Search

Undertaking an experience-sampling study via smartphones is complex. Scheduling and sending mobile notifications often requires the use of proprietary software that imposes limits on participants' operating systems (whether iOS or Android) or the types of questions that can be asked via the application. We have developed an open-source platform—Samply—which overcomes these limitations. Researchers can access the entire interface via a browser, manage studies, schedule and send notifications linking to online surveys or experiments created in any Internet-based service or software, and monitor participants' responses—all without the coding skills usually needed to program a native mobile application. Participants can download the Samply Research mobile application for free from Google Play or the App Store, join a specific study, receive notifications and web links to surveys or experiments, and track their involvement. The mobile application leverages the power of the React Native JavaScript library, which allows it to be rendered in the native code of Android and iOS mobile operating systems. We describe Samply, provide a step-by-step example of conducting an experience-sampling study, and present the results of two validation studies. Study 1 demonstrates how we improved the website's usability for researchers. Study 2 validates the mobile application's data recording ability by analyzing a survey's participation rate. The application's possible limitations and how mobile device settings might affect its reliability are discussed. [ABSTRACT FROM AUTHOR]

In this paper, time spent and the repetition of using the Social Network Sites (SNS) in Android applications are investigated. In this approach, we seek to raise the awareness and limit, but not eliminate the repeated uses of SNS, by introducing AndroidTrack. This AndroidTrack is an android application that was designed to monitor and apply valid experimental studies in order to improve the impacts of social media on Iraqi users. Data generated from the app were aggregated and updated periodically at Google Firebase Real-time Database. The statistical factor analysis (FA) was presented as a result of the user’s interactions. [ABSTRACT FROM AUTHOR]

According to the World Health Organization, cardiovascular diseases are the leading cause of death worldwide. For prevention, diagnosis and treatment of heart disease, a medical examination known as electrocardiogram is required, the exam records the electrical activity of the heart and is acquired through a device called an electrocardiograph. In the same way, there is a growing motivation towards the development of new technologies to monitor health and ensure the general well-being of the population, which is speeded up through the rise and advancement of mobile devices. This paper presents the design and implementation of an electrocardiograph which allows the graphic display of the electrocardiographic signal on a mobile device with Android operating system and has an interface to a personal computer where the signals obtained are deployed, processed and analyzed. To build the device, an evolutionaryincremental methodology was followed. The functioning of the system was evaluated in the detection of arrhythmias and acute myocardial infarction; achieving performance indicators of TPR = 87.50% for signals with arrhythmias and TPR = 92.59% for signals with infarction. In this way, information can be captured, processed, parameterized, transmitted, stored in integral health computer systems and used to perform diagnostics by remote specialists; profiling, this system, as alternatives for the diagnosis, care and monitoring of people who have heart problems. [ABSTRACT FROM AUTHOR]

The number of mobile applications downloaded recently from Google stores increase steadily. It is believed that mobile applications market revenues will grow fast and receive more attention from software developers. Even though, hardware technologies and operating systems have made a big contribution to improve the battery capacity, power consumption is one of the most important and crucial non-functional properties of mobile applications. Many approaches have been dedicated for analyzing and optimizing the power consumption at different levels. This paper proposes a method for analyzing energy leaks of Android application at the design phase. First, it introduces a formalization of an event-based power consumption model. After that, the paper presents a method to translate this model to Event-B notations. Based on the target model, it is able to check if the application leads to energy leaks or violates the power consumption constraints based on formal proofs. Finally, the motivating examples are shown for the illustration purpose. [ABSTRACT FROM AUTHOR]

The reliability of mobile devices is a challenge for vendors, since the mobile software stack has significantly grown in complexity. In this article, we study how to assess the impact of faults on the quality of user experience in the Android mobile OS through fault injection. We first address the problem of identifying a realistic fault model for the Android OS, by providing to developers a set of lightweight and systematic guidelines for fault modeling. Then, we present an extensible fault injection tool (AndroFIT) to apply such fault model on actual, commercial Android devices. Finally, we present a large fault injection experimentation on three Android products from major vendors, and point out several reliability issues and opportunities for improving the Android OS. [ABSTRACT FROM AUTHOR]

