Searcharxiv⌕ Search

arXiv subjects

Qiang Zeng

Publications and source records attributed to Qiang Zeng.

At least 55 records · Page 3Linked to original sources
arXiv2019

Privacy Leakage in Smart Homes and Its Mitigation: IFTTT as a Case Study

The combination of smart home platforms and automation apps introduces much convenience to smart home users. However, this also brings the potential for privacy leakage. If a smart home platform is permitted to collect all the events of a user day and night, then the platform will learn the behavior patterns of this user before long. In this paper, we investigate how IFTTT, one of the most popular smart home platforms, has the capability of monitoring the daily life of a user in a variety of ways that are hardly noticeable. Moreover, we propose multiple ideas for mitigating privacy leakages, which altogether forms a Filter-and-Fuzz (F&F) process: first, it filters out events unneeded by the IFTTT platform; then, it fuzzes the values and frequencies of the remaining events. We evaluate the F&F process, and the results show that the proposed solution makes IFTTT unable to recognize any of the user's behavior patterns.

cs.CR↗
arXiv2018

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

Given a closed-source program, such as most of proprietary software and viruses, binary code analysis is indispensable for many tasks, such as code plagiarism detection and malware analysis. Today, source code is very often compiled for various architectures, making cross-architecture binary code analysis increasingly important. A binary, after being disassembled, is expressed in an assembly languages. Thus, recent work starts exploring Natural Language Processing (NLP) inspired binary code analysis. In NLP, words are usually represented in high-dimensional vectors (i.e., embeddings) to facilitate further processing, which is one of the most common and critical steps in many NLP tasks. We regard instructions as words in NLP-inspired binary code analysis, and aim to represent instructions as embeddings as well. To facilitate cross-architecture binary code analysis, our goal is that similar instructions, regardless of their architectures, have embeddings close to each other. To this end, we propose a joint learning approach to generating instruction embeddings that capture not only the semantics of instructions within an architecture, but also their semantic relationships across architectures. To the best of our knowledge, this is the first work on building cross-architecture instruction embedding model. As a showcase, we apply the model to resolving one of the most fundamental problems for binary code similarity comparison---semantics-based basic block comparison, and the solution outperforms the code statistics based approach. It demonstrates that it is promising to apply the model to other cross-architecture binary code analysis tasks.

cs.CR↗
arXiv2018

Neural Machine Translation Inspired Binary Code Similarity Comparison beyond Function Pairs

Binary code analysis allows analyzing binary code without having access to the corresponding source code. A binary, after disassembly, is expressed in an assembly language. This inspires us to approach binary analysis by leveraging ideas and techniques from Natural Language Processing (NLP), a rich area focused on processing text of various natural languages. We notice that binary code analysis and NLP share a lot of analogical topics, such as semantics extraction, summarization, and classification. This work utilizes these ideas to address two important code similarity comparison problems. (I) Given a pair of basic blocks for different instruction set architectures (ISAs), determining whether their semantics is similar or not; and (II) given a piece of code of interest, determining if it is contained in another piece of assembly code for a different ISA. The solutions to these two problems have many applications, such as cross-architecture vulnerability discovery and code plagiarism detection. We implement a prototype system INNEREYE and perform a comprehensive evaluation. A comparison between our approach and existing approaches to Problem I shows that our system outperforms them in terms of accuracy, efficiency and scalability. And the case studies utilizing the system demonstrate that our solution to Problem II is effective. Moreover, this research showcases how to apply ideas and techniques from NLP to large-scale binary code analysis.

cs.SE↗
arXiv2018

Code-less Patching for Heap Vulnerabilities Using Targeted Calling Context Encoding

