ASAF: Android Static Analysis Framework

The Android operating system dominates the smartphone market. Thus, to service the market, the number of Android applications has risen dramatically. These applications are processing a great amount of sensitive data, which could result in various concerns including data leakage and privacy violations. For example, applications may misuse the sensitive data stored on Android devices and violate the privacy of the user. Therefore, it is essential to maintain user privacy and protect sensitive data from leakage. Static data flow analysis approaches are used for analyzing Android applications to uncover security and privacy issues. However, these approaches frequently generate false alarms, given the different challenges created by Android applications, such as inter-component communication (ICC), reflection, and implicit flow. This work presents the DroidRista approach for conducting static data flow analysis on Android applications to detect sensitive data leakage. DroidRista analyzes ICC, reflection, and implicit flow in Android applications. To evaluate the performance of DroidRista, it was tested on three data sets. The results demonstrate improved performance in terms of detecting data leakage compared to existing static data flow analysis approaches.

Cryptomining malware (also referred to as cryptojacking) has changed the cyber threat landscape. Such malware exploits the victim’s CPU or GPU resources with the aim of generating cryptocurrency. In this paper, we study the potential of using deep learning techniques to detect cryptomining malware by utilizing both static and dynamic analysis approaches. To facilitate dynamic analysis, we establish an environment to capture the system call events of 1500 Portable Executable (PE) samples of the cryptomining malware. We also demonstrate how one can perform static analysis of PE files’ opcode sequences. In our study, we evaluate the performance of using Long Short-Term Memory (LSTM), Attention-based LSTM (ATT-LSTM), and Convolutional Neural Networks (CNN) on our sequential data (opcodes and system call invocations) for classification by a Softmax function. We achieve an accuracy rate of 95% in the static analysis and an accuracy rate of 99% in the dynamic analysis.

Embedded software often involves intensive numerical computations and suffers from a number of runtime errors. The technique of numerical static analysis is of practical importance for checking the correctness of embedded software. However, most of the existing approaches of numerical static analysis consider sequential programs, while interrupts are a commonly used facility that introduces concurrency in embedded systems. Therefore, a numerical static analysis approach is highly desired for embedded software with interrupts. In this article, we propose a static analysis approach specifically for interrupt-driven programs based on sequentialization techniques. We present a method to sequentialize interrupt-driven programs into nondeterministic sequential programs according to the semantics of interrupts. The key benefit of using sequentialization is the ability to leverage the power of state-of-the-art analysis and verification techniques for sequential programs to analyze interrupt-driven programs, for example, the power of numerical abstract interpretation to analyze numerical properties of the sequentialized programs. Furthermore, to improve the analysis precision and scalability, we design specific abstract domains to analyze sequentialized interrupt-driven programs by considering their specific features. Finally, we present encouraging experimental results obtained by our prototype implementation.

Android access control granularity based on its permission mechanism is relatively coarse, which cannot effectively protect the user privacy. Many Android applications do not strictly abide by the principle of least privilege (PLP). Both benign and malicious apps may request more permissions than those they really use. We rethink previous permission over-claim problem of Android applications, and extend it to three kinds of problems: Explicit Permission Over-claim, Implicit Permission Over-claim and Ad Library Permission Over-claim. The latter two problems are new that have not been raised by any previous work. Static analysis is to decompile the applications to generate intermediate code and then analyze the usage of permissions. Our static analysis on 10710 applications shows that 76.08% of them may have Explicit Permission Over-claim problem, among those there are 424 applications that have sensitive permissions, which are only used in the advertisement library’s code of the applications rather than developer’s own code. They have Ad Library Permission Over-claim problem. The main idea of our semantic analysis is to calculate the semantic similarity between apps’ descriptions and function phrases. If the similarity exceeds a certain threshold, the app is considered relevant to the corresponding function. We compare the results of the semantic analysis with those of manual reading of 102 Android application descriptions. The F-measures of the three chosen functions are 80.82%, 70.48% and 89.62%, respectively. The evaluation results show our method can efficiently detect the above three kinds of permission over claim problems which indicates that our method would be helpful for normal users to have a clear understanding of permission usage of Android applications.

Equivalence checking techniques help establish whether two versions of a program exhibit the same behavior. The majority of popular techniques for formally proving/refuting equivalence relies on symbolic execution – a static analysis approach that reasons about program behaviors in terms of symbolic input variables. Yet, symbolic execution is difficult to scale in practice due to complex programming constructs, such as loops and non-linear arithmetic. This paper proposes an approach, named ARDiff, for improving the scalability of symbolic-execution-based equivalence checking techniques when comparing syntactically-similar versions of a program, e.g., for verifying the correctness of code upgrades and refactoring. Our approach relies on a set of novel heuristics to determine which parts of the versions’ common code can be effectively pruned during the analysis, reducing the analysis complexity without sacrificing its effectiveness. Furthermore, we devise a new equivalence checking benchmark, extending existing benchmarks with a set of real-life methods containing complex math functions and loops. We evaluate the effectiveness and efficiency of ARDiff on this benchmark and show that it outperforms existing method-level equivalence checking techniques by solving 86% of all equivalent and 55% of non-equivalent cases, compared with 47% to 69% for equivalent and 38% to 52% for non-equivalent cases in related work.