As digital currency wallets are gaining popularity, security incidents related to them are also increasing. They lead to the disclosure of users' private information and security threats of users' assets. This article analyzes the security risks of digital wallets in Android, which is the most popular mobile operating system. it first establishes the threat model and the security goals, and then analyzes the attack surface and attack vectors from the aspects of wallet apps and the Android system. Experiments are conducted on two realworld digital currency wallet apps, and the results reveal several serious security risks in these apps, which highlight the necessity and importance of developing secure cryptocurrency wallets. [ABSTRACT FROM AUTHOR]

Label manipulation attacks are a subclass of data poisoning attacks in adversarial machine learning used against different applications, such as malware detection. These types of attacks represent a serious threat to detection systems in environments having high noise rate or uncertainty, such as complex networks and Internet of Thing (IoT). Recent work in the literature has suggested using the K-nearest neighboring algorithm to defend against such attacks. However, such an approach can suffer from low to miss-classification rate accuracy. In this paper, we design an architecture to tackle the Android malware detection problem in IoT systems. We develop an attack mechanism based on silhouette clustering method, modified for mobile Android platforms. We proposed two convolutional neural network-type deep learning algorithms against this Silhouette Clustering-based Label Flipping Attack. We show the effectiveness of these two defense algorithms—label-based semi-supervised defense and clustering-based semi-supervised defense—in correcting labels being attacked. We evaluate the performance of the proposed algorithms by varying the various machine learning parameters on three Android datasets: Drebin, Contagio, and Genome and three types of features: API, intent, and permission. Our evaluation shows that using random forest feature selection and varying ratios of features can result in an improvement of up to 19% accuracy when compared with the state-of-the-art method in the literature. [ABSTRACT FROM AUTHOR]

Android is the most widely used mobile operating system (OS). A large number of third-party Android application (app) markets have emerged. The absence of third-party market regulation has prompted research institutions to propose different malware detection techniques. However, due to improvements of malware itself and Android system, it is difficult to design a detection method that can efficiently and effectively detect malicious apps for a long time. Meanwhile, adopting more features will increase the complexity of the model and the computational cost of the system. Permissions play a vital role in the security of the Android apps. Term Frequency—Inverse Document Frequency (TF-IDF) is used to assess the importance of a word for a file set in a corpus. The static analysis method does not need to run the app. It can efficiently and accurately extract the permissions from an app. Based on this cognition and perspective, in this paper, a new static detection method based on TF-IDF and Machine Learning is proposed. The system permissions are extracted in Android application package's (Apk's) manifest file. TF-IDF algorithm is used to calculate the permission value (PV) of each permission and the sensitivity value of apk (SVOA) of each app. The SVOA and the number of the used permissions are learned and tested by machine learning. 6070 benign apps and 9419 malware are used to evaluate the proposed approach. The experiment results show that only use dangerous permissions or the number of used permissions can't accurately distinguish whether an app is malicious or benign. For malware detection, the proposed approach achieve up to 99.5% accuracy and the learning and training time only needs 0.05s. For malware families detection, the accuracy is 99.6%. The results indicate that the method for unknown/new sample's detection accuracy is 92.71%. Compared against other state-of-the-art approaches, the proposed approach is more effective by detecting malware and malware families. [ABSTRACT FROM AUTHOR]

In today's world it is impossible to do without the use of various communication systems. They are now the integral part of our lives. Almost every modern person uses one or another system of information exchange with other people. Mobile platforms are most often used for information exchange. The vast majority are platforms such as Android, iOS and Windows Phone. Information transmitted from one user to another can often be confidential or restricted. So, the appropriate methods of information protection should be used for this purpose. Today, information security researchers focus on improving the performance of cryptographic algorithms and the primitives on which they are based. Nevertheless, the issues of building of integrated security systems for instant messaging systems remain insufficiently considered. This paper is devoted to the development of a comprehensive application protection system for instant messaging. Any IM application consists of three main parts. The first component is the program code executed on a mobile platform. The second part is the communication channel. The last part is the program code executed on the server side. This paper discusses each of the main parts for building a comprehensive application protection system for instant messaging. The choice of certain components for building a security system is substantiated, the schemes of operation of the program code executed on the Android mobile platform are given, the choice of forms of transmission of user information through the communication channel is substantiated. Recommendations for choosing a communication channel and ensuring its security are given. The schemes of the server side of the application are also given. The choice of certain hashes functions, functions of input information checks, approaches to the implementation of the protection system, storage system and processing of user information on the server side is substantiated. The developed application also shows some shortcomings of the mobile platform Android in terms of information security. It is shown how attackers can take advantage of these shortcomings, and suggestions to prevent their use are provided. The results of the work can be used to protect information in practical systems. [ABSTRACT FROM AUTHOR]

