arXiv subjects

Lili Wei

Publications and source records attributed to Lili Wei.

33 records · Page 2Linked to original sources

arXiv2023

$ω$Test: WebView-Oriented Testing for Android Applications

WebView is a UI widget that helps integrate web applications into the native context of Android apps. It provides powerful mechanisms for bi-directional interactions between the native-end (Java) and the web-end (JavaScript) of an Android app. However, these interaction mechanisms are complicated and have induced various types of bugs. To mitigate the problem, various techniques have been proposed to detect WebView-induced bugs via dynamic analysis, which heavily relies on executing tests to explore WebView behaviors. Unfortunately, these techniques either require manual effort or adopt random test generation approaches, which are not able to effectively explore diverse WebView behaviors. In this paper, we study the problem of test generation for WebViews in Android apps. Effective test generation for WebViews requires identifying the essential program properties to be covered by the generated tests. To this end, we propose WebView-specific properties to characterize WebView behaviors, and devise a cross-language dynamic analysis method to identify these properties. We develop $ω$Test, a test generation technique that searches for event sequences covering the identified WebView-specific properties. An evaluation on 74 real-world open-/closed-source Android apps shows that $ω$Test can cover diverse WebView behaviors and detect WebView-induced bugs effectively. $ω$Test detected 36 previously-unknown bugs. From the 22 bugs that we have reported to the app developers, 13 bugs were confirmed, 9 of which were fixed.

cs.SE↗

arXiv2023

Combatting Front-Running in Smart Contracts: Attack Mining, Benchmark Construction and Vulnerability Detector Evaluation

Front-running attacks have been a major concern on the blockchain. Attackers launch front-running attacks by inserting additional transactions before upcoming victim transactions to manipulate victim transaction executions and make profits. Recent studies have shown that front-running attacks are prevalent on the Ethereum blockchain and have caused millions of US dollars loss. Vulnerable smart contracts, blockchain programs invoked by transactions, are held responsible for front-running attacks. Although techniques to detect front-running vulnerabilities have been proposed, their performance on real-world vulnerable contracts is unclear. There is no large-scale benchmark based on real attacks to evaluate their capabilities. This motivates us to build a benchmark consisting of 513 real-world attacks with vulnerable code labeled in 235 distinct smart contracts. We propose automated techniques to effectively collect real-world attacks and localize the corresponding vulnerable code at scale. Our experiments show that our approaches are effective, achieving higher recall in finding real attacks and higher precision in pinpointing vulnerabilities compared to the existing techniques. The evaluation of seven state-of-the-art vulnerability detection techniques on the benchmark reveals their inadequacy in detecting front-running vulnerabilities, with a low recall of at most 6.04%. Our further analysis identifies four common limitations in existing techniques: lack of support for inter-contract analysis, inefficient constraint solving for cryptographic operations, improper vulnerability patterns, and lack of token support.

cs.SE↗

arXiv2021

ÐArcher: Detecting On-Chain-Off-Chain Synchronization Bugs in Decentralized Applications

Since the emergence of Ethereum, blockchain-based decentralized applications (DApps) have become increasingly popular and important. To balance the security, performance, and costs, a DApp typically consists of two layers: an on-chain layer to execute transactions and store crucial data on the blockchain and an off-chain layer to interact with users. A DApp needs to synchronize its off-chain layer with the on-chain layer proactively. Otherwise, the inconsistent data in the off-chain layer could mislead users and cause undesirable consequences, e.g., loss of transaction fees. However, transactions sent to the blockchain are not guaranteed to be executed and could even be reversed after execution due to chain reorganization. Such non-determinism in the transaction execution is unique to blockchain. DApp developers may fail to perform the on-chain-off-chain synchronization accurately due to their lack of familiarity with the complex transaction lifecycle. In this work, we investigate the challenges of synchronizing on-chain and off-chain data in Ethereum-based DApps. We present two types of bugs that could result in inconsistencies between the on-chain and off-chain layers. To help detect such on-chain-off-chain synchronization bugs, we introduce a state transition model to guide the testing of DApps and propose two effective oracles to facilitate the automatic identification of bugs. We build the first testing framework, DArcher, to detect on-chain-off-chain synchronization bugs in DApps. We have evaluated DArcher on 11 popular real-world DApps. DArcher achieves high precision (99.3%), recall (87.6%), and accuracy (89.4%) in bug detection and significantly outperforms the baseline methods. It has found 15 real bugs in the 11 DApps. So far, six of the 15 bugs have been confirmed by the developers, and three have been fixed. These promising results demonstrate the usefulness of DArcher.

