Search

Code summarization (aka comment generation) provides a high-level natural language description of the function performed by code, which can benefit the software maintenance, code categorization and retrieval. To the best of our knowledge, the state-of-the-art approaches follow an encoder-decoder framework which encodes source code into a hidden space and later decodes it into a natural language space. Such approaches suffer from the following drawbacks: (a) they are mainly input by representing code as a sequence of tokens while ignoring code hierarchy; (b) most of the encoders only input simple features (e.g., tokens) while ignoring the features that can help capture the correlations between comments and code; (c) the decoders are typically trained to predict subsequent words by maximizing the likelihood of subsequent ground truth words, while in real world, they are excepted to generate the entire word sequence from scratch. As a result, such drawbacks lead to inferior and inconsistent comment generation accuracy. To address the above limitations, this paper presents a new code summarization approach using hierarchical attention network by incorporating multiple code features, including type-augmented abstract syntax trees and program control flows. Such features, along with plain code sequences, are injected into a deep reinforcement learning (DRL) framework (e.g., actor-critic network) for comment generation. Our approach assigns weights (pays “attention”) to tokens and statements when constructing the code representation to reflect the hierarchical code structure under different contexts regarding code features (e.g., control flows and abstract syntax trees). Our reinforcement learning mechanism further strengthens the prediction results through the actor network and the critic network, where the actor network provides the confidence of predicting subsequent words based on the current state, and the critic network computes the reward values of all the possible extensions of the current state to provide global guidance for explorations. Eventually, we employ an advantage reward to train both networks and conduct a set of experiments on a real-world dataset. The experimental results demonstrate that our approach outperforms the baselines by around 22% to 45% in BLEU-1 and outperforms the state-of-the-art approaches by around 5% to 60% in terms of S-BLEU and C-BLEU.

The rational design of an excellent architecture for active materials combined with carbon matrix is of particular importance to obtain flexible electrode material with high electrochemical properties. Well-designed nanofibers possess unique 3D network structure, which can significantly improve the electron/ion transportation and supplies sufficient active sites for Li+/Na+ insertion. Electrospinning-carbonization technology is a popular strategy to prepare nanofibers with active material embedded in carbon. It is found that the architecture of nanofibers tended to be wrecked and destroyed during the carbonization process without pre-oxidation treatment. In this study, we prepared Na2MnPO4F particles embedded in carbon nanofibers (Na2MnPO4F/C) using PVP as carbon source and investigated the strengthen mechanism of pre-oxidation on their architecture. The experiment and simulation results demonstrate that, without pre-oxidation, the main chain of PVP is severely ruptured during the carbonization procedure, consequently leads to fractured architecture of Na2MnPO4F/C nanofibers. In contrast, with pre-oxidation treatment, a long-chain and heat-resistance structured carbon matrix formed, and Na2MnPO4F/C nanofibers with stable architecture and improved electrochemical performance can be achieved. This study demonstrates a promising guide to construct carbon based nanofiber electrodes with stable architecture and high electrochemical performance.

Lithium-sulfur batteries have attracted numerous attentions owing to their high theory discharge specific capacity and energy density. However, sulfur cathode usually suffers from poor cycle stability and slow reaction kinetics, caused by its poor conductivity, excessive volume changes during charge/discharge processes, complex sulfur species conversion reaction and the dissolution of polysulfide intermediates. Here, we present a free-standing framework of Mn3O4 nanoparticles combine with polypyrrole (PPy) nanotubes as host materials for lithium-sulfur batteries to overcome these issues. In this construction, PPy nanotubes serve as the excellent container of sulfur and physical barrier for the excessive volume expansion of sulfur during electrochemical reaction processes, and the nanotubes also provide an efficient conductive network for the rapid transmission of electrons and ions, while Mn3O4 nanoparticles facilitate trapping lithium polysulfides. The coordination of PPy nanotubes and Mn3O4 effectively alleviate the shuttle effect as well as enhance the utilization of sulfur. The obtained PPy@Mn3O4-S sample shows high capacities of 1419.9 and 925.5 mAh g−1 at 0.1 C and 1 C rate, respectively, and exhibits a low capacity fading rate of 0.062% per cycle for 800 cycles at 1 C rate. This work provides a new and effective way for the design of lithium-sulfur batteries with both high rate performance and long cycle stability.

Code cloning, which reuses a fragment of source code via copy-and-paste with or without modifications, is a common way for code reuse and software prototyping. However, the duplicated code fragments often affect software quality, resulting in high maintenance cost. The existing clone detectors using shallow textual or syntactical features to identify code similarity are still ineffective in accurately finding sophisticated functional code clones in real-world code bases. This article proposes functional code clone detector using attention ( FCCA ), a deep-learning-based code clone detection approach on top of a hybrid code representation by preserving multiple code features, including unstructured (code in the form of sequential tokens) and structured (code in the form of abstract syntax trees and control-flow graphs) information. Multiple code features are fused into a hybrid representation, which is equipped with an attention mechanism that pays attention to important code parts and features that contribute to the final detection accuracy. We have implemented and evaluated FCCA using 275 777 real-world code clone pairs written in Java. The experimental results show that FCCA outperforms several state-of-the-art approaches for detecting functional code clones in terms of accuracy, recall, and F1 score.

Layered transition metal oxide Na0·67Fe0·5Mn0·5O2 is considered as a promising cathode material of sodium-ion batteries because of its naturally elemental abundance and high energy density. However, low rate capability and poor structural reversibility of Na0·67Fe0·5Mn0·5O2 greatly hinder its large scale application. In this study, V-substituted Na0·67Fe0·5Mn0·5O2 cathode material with improved electrochemical performance is successfully synthesized via a sol-gel method. The effects of V-substitution on chemical composition, crystal structure and morphology of Na0·67Fe0·5Mn0·5O2 are studied in detail. Furthermore, modification mechanisms on the improved electrochemical performance by V-substitution are investigated. The results demonstrate that the rate capability and cycle stability of Na0·67Fe0·5Mn0·5O2 cathode material is significantly elevated by V-substitution. And the enhanced electrochemical properties are mainly attributed to the improved Na+ diffusion rate and structural reversibility. This study suggests that introducing V ions into the lattice of Na0·67Fe0·5Mn0·5O2 crystals is a favorable strategy to improve its electrochemical properties.