This research analyzes the construction of the member countries' leaders from the European Union and the United Kingdom through its manifestation in the ecosystem of entertainment applications aimed at ¡OS and Android mobiles. The search and selection of the sample (n=108) have led to the identification of the main features of these discourses, which are analyzed according to two specific research questions: (RQ1) What type of message do the apps related to the political leaders of the member countries of the European Union during the period 2013-2019?; (RQ2) What is the reception of these apps and what is the foreseeable effects of your speech? The methodology to solve both questions is based on the application of content analysis on the apps that make up the sample. Specifically, both, the discourse and the feedback generated from indicators of popularity and comments published on the platforms, are subject to observation. The conclusions allow us to identify the dominant discourses in the scenario being addressed, taking into account the features that influence their popularity, the influence of viral content, and their reception in the conjunction of the mobile ecosystem with the political sphere. [ABSTRACT FROM AUTHOR]

This research analyzes the construction of the member countries' leaders from the European Union and the United Kingdom through its manifestation in the ecosystem of entertainment applications aimed at ¡OS and Android mobiles. The search and selection of the sample (n=108) have led to the identification of the main features of these discourses, which are analyzed according to two specific research questions: (RQ1) What type of message do the apps related to the political leaders of the member countries of the European Union during the period 2013-2019?; (RQ2) What is the reception of these apps and what is the foreseeable effects of your speech? The methodology to solve both questions is based on the application of content analysis on the apps that make up the sample. Specifically, both, the discourse and the feedback generated from indicators of popularity and comments published on the platforms, are subject to observation. The conclusions allow us to identify the dominant discourses in the scenario being addressed, taking into account the features that influence their popularity, the influence of viral content, and their reception in the conjunction of the mobile ecosystem with the political sphere. [ABSTRACT FROM AUTHOR]

In hybrid mobile applications (apps), the core code of an app is in JavaScript. Any JavaScript code in a hybrid app, local or remote, can access available APIs, including JavaScript bridges provided by a hybrid development framework, to access device resources. This JavaScript inclusion capability is dangerous since there is no mechanism to determine the origin (party) of the code to control access. Moreover, any JavaScript code running in a mobile app can access the device resources through the exposed APIs. Previous solutions are either limited to a particular platform (e.g., Android) or a specific hybrid framework (e.g., Cordova) or only protect the device resources and disregard the sensitive elements in the web environment. Furthermore, most solutions require modification of the base platform. In this article, we propose a novel policy enforcement framework to enforce useful fine-grained security and privacy policies based on permission for each party in hybrid mobile apps. In contrast to the conventional permission model in mobile apps, our permission specification is platform-agnostic and context-aware. This new permission specification allows app developers to customize for different parties over single permission. We integrate our permission specification into an app at the development phase; however, by design, it allows end-users to adjust parameters at runtime to protect their privacy. Together with multi-party permission patterns, we introduce comprehensive classes of expensive fine-grained, stateful policies that developers can deploy in practice. These policy patterns can help to protect the privacy of users and can also mitigate significant types of potential attacks in hybrid apps, evidenced by our real-world evaluation. Our experimental results also demonstrate that the framework is compatible with various hybrid development frameworks over two major mobile platforms, with lightweight overhead. [ABSTRACT FROM AUTHOR]

Advances in both telecommunications and Information technology have improved the way users do business online. Android, an open-source mobile operating system, is becoming an attractive target for cyber criminals to exploit due to its predefined permission model. Without classification, the mobile operating system permits installation of mobile applications of all kinds, including Trojans, thus making its trustworthiness into question. In this paper, we present a security system called collaborative policy-based security scheme (CSS) that permits users to customize the access permissions of Android applications during runtime. The proposed CSS security scheme validates the trustworthiness of each application before being installed. The experimental results show that the proposed CSS successfully detects all malicious applications with a run-time overhead of 2.7%. [ABSTRACT FROM AUTHOR]

