To address deficiencies in fine-grained identification of application-layer commands in network traffic, an encrypted FTP command recognition method based on temporal dual-modal feature fusion was proposed, solving FTP command identification under IPsec-ESP encrypted tunnels. First, a multi-constraint matching algorithm based on an encrypted proxy was designed to achieve accurate instruction-level annotation of ESP encrypted traffic. Then, a traffic analysis framework with temporal dual-modal feature fusion was constructed to extract features from macroscopic traffic patterns and microscopic temporal dynamics. In experiments, real FTP traffic was obtained in an encrypted proxy environment to realize matching annotation and accurate identification of 24 fine-grained FTP commands (responses). Comparative experiments with five machine learning models verify the effectiveness of the proposed method. The results show that the method achieves 95.4% accuracy in encrypted FTP command-level classification, significantly outperforming traditional single-modal feature methods, providing a new technical approach for application-layer traffic identification in encrypted networks.

Stateful network protocol implementations are prone to security vulnerabilities due to their complex, state-dependent logic, making efficient detection of such flaws a critical challenge. Existing state-aware fuzzing methods either rely on explicit protocol features—limiting their applicability—or process memory data indiscriminately, introducing noise that reduces accuracy. To address these limitations, this paper proposes a runtime state data-guided fuzzing approach that refines state inference through preprocessing and multi-dimensional feature extraction. Our method first filters irrelevant noise from runtime snapshots, then characterizes protocol states using structural patterns, semantic keywords, and discrete tokens. A tailored state distance metric quantifies differences between states, enabling precise clustering and the dynamic construction of a high-fidelity state machine. We implement this approach in RSAFL, a gray-box fuzzer that integrates lightweight feature extraction and state modeling. Evaluated on 11 widely used protocol implementations, RSAFL achieves better results against six state-of-the-art fuzzers, demonstrating its practical effectiveness in exploring deep state spaces and uncovering hidden security flaws.

Android WebView enables applications to embed web content within native User Interface (UI), wherein embedded JavaScript codes often require elevated privileges to perform operations such as cross-origin requests and access to sensitive data. While these JavaScript codes provide enhanced functionalities, they also introduce potential security risks, such as unauthorized API access and privilege escalation. Existing static analysis approaches fall short in adequately modeling JavaScript’s dynamic features and its runtime interactions with Java interfaces, which results in false negatives for deeply triggered vulnerabilities that are exposed through dynamic execution paths. Furthermore, the lack of priority-guided analysis and adaptive resource scheduling during static analysis results in inefficiencies, particularly when dealing with complex branches and numerous objects. This paper proposes WebViewJSdetect, a novel system that models the dynamic features of JavaScript through concurrent abstract interpretation and mitigates state explosion using a coverage-guided adaptive thread scheduling mechanism. In the evaluation, WebViewJSdetect successfully detects 30 JavaScript-related security vulnerabilities in a real-world Android applications dataset and achieves a 13.3% improvement in vulnerability detection rate over the best baseline approach in a labeled benchmark dataset, while also improving analysis efficiency by approximately 20% on average.

Automated graphical user interface (GUI) testing is essential for ensuring mobile app quality. However, existing related methods lack deep GUI understanding and cannot segment specific functions for targeted testing, resulting in wasted test events and low efficiency. This study aims to leverage large language models (LLMs) to enhance Monkey-based GUI testing by enabling function-level segmentation and tailored parameter generation driven by user requirements. We propose GPT-Monkey, which integrates Monkey’s randomness with LLM’s understanding capability. It establishes global interface associations and cross-modal alignment for LLM-driven function segmentation, employs parameter-retrieval augmented generation (RAG) to guide tailored parameter generation, and adopts a dual-feedback mechanism to iteratively optimize testing. Experiments show that GPT-Monkey improves crash detection by 16.7% and efficiency by 34.5% over the optimal baseline, and achieves 95% function segmentation accuracy and uncovers 397 real-world crashes on 1000 Google Play apps. The results demonstrate that LLM-driven function segmentation and tailored parameter generation significantly enhance the precision and efficiency of automated GUI testing.

Security vulnerabilities in hardware design may affect the normal operation of critical facilities or the leakage and tampering of confidential assets. Three types of methods have been proposed for security detection in the pre-silicon, namely formal verification with high coverage but state explosion problem, simulation test with low running cost but low coverage, and hybrid testing technology combining the two. However, there are still some problems in current research, such as insufficient security vulnerability detection ability and redundant test cases generated. In order to solve the above problems, we propose a hybrid testing technique based on information flow path guidance. PGtest provides accurate vulnerability detection capabilities through path-aware information flow tracking model, and reduces test set by providing path constraints to formal tools through a path selection algorithm. Experiments on the Trust-Hub cryptographic core benchmark show that PGTest can accurately detect security vulnerabilities in hardware design and provide the corresponding minimum number of test cases.

