arXiv subjects

Ting Su

Publications and source records attributed to Ting Su.

At least 37 records · Page 2Linked to original sources

arXiv2024

BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering

Protocol reverse engineering (PRE) aims to infer the specification of network protocols when the source code is not available. Specifically, field inference is one crucial step in PRE to infer the field formats and semantics. To perform field inference, binary analysis based PRE techniques are one major approach category. However, such techniques face two key challenges - (1) the format inference is fragile when the logics of processing input messages may vary among different protocol implementations, and (2) the semantic inference is limited by inadequate and inaccurate inference rules. To tackle these challenges, we present BinPRE, a binary analysis based PRE tool. BinPRE incorporates (1) an instruction-based semantic similarity analysis strategy for format extraction; (2) a novel library composed of atomic semantic detectors for improving semantic inference adequacy; and (3) a cluster-and-refine paradigm to further improve semantic inference accuracy. We have evaluated BinPRE against five existing PRE tools, including Polyglot, AutoFormat, Tupni, BinaryInferno and DynPRE. The evaluation results on eight widely-used protocols show that BinPRE outperforms the prior PRE tools in both format and semantic inference. BinPRE achieves the perfection of 0.73 on format extraction and the F1-score of 0.74 (0.81) on semantic inference of types (functions), respectively. The field inference results of BinPRE have helped improve the effectiveness of protocol fuzzing by achieving 5-29% higher branch coverage, compared to those of the best prior PRE tool. BinPRE has also helped discover one new zero-day vulnerability, which otherwise cannot be found.

cs.SE↗

arXiv2024

An Empirical Study of False Negatives and Positives of Static Code Analyzers From the Perspective of Historical Issues

Static code analyzers are widely used to help find program flaws. However, in practice the effectiveness and usability of such analyzers is affected by the problems of false negatives (FNs) and false positives (FPs). This paper aims to investigate the FNs and FPs of such analyzers from a new perspective, i.e., examining the historical issues of FNs and FPs of these analyzers reported by the maintainers, users and researchers in their issue repositories -- each of these issues manifested as a FN or FP of these analyzers in the history and has already been confirmed and fixed by the analyzers' developers. To this end, we conduct the first systematic study on a broad range of 350 historical issues of FNs/FPs from three popular static code analyzers (i.e., PMD, SpotBugs, and SonarQube). All these issues have been confirmed and fixed by the developers. We investigated these issues' root causes and the characteristics of the corresponding issue-triggering programs. It reveals several new interesting findings and implications on mitigating FNs and FPs. Furthermore, guided by some findings of our study, we designed a metamorphic testing strategy to find FNs and FPs. This strategy successfully found 14 new issues of FNs/FPs, 11 of which have been confirmed and 9 have already been fixed by the developers. Our further manual investigation of the studied analyzers revealed one rule specification issue and additional four FNs/FPs due to the weaknesses of the implemented static analysis. We have made all the artifacts (datasets and tools) publicly available at https://zenodo.org/doi/10.5281/zenodo.11525129.

cs.SE↗

arXiv2023

Software Engineering for OpenHarmony: A Research Roadmap

Mobile software engineering has been a hot research topic for decades. Our fellow researchers have proposed various approaches (with over 7,000 publications for Android alone) in this field that essentially contributed to the great success of the current mobile ecosystem. Existing research efforts mainly focus on popular mobile platforms, namely Android and iOS. OpenHarmony, a newly open-sourced mobile platform, has rarely been considered, although it is the one requiring the most attention as OpenHarmony is expected to occupy one-third of the market in China (if not in the world). To fill the gap, we present to the mobile software engineering community a research roadmap for encouraging our fellow researchers to contribute promising approaches to OpenHarmony. Specifically, we start by presenting a literature review of mobile software engineering, attempting to understand what problems have been targeted by the mobile community and how they have been resolved. We then summarize the existing (limited) achievements of OpenHarmony and subsequently highlight the research gap between Android/iOS and OpenHarmony. This research gap eventually helps in forming the roadmap for conducting software engineering research for OpenHarmony.

cs.SE↗

arXiv2023

Model-driven CT reconstruction algorithm for nano-resolution X-ray phase contrast imaging