Objective: Otitis media with effusion (OME) is the most common cause of hearing loss in children. Early diagnosis is important as hearing loss affects speech and language development in children. The aim of this study was to compare conventional audiometry with the Android mobile operating system application Hearing TestTM in the evaluation of hearing thresholds in children with OME and to determine the accuracy and reliability of the mobile application. Design and Study Sample: Fifty school-age children aged between 5 and 15 years with OME in at least 1 ear were included in the study. First, hearing thresholds were obtained by conventional audiometric methods and the degree of hearing loss was determined. Then, the hearing thresholds of the patients were measured using the smartphone-based Hearing TestTM application. The data were compared using Cohen's kappa analysis.Results: OME was detected in 88 ears. There was no statistically significant correlation between the hearing threshold results obtained with the mobile phone and conventional audiometry at 500, 1,000, 2,000, and 4,000 Hz.Conclusion: The Android mobile phone application Hearing TestTM (version 1.1.3) is not an appropriate screening test to detect hearing loss in children with OME. [ABSTRACT FROM AUTHOR]

Android OS is the most popular mobile OS for the past few years. Vulnerabilities arise with respect to the increasing functionality of Android OS, impolitic app development practices of developers, end-user incautious and interestingly remediation for the vulnerabilities has been introduced frequently as well. To mitigate security risk factor Google has been updated, deprecated and restricted many system level APIs for 3rd party developers. Considering the consequences, this paper provides a wide overview of Android's system level app development, privacy issues, and guideline for the developers about what measure they should consider while developing apps. We also discussed the historical development of Android OS and the end-users role to maintain privacy and to minimize security risks. [ABSTRACT FROM AUTHOR]

Intrusion Detection System (IDS) is crucial to protect smartphones from imminent security breaches and ensure user privacy. Android is the most popular mobile Operating System (OS), holding above 85% market share. The traffic generated by smartphones is expected to exceed the one generated by personal computers by 2021. Consequently, this prevalent mobile OS will stay one of the most attractive targets for potential attacks on fifth generation mobile networks (5G). Although Android malware detection has received considerable attention, offered solutions mostly rely on performing resource intensive analysis on a server, assuming a continuous connection between the device and the server, or on employing supervised Machine Learning (ML) algorithms for profiling the malware's behaviour, which essentially require a training dataset consisting of thousands of examples from both benign and malicious profiles. However, in practice, collecting malicious examples is tedious since it entails infecting the device and collecting thousands of samples in order to characterise the malware's behaviour and the labelling has to be done manually. In this paper, we propose a novel Host-based IDS (HIDS) incorporating statistical and semi-supervised ML algorithms. The advantage of our proposed IDS is two folds. First, it is wholly autonomous and runs on the mobile device, without needing any connection to a server. Second, it requires only benign examples for tuning, with potentially a few malicious ones. The evaluation results show that the proposed IDS achieves a very promising accuracy of above 0.9983, reaching up to 1. [ABSTRACT FROM AUTHOR]

High penetration of Android applications along with their malicious variants requires efficient and effective malware detection methods to build mobile platform security. API call sequence derived from API call graph structure can be used to model application behavior accurately. Behaviors are extracted by following the API call graph, its branching, and order of calls. But identification of similarities in graphs and graph matching algorithms for classification is slow, complicated to be adopted to a new domain, and their results may be inaccurate. In this study, the authors use the API call graph as a graph representation of all possible execution paths that a malware can track during its runtime. The embedding of API call graphs transformed into a low dimension numeric vector feature set is introduced to the deep neural network. Then, similarity detection for each binary function is trained and tested effectively. This study is also focused on maximizing the performance of the network by evaluating different embedding algorithms and tuning various network configuration parameters to assure the best combination of the hyper-parameters and to reach at the highest statistical metric value. Experimental results show that the presented malware classification is reached at 98.86% level in accuracy, 98.65% in F-measure, 98.47% in recall and 98.84% in precision, respectively. [ABSTRACT FROM AUTHOR]

Information technologies give patients the opportunity to communicate with medical professionals remotely. Telemedicine uses these technologies to provide advanced healthcare and medical services. We present a medical online consultation application based on Web Real-Time Communications (WebRTC) technology enabling chat, audio, and video calls. Communication architecture and protocols of the application are explained in detail. Additionally, the user interface of the application is shown via performed calls. The application is tested and evaluated on different network connections (3G, 4G, local, and DSL) and different browsers and mobile operating systems (Android, Chrome, Firefox, Internet Explorer, iOS, Opera, Safari). During calls, communication quality parameters such as round-trip time (RTT) and packet loss, obtained via the WebRTC application programming interface, are analyzed. 3G, 4G, and local connections show low packet losses (<1%). Packet losses are high (>1%) in Android, Chrome, iOS, Opera, and Safari for DSL connection, but RTT values are low (<100 ms) in all different conditions excluding iOS. In the presented application, RTT and packet loss remain lower than 100 ms and 1%, respectively, in various scenarios, indicating good communication quality. RTT and packet loss are related to total time and hang time parameters, which describe the necessary time to establish and to end a call. It is shown that communication quality of the application can simply be measured by analyzing the total time parameter. This enables predictable information for communication quality for WebRTC-based applications without continuously monitoring RTT and packet loss for the first time. [ABSTRACT FROM AUTHOR]

