Export Citations
Save this search
Please login to be able to save your searches and receive alerts for new content matching your search criteria.
- research-articleAugust 2024
CO3: concolic co-execution for firmware
SEC '24: Proceedings of the 33rd USENIX Conference on Security SymposiumArticle No.: 313, Pages 5591–5608Firmware running on resource-constrained embedded microcontrollers (MCUs) is critical in this IoT era, yet their security is under-analyzed. At the same time, concolic execution has proven to be a successful program analysis technique on conventional ...
- research-articleAugust 2024
SHiFT: semi-hosted fuzz testing for embedded applications
SEC '24: Proceedings of the 33rd USENIX Conference on Security SymposiumArticle No.: 298, Pages 5323–5340Modern microcontrollers (MCU)s are ubiquitous on critical embedded applications in the IoT era. Therefore, securing MCU firmware is fundamental. To analyze MCU firmware security, existing works mostly adopt re-hosting based techniques. These techniques ...
- research-articleJuly 2024
AIM: Automatic Interrupt Modeling for Dynamic Firmware Analysis
IEEE Transactions on Dependable and Secure Computing (TDSC), Volume 21, Issue 4Pages 3866–3882https://doi.org/10.1109/TDSC.2023.3339569The security of microcontrollers, which drive modern IoT and embedded devices, continues to raise major concerns. Within a microcontroller (MCU), the firmware is a monolithic piece of software that contains the whole software stack, whereas a variety of ...
- research-articleJanuary 2024
On the Complexity of the Web’s PKI: Evaluating Certificate Validation of Mobile Browsers
IEEE Transactions on Dependable and Secure Computing (TDSC), Volume 21, Issue 1Pages 419–433https://doi.org/10.1109/TDSC.2023.3255869Digital certificates are frequently used to secure communications between users and web servers. Critical to the Web’s PKI is the secure validation of digital certificates. Nonetheless, certificate validation itself is complex and error-prone. ...
- research-articleAugust 2023
A study of multi-factor and risk-based authentication availability
SEC '23: Proceedings of the 32nd USENIX Conference on Security SymposiumArticle No.: 115, Pages 2043–2060Password-based authentication (PBA) remains the most popular form of user authentication on the web despite its long-understood insecurity. Given the deficiencies of PBA, many online services support multi-factor authentication (MFA) and/or risk-based ...
-
- research-articleMay 2023
A novel prediction method for vulnerability outbreak trend
Computers and Electrical Engineering (CENG), Volume 108, Issue Chttps://doi.org/10.1016/j.compeleceng.2023.108743AbstractThe trend prediction of software vulnerability can provide valuable threat intelligence in security event prevention. It is a challenging task for highly accurate prediction. To address this problem, a novel prediction method, STL-EEMD-ARIMA , ...
- ArticleSeptember 2022
JChainz: Automatic Detection of Deserialization Vulnerabilities for the Java Language
- Luca Buccioli,
- Stefano Cristalli,
- Edoardo Vignati,
- Lorenzo Nava,
- Daniele Badagliacca,
- Danilo Bruschi,
- Long Lu,
- Andrea Lanzi
AbstractIn the last decade, we have seen the proliferation of code-reuse attacks that rely on deserialization of untrusted data in the context of web applications. The impact of these attacks is really important since they can be used for exposing private ...
- research-articleJune 2022
A novel self-learning semi-supervised deep learning network to detect fake news on social media
Multimedia Tools and Applications (MTAA), Volume 81, Issue 14Pages 19341–19349https://doi.org/10.1007/s11042-021-11065-xAbstractSocial media has become a popular means for people to consume and share news. However, it also enables the extensive spread of fake news, that is, news that deliberately provides false information, which has a significant negative impact on ...
- research-articleJune 2022
Integrating genomic and resting State fMRI for efficient autism spectrum disorder classification
Multimedia Tools and Applications (MTAA), Volume 81, Issue 14Pages 19183–19194https://doi.org/10.1007/s11042-020-10473-9AbstractAutism spectrum disorder (ASD) is a neurodevelopmental disorder with a complex clinical syndrome and difficult diagnosis. The fusion of multimodal data improves the accuracy of ASD diagnosis, benefiting from the complementary information contained ...
- research-articleMay 2022
Environmental efficiency assessment of China’s integrated power system under the assumption of semi-disposability
Computers and Industrial Engineering (CINE), Volume 167, Issue Chttps://doi.org/10.1016/j.cie.2022.108023Highlights- Incorporate semi-disposability into DNSBM model of China’s provincial power system.
As the largest terminal carbon emitter in China, power industry is crucial for achieving carbon peak by 2030 and carbon neutrality by 2060, and constructing a sustainable society. To scientifically evaluate the environmental ...