Black phosphorus is a potential candidate material for next-generation energy storage devices and has attracted tremendous interest because of its advantageous structural and electrochemical properties, including its large theoretical capacity, high carrier mobility, and low redox potential. However, its practical applicability has remained low owing to its difficult of preparation, large volume expansion during cycling, and poor electronic conductivity. To this end, there have been significant efforts to improve its synthesis methods and electrochemical performance. A number of black-phosphorus-based composite materials have been developed and investigated. Herein, we provide an up-to-date account of the recent progress made in research on black-phosphorus-based materials for use in rechargeable batteries and supercapacitors. We review the available synthesis methods and basic properties of black phosphorus and discuss its applicability in Li-, Na-, K-, Mg-, Al-ion and Li-S batteries as well as supercapacitors. We also summarize the existing challenges and future opportunities and offer our perspective on the possible directions for future research in this area.

Regression bugs are a type of bugs that cause a feature of software that worked correctly but stop working after a certain software commit. This paper presents a systematic study of regression bug chains , an important but unexplored phenomenon of regression bugs. Our paper is based on the observation that a commit $c1$ , which fixes a regression bug $b1$ , may accidentally introduce another regression bug $b2$ . Likewise, commit $c2$ repairing $b2$ may cause another regression bug $b3$ , resulting in a bug chain, i.e., $b1\rightarrow c1\rightarrow b2\rightarrow c2\rightarrow b3$ . We have conducted a large-scale study by collecting 1579 regression bugs and 2630 commits from 57 Linux versions (from 2.6.12 to 4.9). The relationships between regression bugs and commits are modeled as a directed bipartite network. Our major contributions and findings are fourfold: 1) a novel concept of regression bug chains and their formulation; 2) compared to an isolated regression bug, a bug on a regression bug chain is much more difficult to repair, costing 2.4× more fixing time, involving 1.3× more developers and 2.8× more comments; 3) 85.8% of bugs on the chains in Linux reside in Drivers, ACPI, Platform Specific/Hardware, and Power Management; and 4) 83% of the chains affect only a single Linux subsystem, while 68% of the chains propagate across Linux versions.

It is a great challenge to develop the cathode materials with high efficiency, long life and low-cost for lithium-sulfur batteries. In this paper, we design a simple hydrothermal method to synthesize MoS2 wrapped the MOFs-derived N-doped carbon nanorods as an effective sulfur host to improve the electrochemical performance of lithium-sulfur batteries. In the hydrothermal process, the cubic zeolitic imidazolate framework-67 (ZIF67) particles are connected together to form nanorods, and MoS2 nanosheets are wrapped on the surface of the nanorods. In this composite, the carbon nanorods derived from ZIF67 is the main host for S-loading, while N-doping can change the hybrid orbital form of carbon and significantly improve the chemical adsorption of polysulfide. The elemental cobalt and cobalt oxide derived from ZIF67 can improve the electronic conductivity and polarity of the composite. And MoS2 coating layer can provide more active sites, accelerate the sulfur redox reactions and effectively restrain the shuttle effect. The synergetic effects of above-mentioned factors make the MoS2@CZIF67/S composite cathode material shows excellent electrochemical performance. The composite shows high reversible specific capacities of 1391.9 and 806.1 mAh g−1 at 0.1C and 1C rate, respectively, and exhibits a capacity retention of 70.5% after 400 cycles at 1C rate.

It is a challenge to develop a facile and scaleable approach to boost the application of high-energy fluorinated iron/manganese phosphate cathode materials for sodium-ions batteries. In this study, for the first time, the porous Na2Fe1-xMnxPO4F/C (x = 0.2, 0.4, 0.6, 0.8) nanocomposites are successfully designed via spray drying, following in-situ pyrolytic carbonization process. To examine this synergetic design, the rate capability, cycling stability, and reaction kinetics of the cathode materials are investigated in detail. It is found that the solid solution Na2Fe0.6Mn0.4PO4F/C cathode delivers the high discharge capacities of 94.8 and 30.0 mAh g−1 at 0.05 C and 1.0 C, respectively, and a reversible capacity of 51.0 mAh g−1 after 100 cycles at 0.2 C with a capacity retention of 89.3%. Particularly, the cycling stability as well as rate capability of Na2Fe0.6Mn0.4PO4F/C are superior to those of the other Na2Fe1-xMnxPO4F/C solid solutions and the two-phase mixture of Na2MnPO4F/C and Na2FePO4F/C. Furthermore, the potential strategies to further improve the electrochemical performance of Na2Fe0.6Mn0.4PO4F/C cathode are proposed based on the kinetics analysis of its electrochemical impedance spectroscopy spectra at various charge/discharge depths. It is expected that our research strategies and findings can be extended to other electrode materials in Li+/Na+ storage and beyond.

Owing to its high theoretical capacity, P2-type Na2/3Fe1/2Mn1/2O2 has been considered as a kind of promising cathode material. However, the practical application is limited due to excessively high calcining temperature during traditional preparation processes. Here, we report the synthesis of P2-Na2/3Fe1/2Mn1/2O2 by using a facile spray-drying method followed by calcining at low temperature. Under the optimal conditions, the well-crystallized P2-Na2/3Fe1/2Mn1/2O2 material with excellent rate capability and cycle ability is obtained. And the sample exhibits the initial discharge capacities of 217.9, 171.3 and 117.4 mAh g−1 at 0.1 C, 0.5 C and 2 C rate, respectively. The developed Na2/3Fe1/2Mn1/2O2 material, synthesized by a new spray drying-calcining procedure, may potentially be used as a suitable cathode in sodium ion batteries.

Labeling malware or malware clustering is important for identifying new security threats, triaging and building reference datasets. The state-of-the-art Android malware clustering approaches rely heavily on the raw labels from commercial AntiVirus (AV) vendors, which causes misclustering for a substantial number of weakly-labeled malware due to the inconsistent, incomplete and overly generic labels reported by these closed-source AV engines, whose capabilities vary greatly and whose internal mechanisms are opaque (i.e., intermediate detection results are unavailable for clustering). The raw labels are thus often used as the only important source of information for clustering. To address the limitations of the existing approaches, this paper presents Andre, a new ANDroid Hybrid REpresentation Learning approach to clustering weakly-labeled Android malware by preserving heterogeneous information from multiple sources (including the results of static code analysis, the meta-information of an app, and the raw-labels of the AV vendors) to jointly learn a hybrid representation for accurate clustering. The learned representation is then fed into our outlier-aware clustering to partition the weakly-labeled malware into known and unknown families. The malware whose malicious behaviours are close to those of the existing families on the network, are further classified using a three-layer Deep Neural Network (DNN). The unknown malware are clustered using a standard density-based clustering algorithm. We have evaluated our approach using 5,416 ground-truth malware from Drebin and 9,000 malware from VirusShare (uploaded between Mar. 2017 and Feb. 2018), consisting of 3324 weakly-labeled malware. The evaluation shows that Andre effectively clusters weakly-labeled malware which cannot be clustered by the state-of-the-art approaches, while achieving comparable accuracy with those approaches for clustering ground-truth samples.