cs.SE↗

arXiv2021

Characterizing Transaction-Reverting Statements in Ethereum Smart Contracts

Smart contracts are programs running on blockchain to execute transactions. When input constraints or security properties are violated at runtime, the transaction being executed by a smart contract needs to be reverted to avoid undesirable consequences. On Ethereum, the most popular blockchain that supports smart contracts, developers can choose among three transaction-reverting statements (i.e., require, if...revert, and if...throw) to handle anomalous transactions. While these transaction-reverting statements are vital for preventing smart contracts from exhibiting abnormal behaviors or suffering malicious attacks, there is limited understanding of how they are used in practice. In this work, we perform the first empirical study to characterize transaction-reverting statements in Ethereum smart contracts. We measured the prevalence of these statements in 3,866 verified smart contracts from popular dapps and built a taxonomy of their purposes via manually analyzing 557 transaction-reverting statements. We also compared template contracts and their corresponding custom contracts to understand how developers customize the use of transaction-reverting statements. Finally, we analyzed the security impact of transaction-reverting statements by removing them from smart contracts and comparing the mutated contracts against the original ones. Our study led to important findings, which can shed light on further research in the broad area of smart contract quality assurance and provide practical guidance to smart contract developers on the appropriate use of transaction-reverting statements.

cs.CR↗

arXiv2021

Characterizing and Detecting Configuration Compatibility Issues in Android Apps

XML configuration files are widely used in Android to define an app's user interface and essential runtime information such as system permissions. As Android evolves, it might introduce functional changes in the configuration environment, thus causing compatibility issues that manifest as inconsistent app behaviors at different API levels. Such issues can often induce software crashes and inconsistent look-and-feel when running at specific Android versions. Existing works incur plenty of false positive and false negative issue-detection rules by conducting trivial data-flow analysis while failing to model the XML tree hierarchies of the Android configuration files. Besides, little is known about how the changes in an Android framework can induce such compatibility issues. To bridge such gaps, we conducted a systematic study by analyzing 196 real-world issues collected from 43 popular apps. We identified common patterns of Android framework code changes that induce such configuration compatibility issues. Based on the findings, we propose \textsc{ConfDroid} that can automatically extract rules for detecting configuration compatibility issues. The intuition is to perform symbolic execution based on a model learned from the common code change patterns. Experiment results show that ConfDroid can successfully extract 282 valid issue-detection rules with a precision of 91.9%. Among them, 65 extracted rules can manifest issues that cannot be detected by the rules of state-of-the-art baselines. More importantly, 11 out of them have led to the detection of 107 reproducible configuration compatibility issues that the baselines cannot detect in 30 out of 316 real-world Android apps.

cs.SE↗

arXiv2021

Logging Practices with Mobile Analytics: An Empirical Study on Firebase

Software logs are of great value in both industrial and open-source projects. Mobile analytics logging enables developers to collect logs remotely from their apps running on end user devices at the cost of recording and transmitting logs across the Internet to a centralised infrastructure. This paper makes a first step in characterising logging practices with a widely adopted mobile analytics logging library, namely Firebase Analytics. We provide an empirical evaluation of the use of Firebase Analytics in 57 open-source Android applications by studying the evolution of code-bases to understand: a) the needs-in-common that push practitioners to adopt logging practices on mobile devices, and b) the differences in the ways developers use local and remote logging. Our results indicate mobile analytics logs are less pervasive and less maintained than traditional logging code. Based on our analysis, we believe logging using mobile analytics is more user centered compared to traditional logging, where the latter is mainly used to record information for debugging purposes.

cs.SE↗

arXiv2020

Comments on A New Parity Check Stopping Criterion for Turbo Decoding

A parity-check stopping (PCS) criterion for turbo decoding is proposed in [1], which shows its priority compared with the stopping criteria of Sign Change Ratio (SCR), Sign Difference Ratio (SDR), Cross Entropy (CE) and improved CEbased (Yu) method. But another well-known simple stopping criterion named Hard-Decision-Aided (HDA) criterion has not been compared in [1]. In this letter, through analysis we show that using max-log-MAP algorithm, PCS is equivalent to HDA; while simulations demonstrate that using log-MAP algorithm, PCS has nearly the same performance as HDA.

eess.SP↗

arXiv2020

Joint Shortening and Puncturing Optimization for Structured LDPC Codes

The demand for flexible broadband wireless services makes the pruning technique, including both shortening and puncturing, an indispensable component of error correcting codes. The analysis of the pruning process for structured lowdensity parity-check (LDPC) codes can be considerably simplified with their equivalent representations through base-matrices or protographs. In this letter, we evaluate the thresholds of the pruned base-matrices by using protograph based on extrinsic information transfer (PEXIT). We also provide an efficient method to optimize the pruning patterns, which can significantly improve the thresholds of both the full-length patterns and the sub-patterns. Numerical results show that the structured LDPC codes pruned by the improved patterns outperform those with the existing patterns.