The low-density imaging performance of a zone plate based nano-resolution hard X-ray computed tomography (CT) system can be significantly improved by incorporating a grating-based Lau interferometer. Due to the diffraction, however, the acquired nano-resolution phase signal may suffer splitting problem, which impedes the direct reconstruction of phase contrast CT (nPCT) images. To overcome, a new model-driven nPCT image reconstruction algorithm is developed in this study. In it, the diffraction procedure is mathematically modeled into a matrix B, from which the projections without signal splitting can be generated invertedly. Furthermore, a penalized weighed least-square model with total variation (PWLS-TV) is employed to denoise these projections, from which nPCT images with high accuracy are directly reconstructed. Numerical and physical experiments demonstrate that this new algorithm is able to work with phase projections having any splitting distances. Results also reveal that nPCT images with higher signal-to-noise-ratio (SNR) would be reconstructed from projections with larger signal splittings. In conclusion, a novel model-driven nPCT image reconstruction algorithm with high accuracy and robustness is verified for the Lau interferometer based hard X-ray nano-resolution phase contrast imaging.

eess.IV↗

arXiv2023

Super resolution dual-layer CBCT imaging with model-guided deep learning

Objective: This study aims at investigating a novel super resolution CBCT imaging technique with the dual-layer flat panel detector (DL-FPD). Approach: In DL-FPD based CBCT imaging, the low-energy and high-energy projections acquired from the top and bottom detector layers contain intrinsically mismatched spatial information, from which super resolution CBCT images can be generated. To explain, a simple mathematical model is established according to the signal formation procedure in DL-FPD. Next, a dedicated recurrent neural network (RNN), named as suRi-Net, is designed by referring to the above imaging model to retrieve the high resolution dual-energy information. Different phantom experiments are conducted to validate the performance of this newly developed super resolution CBCT imaging method. Main Results: Results show that the proposed suRi-Net can retrieve high spatial resolution information accurately from the low-energy and high-energy projections having lower spatial resolution. Quantitatively, the spatial resolution of the reconstructed CBCT images of the top and bottom detector layers is increased by about 45% and 54%, respectively. Significance: In future, suRi-Net provides a new approach to achieve high spatial resolution dual-energy imaging in DL-FPD based CBCT systems.

physics.med-ph↗

arXiv2023

FREPA: An Automated and Formal Approach to Requirement Modeling and Analysis in Aircraft Control Domain

Formal methods are promising for modeling and analyzing system requirements. However, applying formal methods to large-scale industrial projects is a remaining challenge. The industrial engineers are suffering from the lack of automated engineering methodologies to effectively conduct precise requirement models, and rigorously validate and verify (V&V) the generated models. To tackle this challenge, in this paper, we present a systematic engineering approach, named Formal Requirement Engineering Platform in Aircraft (FREPA), for formal requirement modeling and V\&V in the aerospace and aviation control domains. FREPA is an outcome of the seamless collaboration between the academy and industry over the last eight years. The main contributions of this paper include 1) an automated and systematic engineering approach FREPA to construct requirement models, validate and verify systems in the aerospace and aviation control domain, 2) a domain-specific modeling language AASRDL to describe the formal specification, and 3) a practical FREPA-based tool AeroReq which has been used by our industry partners. We have successfully adopted FREPA to seven real aerospace gesture control and two aviation engine control systems. The experimental results show that FREPA and the corresponding tool AeroReq significantly facilitate formal modeling and V&V in the industry. Moreover, we also discuss the experiences and lessons gained from using FREPA in aerospace and aviation projects.

cs.SE↗

arXiv2023

ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing

Java deserialization vulnerability is a severe threat in practice. Researchers have proposed static analysis solutions to locate candidate vulnerabilities and fuzzing solutions to generate proof-of-concept (PoC) serialized objects to trigger them. However, existing solutions have limited effectiveness and efficiency. In this paper, we propose a novel hybrid solution ODDFUZZ to efficiently discover Java deserialization vulnerabilities. First, ODDFUZZ performs lightweight static taint analysis to identify candidate gadget chains that may cause deserialization vulner-abilities. In this step, ODDFUZZ tries to locate all candidates and avoid false negatives. Then, ODDFUZZ performs directed greybox fuzzing (DGF) to explore those candidates and generate PoC testcases to mitigate false positives. Specifically, ODDFUZZ applies a structure-aware seed generation method to guarantee the validity of the testcases, and adopts a novel hybrid feedback and a step-forward strategy to guide the directed fuzzing. We implemented a prototype of ODDFUZZ and evaluated it on the popular Java deserialization repository ysoserial. Results show that, ODDFUZZ could discover 16 out of 34 known gadget chains, while two state-of-the-art baselines only identify three of them. In addition, we evaluated ODDFUZZ on real-world applications including Oracle WebLogic Server, Apache Dubbo, Sonatype Nexus, and protostuff, and found six previously unreported exploitable gadget chains with five CVEs assigned.