As the COVID-19 pandemic emerged in early 2020, a number of malicious actors have started capitalizing the topic. Although a few media reports mentioned the existence of coronavirus-themed mobile malware, the research community lacks the understanding of the landscape of the coronavirus-themed mobile malware. In this paper, we present the first systematic study of coronavirus-themed Android malware. We first make efforts to create a daily growing COVID-19 themed mobile app dataset, which contains 4,322 COVID-19 themed apk samples (2,500 unique apps) and 611 potential malware samples (370 unique malicious apps) by the time of mid-November, 2020. We then present an analysis of them from multiple perspectives including trends and statistics, installation methods, malicious behaviors and malicious actors behind them. We observe that the COVID-19 themed apps as well as malicious ones began to flourish almost as soon as the pandemic broke out worldwide. Most malicious apps are camouflaged as benign apps using the same app identifiers (e.g., app name, package name and app icon). Their main purposes are either stealing users’ private information or making profit by using tricks like phishing and extortion. Furthermore, only a quarter of the COVID-19 malware creators are habitual developers who have been active for a long time, while 75% of them are newcomers in this pandemic. The malicious developers are mainly located in the US, mostly targeting countries including English-speaking countries, China, Arabic countries and Europe. To facilitate future research, we have publicly released all the well-labelled COVID-19 themed apps (and malware) to the research community. Till now, over 30 research institutes around the world have requested our dataset for COVID-19 themed research.

LiVPO4F has attracted increasing research interest in the field of Li-ion batteries due to its high working voltage platform and high theoretical energy density. However, the construction of stable LiVPO4F cathode material with excellent electrochemical properties is still a major challenge. Herein, we successfully synthesized spherically shaped LiVPO4F/C via a spray drying–roasting method. X-ray diffraction (XRD) and scanning electron microscopy (SEM) results indicate that the well crystallized LiVPO4F/C with triclinic structure shows spherical morphology with an average diameter of 1–3 μm. The spherically shaped LiVPO4F/C delivers a discharge capacity of 137.9 mAh·g−1 at 0.1C rate in the range of 3.0–4.5 V and remains 91.4% capacity retention of its initial discharge capacity after 50 cycles. These results reveal that spray drying–roasting method is a promising approach to synthesize spherically shaped LiVPO4F/C cathode material with stable crystal structure and excellent performance.

Carbon quantum dots/TiO2 nanosheets with a majority of (001) facet (CQDs/TiO2-001) samples are successfully prepared via a facile method. Compared to TiO2-001 and CQDs/P25, the synthesized CQDs/TiO2-001 presents a remarkably higher photocatalytic activity for H2 evolution with a considerable stability. XRD, XPS, HRTEM, FESEM, FTIR, Photoluminescence (PL) spectroscopy, Fluorescence spectroscopy and UV–visible reflectance spectroscopy are adopted to investigate the morphology, structure and properties of synthesized CQDs/TiO2-001. The mechanism of the improved photocatalytic activity over CQDs/TiO2-001 is also investigated. The results show that the improved photocatalytic activity over CQDs/TiO2-001 can be attributed to the synergistic effects of TiO2-001 and CQDs: the highly exposed (001) facets of TiO2-001 promote the transportation of photogenerated electrons and the loading of CQDs restrains the recombination of electrons-holes on (001) facets. Meanwhile, the visible-light absorption is extended because the CQDs serve as a photosensitizer and sensitize TiO2-001 through the newly formed Ti O C bond between the CQDs and TiO2-001.

Fe-doped TiO2 nanoparticles with highly exposed (0 0 1) facets are directly synthesized from Ti-bearing tailings by a facile method for the first time. The effects of F-based additive on the decomposition rate of Ti-bearing tailings as well as exposure percentage of (0 0 1) facets are systematically investigated in this work. The results demonstrate that F-based additive agent effectively promotes decomposition of Ti-bearing tailings during the acidolysis process. What’s more, F-based additive agent also plays a key role in the exposure of high-energy (0 0 1) facets for the obtained TiO2 nanoparticles. Synthesized F-drived TiO2 nanoparticles present outstanding photocatalytic activity on pollution degradation under visible and UV light. This study demonstrates a promising way to achieve advanced materials from secondary resources.

Gas-based reduction roasting magnetic separation process was conducted to separate and recover iron and titanium from oxidized vanadium titano-magnetite (VTM). The effects of reduction temperature, gas composition, reduction time, grinding fineness, and magnetic field intensity on the efficiency of Fe-Ti separation were investigated. Under the condition of reduction temperature of 1050 °C, reduction time of 120 min and gas composition of P(H2)/P(H2 + CO) = 0.72, a magnetic product containing 84.5 wt.% total iron with Fe recovery of 93.67% and a non-magnetic product containing 43.46 wt.% TiO2 with the TiO2 recovery of 67.12% were obtained. The efficiency of Fe-Ti separation shows a rise first followed by a decline with the increases of P(H2)/P(H2 + CO). Theoretical analyses, XRD, and SEM-EDS results demonstrate that H2 has a higher reduction ability than CO on oxidized VTM while CO makes a better role in promoting the grown of metallic iron particles, which are both crucial for Fe-Ti separation. Keywords: Vanadium titano-magnetite, H2 and CO, Reduction roasting, Magnetic separation

Static bug detection has shown its effectiveness in detecting well-defined memory errors, e.g., memory leaks, buffer overflows, and null dereference. However, modern software systems have a wide variety of vulnerabilities. These vulnerabilities are extremely complicated with sophisticated programming logic, and these bugs are often caused by different bad programming practices, challenging existing bug detection solutions. It is hard and labor-intensive to develop precise and efficient static analysis solutions for different types of vulnerabilities, particularly for those that may not have a clear specification as the traditional well-defined vulnerabilities. This article presents D eep W ukong , a new deep-learning-based embedding approach to static detection of software vulnerabilities for C/C++ programs. Our approach makes a new attempt by leveraging advanced recent graph neural networks to embed code fragments in a compact and low-dimensional representation, producing a new code representation that preserves high-level programming logic (in the form of control- and data-flows) together with the natural language information of a program. Our evaluation studies the top 10 most common C/C++ vulnerabilities during the past 3 years. We have conducted our experiments using 105,428 real-world programs by comparing our approach with four well-known traditional static vulnerability detectors and three state-of-the-art deep-learning-based approaches. The experimental results demonstrate the effectiveness of our research and have shed light on the promising direction of combining program analysis with deep learning techniques to address the general static code analysis challenges.