Exploitation of heap vulnerabilities has been on the rise, leading to many devastating attacks. Conventional heap patch generation is a lengthy procedure, requiring intensive manual efforts. Worse, fresh patches tend to harm system dependability, hence deterring users from deploying them. We propose a heap patching system that simultaneously has the following prominent advantages: (1) generating patches without manual efforts; (2) installing patches without altering the code (so called code-less patching); (3) handling various heap vulnerability types; (4) imposing a very low overhead; and (5) no dependency on specific heap allocators. As a separate contribution, we propose targeted calling context encoding, which is a suite of algorithms for optimizing calling context encoding, an important technique with applications in many areas. The system properly combines heavyweight offline attack analysis with lightweight online defense generation, and provides a new countermeasure against heap attacks. The evaluation shows that the system is effective and efficient.

cs.CR↗
arXiv2018

Existence of two-step replica symmetry breaking for the spherical mixed p-spin glass at zero temperature

We provide the first examples of two-step replica symmetry breaking (2-RSB) models for the spherical mixed p-spin glass at zero temperature. Precisely, we show that for a certain class of mixtures, the Parisi measure at zero temperature is purely atomic and has exactly three distinct points in its support. We then derive a few consequences for the topology of the random landscape in these cases. Our main result also provides a negative answer to a question raised in 2011 by Auffinger and Ben Arous about the classification of pure-like and full mixture models.

math.PR↗
arXiv2018

e-SAFE: Secure, Efficient and Forensics-Enabled Access to Implantable Medical Devices

To facilitate monitoring and management, modern Implantable Medical Devices (IMDs) are often equipped with wireless capabilities, which raise the risk of malicious access to IMDs. Although schemes are proposed to secure the IMD access, some issues are still open. First, pre-sharing a long-term key between a patient's IMD and a doctor's programmer is vulnerable since once the doctor's programmer is compromised, all of her patients suffer; establishing a temporary key by leveraging proximity gets rid of pre-shared keys, but as the approach lacks real authentication, it can be exploited by nearby adversaries or through man-in-the-middle attacks. Second, while prolonging the lifetime of IMDs is one of the most important design goals, few schemes explore to lower the communication and computation overhead all at once. Finally, how to safely record the commands issued by doctors for the purpose of forensics, which can be the last measure to protect the patients' rights, is commonly omitted in the existing literature. Motivated by these important yet open problems, we propose an innovative scheme e-SAFE, which significantly improves security and safety, reduces the communication overhead and enables IMD-access forensics. We present a novel lightweight compressive sensing based encryption algorithm to encrypt and compress the IMD data simultaneously, reducing the data transmission overhead by over 50% while ensuring high data confidentiality and usability. Furthermore, we provide a suite of protocols regarding device pairing, dual-factor authentication, and accountability-enabled access. The security analysis and performance evaluation show the validity and efficiency of the proposed scheme.

cs.CR↗
arXiv2017

Harmonic analysis approach to Gromov--Hausdorff convergence for noncommutative tori

We show that the rotation algebras are limit of matrix algebras in a very strong sense of convergence for algebras with additional Lipschitz structure. Our results generalize to higher dimensional noncommutative tori and operator valued coefficients. In contrast to previous results by Rieffel, Li, Kerr, and Latrémolière we use Lipschitz norms induced by the `carré du champ' of certain natural dynamical systems, including the heat semigroup.

math.OA↗
arXiv2017

Free monotone transport for infinite variables

We extend the free monotone transport theorem of Guionnet and Shlyakhtenko to the case of infinite variables. As a first application, we provide a criterion for when mixed $q$-Gaussian algebras are isomorphic to $L(\mathbb{F}_\infty)$; namely, when the structure array $Q$ of a mixed $q$-Gaussian algebra has uniformly small entries that decay sufficiently rapidly. Here a mixed $q$-Gaussian algebra with structure array $Q=(q_{ij})_{i,j\in\mathbb{N}}$ is the von Neumann algebra generated by $X_n^Q=l_n+l_n^*, n\in\mathbb{N}$ and $(l_n)$ are the Fock space representations of the commutation relation $l_i^*l_j-q_{ij}l_jl_i^*=δ_{i=j}, i,j\in\mathbb{N}$, $-1<q_{ij}=q_{ji}<1$.