Android as a widest used operating system for smartphones and mobile devices uses permissions to restrict malicious applications (apps). However, malware developers use various social engineering methods to entice users for installing malwares after granting critical permissions by users. Therefore, it is essential to estimate security risks of untrusted Android apps to help users for making better decisions regarding app selection and installation. In this paper, the concept of criticality for Android permissions is precisely defined according to the abuse of permissions by known malwares and their legal usage by useful apps. Based on this definition and analyzing requested permissions of large numbers of malwares and benign apps, a new criterion is proposed to measure the security risks of the apps. This measure benefits from the concepts of entropy and information gain of permissions regarding separating malwares from benign apps. In this criterion, more informative permissions have higher impacts on the computed risk values. In order to evaluate the proposed criterion, two new datasets of recent malicious and non-malicious Android apps have been constructed and analyzed against existing ones. This analysis shows that permission usage patterns of Android apps are changed over the time. Empirical evaluations on recent and previous malwares and benign apps reveal the superiority of the proposed criterion with respect to previously proposed ones in terms of assigning larger risk values to malwares. [ABSTRACT FROM AUTHOR]

Android as a widest used operating system for smartphones and mobile devices uses permissions to restrict malicious applications (apps). However, malware developers use various social engineering methods to entice users for installing malwares after granting critical permissions by users. Therefore, it is essential to estimate security risks of untrusted Android apps to help users for making better decisions regarding app selection and installation. In this paper, the concept of criticality for Android permissions is precisely defined according to the abuse of permissions by known malwares and their legal usage by useful apps. Based on this definition and analyzing requested permissions of large numbers of malwares and benign apps, a new criterion is proposed to measure the security risks of the apps. This measure benefits from the concepts of entropy and information gain of permissions regarding separating malwares from benign apps. In this criterion, more informative permissions have higher impacts on the computed risk values. In order to evaluate the proposed criterion, two new datasets of recent malicious and non-malicious Android apps have been constructed and analyzed against existing ones. This analysis shows that permission usage patterns of Android apps are changed over the time. Empirical evaluations on recent and previous malwares and benign apps reveal the superiority of the proposed criterion with respect to previously proposed ones in terms of assigning larger risk values to malwares. [ABSTRACT FROM AUTHOR]

Android is one of the most commonly used mobile operating systems; however, its open-source nature and flexibility of usage attract a lot of attention from cybercriminals. In recent years, the rapid increase in malware has become a major cause of concern amongst Android users. The cybercriminals either aim to exploit confidential information from users or try to corrupt their systems by infecting them with malicious code. In order to make Android systems more secure, several malware detection techniques using static, dynamic, and hybrid analysis have been introduced in recent times; however, these techniques are inaccurate and have low efficiency. The paper not only explains how distinctive parallel classifiers can be used for detecting zero-day android malware but also addresses the oncoming highly elusive vulnerabilities. The proposed methodology combines characteristics from various parallel classifiers using expectation maximization to achieve 98.27% accuracy. [ABSTRACT FROM AUTHOR]

The Android operating system (OS) is a sophisticated man-made system and is the dominant OS in the current smartphone market. Due to the accumulation of errors in the system internal state and the incremental consumption of resources, such as the Dalvik heap memory of software applications and the physical memory, software aging is observed frequently and recognized as a chronic problem of Android smartphones. To mitigate this problem, we propose a two-level software rejuvenation, with the two levels referring to software applications and the OS, in this paper. Based on this strategy, a Markov regenerative process model is constructed to evaluate the steady-state availability and to optimize the time required to trigger rejuvenation for Android smartphones. The parameters of the model, such as the degradation rate and failure rate of software applications and the Android OS, are obtained via our testing platform. Experiments on two real Android applications show that the availability of an Android smartphone increases by 10.81% and 10.18% for the two subjects in our experiments, respectively. An empirical study comparing our two-level strategy with one-level strategies (single application-level and system-level rejuvenation) further verifies the effectiveness of our approach. [ABSTRACT FROM AUTHOR]