This paper presents a comprehensive survey on the development of Intel SGX (software guard extensions) processors and its applications. With the advent of SGX in 2013 and its subsequent development, the corresponding research works are also increasing rapidly. In order to get a more comprehensive literature review related to SGX, we have made a systematic analysis of the related papers in this area. We first search through five large-scale paper retrieval libraries by keywords (i.e., ACM Digital Library, IEEE/IET Electronic Library, SpringerLink, Web of Science, and Elsevier Science Direct). We read and analyze a total of 128 SGX-related papers. The first round of extensive study is conducted to classify them. The second round of intensive study is carried out to complete a comprehensive analysis of the paper from various aspects. We start with the working environment of SGX and make a conclusive summary of trusted execution environment (TEE). We then focus on the applications of SGX. We also review and study multifarious attack methods to SGX framework and some recent security improvements made on SGX. Finally, we summarize the advantages and disadvantages of SGX with some future research opportunities. We hope this review could help the existing and future research works on SGX and its application for both developers and users.

Flow-sensitive points-to analysis provides better precision than its flow-insensitive counterpart. Traditionally performed on the control-flow graph, it incurs heavy analysis overhead. For performance, staged flow-sensitive analysis (SFS) is conducted on a pre-computed def-use (value-flow) graph where points-to sets of variables are propagated across def-use chains sparsely rather than across control-flow in the control-flow graph. SFS makes the propagation of different objects' points-to sets sparse (multiple-object sparsity), however, it suffers from redundant propagation between instructions of the same object's points-to sets (single-object sparsity). The points-to set of an object is often duplicated, resulting in redundant propagation and storage, especially in real-world heap-intensive programs. We notice that a simple graph prelabelling extension can identify much of this redundancy in a pre-analysis. With this pre-analysis, multiple nodes (instructions) in the value-flow graph can share an individual memory object's points-to set rather than each node maintaining its own points-to set for that single object. We present object versioning for flow-sensitive points-to analysis, a finer single-object sparsity technique which maintains the same precision while allowing us to avoid much of the redundancy present in propagating and storing points-to sets. Our experiments conducted on 15 open-source programs, when compared with SFS, show that our approach runs up to 26.22× faster (5.31× on average), and reduces memory usage by up to 5.46× (2.11 × on average).

Android piggybacked malware (i.e., apps that piggyback malicious code) are becoming ubiquitous in app stores. Malware writers often use obfuscation techniques to obfuscate piggybacked apps to evade detection by Android malware detectors. Previous studies in this field have focused on the impact of code obfuscations on the detection of piggybacked malware, but the impact of code deobfuscation on detecting obfuscated piggybacked apps has rarely been studied. Knowing about the impact of code deobfuscation can provide useful insights into obfuscated piggybacked apps and therefore the design of resilient Android malware detectors. In this paper we conduct an empirical study of code deobfuscations on detecting obfuscated Android piggybacked apps, focusing on three types of malware detectors: commercial anti-malware products, machine learning-based detectors, and similarity-based detectors. We observe that code deobfuscations can impact differently depending on the malware detectors. For example, some deobfuscation strategies can improve the precision of detecting obfuscated piggybacked apps. Also we observe that the examined deobfuscation tools (Simplify and Deguard) have a different impact on obfuscated piggybacked apps after deobfuscations.

Code embedding, as an emerging paradigm for source code analysis, has attracted much attention over the past few years. It aims to represent code semantics through distributed vector representations, which can be used to support a variety of program analysis tasks (e.g., code summarization and semantic labeling). However, existing code embedding approaches are intraprocedural, alias-unaware and ignoring the asymmetric transitivity of directed graphs abstracted from source code, thus they are still ineffective in preserving the structural information of code. This paper presents Flow2Vec, a new code embedding approach that precisely preserves interprocedural program dependence (a.k.a value-flows). By approximating the high-order proximity, i.e., the asymmetric transitivity of value-flows, Flow2Vec embeds control-flows and alias-aware data-flows of a program in a low-dimensional vector space. Our value-flow embedding is formulated as matrix multiplication to preserve context-sensitive transitivity through CFL reachability by filtering out infeasible value-flow paths. We have evaluated Flow2Vec using 32 popular open-source projects. Results from our experiments show that Flow2Vec successfully boosts the performance of two recent code embedding approaches codevec and codeseq for two client applications, i.e., code classification and code summarization. For code classification, Flow2Vec improves codevec with an average increase of 21.2%, 20.1% and 20.7% in precision, recall and F1, respectively. For code summarization, Flow2Vec outperforms codeseq by an average of 13.2%, 18.8% and 16.0% in precision, recall and F1, respectively.

© 2020 ACM. Android deep link is a URL that takes users to a specific page of a mobile app, enabling seamless user experience from a webpage to an app. Android app link, a new type of deep link introduced in Android 6.0, is claimed to offer more benefits, such as supporting instant apps and providing more secure verification to protect against hijacking attacks that previous deep links can not. However, we find that the app link is not as secure as claimed, because the verification process can be bypassed by exploiting instant apps. In this paper, we explore the weakness of the existing app link mechanism and propose three feasible hijacking attacks. Our findings show that even popular apps are subject to these attacks, such as Twitter, Whatsapp, Facebook Message. Our observation is confirmed by Google. To measure the severity of these vulnerabilities, we develop an automatic tool to detect vulnerable apps, and perform a large-scale empirical study on 400,000 Android apps. Experiment results suggest that app link hijacking vulnerabilities are prevalent in the ecosystem. Specifically, 27.1% apps are vulnerable to link hijacking with smart text selection (STS); 30.0% apps are vulnerable to link hijacking without STS, and all instant apps are vulnerable to instant app attack. We provide an in-depth understanding of the mechanisms behind these types of attacks. Furthermore, we propose the corresponding detection and defense methods that can successfully prevent the proposed hijackings for all the evaluated apps, thus raising the bar against the attacks on Android app links. Our insights and findings demonstrate the urgency to identify and prevent app link hijacking attacks.

Data dependence analysis underlies various applications in software quality assurance, yet existing frameworks/tools for this analysis commonly suffer scalability challenges. We present PCA, a static interprocedural data dependence analyzer for real-world C programs. PCA performs interprocedural points-to and data-flow analyses with a lightweight design. Most of all, it features a partial call-path (PCA) analysis that consists of optimization options to further speed up data dependence computation. As an example application of it, PCA readily supports memory leak detection, for which it helps achieve close or better performance and precision relative to the same application based on a state-of-the-art value flow analysis. In particular, it found four more memory leaks in an industry-scale system which have been fixed by the developers. Through the data dependence it computes, PCA can enable other applications (e.g., impact analysis and taint analysis).

