TWC: Medium: Collaborative: Improving Mobile-Application Security via Text Analytics

TWC：媒介：协作：通过文本分析提高移动应用程序安全性

• 批准号: 1513939
• 负责人: Tao Xie
• 金额: $ 90万
• 依托单位: University of Illinois at Urbana-Champaign
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2015
• 资助国家: 美国
• 起止时间: 2015-07-01 至 2019-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1513939&HistoricalAwards=false
• 关键词: TWC; Medium; Collaborative; Improving; Mobile

Security policies often base access decisions on temporal context (e.g., time of day) and environmental context (e.g., geographic location). Access control policies for operating systems frequently consider execution context (e.g., user ID, program arguments). However, little has been done to incorporate user expectation context into security decision mechanisms. Text artifacts provide a source of user expectation context. When finding, installing, and running software, users are shown natural language text, e.g., textual functionality descriptions, permission requests, privacy notices, and user interface text. This research aims to improve security decisions using expectation context, by relating user-facing natural language text with security operations.This research focuses specifically on mobile applications by incorporating expectation context when making security decisions. Mobile applications provide specific forms of user text and security operations. This research considers the relationship between an application's description or user interface text and different granularities of security operations. The research forms the foundation for techniques and tools that inform mobile-device users of the security and privacy implications of installing mobile applications. As broader impacts, this research enables developers to produce more secure mobile applications and enables users to use more secure mobile applications.

安全策略通常基于时间上下文(例如，一天中的时间)和环境上下文(例如，地理位置)做出访问决策。操作系统的访问控制策略经常考虑执行上下文(例如，用户ID、程序参数)。然而，在将用户期望上下文纳入安全决策机制方面所做的工作很少。文本构件提供了用户期望上下文的来源。当查找、安装和运行软件时，向用户显示自然语言文本，例如文本功能描述、许可请求、隐私声明和用户界面文本。该研究旨在通过将面向用户的自然语言文本与安全操作相关联来改进使用预期上下文的安全决策，并通过在安全决策时引入预期上下文来专门针对移动应用。移动应用程序提供特定形式的用户文本和安全操作。该研究考虑了应用程序的描述或用户界面文本与不同粒度的安全操作之间的关系。这项研究为向移动设备用户告知安装移动应用程序的安全和隐私影响的技术和工具奠定了基础。作为更广泛的影响，这项研究使开发人员能够生产更安全的移动应用程序，并使用户能够使用更安全的移动应用程序。

项目成果

SemRegex: A Semantics-Based Approach for Generating Regular Expressions from Natural Language Specifications

• DOI: 10.18653/v1/d18-1189
• 发表时间: 2018-10
• 作者: Zexuan Zhong;Jiaqi Guo;Wei Yang;Jian Peng;Tao Xie;Jian-Guang Lou;Ting Liu;D. Zhang

Testing Untestable Neural Machine Translation: An Industrial Case

• DOI: 10.1109/icse-companion.2019.00131
• 发表时间: 2018-07
• 期刊: 2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)
• 作者: Wujie Zheng;Wenyu Wang;Dian Liu;Changrong Zhang;Qinsong Zeng;Yuetang Deng;Wei Yang;Pinjia He;Tao Xie

FinExpert: domain-specific test generation for FinTech systems

FinExpert：金融科技系统的特定领域测试生成

• DOI: 10.1145/3338906.3340441
• 发表时间: 2019
• 期刊: ESEC/FSE 2019: Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
• 作者: Jin, Tiancheng;Wang, Qingshun;Xu, Lihua;Pan, Chunmei;Dou, Liang;Qian, Haifeng;He, Liang;Xie, Tao
• 通讯作者: Xie, Tao

FACTS: automated black-box testing of FinTech systems

• DOI: 10.1145/3236024.3275533
• 发表时间: 2018-10
• 期刊: Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
• 作者: Qingshun Wang;Lintao Gu;Minhui Xue;Lihua Xu;Wenyu Niu;Liang Dou;Liang He;Tao Xie

Detecting Failures of Neural Machine Translation in the Absence of Reference Translations

在缺乏参考翻译的情况下检测神经机器翻译的故障

• DOI: 10.1109/dsn-industry.2019.00007
• 发表时间: 2019
• 期刊: 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks – Industry Track
• 作者: Wang, Wenyu;Zheng, Wujie;Liu, Dian;Zhang, Changrong;Zeng, Qinsong;Deng, Yuetang;Yang, Wei;He, Pinjia;Xie, Tao
• 通讯作者: Xie, Tao