Over half of educational apps on mobile-app markets are for preschoolers, but little research has examined whether the designs of preschool apps are truly educational. Preschoolers process information differently from older learners (i.e., shorter attention spans), so app designs should be guided by developmental science. This content analysis of popular Apple and Android math and literacy preschool apps uses a developmental framework to code and analyze apps’ educational features. Findings show a wide variety of features apps used. However, few provided developmentally appropriate guidance, like scaffolded feedback. This study offers insights for improving apps to meaningfully teach preschoolers. [ABSTRACT FROM AUTHOR]

Input Method Editor (IME) is an indispensable component on current smartphones. With its assistance, the number of key presses is reduced, and non-Latin characters could be inputted. Furthermore, modern IMEs integrate several personalized features like reordering suggestion lists and predicting the next words based on user's input history. Such optimization improves the user experience but turns the IME dictionary into a pool of user privacy. Previous works have discussed the privacy risks coming from malicious IMEs. Indeed, they could cause security and privacy issues if installed by common users, but their impact is limited as the majority of IMEs are well-behaved. However, whether legitimate IMEs are bullet-proof is not answered before. In this paper, we make the first attempt to study the security implications of IME personalization and the back-end infrastructure on Android devices. In the end, we identify a critical vulnerability lying under the Android KeyEvent processing framework, which can be exploited to launch cross-app KeyEvent injection (CAKI) attack and bypass the app-isolation mechanism. By abusing such design flaw, an adversary can harvest entries from the personalized user dictionary of IME through an ostensibly innocuous app only asking for common permissions. Our evaluation over a broad spectrum of Android OSes, devices, and IMEs suggests such issue should be fixed immediately. All Android versions we examined (from very old 2.3.4 to the latest 6.0.1) and most IME apps we surveyed (11 out of 18) are vulnerable. User's private information, like contact names, location, etc., can be easily exfiltrated. Up to hundreds of millions of mobile users are under this threat. To mitigate this security issue, we propose a practical defense mechanism which augments the existing KeyEvent processing framework without forcing any change to IME apps. [ABSTRACT FROM AUTHOR]

Today's Android-powered smartphones have various embedded sensors that measure the acceleration, orientation, light and other environmental conditions. Many functions in the third-party applications (apps) need to use these sensors. However, embedded sensors may lead to security issues, as the third-party apps can read data from these sensors without claiming any permissions. It has been proven that embedded sensors can be exploited by well designed malicious apps, resulting in leaking users' privacy. In this work, we are motivated to provide an overview of sensor usage patterns in current apps by investigating what, why and how embedded sensors are used in the apps collected from both a Chinese app. market called 'AppChina' and the official market called 'Google Play'. To fulfill this goal, We develop a tool called 'SDFDroid' to identify the used sensors' types and to generate the sensor data propagation graphs in each app. We then cluster the apps to find out their sensor usage patterns based on their sensor data propagation graphs. We apply our method on 22,010 apps collected from AppChina and 7,601 apps from Google Play. Extensive experiments are conducted and the experimental results show that most apps implement their sensor related functions by using the third-party libraries. We further study the sensor usage behaviors in the third-party libraries. Our results show that the accelerometer is the most frequently used sensor. Though many third-party libraries use no more than four types of sensors, there are still some third-party libraries registering all the types of sensors recklessly. These results call for more attentions on better regulating the sensor usage in Android apps. [ABSTRACT FROM AUTHOR]