© 2020 IEEE Computer Society. All rights reserved. Extended Reality (XR) technologies are becoming increasingly popular in recent years. To help developers deploy XR applications on the Web, W3C released the WebXR Device API in 2019, which enable users to interact with browsers using XR devices. Given the convenience brought byWebXR, a growing number of WebXR projects have been deployed in practice. However, many WebXR applications are insufficiently tested before being released. They suffer from various bugs that can degrade user experience or cause undesirable consequences. Yet, the community has limited understanding towards the bugs in the WebXR ecosystem, which impedes the advance of techniques for assuring the reliability of WebXR applications. To bridge this gap, we conducted the first empirical study of WebXR bugs. We collected 368 real bugs from 33 WebXR projects hosted on GitHub. Via a seven-round manual analysis of these bugs, we built a taxonomy of WebXR bugs according to their symptoms and root causes. Furthermore, to understand the uniqueness of WebXR bugs, we compared them with bugs in conventional JavaScript programs and web applications. We believe that our findings can inspire future researches on relevant topics and we released our bug dataset to facilitate follow-up studies.

©2020 IEEE. TensorFlow is one of the most popular machine learning frameworks for developing machine learning algorithms. Because of the popularity and large-scale use of TensorFlow, even a single bug may lead to severe consequences and impact a large number of users. With a growing number of safetycritical systems built upon TensorFlow, its reliability is becoming increasingly important. An essential step to ensure TensorFlow's reliability is to understand the characteristics of bugs that occurred in TensorFlow. This paper presents the first comprehensive empirical study on fault triggering conditions in TensorFlow. 2,285 bug reports from TensorFlow's GitHub repository are collected. A bug classification is performed based on fault triggering conditions, followed by the frequency distribution of different types of bugs and the evolution features of varying bug types over time. Then the relationships between bug types and fixing time are also investigated. In addition, the root causes of Bohrbugs and Mandelbugs are studied. Five root causes are discovered. Furthermore, the analysis of regression bugs in TensorFlow is conducted. We have revealed 10 important findings based on our empirical results. There are 8 implications based on these findings are provided for developers and users.

©2020 IEEE. Duplicate bug reports often exist in bug tracking systems (BTSs). Almost all the existing approaches for automatically detecting duplicate bug reports are based on text similarity. A recent study found that such approaches may become ineffective in detecting duplicates in bug reports submitted after the justin- time (JIT) retrieval, which is now a built-in feature of modern BTSs (e.g., Bugzilla). This is mainly because the embedded JIT feature suggests possible duplicates in a bug database when a bug reporter types in the new summary field, therefore minimizing the submission of textually similar reports. Although JIT filtering seems effective, a number of bug report duplicates remain undetected. Our hypothesis is that we can detect them using a semantic similarity-based approach. This paper presents HINDBR, a novel deep neural network (DNN) that accurately detects semantically similar duplicate bug reports using a heterogeneous information network (HIN). Instead of matching text similarity alone, HINDBR embeds semantic relations of bug reports into a low-dimensional embedding space where two duplicate bug reports represented by two vectors are close to each other in the latent space. Results show that HINDBR is effective.

© 2020 ACM. Reentrancy bugs, one of the most severe vulnerabilities in smart contracts, have caused huge financial loss in recent years. Researchers have proposed many approaches to detecting them. However, empirical studies have shown that these approaches suffer from undesirable false positives and false negatives, when the code under detection involves the interaction between multiple smart contracts. In this paper, we propose an accurate and efficient cross-contract reentrancy detection approach in practice. Rather than design rule-of-thumb heuristics, we conduct a large empirical study of 11714 real-world contracts from Etherscan against three well-known general-purpose security tools for reentrancy detection. We manually summarized the reentrancy scenarios where the state-of-the-art approaches cannot address. Based on the empirical evidence, we present Clairvoyance, a cross-function and cross-contract static analysis to detect reentrancy vulnerabilities in real world with significantly higher accuracy. To reduce false negatives, we enable, for the first time, a cross-contract call chain analysis by tracking possibly tainted paths. To reduce false positives, we systematically summarized five major path protective techniques (PPTs) to support fast yet precise path feasibility checking. We implemented our approach and compared Clairvoyance with five state-of-the-art tools on 17770 real-worlds contracts. The results show that Clairvoyance yields the best detection accuracy among all the five tools and also finds 101 unknown reentrancy vulnerabilities.

© 2020 Copyright held by the owner/author(s). Publication rights licensed to ACM. In large-scale software development projects, change impact analysis (CIA) plays an important role in controlling software designevolution. Identifying and accessing the effects of software changesusing traceability links between various software artifacts is a common practice during the software development cycle. Recently,research in automated traceability-link recovery has received broadattention in the software maintenance community to reduce themanual maintenance cost of trace links by developers. In this study,we conducted a systematic literature review related to automatictraceability link recovery approaches with a focus on CIA. We identified 33 relevant studies and investigated the following aspects ofCIA: traceability approaches, CIA sets, degrees of evaluation, tracedirection and methods for recovering traceability link between artifacts of different types. Our review indicated that few traceabilitystudies focused on designing and testing impact analysis sets, presumably due to the scarcity of datasets. Based on the findings, weurge further industrial case studies. Finally, we suggest developingtraceability tools to support fully automatic traceability approaches,such as machine learning and deep learning.

© 2020 Copyright held by the owner/author(s). Reentrancy bugs in smart contracts caused a devastating financialloss in 2016, considered as one of the most severe vulnerabilities insmart contracts. Most of the existing general-purpose security toolsfor smart contracts have claimed to be able to detect reentrancybugs. In this paper, we present Clairvoyance, a cross-function andcross-contract static analysis by identifying infeasible paths to detect reentrancy vulnerabilities in smart contracts. To reduce FPs,we have summarized five major path protective techniques (PPTs)to support fast yet precise path feasibility checking. We have implemented our approach and compared Clairvoyance with threestate-of-the-art tools on 17770 real-worlds contracts. The resultsshow that Clairvoyance yields the best detection accuracy amongall the tools.