Intent vulnerabilities pose a significant threat as they allow attackers to exploit unverified intent messages, leading to sensitive data leaks, privilege escalations, or unauthorized actions that compromise user privacy and system security. Fuzzing methods, as traditional Intent vulnerability detection methods, are guided by the edge coverage of the program-directed graph and do not focus on sensitive information, resulting in a lack of ability to discover vulnerabilities related to sensitive information, especially long-path vulnerabilities. This article proposes PathFuzzer, which is an intent-sensitive information flow path-guided fuzzing method designed to efficiently detect intent vulnerabilities in Android applications. It leverages intent-sensitive information flow paths to guide fuzzing by sending test cases along these paths and mutating test cases based on the parameter within the paths. Additionally, PathFuzzer utilizes unique long path encoding and key node identification technology to enable test cases to efficiently test along sensitive information flow paths, while monitoring the test status to form a feedback mechanism for long paths. The evaluation results show that PathFuzzer successfully detected 131 intent vulnerabilities across 500 popular applications from Google Play. Compared to traditional methods, PathFuzzer achieved a 92% average path coverage rate on sensitive paths while improving detection efficiency by an average of up to 64%. In summary, PathFuzzer provides an efficient, accurate, and comprehensive method for detecting Intent vulnerabilities.

Information flow tracking technology is commonly used in the security analysis of hardware design. This technology protects the confidentiality and integrity of essential assets by instrumenting trace logic on each operation unit to detect whether critical information has been leaked or tampered with. However, as hardware design becomes increasingly large-scale and complex, the significant performance overhead introduced by instrumentation has become a major challenge. This article proposes Selective Hardware Information Flow Tracking (SHIFT), a constraint-driven optimization technique. The core idea of SHIFT includes selective monitoring of operations and selective optimization of propagation logic. In the intermediate representation of the hardware design, SHIFT scans taint sources in the code statically using a conservative analysis algorithm to determine whether logic structures require monitoring and assigns optimization tags based on known conditions. During the synthesis process, these optimization tags are passed to the netlist, thereby enabling selective instrumentation of the trace logic on the cell. In the Trust-Hub AES test bench, SHIFT reduces the deployment time of the tracking model by 12.1%, decreases the number of cells by 19.9%, and reduces the synthesized area by 35.7%, Additionally, the security verification time of the flow model was reduced by 10.5%. In general, SHIFT reduces the overhead of deploying trace logic without introducing false positives.

Vulnerabilities and Trojans in hardware design may cause sensitive data to be leaked and tampered. Information flow tracking technology can effectively verify the confidentiality and integrity of hardware design. Currently, this technology mainly analyzes the reachability of information flow and lacks fine-grained analysis of information flow paths. It is difficult to find structural defects in information flow paths and malicious sensitive information processes in hardware design. To solve above problem, we propose Path-aware Dynamic Information Flow Tracking (PDIFT) technology, which performs taint tracking and path tracking while sensitive information is propagated. It analyzes the propagation of sensitive information in hardware design with fine-grained taint label propagation logic and inserts path label propagation logic only on basic blocks divided by branch nodes, which greatly simplifies the path tracing overhead compared to the full node sequence tracing on the path. Experiments have shown that compared to CellIFT, PDIFT has a 12.1% increase in static analysis time and a 0.1% increase in dynamic validation time. The average instrumentation area cost of each basic block has increased by 16.4 um2. In terms of detection capability, PDIFT makes up for the limitation of false negatives in traditional taint tracking technology through joint analysis of path labels and taint labels, then detect problems such as insufficient iterations of encryption components and malicious processing of important assets, thereby improving the accuracy of hardware security verification.

Comparing the expressive power of access control models is a fundamental issue in computer security. A better solution to this problem is helpful for understanding the limitations and potential capabilities of models, improving models and selecting appropriate security models for different applications. The existing comparison theories either do not consider the security properties when comparing, or the semantics of the security properties considered are too weak, or the comparison methods are vague and difficult to operate. In this paper, we define a mapping between models whose security properties are preserved based on temporal logic, and propose a more scientific and standard comparison method of expressive power with operability based on the mapping. On this basis, we demonstrate that the DIFC has better expressive power than the BLP model.

