TWC: Medium: Collaborative: Improving Mobile-Application Security via Text Analytics

TWC：媒介：协作：通过文本分析提高移动应用程序安全性

• 批准号: 1513939
• 负责人: Tao Xie
• 金额: $ 90万
• 依托单位: University of Illinois at Urbana-Champaign
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2015
• 资助国家: 美国
• 起止时间: 2015-07-01 至 2019-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1513939&HistoricalAwards=false
• 关键词: TWC; Medium; Collaborative; Improving; Mobile

Security policies often base access decisions on temporal context (e.g., time of day) and environmental context (e.g., geographic location). Access control policies for operating systems frequently consider execution context (e.g., user ID, program arguments). However, little has been done to incorporate user expectation context into security decision mechanisms. Text artifacts provide a source of user expectation context. When finding, installing, and running software, users are shown natural language text, e.g., textual functionality descriptions, permission requests, privacy notices, and user interface text. This research aims to improve security decisions using expectation context, by relating user-facing natural language text with security operations.This research focuses specifically on mobile applications by incorporating expectation context when making security decisions. Mobile applications provide specific forms of user text and security operations. This research considers the relationship between an application's description or user interface text and different granularities of security operations. The research forms the foundation for techniques and tools that inform mobile-device users of the security and privacy implications of installing mobile applications. As broader impacts, this research enables developers to produce more secure mobile applications and enables users to use more secure mobile applications.

安全策略通常会基于时间上下文（例如，一天中的时间）和环境环境（例如地理位置）的访问决策。操作系统的访问控制策略经常考虑执行上下文（例如，用户ID，程序参数）。但是，几乎没有完成将用户期望上下文纳入安全决策机制中的几乎没有。文本工件提供了用户期望上下文的来源。在查找，安装和运行软件时，向用户显示自然语言文本，例如文本功能描述，权限请求，隐私声明和用户界面文本。这项研究旨在通过将自然语言文本与安全操作联系起来，通过将自然语言文本与安全操作联系起来，以改善安全决策。本研究专门针对移动应用程序，通过在制定安全决策时结合期望环境。移动应用程序提供了特定形式的用户文本和安全操作。这项研究考虑了应用程序的描述或用户界面文本与安全操作的不同粒度之间的关系。该研究构成了技术和工具的基础，该技术和工具为移动设备用户提供了安装移动应用程序的安全性和隐私影响。随着更广泛的影响，该研究使开发人员能够生产更安全的移动应用程序，并使用户能够使用更安全的移动应用程序。

项目成果

REINAM: Reinforcement Learning for Input-Grammar Inference

• DOI: 10.1145/3338906.3338958
• 发表时间: 2019-01-01
• 期刊: ESEC/FSE'2019: PROCEEDINGS OF THE 2019 27TH ACM JOINT MEETING ON EUROPEAN SOFTWARE ENGINEERING CONFERENCE AND SYMPOSIUM ON THE FOUNDATIONS OF SOFTWARE ENGINEERING
• 作者: Wu, Zhengkai;Johnson, Evan;Xie, Tao
• 通讯作者: Xie, Tao

SemRegex: A Semantics-Based Approach for Generating Regular Expressions from Natural Language Specifications

• DOI: 10.18653/v1/d18-1189
• 发表时间: 2018-10
• 作者: Zexuan Zhong;Jiaqi Guo;Wei Yang;Jian Peng;Tao Xie;Jian-Guang Lou;Ting Liu;D. Zhang

FinExpert: domain-specific test generation for FinTech systems

FinExpert：金融科技系统的特定领域测试生成

• DOI: 10.1145/3338906.3340441
• 发表时间: 2019
• 期刊: ESEC/FSE 2019: Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
• 作者: Jin, Tiancheng;Wang, Qingshun;Xu, Lihua;Pan, Chunmei;Dou, Liang;Qian, Haifeng;He, Liang;Xie, Tao
• 通讯作者: Xie, Tao

Testing Untestable Neural Machine Translation: An Industrial Case

• DOI: 10.1109/icse-companion.2019.00131
• 发表时间: 2018-07
• 期刊: 2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)
• 作者: Wujie Zheng;Wenyu Wang;Dian Liu;Changrong Zhang;Qinsong Zeng;Yuetang Deng;Wei Yang;Pinjia He;Tao Xie

FACTS: automated black-box testing of FinTech systems

• DOI: 10.1145/3236024.3275533
• 发表时间: 2018-10
• 期刊: Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
• 作者: Qingshun Wang;Lintao Gu;Minhui Xue;Lihua Xu;Wenyu Niu;Liang Dou;Liang He;Tao Xie