A large set of diverse hybrid mobile apps, which use both native Android app UIs and Web UIs, are widely available in today's smartphones. These hybrid apps usually use SSL or TLS to secure HTTP based communication. However, researchers show that incorrect implementation of SSL or TLS may lead to serious security problems, such as Man-In-The-Middle (MITM) attacks and phishing attacks. This paper investigates a particular SSL vulnerability that results from error-handling code in the hybrid mobile Web apps. Usually such error-handling code is used to terminate an ongoing communication, but the vulnerability of interest is able to make the communication proceed regardless of SSL certificate verification failures, eventually lead to MITM attacks. To identify those vulnerable apps, we develop a hybrid approach, which combines both static analysis and dynamic analysis to (1) automatically distinguish the native Android UIs and Web UIs, and execute the Web UIs to trigger the error-handling code; (2) accurately select the correct paths from the app entry-point to the targeted code, meanwhile avoiding the crash of apps, and populate messaging objects for the communication between components. Specifically, we construct inter-component call graphs to model the connections, and design algorithms to select the paths from the established graph and determine the parameters by backtracing. To evaluate our approach, we have implemented and tested it with 13,820 real world mobile Web apps from Google Play. The experimental results demonstrate that 1,360 apps are detected as potentially vulnerable ones solely using the static analysis. The dynamic analysis process further confirms that 711 apps are truly vulnerable among the potentially vulnerable set. [ABSTRACT FROM AUTHOR]

Many previous studies have addressed the provision of sustainable context awareness. However, they did not consider the transition between contexts and instead handled each context individually. In other words, they neglected the relationship between contexts, which can be perceived during the transition of contexts, and instead determined the context using only the value output from a sensor. As a result, although the contexts inferred during the transition are meaningless, the service consumes unnecessary power trying to be aware of these contexts. Individual context awareness for Indoor/Outdoor contexts is a representative example of this. The Indoor/Outdoor contexts should not be inferred concurrently. However, the existing services infer each context independently, so they cannot prevent power wastage when two contexts are inferred at once. For this, there is a need to consider the contexts that could simultaneously occur during context transition in order to increase the power efficiency of a context-aware service. To this end, we propose a low-power sensing model capable of considering context transition for a location-based service. In our method, we generate a context-aware model capable of considering context transition based on the activity of sensors and identify the unstable state in which context-aware services do not infer the context and therefore drain the power inefficiently. Then, by adapting the freezing method proposed in this paper to the UNSTABLE state, we block the activation of the sensors to improve the power efficiency until certain conditions are satisfied. On applying our method to context-aware services for Indoor/Outdoor contexts, we were able to improve the power efficiency by 60% in the UNSTABLE state. [ABSTRACT FROM AUTHOR]

As mobile devices have evolved from simple phones to rich computing systems, the data stored on these multi-taskers have consequently become more sensitive and private. Due to this, modern mobile operating systems include sophisticated permission systems for restricting the access to this device for the mobile applications. However, many applications acquire more permissions than required. These over-privileged applications can affect data security and user privacy. All application permissions are indicated to the user, but these notifications have been shown to be ignored or not understood. Thus, other mechanisms need to be improved. This paper presents design approaches to communicate the degree of over-privilege in mobile applications. It uses an additional rating system in application stores to inform users before making the decision of installing a specific application. The approaches have been evaluated in a usability study based on distinct prototype Android application stores. The findings show that passive security indicators can be applied to influence the decision-making process of users before downloading and installing an application. [ABSTRACT FROM AUTHOR]

This study started from the perspective of predicting science and technology competition, building on this to discuss the dynamic competition between Android and iOS by sales volume in each quarter. The Lotka–Volterra system of equations, one well-known competitive diffusion models, has been adopted to represent the competitive situations of the smartphone operating system market, with the Lyapunov function used to carry out equilibrium and stability analysis. The results showed that Android and iOS have a predator–prey relationship, in which iOS serves as the predator, and Android as a prey. The equilibrium and stability analysis show that both products are able to coexist in the market, and thus, each system has its own stable sales volume. [ABSTRACT FROM PUBLISHER]

Engineering simulation is essential to modern engineering design, although it is often a computationally demanding activity which can require powerful computer systems to conduct a study. Traditionally the remit of large desktop workstations or off-site computational facilities, potential is now emerging for mobile computation , whereby the unique characteristics of portable devices are harnessed to provide a novel means of engineering simulation. Possible use cases include emergency service assistance, teaching environments, augmented reality or indeed any such case where large computational resources are unavailable and a system prediction is needed. This is particularly relevant if the required accuracy of a calculation is relatively low, such as cases where only an intuitive result is required. In such cases the computational resources offered by modern mobile devices may already be adequate. This paper proceeds to discuss further the possibilities that modern mobile devices might offer to engineering simulation and describes some initial developments in this direction. We focus on the development of an interactive fluid flow solver employing the lattice Boltzmann method, and investigate both task-based and thread-based parallel implementations. The latter is more traditional for high performance computing across many cores while the former, native to Android, is more simple to implement and returns a slightly higher performance. The performance of both saturates when the number of threads/tasks equal three on a quad-core device. Execution time is improved by a further 20% by implementing the kernel in C++ and cross-compiling using the Android NDK. [ABSTRACT FROM AUTHOR]