With the rise in the underground Internet economy, automated malicious programs popularly known as malwares have become a major threat to computers and information systems connected to the internet. Properties such as self healing, self hiding and ability to deceive the security devices make these software hard to detect and mitigate. Therefore, the detection and the mitigation of such malicious software is a major challenge for researchers and security personals. The conventional systems for the detection and mitigation of such threats are mostly signature based systems. Major drawback of such systems are their inability to detect malware samples for which there is no signature available in their signature database. Such malwares are known as zero day malware. Moreover, more and more malware writers uses obfuscation technology such as polymorphic and metamorphic, packing, encryption, to avoid being detected by antivirus. Therefore, the traditional signature based detection system is neither effective nor efficient for the detection of zero-day malware. Hence to improve the effectiveness and efficiency of malware detection system we are using classification method based on structural information and behavioral specifications. In this paper we have used both static and dynamic analysis approaches. In static analysis we are extracting the features of an executable file followed by classification. In dynamic analysis we are taking the traces of executable files using NtTrace within controlled atmosphere. Experimental results obtained from our algorithm indicate that our proposed algorithm is effective in extracting malicious behavior of executables. Further it can also be used to detect malware variants.

With the UHV (Ultra High Voltage) power grid construction and the interconnection of regional power grids, the scale of power grids in China is increasing rapidly. At the same time, significant uncertainty and variability is being introduced into power grid operation with the integration of large-scale renewable energy in power systems. All of these pose an enormous challenge to the operation control of power systems in China. For a long time, online static security analysis, as an important part of EMS (Energy Management System), has been an effective tool for power grid operation. However, it is increasingly difficult for traditional static security analysis in serial computing mode to be online applied in bulk power grids in China. A new practical parallel approach for online static security analysis is put forward in this paper. A multithread parallelism is introduced into contingency screening, detailed contingency evaluation and decision support for reducing the execution time. By employing the multithread technology, the hardware resources of multi-processor/multi-core computer can be fully used and the program can be speeded up effectively. The performance of the parallel static security analysis is demonstrated by tests on two large-scale power systems. The test results show that the proposed method can be online applied in real bulk power grids.

This paper introduces a new approach of power system static security analysis based on the vulnerability index (VI) and network contribution factor (NCF) method. Vulnerability index method provides quantitative vulnerability information about generation, transmission, load condition, and the whole system. NCF method gives fast approximate power flow results due to parameter change (contingency) based on the base load flow condition and network information. The contingency list can be chosen based on NCF method and VI evaluation. Comparison with the full AC power flow method shows that this approach is promising for fast and accurate static security analysis

Spreadsheets are the most prominent example of end-user programs. Unfortunately, spreadsheets often contain faults. In this paper, we propose a static analysis approach that can be used in a variety of spreadsheet quality assurance techniques. Our approach automatically detects groups of related formula cells and input cells, computation blocks, and the headers of the input and formula cells for a given spreadsheet. In the empirical evaluation, we show that 99% of the blocks of the investigated spreadsheets and more than 76% of the headers can be detected. Furthermore, we explain how the results of the static analysis approach can be used to improve existing spreadsheet smells and we propose four new spreadsheet smells.

The recently developed cloud-based platform www.geomiso.cloud is introduced to help engineers and industries make effective use of inelastic static isogeometric analysis and design with advanced spline techniques. The new Geomiso TNL software combines IGA and cloud computing, one of the fastest growing fields in IT industry. Cloud-based IGA represents the future of product engineering, soon to become an industry standard. This program fully integrates the industrial design with its computational real-time testing, while it is seen to handle demanding inelastic applications in structural mechanics remarkably well, as the numerical examples exhibit significantly improved accuracy with shortened computational time. It is argued that Geomiso TNL is a new, more efficient, alternative to FEA software packages. This is the first time ever such a cloud-based program has been developed.

