Collaborative Research: EAGER: Enhancing Security and Privacy of Augmented Reality Mobile Applications through Software Behavior Analysis

合作研究：EAGER：通过软件行为分析增强增强现实移动应用程序的安全性和隐私性

• 批准号: 2221843
• 负责人: Wei Wang
• 金额: $ 15万
• 依托单位: University of Texas at San Antonio
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-06-15 至 2024-05-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2221843&HistoricalAwards=false
• 关键词: Collaborative; Research; EAGER; Enhancing; Security

Augmented Reality (AR) mobile apps mix virtual reality (VR) with reality to provide revolutionary user experience in tasks such as navigation, virtual meetings, exhibitions, gaming, and translation. To make virtual objects appear to be attached to real-world objects (e.g., surfaces such as walls and human faces), AR apps place virtual objects at a location (called anchors) relative to the real-world objects (called trackables) identified by the AR devices. However, AR apps’ privilege to retrieve and manipulate camera output from AR devices (i.e., often part or the whole of users’ eyesight), enabled by AR framework software APIs, result in unique security and privacy concerns, such as vandalism of VR arts and tracking bystanders. Existing defense mechanisms of AR apps (e.g., the permission system in an Android smartphone) do not model the unique behaviors of AR elements (e.g., trackables and anchors) and are too coarse grained to detect and mitigate potential privilege abuses of AR apps. The goal of the project is to (i) develop a novel software analysis framework that detects and mitigates VR app’s security and privacy risks, and (ii) conduct a large scale study on real AR apps (e.g. AR-assisted Driving and shared AR arts) to study their unique security issues.More specifically, the project will develop static and dynamic program analysis with a focus on the unique AR elements (e.g., trackables and anchors) to detect two major types of privilege abuses: abuses of read access to camera output and abuses of write abuses to screen. In particular, the project will develop (1) trackable-anchor analysis that formally models the software behaviors of AR elements and their life cycles in AR software; and (2) anomaly detection techniques for read and write abuses using anomaly detection models. The project will then conduct a study on a large number of real VR apps by applying the developed techniques to evaluate the effectiveness of the techniques and uncover unique security issues. The success of this project will lead to more secure AR apps and AR systems, and the study will deepen the understanding of the security risks and vulnerabilities in AR apps. The proposed research will also enable finer-grained AR access control on dynamically generated virtual objects.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

增强现实（AR）移动应用程序将虚拟现实（VR）与现实混合在一起，以在导航，虚拟会议，展览，游戏和翻译等任务中提供革命性的用户体验。为了使虚拟对象似乎连接到现实世界对象（例如，墙壁和人脸等表面），AR应用程序将虚拟对象放置在相对于由AR设备标识的现实世界对象（称为Trackables）的位置（称为锚定）。但是，AR应用程序有权从AR设备（即通常是部分或全部用户的视力）检索和操纵相机输出，并由AR Framework软件API启用，从而导致独特的安全性和隐私问题，例如VR Arts的破坏行为和跟踪旁观者。 AR应用程序的现有防御机制（例如，Android智能手机中的许可系统）不会对AR元素的独特行为进行建模（例如，可跟踪和锚定），并且太粗糙了，无法检测和减轻对AR应用程序的潜在特权滥用。该项目的目的是（i）开发一个新颖的软件分析框架，该框架可检测并减轻VR App的安全性和隐私风险，以及（ii）对真实AR Apps（例如，AR辅助驾驶和共享AR ARTS）进行大规模研究，以研究其独特的安全问题。具体来说，该项目将对静态和动态分析进行静态和动态分析，以构成独特的ARIENTS（E.G）。特权滥用：滥用访问对摄像机输出的滥用和滥用滥用滥用的屏幕。特别是，该项目将开发（1）可跟踪的锚定分析，该分析正式对AR元素的软件行为及其在AR软件中的生命周期进行建模； （2）使用异常检测模型读写滥用的异常检测技术。然后，该项目将通过应用开发的技术来评估技术的有效性并发现独特的安全问题，对大量实际VR应用程序进行研究。该项目的成功将导致更安全的AR应用程序和AR系统，该研究将加深对AR应用程序安全风险和脆弱性的理解。拟议的研究还将对动态生成的虚拟对象进行良好的AR访问控制。该奖项反映了NSF的法定任务，并通过使用基金会的知识分子优点和更广泛的影响评估标准来评估，被视为珍贵的支持。

项目成果

DAISY: Dynamic-Analysis-Induced Source Discovery for Sensitive Data

• DOI: 10.1145/3569936
• 发表时间: 2022-10
• 期刊: ACM Transactions on Software Engineering and Methodology
• 影响因子: 4.4
• 作者: Xueling Zhang;John Heaps;Rocky Slavin;Jianwei Niu;T. Breaux;Xiaoyin Wang

A Cloud 3D Dataset and Application-Specific Learned Image Compression in Cloud 3D

• DOI: 10.1007/978-3-031-19839-7_16
• 发表时间: 2022
• 作者: Tianyi Liu;Sen He;V. Jayakumar;Wei Wang

PredART: Towards Automatic Oracle Prediction of Object Placements in Augmented Reality Testing

• DOI: 10.1145/3551349.3561160
• 发表时间: 2022-10
• 期刊: Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering
• 作者: Tahmid Rafi;Xueling Zhang;Xiaoyin Wang