With the rapid development of cloud computing, cloud storage is widely used. In the cloud environment, users’ virtual machine system mirrors and data are stored in the cloud server. The escape of virtual machines and Trojan virus attacks make it challenging to ensure the integrity of virtual machine systems. Trusted computing is expensive to randomly verify data integrity and does not adapt to dynamic data changes. Provable data integrity is a potential solution to this problem. Merkle Hash Tree (MHT) model is widely adopted in provable data integrity. Although MHT requires only a small amount of evidence for verification, the verifier’s number of hash calculations and the server’s efficiency of evidence query are not optimal. Moreover, the verification frequency of each piece of data is not considered by MHT. Properly handling these factors can improve the actual verification performance. In this paper, a lightweight and efficient data integrity verification approach called HB+-MHT is proposed for the tenant virtual machine (TVM) in cloud computing. In HB+-MHT, the Huffman hash tree scheme is used for small file verification to ensure that the hot file has a shorter path, which reduces the required amount of evidence for verification. Meanwhile, the B+ hash tree scheme is used for big files verification, which can effectively reduce evidence query time and hash calculation times. The experimental results show that the scheme proposed in this paper can perform data integrity verification well, with reduced computing and storage overhead.

Android faces an increasing threat of malware attacks. The few existing formal detection methods have drawbacks such as complex code modeling, incomplete and inaccurate expression of family properties, and excessive manual participation. To this end, this paper proposes a formal detection method, called DroidFDR, for Android malware classification based on communicating sequential processes (CSP). In this method, the APK file of an application is converted to an easy-to-analyze representation, namely Jimple, in order to model the code behavior with CSP. The process describing the behavior of a sample is inputted to an FDR model checker to be simplified and verified against a process that is automatically abstracted from the malware to express the property of a family. The sample is classified by detecting whether it has the typical behavior of any family property. DroidFDR can capture the behavioral characteristics of malicious code such as control flow, data flow, procedure calls, and API calls. The experimental results show that the automated method can characterize the behavior patterns of applications from the structure level, with a high family classification accuracy of 99.06% in comparison with another formal detection method.

Despite the demonstrated effectiveness of dynamic taint analysis (DTA) in a variety of security applications, the poor performance achieved by available DTA prototypes prevents their widespread adoption in production systems, especially the Android system with limited computation and storage resources. To overcome DTA’s overhead bottlenecks, recent research efforts aim to decouple taint tracking logic from program execution. Continuing this line of research, this work proposes FSAFlow, a novel hybrid taint tracking and control system, to reduce DTA overhead significantly while ensuring sound Android privacy protection. FSAFlow further separates the path tracking logic from the corresponding taint tracking logic and the control of the information flow path is optimized. Specifically, a classic static analysis algorithm is first modified to search target paths and their key branch information. Then, the potential paths that violate the user’s predefined privacy protection policy are chosen and encoded with a Finite State Automaton (FSA). A small amount of FSA-based state management code is inserted into the corresponding position in the program. Finally, it monitors the program’s state of path execution and prevents information leakage during runtime. The efficiency and correctness of FSAFlow are proved by theoretical analysis. The experimental results show that FSAFlow incurs lower overhead than several representative DTA optimization approaches, 2.06% for popular applications, and 5.41% on CaffeineMark 3.0. FSAFlow has fewer false negatives in implicit flow tracking than the Android DTA platform, TaintDroid, and achieves higher precision than the static analysis tool, FlowDroid, by verifying the paths that never occur and tracking in the complete execution stage of the loop body at runtime.

The openness of Android operating system not only brings convenience to users, but also leads to the attack threat from a large number of malicious applications (apps). Thus malware detection has become the research focus in the field of mobile security. In order to solve the problem of more coarse-grained feature selection and larger feature loss of graph structure existing in the current detection methods, we put forward a method named DGCNDroid for Android malware detection, which is based on the deep graph convolutional network. Our method starts by generating a function call graph for the decompiled Android application. Then the function call subgraph containing the sensitive application programming interface (API) is extracted. Finally, the function call subgraphs with structural features are trained as the input of the deep graph convolutional network. Thus the detection and classification of malicious apps can be realized. Through experimentation on a dataset containing 11,120 Android apps, the method proposed in this paper can achieve detection accuracy of 98.2%, which is higher than other existing detection methods.

Android has become the most popular mobile operating system all over the world. Due to its openness, users can install applications freely. At the same time, users are increasingly storing personal privacy information in their mobile phones, which has led to Android becoming the main target of malicious applications, and privacy leaks have occurred from time to time. Although the Android operating system provides the permissions to restrict the ability of applications to access sensitive resources, users do not pay much attention to the granting of permissions, which makes malicious applications available. Therefore, it is of great significance to make risk assessments for applications before installation. In this paper we propose a privacy risk assessment framework called PRADroid for Android applications. Through likelihood assessment based on permissions and severity assessment based on information flow analysis, a risk matrix is finally generated to score the application privacy risk. We evaluate PRADroid on 2000 Android applications, and the experimental results show that PRADroid can score reasonably and effectively.