cs.CR↗

arXiv2022

Matroids over Skew Tracts

Matroids over tracts provide an algebraic framework simultaneously generalizing the notions of matroids, oriented matroids, and valuated matroids, presented by Baker and Bowler. Pendavingh partially extended this theory to skew hyperfields and presented a new axiom system in terms of quasi-Plücker coordinates. We present a theory of matroids over skew tracts, which generalizes both the theory of matroids over tracts and the theory of weak matroids over skew hyperfields developed by Pendavingh. We give several cryptomorphic axiom systems for such matroids in terms of circuits, quasi-Plücker coordinates and dual pairs.

math.CO↗

arXiv2022

Leveraging Users' Social Network Embeddings for Fake News Detection on Twitter

Social networks (SNs) are increasingly important sources of news for many people. The online connections made by users allows information to spread more easily than traditional news media (e.g., newspaper, television). However, they also make the spread of fake news easier than in traditional media, especially through the users' social network connections. In this paper, we focus on investigating if the SNs' users connection structure can aid fake news detection on Twitter. In particular, we propose to embed users based on their follower or friendship networks on the Twitter platform, so as to identify the groups that users form. Indeed, by applying unsupervised graph embedding methods on the graphs from the Twitter users' social network connections, we observe that users engaged with fake news are more tightly clustered together than users only engaged in factual news. Thus, we hypothesise that the embedded user's network can help detect fake news effectively. Through extensive experiments using a publicly available Twitter dataset, our results show that applying graph embedding methods on SNs, using the user connections as network information, can indeed classify fake news more effectively than most language-based approaches. Specifically, we observe a significant improvement over using only the textual information (i.e., TF.IDF or a BERT language model), as well as over models that deploy both advanced textual features (i.e., stance detection) and complex network features (e.g., users network, publishers cross citations). We conclude that the Twitter users' friendship and followers network information can significantly outperform language-based approaches, as well as the existing state-of-the-art fake news detection models that use a more sophisticated network structure, in classifying fake news on Twitter.

cs.SI↗

arXiv2022

Entity-Assisted Language Models for Identifying Check-worthy Sentences

We propose a new uniform framework for text classification and ranking that can automate the process of identifying check-worthy sentences in political debates and speech transcripts. Our framework combines the semantic analysis of the sentences, with additional entity embeddings obtained through the identified entities within the sentences. In particular, we analyse the semantic meaning of each sentence using state-of-the-art neural language models such as BERT, ALBERT, and RoBERTa, while embeddings for entities are obtained from knowledge graph (KG) embedding models. Specifically, we instantiate our framework using five different language models, entity embeddings obtained from six different KG embedding models, as well as two combination methods leading to several Entity-Assisted neural language models. We extensively evaluate the effectiveness of our framework using two publicly available datasets from the CLEF' 2019 & 2020 CheckThat! Labs. Our results show that the neural language models significantly outperform traditional TF.IDF and LSTM methods. In addition, we show that the ALBERT model is consistently the most effective model among all the tested neural language models. Our entity embeddings significantly outperform other existing approaches from the literature that are based on similarity and relatedness scores between the entities in a sentence, when used alongside a KG embedding.

cs.CL↗

arXiv2022

Super resolution dual-energy cone-beam CT imaging with dual-layer flat-panel detector

