discusses such emerging services and outlines five resulting new research directions towards enabling …

Metrics To Meet Security & Privacy Requirements With Agile Software Development Methods In A Regulated Environment, Torrey J. Wagner, Thomas C. Ford

Faculty Publications

This work examines metrics that can be used to measure the ability of agile software development methods to meet security and privacy requirements of communications applications. Many implementations of communication protocols, including those in vehicular networks, occur within regulated environments where agile development methods are traditionally discouraged. We propose a framework and metrics to measure adherence to security, quality and software effectiveness regulations if developers desire the cost and schedule benefits of agile methods. After providing an overview of specific challenges that a regulated environment imposes on communications software development, we proceed to examine the 12 agile principles and how …

Stealthy And Efficient Adversarial Attacks Against Deep Reinforcement Learning, Jianwen Sun, Tianwei Zhang, Xiaofei Xie, Lei Ma, Yan Zheng, Kangjie Chen, Yang Liu

Research Collection School Of Computing and Information Systems

Adversarial attacks against conventional Deep Learning (DL) systems and algorithms have been widely studied, and various defenses were proposed. However, the possibility and feasibility of such attacks against Deep Reinforcement Learning (DRL) are less explored. As DRL has achieved great success in various complex tasks, designing effective adversarial attacks is an indispensable prerequisite towards building robust DRL algorithms. In this paper, we introduce two novel adversarial attack techniques to stealthily and efficiently attack the DRL agents. These two techniques enable an adversary to inject adversarial samples in a minimal set of critical moments while causing the most severe damage to …