When users upload their private data to the cloud, they lose control of the data stored in the cloud server.If the cloud system cannot provide an effective security mechanism to protect the data, the consequent data leakage issue will hinder the development of cloud computing.Conventional access control and encryption technologies cannot effectively control the propagation of tenant private data in the system.The mandatory one-way information flow control model is limited by the complexity of the cloud environment, and it is difficult to effectively protect private data stored in the cloud.To solve the above problems, this article proposes a tenant-led ciphertext information flow control method for cloud virtual machines.Through the design of a decentralized information flow control security policy, a secret-domain key management scheme, and a multi-ID-based threshold encryption scheme, the information flow control strategies of taint infection, secret-level reduction, and ability propagation are realized in a ciphertext form, which can effectively prevent malicious users inside and outside the system from illegally reading private data.The feasibility of this method is verified by a security proof and an experiment.

Mobile operating systems such as Android are facing serious security risk. First, they have a large number of users and store a large number of users’ private data, which have become major targets of network attack; second, their openness leads to high security risks; third, their coarse-grained static permission control mechanism leads to a large number of privacy leaks. Recent decentralized information flow control (DIFC) operating systems such as Asbestos, HiStar, and Flume dynamically adjust the label of each process. Asbestos contains inherent covert channels due to this implicit label adjustment. The others close these covert channels through the use of explicit label change, but this impedes communication and increases performance overhead. We present an enhanced implicit label change model (EILCM) for mobile operating systems that can close the known covert channel in these models with implicit label change and supports dynamic constraints on tags for separation of duty. We also formally analyze the reasons why EILCM can close the known covert channels and prove that abstract EILCM systems have the security property of noninterference with declassification by virtue of the model checker tool FDR. We also prove that the problem of EILCM policy verification is NP-complete and propose a backtrack-based search algorithm to solve the problem. Experiments are presented to show that the algorithm is effective.

In order to strengthen the cloud system’s ability to type control data resources, The information flow control model can more effectively protect the confidentiality and integrity of users' data in the cloud environment, and can prevent system vulnerabilities or attacks by illegal users outside the cloud system. However, in the process of implementing the type control system, too much manpower is often required to formulate rules to divide user security type labels. Unreasonable security type label division will directly affect system security and usability. In order to solve the problem of information flow control security type label distribution in the process of authorization system migration in a scientific way. This chapter proposes a bottom-up information flow access control security type label optimization mining method. The category domain label mining algorithm based on Louvain community discovery algorithm and the secret level mining algorithm based on genetic algorithm are used to obtain the optimal approximate solution to Information flow control security type label optimization mining problem (IFCSLMP). The results show that the proposed scheme can effectively dig out the effective information flow control security type label from the access control matrix.

Information flow control (IFC) can effectively resist Trojans and viruses that steal information from systems, and is usually adopted to protect the confidentiality of systems with a high security level. However, covert channel attacks can bypass IFC by exploiting its implementation defects. Thus, it is crucial to verify the system security and identify potential covert channels. Decentralized IFC (DIFC) is a key innovation that provides new flexible mechanisms, including decentralized declassification and taint tracking. However, the flexibility of DIFC systems also brings security risks. At present, there is a lack of a systematic and automatic security analysis approach for complex DIFC systems. In this paper, we propose a formal and automatic method to analyze the security of DIFC systems by using the FDR2 tool. We provide a new definition of noninterference, based on which the security analysis is performed. The analysis results indicate that our approach can both effectively detect covert channels in DIFC systems and accommodate conditional declassification information. The proposed method is more efficient and accurate than existing manual methods of covert channel detection.

Android is increasingly facing the threat of malware attacks. It is difficult to effectively detect large-sample and multi-class malware for traditional machine learning methods such as support vector machine, method for Android malware detection and family classification based on deep neural network was proposed. Based on the comprehensive extraction of application components, Intent Filter, permissions, and data flow, the method performed an effective feature selection to reduce dimensions, and conducted a large-sample detection and multi-class classification for malware based on deep neural network. The experimental results show that the method can conduct an effective detection and classification. The accuracy of binary classification between benign and malicious Apps is 97.73%, and the accuracy of family multi-class classification can reach 93.54%, which is higher than other machine learning algorithms.