TaintART

Today’s Smartphone operating systems frequently fail to provide users with adequate control and visibility into how the third-party applications use their private data. With TaintDroid realized on Android system, we can detect user’s implicit taint and privacy leakage. But TaintDroid has some inherent defects. To better detect user’s implicit taint and privacy leakage in the Android platform, this paper analyzes implicit taint detection and then proposes an automated detection system based on dynamic taint tracking, called TaintChaser. Monitoring sensitive data with TaintChaser provides informed use of third-party applications for phone users and valuable input for smart-phone security service firms seeking to identify misbehaving applications. TaintChaser can detect behaviors of user’s data leakage in Android applications at a fine granularity level and the system can also analyze and test massive Android software in an automatic way. It uses TaintChaser to automatically analyze 38,268 popular Android applications and finds that 34.41 % of them may leak user’s privacy.

Abstract— Aim/Background This study aims to systematically evaluate the practical runtime performance of the Insertion Sort algorithm across six widely used programming languages: C, C++, Go, Java, PHP, and Python. While Insertion Sort’s theoretical time complexity is well established, real-world execution performance may differ significantly due to variations in language paradigms, compilation strategies, and runtime environments. The research focuses on identifying how language-specific characteristics influence actual execution time. Methods The Insertion Sort algorithm was implemented uniformly in all six languages using a shared pseudocode to ensure consistency. Experiments were conducted under controlled conditions using input sizes of 1K, 10K, and 100K elements. Each dataset was tested with four different data arrangements: ascending, descending, nearly sorted, and random. Runtime measurements were collected and compared. Additionally, a Relative Execution Time Ratio (RETR) metric was introduced to provide a normalized and quantitative comparison of performance across languages. Results The experimental findings show clear performance differences among the programming languages. Go demonstrated the fastest runtimes across most scenarios, benefiting from its efficient compiled execution model. Java performed second-best, leveraging just-in-time (JIT) compilation and runtime optimizations. C and C++ showed moderate performance, influenced by compiler optimization levels and memory management mechanisms. PHP and Python exhibited significantly slower execution times, particularly for large and poorly ordered datasets, mainly due to interpreter overhead and runtime inefficiencies. The RETR metric effectively highlighted these relative performance gaps. Conclusion The study confirms that programming language choice significantly impacts real-world algorithm performance, even for well-understood algorithms like Insertion Sort. Compiled languages with efficient runtime optimizations generally outperform interpreted languages, especially for larger datasets. These results emphasize the importance of selecting appropriate programming languages for performance-critical applications and aligning algorithm implementation with both data characteristics and execution environments.

Today's Android-powered smartphones are equipped with various embedded sensors, such as the motion sensors, the environmental sensors and the position sensors. Many functions in the third-party applications (apps) need to use these sensors. However, embedded sensors may lead to security issues, as the third-party apps can access data from these sensors without claiming any permissions. It has been proven that embedded sensors can be exploited by well designed malicious apps, resulting in leaking users' privacy. In this work, we are motivated to provide an up-to-date overview of sensor usage patterns in current apps by investigating what, why and how embedded sensors are used in all the apps collected from a complete app market. To fulfill this goal, We develop a tool called “SDFDroid” to identify the sensors' types and to generate the sensor data propagation paths in each app. We then cluster the apps to find out their sensor usage patterns based on their sensor data propagation paths. We apply our method on AppChina, a widely used Chinese Android app market. Extensive experiments are conducted and the experimental results show that most apps implement their sensor related functions by using the third-party libraries. We further study the sensor usage in the third-party libraries. Our results show the accelerometer sensor is the most frequently used sensor. Though many third-party libraries use no more than four types of sensors, there are some third-party libraries register all the types of sensors recklessly. These results show the need for better regulating the sensor usage in Android apps.

Android requires third-party applications to request for permissions when they access critical mobile resources, such as users' personal information and system operations. In this paper, we present the attacks that can be launched without permissions. We first perform call graph analysis, component analysis and data-flow analysis on various parts of Android framework to retrieve unprotected APIs. Unprotected APIs provide a way of accessing resources without any permissions. We then exploit selected unprotected APIs and launch a number of attacks on Android phones. We discover that without requesting for any permissions, an attacker can access to device ID, phone service state, SIM card state, Wi-Fi and network information, as well as user setting information, such as airplane, location, NFC, USB and power modes of mobile devices. An attacker can also disturb Bluetooth discovery services, and block the incoming emails, calendar events, and Google documents. Moreover, an attacker can set volumes of devices and trigger alarm tones and ringtones that users personally set for their devices. An attacker can also launch camera, mail, music and phone applications even when the devices are locked. We compare our research on two Android versions, and discover that as platform providers incorporate more APIs, the number of unprotected APIs increases and new attacks become possible. We thus suggest platform providers to inspect Android frameworks systematically before releasing new versions.