math.OA↗
arXiv2016

Ultraproduct methods for mixed $q$-Gaussian algebras

We provide a unified ultraproduct approach for constructing Wick words in mixed $q$-Gaussian algebras, which are generated by $s_j=a_j+a_j^*$, $j=1,\cdots,N$, where $a_ia^*_j - q_{ij}a^*_ja_i =δ_{ij}$. Here we also allow equality in $-1\le q_{ij}=q_{ji}\le 1$. Using the ultraproduct method, we construct an approximate co-multiplication of the mixed $q$-Gaussian algebras. Based on this we prove that these algebras are weakly amenable and strongly solid in the sense of Ozawa and Popa. We also encode Speicher's central limit theorem in the unified ultraproduct method, and show that the Ornstein--Uhlenbeck semigroup is hypercontractive, the Riesz transform associated to the number operator is bounded, and the number operator satisfies the $L_p$ Poincaré inequalities with constants $C\sqrt{p}$.

math.OA↗
arXiv2016

Context-aware System Service Call-oriented Symbolic Execution of Android Framework with Application to Exploit Generation

Android Framework is a layer of software that exists in every Android system managing resources of all Android apps. A vulnerability in Android Framework can lead to severe hacks, such as destroying user data and leaking private information. With tens of millions of Android devices unpatched due to Android fragmentation, vulnerabilities in Android Framework certainly attract attackers to exploit them. So far, enormous manual effort is needed to craft such exploits. To our knowledge, no research has been done on automatic generation of exploits that take advantage of Android Framework vulnerabilities. We make a first step towards this goal by applying symbolic execution of Android Framework to finding bugs and generating exploits. Several challenges have been raised by the task. (1) The information of an app flows to Android Framework in multiple intricate steps, making it difficult to identify symbolic inputs. (2) Android Framework has a complex initialization phase, which exacerbates the state space explosion problem. (3) A straightforward design that builds the symbolic executor as a layer inside the Android system will not work well: not only does the implementation have to ensure the compatibility with the Android system, but it needs to be maintained whenever Android gets updated. We present novel ideas and techniques to resolve the challenges, and have built the first system for symbolic execution of Android Framework. It fundamentally changes the state of the art in exploit generation on the Android system, and has been applied to constructing new techniques for finding vulnerabilities.

cs.CR↗
arXiv2015

An application of free transport to mixed $q$-Gaussian algebras

We consider the mixed $q$-Gaussian algebras introduced by Speicher which are generated by the variables $X_i=l_i+l_i^*,i=1,\ldots,N$, where $l_i^* l_j-q_{ij}l_j l_i^*=δ_{i,j}$ and $-1<q_{ij}=q_{ji}<1$. Using the free monotone transport theorem of Guionnet and Shlyakhtenko, we show that the mixed $q$-Gaussian von Neumann algebras are isomorphic to the free group von Neumann algebra $L(\mathbb{F}_N)$, provided that $\max_{i,j}|q_{ij}|$ is small enough. The proof relies on some estimates which are generalizations of Dabrowski's results for the special case $q_{ij}\equiv q$.

math.OA↗
arXiv2015

Subgaussian 1-cocycles on discrete groups

We prove the $L_p$ Poincaré inequalities with constant $C\sqrt{p}$ for $1$-cocycles on countable discrete groups under Bakry--Emery's $Γ_2$-criterion. These inequalities determine an analogue of subgaussian behavior for 1-cocycles. Our theorem improves some of our previous results in this direction, and in particular implies Efraim and Lust-Piquard's Poincaré type inequalities for the Walsh system. The key new ingredient in our proof is a decoupling argument. As complementary results, we also show that the spectral gap inequality implies the $L_p$ Poincaré inequalities with constant $C{p}$ under some conditions in the noncommutative setting. New examples which satisfy the $Γ_2$-criterion are provided as well.

math.PR↗
arXiv2014

Hybrid Ant Colony Algorithm Clonal Selection in the Application of the Cloud's Resource Scheduling