With the popularity of mobile phones with Android platform, Android platform-based individual privacy information protection has been paid more attention to. In consideration of individual privacy information problem after mobile phones are lost, this paper tried to use SMS for remote control of mobile phones and providing comprehensive individual information protection method for users and completed a mobile terminal system with self-protection characteristics. This system is free from the support of the server and it can provide individual information protection for users by the most basic SMS function, which is an innovation of the system. Moreover, the protection mechanism of the redundancy process, trusted number mechanism and SIM card detection mechanism are the innovations of this system. Through functional tests and performance tests, the system could satisfy user functional and non-functional requirements, with stable operation and high task execution efficiency. [ABSTRACT FROM AUTHOR]

Mobile devices have proliferated at affordable prices nowadays. These devices provide high computational power and high- quality communication facilities, with near and remote users. In addition, most mobile devices include flexible sensors such as microphones, accelerometers and cameras, which are suitable for biomedical applications. Several students in the Biomedical Engineering Program, at our research center (Center for Studies on Electronics and Information Technologies, CEETI) have taken advantage of the mobile devices internal hardware capabilities to develop health care applications. These applications have been developed for Android-based devices. In this article two applications are presented, based on mobile platform, ECAH-M for speech analysis and i-Walker a pedometer. [ABSTRACT FROM AUTHOR]

As smartphones have become an indispensable part of daily life, mobile users are increasingly relying on them to process personal information with feature-rich applications. This situation requires robust security mechanisms for protecting sensitive applications and data on mobile devices. Android, as one the most popular smartphone operating systems, provides two core security mechanisms, application sandboxing and a permission system. However, recent studies show that these mechanisms are vulnerable to be passed by a variety of attacks. In this paper, we argue for the need of designing and implementing more comprehensive security mechanisms for Android. We realize that mediating Inter-Process Communication (IPC) channels used by Android applications can mitigate prominent attacks effectively and efficiently. Based on this observation, we propose a practical multi-layer security framework called TRIPLEMON to support policy-based mediation on Android IPC.We also discuss and evaluate a proof-of-concept prototype of TRIPLEMON along with the experimental results derived from real malware samples and synthetic attacks. [ABSTRACT FROM AUTHOR]

Recently, it is increasingly important to provide good real-time performance with the Android platform, since it has been used in industrial devices. The Android platform, however, does not provide a tight real-time guarantee that is required by such industrial devices as robots. Until a real-time extension of the Android platform becomes publicly available, application developers need a lightweight application-centric approach to achieve good real-time performance on the existing platform. This paper proposes an application-centric approach requiring no real-time extensions of the Android platform, which centers around multi-core partitioning and partition-aware application design. Following the proposed approach, we present an implementation study of motion control applications where the real-time tasks of the target application run on dedicated processor cores as a native Linux process while the non-real-time tasks run on other cores as an Android process. In the paper, we prove that the proposed approach is enough effective to deal with motion control applications on the existing Android platform with no real-time extensions. Our experiments show that on a quad-core Android board we can achieve such a good real-time performance as 99 % task activation jitters less than 5 µs for a motion control application with four real-time tasks and a period of 500 µs. [ABSTRACT FROM AUTHOR]

AndroTotal, a scalable antivirus evaluation system for mobile devices, creates reproducible, self-contained testing environments for each antivirus application and malware pair and stores them in a repository, benefiting both the research community and Android device users. [ABSTRACT FROM AUTHOR]

Multicast, originally designed as an efficient way of broadcasting content, is being used in security protocols. Multicast security protocols are difficult to verify using model checking because they typically involve a large number of participants. Likewise, the exponential growth of knowledge being distributed during protocol run is a challenge. From a specification point of view, multicast is also a general way of representing message casting in protocol verification, with unicast, anycast and broadcast as special cases. Using the inductive method of protocol verification and Isabelle/HOL, we have devised techniques for specifying multicast protocols and proving many of their essential properties. We show backwards compatibility revisiting a well-known protocol and secrecy proofs for a mixed environment protocol as a case study. Our contributions are twofold: a usable multicast specification using the inductive method and the assertion that protocols should be verified by default using a multicast specification. [ABSTRACT FROM AUTHOR]