Mascara is the first way to use virtualization technology to realize the virtualization customization of any Android application, and can effectively escape the attack of the current detection mechanism. The malicious application customized by Mascarer framework is an installable legal plug-in. The plug-in can extract sensitive information from the victim's mobile phone by using the generated virtual environment, which is highly harmful. This paper proposes a detection method based on multiple analysis for Mascara attack. Based on the study of the principle of Mascara attack, aiming at the new anti detection mechanism of detecting and protecting the loading path of plug-in APK in its virtual environment, this method creatively puts forward and realizes the multiple progressive detection from virtual environment and dynamic loading to loading file. Firstly, check whether the target app generates the Android virtual environment by checking the field value of the data structure in the Android Runtime (ART) environment. If it has the generation behavior, use hook technology to further detect the dynamic loading APK behavior, and then extract the sensitive permission API of the loaded APK file through static analysis. Finally, a progressive scoring standard model is designed to provide a basis for further manual detection. The effectiveness of this method is verified by an example study.

SummaryMulti‐core systems equipped with micro processing units and accelerators such as digital signal processors (DSPs) and graphics processing units (GPUs) have become a major trend in processor design in recent years in attempts to meet ever‐increasing application performance requirements. Open Computing Language (OpenCL) is one of the programming languages that include new extensions proposed to exploit the computing power of these kinds of processors. Among the newly extended language features, the single‐instruction multiple‐data (SIMD) linguistics and vector types are added to OpenCL to exploit hardware features of the accelerators. The addition makes it necessary to consider how traditional compiler data flow analysis can be adopted to meet the optimization requirements of vector linguistics. In this paper, we propose a calculus framework to support the data flow analysis of vector constructs for OpenCL programs that compilers can use to perform SIMD optimizations. We model OpenCL vector operations as data access functions in the style of mathematical functions. We then show that the data flow analysis for OpenCL vector linguistics can be performed based on the data access functions. Based on the information gathered from data flow analysis, we illustrate a set of SIMD optimizations on OpenCL programs. The experimental results incorporating our calculus and our proposed compiler optimizations show that the proposed SIMD optimizations can provide average performance improvements of 22% on x86 CPUs and 4% on advanced micro devices GPUs. For the selected 15 benchmarks, 11 of them are improved on x86 CPUs, and six of them are improved on advanced micro devices GPUs. The proposed framework has the potential to be used to construct other SIMD optimizations on OpenCL programs. Copyright © 2015 John Wiley & Sons, Ltd.

Modern compilers are still built using technology that existed decades ago. These include basic algorithms and techniques for lexing, parsing, data-flow analysis, data dependence analysis, vectorization, register allocation, instruction selection, and instruction scheduling. It is high time that we modernize our compiler toolchain. In this talk, I will show the path to the modernization of one important compiler technique -- vectorization. Vectorization was first introduced in the era of Cray vector processors during the 1980's. In modernizing vectorization, I will first show how to use new techniques that better target modern hardware. While vector supercomputers need large vectors, which are only available by parallelizing loops, modern SIMD instructions efficiently work on short vectors. Thus, in 2000, we introduced Superword Level Parallelism (SLP) based vectorization. SLP finds short vector instructions within basic blocks, and by loop unrolling we can convert vector parallelism to SLP. Next, I will show how we can take advantage of the power of modern computers for compilation, by using more accurate but expensive techniques to improve SLP vectorization. Due to the hardware resource constraints of the era, like many other compiler optimizations, SLP implementation was a greedy algorithm. In 2018, we introduced goSLP, which uses integer linear programming to find an optimal instruction packing strategy and achieves 7.58% geomean performance improvement over the LLVM's SLP implementation on SPEC2017fp C/C++ programs. Finally, I will show how to truly modernize a compiler by automatically learning the necessary components of the compiler with Ithemal and Vemal. The optimality of goSLP is under LLVM's simple per instruction additive cost model that fits within the Integer programming framework. However, the actual cost of execution in a modern out-of-order, pipelined, superscalar processor is much more complex. Manually building such cost models as well as manually developing compiler optimizations is costly, tedious, error-prone and is hard to keep up with the architectural changes. Ithemal is the first learnt cost model for predicting the throughput of x86 basic blocks. It not only significantly outperforms (more than halves the error) state-of-the-art analytical hand-written tools like llvm-mca, but also is learnt from data requiring minimal human effort. Vemal is a learnt policy for end-to-end vectorization as opposed to tuning heuristics, which outperforms LLVM's SLP vectorizer. These data-driven techniques can help achieve state-of-the-art results while also reducing the development and maintenance burden of the compiler developer.

The widespread availability of mobile devices equipped with sensors on board is strongly pushing towards the development of smart spaces -- offices, streets, hospital, airports, homes and shops equipped with sensing systems to help people find relevant information quickly and use services comfortably, often in a collaborative way. A common aspect in these scenarios is that the technology complexity is amplified by the organisational and procedural complexity of the application domain: this is in fact typical of socio-technical systems -- kinds of systems that inherently need to be conceived, designed and developed taking into account both the technological and the human/organisational aspects from the earliest stages. In this paper, we select and discuss some challenges in the definition and development of adaptive socio-technical systems for smart spaces, the selected challenges aim at focusing in particular on (i) a socio-technical model and process, (ii) a multi-level integration framework, and (iii) methods and system analysis techniques for runtime adaptation. In fact, designing such systems requires the suitable combination of enabling technologies into an operational framework, integrating and coordinating a multiplicity of processes managed by complex organisations, each made up of independent and autonomous units.