© 2020 Association for Computing Machinery. Existing coverage-based fuzzers usually use the individual control flow graph (CFG) edge coverage to guide the fuzzing process, which has shown great potential in finding vulnerabilities. However, CFG edge coverage is not effective in discovering vulnerabilities such as use-after-free (UaF). This is because, to trigger UaF vulnerabilities, one needs not only to cover individual edges, but also to traverse some (long) sequence of edges in a particular order, which is challenging for existing fuzzers. To this end, we propose to model UaF vulnerabilities as typestate properties, and develop a typestateguided fuzzer, named UAFL, for discovering vulnerabilities violating typestate properties. Given a typestate property, we first perform a static typestate analysis to find operation sequences potentially violating the property. Our fuzzing process is then guided by the operation sequences in order to progressively generate test cases triggering property violations. In addition, we also employ an information flow analysis to improve the efficiency of the fuzzing process. We have performed a thorough evaluation of UAFL on 14 widely-used real-world programs. The experiment results show that UAFL substantially outperforms the state-of-the-art fuzzers, including AFL, AFLFast, FairFuzz, MOpt, Angora and QSYM, in terms of the time taken to discover vulnerabilities. We have discovered 10 previously unknown vulnerabilities, and received 5 new CVEs.

Cathode materials made of xLiVPO4F·yLi3V2(PO4)3/C (x:y = 1:0, 2:1, 0:1) are synthesized via a feasible sol-gel method for high-performance lithium-ion batteries. The structures, morphology, and electrochemical properties of the composites are thoroughly investigated. The results show that LiVPO4F/C, Li3V2(PO4)3/C, and 2LiVPO4F·Li3V2(PO4)3/C can be synthesized under 750°C without the formation of impurities. Meanwhile, the unique morphology of the 2LiVPO4F·Li3V2(PO4)3/C composite, which is porous, with nanoflakes adhering to the surface, is revealed. This composite integrates the advantages of LiVPO4F and Li3V2(PO4)3. There are four discharge plateaus near 4.2, 4.1, 3.7, and 3.6 V, and the cathode material delivers high capacities of 143.4, 141.6, 133.2, 124.1, and 117.6 mAh g−1 at rates of 0.1, 0.2, 0.5, 1, and 2 C, respectively. More importantly, the discharge capacity can be almost fully recovered when the discharge rate returns to 0.1 C. The study is highly promising for the development of cathode material for LIBs.

© 2018 Elsevier Ltd There are several challenges (e.g., imbalance between supply and demand of hardware resources and software licenses, and usability) under modern High-Performance Computing (HPC) environment. As a means of providing an on-demand service for end users, we propose a Software-as-a-Service (SaaS) approach for managing commercial HPC applications as a Web-based service deployed on top of federated clouds. Some inter-trusted private or public clouds are federated to create a unified service platform with a large amount of hardware resources. In addition, an on-demand, pay-per-use model for Web-service-enabled HPC applications is proposed. Further, we provide an economic analysis of the proposed approach from the perspective of end users, cloud service providers, and Independent Software Vendors (ISVs). We conduct a simulation using two HPC application services on three federated clouds. A combined Quality of Service (QoS) and economic evaluation demonstrates a better effect of the proposed approach comparing with existing HPC platforms.

In this work, highly pure nano-TiO2 photocatalysts with varying Fe doping concentration were successfully synthesized from low-cost Ti-bearing tailings by an acidolysis-hydrothermal route. The effects of H2SO4 concentration, leaching temperature, acid/tailings ratio and leaching time on the recovery of TiO2 from the tailings were investigated. Synthesized samples were characterized by XRD, TEM, EDS, XPS, and UV–vis spectroscopy. The results showed that the material prepared is characteristic anatase with the average size of 20 nm and the Fe doping concentration in the synthesized nano-TiO2 is tunable. The photocatalytic activity of synthesized nano-TiO2 photocatalyst was also evaluated by the photodegradation of Rhodamine B under visible light and UV light irradiation. Our study demonstrates a low-cost approach to synthesize highly efficient and visible light responsive catalysts.

For the first time, a one-step synthetic strategy has been developed towards the preparation of Ti3+ self-doped TiO2 with internal-pores and highly exposed {001} facets using ethylene glycol (EG) and HF as control agents. The obtained samples were characterized by XRD, XPS, SEM, TEM, HAADF-STEM, photoluminescence spectroscopy (PL), and UV–vis reflectance spectroscopy. The synergistic effect of EG and HF plays a vital role in the formation of synthesized TiO2 with Ti3+ self-doping, internal-pores and highly exposed {001} facets. As-synthesized TiO2 exhibit much higher activity than commercial P25 on photocatalytic degradation of phenol and the outstanding performance is attributed to the synergistic effect of Ti3+ doping, internal-pores, and facets heterojunction.

Sunlight-driven hydrogen production from water splitting, assisted with the commonly used Pt/TiO 2 catalyst, is a promising way to store clean and renewable energy. However, the photocatalytic activity of Pt/TiO 2 is limited owing to the agglomeration of Pt atoms. Herein, we successfully synthesized a Pt/TiO 2 catalyst, where Pt is atomically and selectively dispersed on the (1 0 1) facets of nanosized TiO 2 single crystals. A remarkably higher photocatalytic activity for H 2 evolution together with a considerable stability was observed as compared to commonly used Pt/TiO 2 . This study demonstrates a promising way to achieve atomically dispersed highly-active catalyst for water splitting.

C is the most widely used programming language for developing embedded software, operating systems, and device drivers. Unlike programs written in managed languages like Java, C programs rely on explicit memory management, and are therefore prone to memory leaks. Existing (static or dynamic) debugging tools only report leaks, but fixing them often requires considerable manual effort by inspecting a list of reported true and false alarms. How to develop on-demand lightweight techniques for automated leak fixing without introducing new memory errors remains challenging. In this paper, we introduce A uto F ix , a fully automated leak-fixing approach for C programs by combining static and dynamic program analyses. Given a leaky allocation site reported by a static memory leak detector, A uto F ix performs a graph reachability analysis to identify leaky paths on the value-flow slices of the program, and then conducts a liveness analysis to locate the program points for inserting fixes (i.e., the missing free calls) on the identified leaky paths. We have implemented A uto F ix in LLVM-3.5.0 and evaluated it using five SPEC2000 benchmarks and three open-source applications. Experimental results show that A uto F ix can safely fix all the memory leaks reported by a state-of-the-art static memory leak detector with small instrumentation overhead.