The uncertainty in the new power system has increased, leading to limitations in traditional stability analysis methods. Therefore, considering the perspective of the three-dimensional static security region (SSR), we propose a novel approach for system static stability analysis. To address the slow training speed of traditional deep learning algorithms using batch gradient descent (BGD), we introduce an improved stochastic–batch gradient descent (S-BGD) search method that combines the advantages of stochastic gradient descent (SGD) in fast training. This method ensures both speed and precision in parameter training. Moreover, to tackle the problem of getting trapped in local optima and saddle points during parameter training, we draw inspiration from kinematic theory and propose a gradient pile (GP) training method. By utilizing accumulated gradients as parameter corrections, this method effectively avoids getting stuck in local optima and saddle points, thereby enhancing precision. Finally, we apply the proposed methods to construct the static security region for the IEEE-118 new power system using its data as samples, demonstrating the effectiveness of our approach.

ABSTRACTA formulation for static and dynamic vibration analysis of composite laminated curved beams is presented by using an efficient domain decomposition method. Multi-segment partitioning strategy is used to accommodate the accurate requirements of responses. The system potential functional is introduced to satisfy the continuity constraints on the segment interfaces. The Chebyshev orthogonal polynomials are used as displacement admissible functions. The theoretical results are verified by comparing with those previously published in literature, and the ones obtained by using the program ABAQUS. Based on the verification, the parametric study of composite laminated curved beam is carried out.

This paper presents an advanced framework for real-time monitoring and analysis of network traffic and endpoint security in large-scale enterprises by addressing the increasing complexity and frequency of cyber-attacks. Our Network Security Traffic Analysis Platform employs a comprehensive technology stack including the Elastic Stack, ZEEK, Osquery, Kafka, and GeoLocation data. By integrating supervised machine learning models trained on the UNSW-NB15 dataset, we evaluate Random Forest (RF), Decision Trees (DT), and Support Vector Machines (SVM), with the Random Forest classifier achieving a notable accuracy of 99.32%. Leveraging Artificial Intelligence and Natural Language Processing, we apply the BERT model with a Byte-level Byte-pair tokenizer to enhance network-based attack detection in IoT systems. Experiments on UNSW-NB15, TON-IoT, and Edge-IIoT datasets demonstrate our platform’s superiority over traditional methods in multi-class classification tasks, achieving near-perfect accuracy on the Edge-IIoT dataset. Furthermore, Network Security Traffic Analysis Platform’s ability to produce actionable insights through charts, tables, histograms, and other visualizations underscores its capability in static analysis of traffic data. This dual approach of real-time and static analysis provides a robust foundation for developing scalable, efficient, and automated security solutions, essential for managing the evolving threats in modern networks.

This paper presents a novel approach to automating the detection and optimization of inference bottlenecks in distributed deep learning systems through the application of Large Language Models (LLMs). While traditional performance optimization in distributed environments requires extensive manual analysis across multiple components, this paper propose a static analysis framework that leverages LLMs' code comprehension capabilities to identify performance-critical patterns without execution.This system processes distributed model architectures and implementation code to generate an abstract syntax tree representation, which is then analyzed by a fine-tuned LLM trained on a curated dataset of 5,000+ annotated performance bottlenecks from production distributed environments. Experimental evaluation across 78 diverse distributed neural network deployments demonstrates that the approach identifies 93.7% of inference bottlenecks that would otherwise require dynamic profiling, while suggesting optimizations that yield an average 2.8x inference speedup on resource-constrained devices. A comparative analysis reveals this static analysis method reduces optimization time by 76% compared to conventional profiling-based approaches in distributed settings. Additionally, the system generates natural language explanations of detected issues and recommends contextually appropriate optimization strategies for distributed inference pipelines, facilitating knowledge transfer to practitioners. This research addresses critical challenges in deep learning deployment across distributed environments and enables more efficient utilization of computational resources in production systems.

A new static–dynamic equivalence approach for beam bending is developed to determine the critical stability load of a vibrating beam resting on an elastic foundation. It is validated that the critical stability load corresponding to an arbitrary natural frequency parameter can be obtained via both the vibration and the static analysis approaches. By introducing a new elastic foundation stiffness parameter, the natural frequency parameter can be substituted, thus allowing a new formulation to solve the critical stability that corresponds to the zero or negative elastic foundation constant. In the vibration analysis, the governing equation of motion is solved by a harmonic response assumption. In this case, the critical stability loads can be determined by solving the determinant of the dynamic system under different boundary conditions. For zero or negative elastic foundation stiffness, a beam acted by a specific point load on such an elastic foundation can yield an infinite deflection. Under such circumstances, each real natural frequency has an equivalent relationship with the corresponding negative elastic stiffness. Consequently, using this equivalent system, directly solving of the transcendental equation in the dynamic frequency analysis can be avoided. Some numerical examples are presented and it is demonstrated that highly accurate numerical critical stability solutions can be derived by this equivalent static bending approach. The results are validated by comparing with the classical beam buckling solutions. In conclusion, a new theoretical model with analytical solution procedure is put forward and it yields highly convergent numerical solutions that compare well with classical analytical solutions.