Toward a more dependable hybrid analysis of android malware using aspect-oriented programming

Most African societies practice a patriarchal family system that endows a man with authority and dominance in the family and society with a defined role of being the breadwinner of the home. A man is expected to have a great influence in determining the ideal number of children in the family and take a domineering role in decision-making, especially those related to household resource allocation. Therefore, this study examines the relationship between men’s wealth status and an ideal number of children. The study used secondary data from the National Demographic Health Survey (NDHS) from 2003 to 2018. The objectives were achieved using descriptive and inferential statistics, including frequency, mean, ANOVA, and multilevel analysis techniques. Wealth status significantly influenced the ideal number of children considering the crude and adjusted regression analysis. After adjusting for individual-level and contextual factors, the odd ratio of ideal number of children was significantly lower among men in the richest categories of the wealth index. Moreover, men with two wives and above, uneducated men, Northern residents, men living in high community family norms, low community family planning, high community poverty, and low community level of education desired a high number of children. The analyses suggest the need for a consideration of community structures to provide lucrative employment for men and would experience an appreciable fertility decline in line with the objectives and targets stated in Nigeria’s population policies and programmes.

Graph Neural Networks (GNNs) have been increasingly deployed in a plethora of applications. However, the graph data used for training may contain sensitive personal information of the involved individuals. Once trained, GNNs typically encode such information in their learnable parameters. As a consequence, privacy leakage may happen when the trained GNNs are deployed and exposed to potential attackers. Facing such a threat, machine unlearning for GNNs has become an emerging technique that aims to remove certain personal information from a trained GNN. Among these techniques, certified unlearning stands out, as it provides a solid theoretical guarantee of the information removal effectiveness. Nevertheless, most of the existing certified unlearning methods for GNNs are only designed to handle node and edge unlearning requests. Meanwhile, these approaches are usually tailored for either a specific design of GNN or a specially designed training objective. These disadvantages significantly jeopardize their flexibility. In this paper, we propose a principled framework named IDEA to achieve flexible and certified unlearning for GNNs. Specifically, we first instantiate four types of unlearning requests on graphs, and then we propose an approximation approach to flexibly handle these unlearning requests over diverse GNNs. We further provide theoretical guarantee of the effectiveness for the proposed approach as a certification. Different from existing alternatives, IDEA is not designed for any specific GNNs or optimization objectives to perform certified unlearning, and thus can be easily generalized. Extensive experiments on real-world datasets demonstrate the superiority of IDEA in multiple key perspectives.

Rapid development of web 2.0 and social networks brings convenience for users' information sharing. The thriving of information sharing inevitably leaves users' private information vulnerable to leakage. Weighted social networks can provide more personal information than unweighted social networks, such as those weight based information. Weight based information (weight distribution, shortest paths etc.) can be not only the objects needing preserving but also clues grasped by adversaries to initiate identity re-identification. Most of current work however overlooks this kind of privacy leakage incurred by adversaries' grasping of some weight distribution information. In this paper, we propose a Hellinger distance based privacy model (k, λ)-similarity to surmount the problem of sensitive identity re-identification leveraging background knowledge of weight distribution. Particularly, a sliding window and binary approximation based data perturbation algorithm SWBADP is devised to realize (k, λ)-similarity privacy constraint. Further, concerning the potential privacy leakage originated from merely k-degree anonymous, an optimization criterion, called depth clustering, is discussed to address the problem. The empirical studies demonstrate our implementation delivers both well defense capability to sensitive identity re-identification and better weight based data utility.

Edge-based differential privacy computing for sensor–cloud systems

As the rapid development of online social networks, the service providers collect a tremendous amount of personal data. They have the potential motivation to sell the users’ data for extra profits. To figure out the trading strategy of the service providers, we should understand the users’ behavior after they realized privacy leaked. In this paper, we build the users’ utility function and information diffusion model about privacy leakage. We take advantage of agent-based model to simulate the evolution of online social network after privacy leaked. Our result shows the service providers are almost certain to sell some personal data. If users are very attention to their privacy, the service providers more likely sell all the data.

Differential privacy is a privacy scheme in which a database is modified such that each users personal data are protected without affecting significantly the characteristics of the whole data. Example of such mechanism is Randomized Aggregatable Privacy-Preserving Ordinal Response (RAPPOR). Later it is found that the interpretations of privacy, accuracy and utility parameters in differential privacy are not totally clear. Therefore in this article an alternative definition of privacy aspect are proposed, where they are measured in term of Shannon entropy. Here Shannon entropy can be interpreted as number of binary questions an aggregator needs to ask in order to learn information from a modified database. Then privacy leakage of a differentially private mechanism is defined as mutual information between original distribution of an attribute in a database and its modified version. Furthermore, some simulations using the MATLAB software for special cases in RAPPOR are also presented to show that this alternative definition does make sense.