For medical cone-beam computed tomography (CBCT) imaging, the native receptor array of the flat-panel detector (FPD) is usually binned into a reduced matrix size. By doing so, the signal readout speed can be increased by over 4-9 times at the expense of sacrificing the spatial resolution by at least 50%-67%. Clearly, such tradition poses a main bottleneck in generating high spatial resolution and high temporal resolution CBCT images at the same time. In addition, the conventional FPD is also difficult in generating dual-energy CBCT images. In this paper, we propose an innovative super resolution dual-energy CBCT imaging method, named as suRi, based on dual-layer FPD (DL-FPD) to overcome these aforementioned difficulties at once. With suRi, specifically, an 1D or 2D sub-pixel (half pixel in this study) shifted binning is applied to replace the conventionally aligned binning to double the spatial sampling rate during the dual-energy data acquisition. As a result, the suRi approach provides a new strategy to enable high signal readout speed and high spatial resolution CBCT imaging with FPD. Moreover, a penalized likelihood material decomposition algorithm is developed to directly reconstruct the high resolution bases from the dual-energy CBCT projections containing spatial sub-pixel shifts. Experiments based on the single-layer FPD and DL-FPD are performed with physical phantoms and biological specimen to validate this newly developed suRi method. The synthesized monochromatic CT imaging results demonstrate that suRi can significantly improve the spatial image resolution by 46.15%. We believe the developed suRi method would be capable to greatly enhance the imaging performance of the DL-FPD based dual-energy CBCT systems in future.

physics.med-ph↗

arXiv2022

CMOS based high-resolution dynamic X-ray imaging with inorganic perovskite

High-resolution dynamic X-ray detector is crucial for time-resolved digital radiography (DR) imaging and fast 3D medical computed tomography (CT) imaging. Recently, perovskites have become promising alternatives to conventional semi-conductor materials, e.g., Si, a-Se and CdTe, for direct X-ray detection. However, the feasibility of their combination with high-speed pixelated complementary metal-oxide-semiconductor (CMOS) arrays remains unknown. This work originally reports an innovative direct-conversion X-ray detector fabricated with 300 micrometer thick inorganic perovskite film printed on a tailored CMOS array. In-house measurements demonstrate that the CsPbBr3 film has excellent optoelectric properties of an electron mobility-lifetime product of 3.40x10$^{-5}$ cm$^2$ V$^{-1}$, and the X-ray detector exhibits high sensitivity of 9341uC Gy$_{\rm air}^{-1}$ cm$^{-2}$, and low detection limit of 588 nGy$_{\rm air}^{-1}$. This CMOS X-ray imaging detector achieves a high spatial resolution up to 5.5 lp/mm (close to the resolution limit of 6.0 lp/mm), and >300 frame per second (fps) readout speed. DR image of a resolution pattern phantom and a anesthesia mice, CT images of a biological specimen are acquired for the first time.

physics.app-ph↗

arXiv2022

Detecting and Fixing Data Loss Issues in Android Apps

Android apps are event-driven, and their execution is often interrupted by external events. This interruption can cause data loss issues that annoy users. For instance, when the screen is rotated, the current app page will be destroyed and recreated. If the app state is improperly preserved, user data will be lost. In this work, we present an approach and tool iFixDataloss that automatically detects and fixes data loss issues in Android apps. To achieve this, we identify scenarios in which data loss issues may occur, develop strategies to reveal data loss issues, and design patch templates to fix them. Our experiments on 66 Android apps show iFixDataloss detected 374 data loss issues (284 of them were previously unknown) and successfully generated patches for 188 of the 374 issues. Out of 20 submitted patches, 16 have been accepted by developers. In comparison with state-of-the-art techniques, iFixDataloss performed significantly better in terms of the number of detected data loss issues and the quality of generated patches.

cs.SE↗

arXiv2022

Matroids of Gain Signed Graphs

A signed graph has edge signs. A gain graph has oriented edge gains drawn from a group. We define the combination of the two for the abelian case, in which each oriented edge of a signed graph has a gain from an abelian group, concentrating on the case of the additive group of a field. We develop the elementary graph properties, the associated matroid, and the vector and hyperplanar representations.

