Hardware and software fingerprinting of mobile devices

This dissertation presents novel and practical algorithms to identify the software and hardware components on mobile devices. In particular, we make significant contributions in two challenging areas: library fingerprinting, to identify third-party software libraries, and device fingerprinting, to identify individual hardware components. Our work has significant implications for the privacy and security of mobile platforms. Software-based library fingerprinting can be used to detect vulnerable libraries and uncover large-scale data collection activities. We develop a novel Android library finger-printing tool, LibID, to reliably identify specific versions of in-app third-party libraries. LibID is more effective against code obfuscation than prior art. When comparing LibID with other tools in identifying the correct library version using obfuscated F-Droid apps, LibID achieves an F1 score of more than 0.5 in all cases while prior work is below 0.25. We also demonstrate the utility of LibID by detecting the use of a vulnerable version of the OkHttp library in nearly 10% of the 3 958 popular apps on the Google Play Store. Hardware-based device fingerprinting allows apps and websites to invade user privacy by tracking user activity online as the user moves between apps or websites. In particular, we present a new type of device fingerprinting attack, the factory calibration fingerprinting attack, that recovers embedded per-device factory calibration data from motion sensors in a smartphone. We investigate the calibration behaviour of each sensor and show that the calibration fingerprint is fast to generate, does not change over time or after a factory reset, and can be obtained without any special user permissions. We estimate the entropy of the calibration fingerprint and find the fingerprint is very likely to be globally unique for iOS devices (~67 bits of entropy for iPhone 6S) and recent Google Pixel devices (~57 bits of entropy for Pixel 4/4 XL). By comparison, the fingerprint generated by previous work has at most 13 bits of entropy. Following our disclosures, Apple deployed a fix in iOS 12.2 and Google in Android 11. Both code obfuscation and factory calibration help to hide software and hardware idiosyncrasies from third-parties, but this dissertation demonstrates that reliable software and hardware fingerprints can still be generated given sufficient knowledge and a suitable approach. Our work has significant practical implications and can be used to improve platform security and protect user privacy.China Scholarship Council The Boeing Company Microsoft Researc

Metrics and Visualizations for Managing Value Creation in Continuous Software Engineering

Digitalized society is built on top of software. The supplier of a software system delivers valuable new features to the users of the system in small increments in a continuous manner. To achieve continuous delivery of new features, new versions of software are delivered in rapid cycles. The goal is to get timely feedback from the stakeholders of the system in order to deliver business value.The development team needs timely information of the process to be able to improve it. A demonstrative overview of the process helps to get better understanding about the development process. Moreover, the development team is often willing to get retrospective information of the process in order to improve it and to maintain the flow of continuous value creation.The team uses various tools in the daily software engineering activities. The tools generate vast amount of data concerning the development process. For instance, issue management and version control systems hold detailed information on the actual development process. Mining software repositories provides a data-driven view to the development process.In this thesis, novel metrics and visualizations were built on top of the data. The developed artifacts help to understand and manage the value creation process. With this novel, demonstrative information, lean continuous improvement of the development process is made possible. With the novel metrics and visualizations, the development organization can get such new information on the process which is not easily available otherwise.The new information the metrics and visualizations provide help to different stakeholders of the project to get insight of the development process. The automatically generated data reflects the actual events in the development. The novel metrics and visualizations provide a practical tool for management purposes and continuous software process improvement

プログラムの解析、テスト、修復のための表現学習

学位の種別: 課程博士審査委員会委員 : （主査）東京大学特任准教授 松尾 豊, 東京大学教授 和泉 潔, 東京大学准教授 阿部 力也, 東京大学准教授 森 純一郎, 国立情報学研究所教授 蓮尾 一郎University of Tokyo(東京大学

Beyond Similar Code: Leveraging Social Coding Websites

Programmers often write code with similarity to existing code written somewhere. Code search tools can help developers find similar solutions and identify possible improvements. For code search tools, good search results rely on valid data collection. Social coding websites, such as Question & Answer forum Stack Overflow (SO) and project repository GitHub, are popular destinations when programmers look for how to achieve certain programming tasks. Over the years, SO and GitHub have accumulated an enormous knowledge base of, and around, code. Since these software artifacts are publicly available, it is possible to leverage them in code search tools. This dissertation explores the opportunities of leveraging software artifacts from the social coding websites in searching for not just similar, but related, code. Programmers query SO and GitHub extensively to search for suitable code for reuse, however, not much is known about the usability or quality of the available code from each website. This dissertation first investigates under what circumstances the software artifacts found in social coding websites can be leveraged for purposes other than their immediate use by developers. It points out a number of problems that need to be addressed before those artifacts can be leveraged for code search and development tools. Specifically, triviality, fragility, and duplication, dominate these artifacts. However, when these problems are addressed, there is still a considerable amount of good quality artifacts that can be leveraged.SO and GitHub are not only two separate data resources, moreover, they together, belong to a larger system of software development process: the same users that rely on facilities of GitHub often seeks support on SO for their problems, and return to GitHub to apply the knowledge acquired. This dissertation further studies the crossover of software artifacts between SO and GitHub, and categorizes the adaptations from a SO code snippet to its GitHub counterparts. Existing search tools only recommend other code locations that are syntactically or semantically similar to the given code but do not reason about other kinds of relevant code that a developer should also pay attention to, e.g., auxiliary code to accomplish a complete task. With the good quality software artifacts and crossover between the two systems available, this dissertation presents two approaches that leverage these artifacts in searching for related code. Aroma indexes GitHub projects, takes a partial code snippet as input, searches the corpus for methods containing the partial code snippet, and clusters and intersects the results of the search to recommend. Aroma is evaluated on randomly selected queries created from the GitHub corpus, as well as queries derived from SO code snippets. It recommends related code for error checking and handling, objects configuring, etc. Furthermore, a user study is conducted where industrial developers are asked to complete programming tasks using Aroma and provide feedback. The results indicate that Aroma is capable of retrieving and recommending relevant code snippets efficiently. CodeAid reuses the crossover between SO and GitHub and recommends related code outside of a method body. For each SO snippet as a query, CodeAid retrieves the co-occurring code fragments for its GitHub counterparts and clusters them to recommend common ones. 74% of the common co-occurring code fragments represent related functionality that should be included in code search results. Three major types of relevancy--complementary, supplementary, and alternative methods, are identified

1st Design Factory Global Network Research Conference ‘Designing the Future’ 5-6 October 2022

DFGN.R 2022 -Designing the Future - is the first research conference organised by the Design Factory Global Network. The open event offers the opportunity for all like-minded educators, designers and researchers to share their insights and inspire others on education, methods, practices and ecosystems of co-creation and innovation. The DFGN.R conference is a two-day event hosted on-site in Leeuwarden, the Netherlands. The conference is organized alongside International Design Factory Week 2022, the annual gathering of DFGN members. This year's conference is organized in collaboration with Aalto University from Helsinki Finland and hosted by the NHL Stenden University of Applied Sciences