- research-articleJanuary 2022
A Novel Approach of Feature Space Reconstruction with Three-Way Decisions for Long-Tailed Text Classification
- Ahmed Mostafa Khalil,
- Xin Li,
- Lianting Hu,
- Peixin Lu,
- Tianhui Huang,
- Wei Yang,
- Quan Lu,
- Huiying Liang,
- Long Lu
Text classification is widely studied by researchers in the natural language processing field. However, real-world text data often follow a long-tailed distribution as the frequency of each class is typically different. The performance of current ...
- research-articleDecember 2021
Guided Feature Identification and Removal for Resource-constrained Firmware
ACM Transactions on Software Engineering and Methodology (TOSEM), Volume 31, Issue 2Article No.: 28, Pages 1–25https://doi.org/10.1145/3487568IoT firmware oftentimes incorporates third-party components, such as network-oriented middleware and media encoders/decoders. These components consist of large and mature codebases, shipping with a variety of non-critical features. Feature bloat increases ...
- ArticleNovember 2021
Browserprint: an Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy
AbstractWeb browsers are indispensable applications in our daily lives. Millions of users use web browsers for a wide range of activities such as social media, online shopping, emails, or surfing the web. The evolution of increasingly more complicated web ...
- research-articleAugust 2021
Retracted on February 24, 2022: Management Accounting Personnel Training Mechanism Driven by Big Data and Guided by Industry Finance Integration
ICIMTECH 21: Retracted on September 15, 2021 The Sixth International Conference on Information Management and TechnologyArticle No.: 174, Pages 1–5https://doi.org/10.1145/3465631.3465845NOTICE OF RETRACTION: While investigating potential publication-related misconduct in connection with the ICIMTech 2021 Conference Proceedings, serious concerns were raised that cast doubt on the integrity of the peer-review process and all papers ...
- ArticleJuly 2021
SCRUTINIZER: Detecting Code Reuse in Malware via Decompilation and Machine Learning
Detection of Intrusions and Malware, and Vulnerability AssessmentPages 130–150https://doi.org/10.1007/978-3-030-80825-9_7AbstractGrowing numbers of advanced malware-based attacks against governments and corporations, for political, financial and scientific gains, have taken security breaches to the next level. In response to such attacks, both academia and industry have ...
- research-articleJune 2021
SoK: Enabling Security Analyses of Embedded Systems via Rehosting
- Andrew Fasano,
- Tiemoko Ballo,
- Marius Muench,
- Tim Leek,
- Alexander Bulekov,
- Brendan Dolan-Gavitt,
- Manuel Egele,
- Aurélien Francillon,
- Long Lu,
- Nick Gregory,
- Davide Balzarotti,
- William Robertson
ASIA CCS '21: Proceedings of the 2021 ACM Asia Conference on Computer and Communications SecurityPages 687–701https://doi.org/10.1145/3433210.3453093Closely monitoring the behavior of a software system during its execution enables developers and analysts to observe, and ultimately understand, how it works. This kind of dynamic analysis can be instrumental to reverse engineering, vulnerability ...
- proceedingNovember 2020
FEAST'20: Proceedings of the 2020 ACM Workshop on Forming an Ecosystem Around Software Transformation
The FEAST 2020 co-chairs are pleased to welcome all attendees to the 5th Annual Workshop on Forming an Ecosystem Around Software Transformation. Originally launched in 2016, FEAST has continued to serve as a premiere forum for presenting, discussing, and ...
- abstractNovember 2020
FEAST'20: Fifth Workshop on Forming an Ecosystem Around Software Transformation
CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications SecurityPages 2149–2150https://doi.org/10.1145/3372297.3416251The Fifth Workshop on Forming an Ecosystem Around Software Transformation (FEAST) provides a forum for presentation and discussion of new tools, methodologies, and techniques facilitating the automated or semi-automated transformation and analysis of ...
- research-articleAugust 2020
P2IM: scalable and hardware-independent firmware testing via automatic peripheral interface modeling
SEC'20: Proceedings of the 29th USENIX Conference on Security SymposiumArticle No.: 70, Pages 1237–1254Dynamic testing or fuzzing of embedded firmware is severely limited by hardware-dependence and poor scalability, partly contributing to the widespread vulnerable IoT devices. We propose a software framework that continuously executes a given firmware ...
- research-articleDecember 2019
Detecting (absent) app-to-app authentication on cross-device short-distance channels
ACSAC '19: Proceedings of the 35th Annual Computer Security Applications ConferencePages 328–338https://doi.org/10.1145/3359789.3359814Short-distance or near-field communication is increasingly used by mobile apps for interacting or exchanging data in a cross-device fashion. In this paper, we identify a security issue, namely cross-device app-to-app communication hijacking (or CATCH), ...