math.CO↗

arXiv2022

Dual-domain Attention-based Deep Network for Sparse-view CT Artifact Reduction

Due to the wide applications of X-ray computed tomography (CT) in medical imaging activities, radiation exposure has become a major concern for public health. Sparse-view CT is a promising approach to reduce the radiation dose by down-sampling the total number of acquired projections. However, the CT images reconstructed by this sparse-view imaging approach suffer from severe streaking artifacts and structural information loss. In this work, an end-to-end dual-domain attention-based deep network (DDANet) is proposed to solve such an ill-posed CT image reconstruction problem. The image-domain CT image and the projection-domain sinogram are put into the two parallel sub-networks of the DDANet to independently extract the distinct high-level feature maps. In addition, a specified attention module is introduced to fuse the aforementioned dual-domain feature maps to allow complementary optimizations of removing the streaking artifacts and mitigating the loss of structure. Numerical simulations, anthropomorphic thorax phantom and in vivo pre-clinical experiments are conducted to verify the sparse-view CT imaging performance of the DDANet. Results demonstrate that this newly developed approach is able to robustly remove the streaking artifacts while maintaining the fine structures. As a result, the DDANet provides a promising solution in achieving high quality sparse-view CT imaging.

physics.med-ph↗

arXiv2021

High-performance Estimation of Jamming Covariance Matrix for IRS-aided Directional Modulation Network with a Malicious Attacker

In this paper, we investigate the anti-jamming problem of a directional modulation (DM) system with the aid of intelligent reflecting surface (IRS). As an efficient tool to combat malicious jamming, receive beamforming (RBF) is usually designed to be on null-space of jamming channel or covariance matrix from Mallory to Bob. Thus, it is very necessary to estimate the receive jamming covariance matrix (JCM) at Bob. To achieve a precise JCM estimate, three JCM estimation methods, including eigenvalue decomposition (EVD), parametric estimation method by gradient descend (PEM-GD) and parametric estimation method by alternating optimization (PEM-AO), are proposed. Here, the proposed EVD is under rank-2 constraint of JCM. The PEM-GD method fully explores the structure features of JCM and the PEM-AO is to decrease the computational complexity of the former via dimensionality reduction. The simulation results show that in low and medium jamming-noise ratio (JNR) regions, the proposed three methods perform better than the existing sample covariance matrix method. The proposed PEM-GD and PEM-AO outperform EVD method and existing clutter and disturbance covariance estimator RCML.

cs.IT↗

arXiv2021

Fully Automated Functional Fuzzing of Android Apps for Detecting Non-crashing Logic Bugs

Android apps are GUI-based event-driven software and have become ubiquitous in recent years. Obviously, functional correctness is critical for an app's success. However, in addition to crash bugs, non-crashing functional bugs (in short as "non-crashing bugs" in this work) like inadvertent function failures, silent user data lost and incorrect display information are prevalent, even in popular, well-tested apps. These non-crashing functional bugs are usually caused by program logic errors and manifest themselves on the graphic user interfaces (GUIs). In practice, such bugs pose significant challenges in effectively detecting them because (1) current practices heavily rely on expensive, small-scale manual validation (the lack of automation); and (2) modern fully automated testing has been limited to crash bugs (the lack of test oracles). This paper fills this gap by introducing independent view fuzzing, a novel, fully automated approach for detecting non-crashing functional bugs in Android apps. Inspired by metamorphic testing, our key insight is to leverage the commonly-held independent view property of Android apps to manufacture property-preserving mutant tests from a set of seed tests that validate certain app properties. The mutated tests help exercise the tested apps under additional, adverse conditions. Any property violations indicate likely functional bugs for further manual confirmation. We have realized our approach as an automated, end-to-end functional fuzzing tool, Genie. Given an app, (1) Genie automatically detects non-crashing bugs without requiring human-provided tests and oracles (thus fully automated); and (2) the detected non-crashing bugs are diverse (thus general and not limited to specific functional properties), which set Genie apart from prior work.

cs.SE↗

arXiv2021

Quality Assessment of DIBR-synthesized views: An Overview

The Depth-Image-Based-Rendering (DIBR) is one of the main fundamental technique to generate new views in 3D video applications, such as Multi-View Videos (MVV), Free-Viewpoint Videos (FVV) and Virtual Reality (VR). However, the quality assessment of DIBR-synthesized views is quite different from the traditional 2D images/videos. In recent years, several efforts have been made towards this topic, but there {is a lack of} detailed survey in {the} literature. In this paper, we provide a comprehensive survey on various current approaches for DIBR-synthesized views. The current accessible datasets of DIBR-synthesized views are firstly reviewed{, followed} by a summary analysis of the representative state-of-the-art objective metrics. Then, the performances of different objective metrics are evaluated and discussed on all available datasets. Finally, we discuss the potential challenges and suggest possible directions for future research.

eess.IV↗