Spatial errors (e.g., buffer overflows) continue to be one of the dominant threats to software reliability and security in C/C++ programs. Presently, the software industry typically enforces spatial memory safety by instrumentation. Due to high overheads incurred in bounds checking at runtime, many program inputs cannot be exercised, causing some input-specific spatial errors to go undetected in today's commercial software. This paper introduces a new compile-time approach for reducing bounds checking overheads based on the notion of weakest precondition (WP). The basic idea is to guard a bounds check at a pointer dereference inside a loop, where the WP-based guard is hoisted outside the loop, so that its falsehood implies the absence of out-of-bounds errors at the dereference, thereby avoiding the corresponding bounds check inside the loop. This WP-based approach is applicable to any spatial-error detection approach (in software or hardware or both). To evaluate the effectiveness of our approach, we take S oft B ound , a compile-time tool with an open-source implementation in low-level virtual machine (LLVM), as our baseline. S oft B ound adopts a pointer-based checking scheme with disjoint metadata, making it a state-of-the-art tool in providing compatible and complete spatial safety for C. Our new tool, called WPB ound , is a refined version of S oft B ound , also implemented in LLVM, by incorporating our WP-based compiler approach comprising both intra and interprocedural optimizations. For a set of 20 C benchmarks selected from SPEC and MiBench,WPB ound reduces the average runtime overhead of S oft B ound from 77% to 47% (by a reduction of 39%), with small code size increases.

© 2019 IEEE. Static vulnerability detection has shown its effectiveness in detecting well-defined low-level memory errors. However, high-level control-flow related (CFR) vulnerabilities, such as insufficient control flow management (CWE-691), business logic errors (CWE-840), and program behavioral problems (CWE-438), which are often caused by a wide variety of bad programming practices, posing a great challenge for existing general static analysis solutions. This paper presents a new deep-learning-based graph embedding approach to accurate detection of CFR vulnerabilities. Our approach makes a new attempt by applying a recent graph convolutional network to embed code fragments in a compact and low-dimensional representation that preserves high-level control-flow information of a vulnerable program. We have conducted our experiments using 8,368 real-world vulnerable programs by comparing our approach with several traditional static vulnerability detectors and state-of-the-art machine-learning-based approaches. The experimental results show the effectiveness of our approach in terms of both accuracy and recall. Our research has shed light on the promising direction of combining program analysis with deep learning techniques to address the general static analysis challenges.

In this paper, we report a facile one-step hydrothermal method to synthesize tetragonal Na3V2(PO4)2F3@C particles which are connected by carbon nanotubes (CNTs) networks, using water as hydrothermal solvents. In this strategy, the reduction and crystallization of materials are carried out in the hydrothermal process (180°C, 12 h), no additional heat treatment is required. The well-crystallized Na3V2(PO4)2F3 tetragonal grains (5–10 μm) are coated with amorphous nano-carbon and connected by highly conductive CNTs. The addition of CNTs can not only improve the conductivity of materials but also effectively inhibit the Na3V2(PO4)2F3 grains over growth. The Na3V2(PO4)2F3@C/CNTs composite possesses very flat charge/discharge platforms of 3.6 and 4.1 V. The sample exhibits an initial discharge specific capacity of 120.2 and 74.3 mAh g−1 at 0.1 and 10 C rate, respectively, and shows excellent cyclical stability. The composite owns excellent electrochemical performances owing to the three-dimensional highly conductive network which is co-constructed by the CNTs and nano-carbon coating layer.

© 2019 IEEE. For performance reasons, C++, albeit unsafe, is often the programming language of choice for developing software infrastructures. A serious type of security vulnerability in C++ programs is type confusion, which may lead to program crashes and control flow hijack attacks. While existing mitigation solutions almost exclusively rely on dynamic analysis techniques, which suffer from low code coverage and high overhead, static analysis has rarely been investigated. This paper presents TCD, a static type confusion detector built on top of a precise demand-driven field-, context-and flow-sensitive pointer analysis. Unlike existing pointer analyses, TCD is type-aware as it not only preserves the type information in the pointed-to objects but also handles complex language features of C++ such as multiple inheritance and placement new, making it therefore possible to reason about type casting in C++ programs. We have implemented TCD in LLVM and evaluated it using seven C++ applications (totaling 526,385 lines of C++ code) from Qt, a widely-adopted C++ toolkit for creating GUIs and cross-platform software. TCD has found five type confusion bugs, including one reported previously in prior work and four new ones, in under 7.3 hours, with a low false positive rate of 28.2%.

Traceability links between various software artifacts of a system aid software engineers in system comprehension, verification and change impact analysis. Establishing trace links between software artifacts manually is an error-prone and costly task. Recently, studies in automated traceability link recovery area have received broad attention in the software maintenance community aiming to overcome the challenges of manual trace links maintenance process. In these studies, the trace links results generated by an automated trace recovery approach are presented either in a bland textual matrix format (e.g., tabular format) or two-dimensional graphical formats (e.g. tree view, hierarchical leaf node). Therefore, it is challenging for software engineers to explore the inter-relationships between various artifacts at once (e.g., which test cases and source code files/methods are related to a particular requirement). In this position paper, we propose a hierarchical trace map visualization technique to explore inter-relationships between various artifacts at once naturally and intuitively.

© 2019 IEEE. Automated Program Repair (APR) faces a key challenge in efficiently generating correct patches from a potentially infinite solution space. Existing approaches, which attempt to reason about the entire solution space, can be ineffective (by often producing no plausible patches at all) and imprecise (by often producing plausible but incorrect patches). We present VFIX, a new value-flow-guided APR approach, to fix null pointer exception (NPE) bugs by considering a substantially reduced solution space in order to greatly increase the number of correct patches generated. By reasoning about the data and control dependences in the program, VFIX can identify bug-relevant repair statements more accurately and generate more correct repairs than before. VFIX outperforms a set of 8 state-of-the-art APR tools in fixing the NPE bugs in Defects4j in terms of both precision (by correctly fixing 3 times as many bugs as the most precise one and 50% more than all the bugs correctly fixed by these 8 tools altogether) and efficiency (by producing a correct patch in minutes instead of hours).

LiFeBO3/C cathode material with hollow sphere architecture is successfully synthesized by a spray-drying method. SEM and TEM results demonstrate that the micro-sized LiFeBO3/C hollow spheres consist of LiFeBO3@C particles and the average size of LiFeBO3@C particles is around 50-100 nm. The thickness of the amorphous carbon layer which is coated on the surface of LiFeBO3 nanoparticles is about 2.5 nm. LiFeBO3@C particles are connected by carbon layers and formed conductive network in the LiFeBO3/C hollow spheres, leading to improved electrical conductivity. Meanwhile, the hollow structure boosts the Li+ diffusion and the carbon layers of LiFeBO3@C particles protect LiFeBO3 from moisture corrosion. Consequently, synthesized LiFeBO3/C sample exhibits good electrochemical properties and storage performance.