eess.SP↗

arXiv2020

Increasing Security Degree of Freedom in Multi-user and Multi-eve Systems

Secure communication in the Multi-user and Multi-eavesdropper (MUME) scenario is considered in this paper. It has be shown that secrecy can be improved when the transmitter simultaneously transmits information-bearing signal to the intended receivers and artificial noise to confuse the eavesdroppers. Several processing schemes have been proposed to limit the co-channel interference (CCI). In this paper, we propose the increasing security degree of freedom (ISDF) method, which takes idea from the dirty-paper coding (DPC) and ZF beam-forming. By means of known interference pre-cancelation at the transmitter, we design each precoder according to the previously designed precoding matrices, rather than other users' channels, which in return provides extra freedom for the design of precoders. Simulations demonstrate that the proposed method achieves the better performance and relatively low complexity.

cs.IT↗

arXiv2020

Design of Convergence-Optimized Non-binary LDPC Codes over Binary Erasure Channel

In this letter, we present a hybrid iterative decoder for non-binary low density parity check (LDPC) codes over binary erasure channel (BEC), based on which the recursion of the erasure probability is derived to design non-binary LDPC codes with convergence-optimized degree distributions. The resulting one-step decoding tree is cycle-free and achieves lower decoding complexity. Experimental studies show that the proposed convergence-optimization algorithm accelerates the convergence process by 33%.

eess.SP↗

arXiv2020

Compute-and-Forward Network Coding Design over Multi-Source Multi-Relay Channels

Network coding is a new and promising paradigm for modern communication networks by allowing intermediate nodes to mix messages received from multiple sources. Compute-and-forward strategy is one category of network coding in which a relay will decode and forward a linear combination of source messages according to the observed channel coefficients, based on the algebraic structure of lattice codes. The destination will recover all transmitted messages if enough linear equations are received. In this work, we design in a system level, the compute-and-forward network coding coefficients by Fincke-Pohst based candidate set searching algorithm and network coding system matrix constructing algorithm, such that by those proposed algorithms, the transmission rate of the multi-source multi-relay system is maximized. Numerical results demonstrate the effectiveness of our proposed algorithms.

eess.SP↗

arXiv2020

Optimal Binary/Quaternary Adaptive Signature Design for Code-Division Multiplexing

We consider signature waveform design for synchronous code division multiplexing in the presence of interference and wireless multipath fading channels. The adaptive real/complex signature that maximizes the signal-to-interference-plus-noise ratio (SINR) at the output of the maximum-SINR filter is the minimum-eigenvalue eigenvector of the disturbance autocovariance matrix. In digital communication systems, the signature alphabet is finite and digital signature optimization is NP-hard. In this paper, first we convert the maximum-SINR objective of adaptive binary signature design into an equivalent minimization problem. Then we present an adaptive binary signature design algorithm based on modified Fincke-Pohst (FP) method that achieves the optimal exhaustive search performance with low complexity. In addition, with the derivation of quaternary-binary equivalence, we extend and propose the optimal adaptive signature design algorithm for quaternary alphabet. Numerical results demonstrate the optimality and complexity reduction of our proposed algorithms.

eess.SP↗

arXiv2020

Integer-Forcing Linear Receiver Design with Slowest Descent Method

Compute-and-forward (CPF) strategy is one category of network coding in which a relay will compute and forward a linear combination of source messages according to the observed channel coefficients, based on the algebraic structure of lattice codes. Recently, based on the idea of CPF, integer forcing (IF) linear receiver architecture for MIMO system has been proposed to recover different integer combinations of lattice codewords for further original message detection. In this paper, we consider the problem of IF linear receiver design with respect to the channel conditions. Instead of exhaustive search, we present practical and efficient suboptimal algorithms to design the IF coefficient matrix with full rank such that the total achievable rate is maximized, based on the slowest descent method. Numerical results demonstrate the effectiveness of our proposed algorithms.

eess.SP↗

arXiv2020

Optimal Upward Scaling of Minimum-TSC Binary Signature Sets

We consider upward scaling an overloaded min-TSC binary signature set and propose an optimal solution based on improved sphere decoding algorithm. Instead of previous suboptimal approach, we are guaranteed to find the optimal maximum-likelihood (ML) searching result with low complexity.

eess.SP↗

arXiv2016

DroidLeaks: Benchmarking Resource Leak Bugs for Android Applications

Resource leak bugs in Android apps are pervasive and can cause serious performance degradation and system crashes. In recent years, several resource leak detection techniques have been proposed to assist Android developers in correctly managing system resources. Yet, there exist no common bug benchmarks for effectively and reliably comparing such techniques and quantitatively evaluating their strengths and weaknesses. This paper describes our initial contribution towards constructing such a benchmark. To locate real resource leak bugs, we mined 124,215 code revisions of 34 large-scale open-source Android apps. We successfully found 298 fixed resource leaks, which cover a diverse set of resource classes, from 32 out of the 34 apps. To understand the characteristics of these bugs, we conducted an empirical study, which revealed the root causes of frequent resource leaks in Android apps and common patterns of faults made by developers. With our findings, we further implemented a static checker to detect a common pattern of resource leaks in Android apps. Experiments showed that the checker can effectively locate real resource leaks in popular Android apps, confirming the usefulness of our work.

cs.SE↗