In this paper, thinking over characteristics of ant colony optimization Algorithm, taking into account the characteristics of cloud computing, combined with clonal selection algorithm (CSA) global optimum advantage of the convergence of the clonal selection algorithm (CSA) into every ACO iteration, speeding up the convergence rate, and the introduction of reverse mutation strategy, ant colony optimization algorithm avoids local optimum. Depth study of the cloud environment ant colony clonal selection algorithm resource scheduling policy, clonal selection algorithm converges to solve optimization problems when sufficient condition for global optimal solution based on clonal selection algorithm for various applications such as BCA and CLONALG algorithm, using these sufficient condition to meet and simulation platform CloudSim achieve a simulation by extending the cloud. Experimental results show that this task can be shortened fusion algorithm running time cloud environment, improve resource utilization. Demonstrate the effectiveness of the method.

cs.DC↗
arXiv2013

Noncommutative martingale deviation and Poincaré type inequalities with applications

We prove a deviation inequality for noncommutative martingales by extending Oliveira's argument for random matrices. By integration we obtain a Burkholder type inequality with satisfactory constant. Using continuous time, we establish noncommutative Poincaré type inequalities for "nice" semigroups with a positive curvature condition. These results allow us to prove a general deviation inequality and a noncommutative transportation inequality due to Bobkov and Götze in the commutative case. To demonstrate our setting is general enough, we give various examples, including certain group von Neumann algebras, random matrices and classical diffusion processes, among others.

math.PR↗
arXiv2013

Noncommutative Bennett and Rosenthal inequalities

In this paper we extend the Bernstein, Prohorov and Bennett inequalities to the noncommutative setting. In addition we provide an improved version of the noncommutative Rosenthal inequality, essentially due to Nagaev, Pinelis and Pinelis, Utev for commutative random variables. We also present new best constants in Rosenthal's inequality. Applying these results to random Fourier projections, we recover and elaborate on fundamental results from compressed sensing, due to Candes, Romberg and Tao.

math.PR↗
arXiv2013

Poincaré type inequalities for group measure spaces and related transportation cost inequalities

Let $G$ be a countable discrete group with an orthogonal representation $α$ on a real Hilbert space $H$. We prove $L_p$ Poincaré inequalities for the group measure space $L_\infty(Ω_H,γ)\rtimes G$, where both the group action and the Gaussian measure space $(Ω_H, γ)$ are associated with the representation $α$. The idea of proof comes from Pisier's method on the boundedness of Riesz transform and Lust-Piquard's work on spin systems. Then we deduce a transportation type inequality from the $L_p$ Poincaré inequalities in the general noncommutative setting. This inequality is sharp up to a constant (in the Gaussian setting). Several applications are given, including Wiener/Rademacher chaos estimation and new examples of Rieffel's compact quantum metric spaces.

math.FA↗
arXiv2012

Adding Logical Operators to Tree Pattern Queries on Graph-Structured Data

As data are increasingly modeled as graphs for expressing complex relationships, the tree pattern query on graph-structured data becomes an important type of queries in real-world applications. Most practical query languages, such as XQuery and SPARQL, support logical expressions using logical-AND/OR/NOT operators to define structural constraints of tree patterns. In this paper, (1) we propose generalized tree pattern queries (GTPQs) over graph-structured data, which fully support propositional logic of structural constraints. (2) We make a thorough study of fundamental problems including satisfiability, containment and minimization, and analyze the computational complexity and the decision procedures of these problems. (3) We propose a compact graph representation of intermediate results and a pruning approach to reduce the size of intermediate results and the number of join operations -- two factors that often impair the efficiency of traditional algorithms for evaluating tree pattern queries. (4) We present an efficient algorithm for evaluating GTPQs using 3-hop as the underlying reachability index. (5) Experiments on both real-life and synthetic data sets demonstrate the effectiveness and efficiency of our algorithm, from several times to orders of magnitude faster than state-of-the-art algorithms in terms of evaluation time, even for traditional tree pattern queries with only conjunctive operations.

cs.DB↗