© Springer Nature Switzerland AG 2019. By distinguishing the fields of an object, Andersen’s field-sensitive pointer analysis yields better precision than its field-insensitive counterpart. A typical field-sensitive solution to inclusion-based pointer analysis for C/C++ is to add positive weights to the edges in Andersen’s constraint graph to model field access. However, the precise modeling is at the cost of introducing a new type of constraint cycles, called positive weight cycles (PWCs). A PWC, which contains at least one positive weight constraint, can cause infinite and redundant field derivations of an object unless the number of its fields is bounded by a pre-defined value. PWCs significantly affect analysis performance when analyzing large C/C++ programs with heavy use of structs and classes.para This paper presents Dea, a fast and precise approach to handling of PWCs that significantly accelerates existing field-sensitive pointer analyses by using a new field collapsing technique that captures the derivation equivalence of fields derived from the same object when resolving a PWC.para Two fields are derivation equivalent in a PWC if they are always pointed to by the same variables (nodes) in this PWC. A stride-based field representation is proposed to identify and collapse derivation equivalent fields into one, avoiding redundant field derivations with significantly fewer field objects during points-to propagation. We have conducted experiments using 11 open-source C/C++ programs. The evaluation shows that Dea is on average 7.1X faster than Pearce et al.’s field-sensitive analysis (Pkh), obtaining the best speedup of 11.0X while maintaining the same precision.

Interprocedural memory SSA form, which provides a sparse data-flow representation for indirect memory operations, paves the way for many advanced program analyses. Any performance improvement for memory SSA construction benefits for a wide range of clients (e.g., bug detection and compiler optimisations). However, its construction is much more expensive than that for scalar-based SSA form. The memory objects distinguished at a pointer dereference significantly increases the number of variables that need to be put on SSA form, resulting in considerable analysis overhead when analyzing large programs (e.g., millions of lines of code). This paper presents ParSSA , a fully parameterised approach for parallel construction of interprocedural memory SSA form by utilising multi-core computing resources. ParSSA partitions whole-program memory objects into uniquely identified memory regions. The indirect memory accesses in a function are fully parameterised using partitioned memory regions, so that the memory SSA construction of a parameterised function is readily parallelised. We implemented ParSSA in LLVM using Intel Threading Building Block (TBB) for creating parallel tasks. We evaluated ParSSA using 15 large applications. ParSSA achieves up to 6.9 × speedup against the sequential version on an 8-core machine.

Na3V2(PO4)3/C nanofibers are prepared by a pre-reduction assisted electrospinning method. In order to maintain the perfect fibrous architecture of the Na3V2(PO4)3/C samples after calcining, a series of heat treatment parameters are studied in detail. It is found that the heat treatment process shows important influence on the morphology and electrochemical performance of Na3V2(PO4)3/C composite nanofibers. Under the calcining conditions of 800°C for 10 h with a heating rate of 2.5°C min−1, the well-crystallized uniform Na3V2(PO4)3/C nanofibers with excellent electrochemical performances are successfully obtained. The initial discharge specific capacities of the nanofibers at 0.05, 1, and 10C are 114.0, 106.0, and 77.9 mAh g−1, respectively. The capacity retention still remains 97.0% after 100 cycles at 0.05C. This smooth, uniform, and continuous Na3V2(PO4)3/C composite nanofibers prepared by simple electrospinning method, is expected to be a superior cathode material for sodium-ion batteries.

© 2018 IEEE. Popular IoT programming frameworks, such as Google Fit, enable third-party developers to build apps to store and retrieve user data from a variety of data sources (e.g., wearables). The problem of overprivilege stands out due to the diversity and complexity of IoT apps, and developers rushing to release apps to meet the high demand in the IoT market. Any incorrect API usage of the IoT frameworks by third-party developers can lead to security risks, especially in health and fitness apps. Protecting sensitive user information is critically important to prevent financial and psychological harms. This paper presents PGFIT, a static permission analysis tool that precisely and efficiently identifies overprivilege issues in third-party apps built on top of a popular IoT programming framework, Google Fit. PGFIT extracts the set of requested permission scopes and the set of used data types in Google Fitenabled apps to determine whether the requested permission scopes are actually necessary. In this way, PGFIT serves as a quality assurance tool for developers and a privacy checker for app users. We used PGFIT to perform overprivilege analysis on a set of 20 Google Fit-enabled apps and with manual inspection, we found that 6 (30%) of them are overprivileged.

© 2018 Authors. To obtain precise and sound results, most of existing static analyzers require whole program analysis with complete source code. However, in reality, the source code of an application always interacts with many third-party libraries, which are often not easily accessible to static analyzers. Worse still, more than 30% of legacy projects [1] cannot be compiled easily due to complicated configuration environments (e.g., third-party libraries, compiler options and macros), making ideal "whole-program analysis" unavailable in practice. This paper presents CoBOT [2], a static analysis tool that can detect bugs in the presence of incomplete code. It analyzes function APIs unavailable in application code by either using function summarization or automatically downloading and analyzing the corresponding library code as inferred from the application code and its configuration files. The experiments show that CoBOT is not only easy to use, but also effective in detecting bugs in real-world programs with incomplete code. Our demonstration video is at: https://youtu.be/bhjJp3e7LPM.

Existing static analyses model activity transitions in Android apps context-insensitively, making it impossible to distinguish different activity launch modes, reducing the pointer analysis precision for an activity's callbacks, and potentially resulting in infeasible activity transition paths. In this paper, we introduce Chime, a launch-mode-aware context-sensitive activity transition analysis that models different instances of an activity class according to its launch mode and the transitions between activities context-sensitively, by working together with an object-sensitive pointer analysis. Our evaluation shows that our context-sensitive activity transition analysis is more precise than its context-insensitive counterpart in capturing activity transitions, facilitating GUI testing, and improving the pointer analysis precision.

Per-Input Control Flow Integrity (PICFI) represents a recent advance in dynamic CFI techniques. PICFI starts with the empty CFG of a program and lazily adds edges to the CFG during execution according to concrete inputs. However, this CFG grows monotonically, i.e., invalid edges are never removed when corresponding control flow transfers (via indirect calls) become illegal (i.e., will never be executed again). This paper presents LPCFI, Live Path Control Flow Integrity, to more precisely enforce forward edge CFI using a dynamically computed CFG by both adding and removing edges for all indirect control flow transfers from function pointer calls, thereby raising the bar against control flow hijacking attacks.