Question: Real-time collection of primary memory information from Android mobile devices and smartwatches.

This article introduces a pioneering methodology and toolkit for the acquisition and comprehensive analysis of volatile physical memory from Android devices, encompassing both smartphones and smartwatches. Given the rapid market penetration of the Android operating system, particularly in mobile devices, the significance of developing robust data acquisition techniques becomes increasingly apparent. The paper delves into the intricacies and challenges associated with Android memory acquisition, highlighting the necessity for a versatile and adaptable approach. To address these challenges, a novel kernel module, designated as dmd, has been developed to facilitate memory dumping. This tool is designed to support memory acquisition to either the device's SD card or through network transmission, ensuring flexibility and compatibility across a wide array of devices. Moreover, the paper demonstrates the application of advanced Volatility features for analyzing kernel structures, underscoring the potential of detailed memory analysis in enhancing the capabilities of digital forensics investigators. The outcomes of this research underscore the value of in-depth memory analysis in the realm of digital forensics, offering a powerful toolset for investigators to uncover critical evidence from Android devices.

Smartphones are increasingly utilized in society and enable scientists to record a wide range of behavioral and environmental information. These information, referred to as Unobtrusive Ecological Momentary Assessment Data, might support prediction procedures regarding the mood level of users and simultaneously contribute to an enhancement of therapy strategies. In this paper, we analyze how the mood level of healthy clients is affected by unobtrusive measures and how this kind of data contributes to the prediction performance of various statistical models (Bayesian methods, Lasso procedures, etc.). We conduct analyses on a non-user and a user level. We then compare the models by utilizing introduced performance measures. Our findings indicate that the prediction performance increases when considering individual users. However, the implemented models only perform slightly better than the introduced mean model. Indicated by feature selection methods, we assume that more meaningful variables regarding the outcome can potentially increase prediction performance.

Android platform has become the main target of the malware developers in the past few years. One of Android's main defense mechanisms against malicious apps is a permission-based access control mechanism. It is a feasible approach to detect a potential malicious application based on the permissions it requested. In this paper, we proposed a two-layered permission based detection scheme for detecting malicious Android applications. Comparing with previous researches, we consider the apps requested permission pairs as the additional condition, and we also consider used permissions to improve detection accuracy. The result of an evaluation, performed using 28548 benign apps and 1536 malicious apps, indicates that a two-layered permission-based detector has high detection rate of malware.

Due to the rapid increase of Android apps and their wide usage to handle personal data, a precise and large-scaling checker is in need to validate the apps' permission flow before they are listed on the market. Several tools have been proposed to detect sensitive data leaks in Android apps. But these tools are not applicable to large-scale analysis since they fail to deal with the arbitrary execution orders of different event handlers smartly. Event handlers are invoked by the framework based on the system state, therefore we cannot pre-determine their order of execution. Besides, since all exported components can be invoked by an external app, the execution orders of these components are also arbitrary. A naive way to simulate these two types of arbitrary execution orders yields a permutation of all event handlers in an app. The time complexity is O(n!) where n is the number of event handlers in an app. This leads to a high analysis overhead when n is big. To give an illustration, CHEX [10] found 50.73 entry points of 44 unique class types in an app on average. In this paper we propose an improved static taint analysis to deal with the challenge brought by the arbitrary execution orders without sacrificing the high precision. Our analysis does not need to make permutations and achieves a polynomial time complexity. We also propose to unify the array and map access with object reference by propagating access paths to reduce the number of false positives due to field-insensitivity and over approximation of array access and map access.
 We implement a tool, WeChecker, to detect privilege escalation vulnerabilities [7] in Android apps. WeChecker achieves 96% precision and 96% recall in the state-of-the-art test suite DriodBench (for compairson, the precision and recall of FlowDroid [1] are 86% and 93%, respectively). The evaluation of WeChecker on real apps shows that it is efficient (average analysis time of each app: 29.985s) and fits for large-scale checking.

We introduce hand movement, orientation, and grasp (HMOG), a set of behavioral features to continuously authenticate smartphone users. HMOG features unobtrusively capture subtle micro-movement and orientation dynamics resulting from how a user grasps, holds, and taps on the smartphone. We evaluated authentication and biometric key generation (BKG) performance of HMOG features on data collected from 100 subjects typing on a virtual keyboard. Data were collected under two conditions: 1) sitting and 2) walking. We achieved authentication equal error rates (EERs) as low as 7.16% (walking) and 10.05% (sitting) when we combined HMOG, tap, and keystroke features. We performed experiments to investigate why HMOG features perform well during walking. Our results suggest that this is due to the ability of HMOG features to capture distinctive body movements caused by walking, in addition to the hand-movement dynamics from taps. With BKG, we achieved the EERs of 15.1% using HMOG combined with taps. In comparison, BKG using tap, key hold, and swipe features had EERs between 25.7% and 34.2%. We also analyzed the energy consumption of HMOG feature extraction and computation. Our analysis shows that HMOG features extracted at a 16-Hz sensor sampling rate incurred a minor overhead of 7.9% without sacrificing authentication accuracy. Two points distinguish our work from current literature: 1) we present the results of a comprehensive evaluation of three types of features (HMOG, keystroke, and tap) and their combinations under the same experimental conditions and 2) we analyze the features from three perspectives (authentication, BKG, and energy consumption on smartphones).

A Smart Home (SH) is a house or an apartment equipped with advanced automation technologies to provide the occupants with intelligent monitoring and actionable information that can be situation specific. It allows for improvements in the way we live or work, and for improved energy efficiencies. The smart home is especially relevant for the elderly because the intelligent sensing systems would allow for remote monitoring and possibly control of health and environmental parameters according to their health status and living needs. The burgeoning elderly population and rising costs of elderly healthcare and home needs have led to a rapid evolution of the elderly smart living environment. However, the lack of proper eldercare smart home technologies has inspired us to develop Information and Communication Technologies (ICT) based smart home for the elderly using the Android platform. We have proposed a model for the elderly using Wireless Sensor Networks (WSNs) implemented as an Android application. Our smart home research potentially allows the elderly to continue to live in their own homes while being monitored non-invasively, seamlessly and economically according to their healthcare needs and status.

When compared to image recognition, object detection is a much more challenging task because it requires the accurate real-time localization of an object in the target image. In interaction scenarios, this pipeline can be simplified by incorporating the users’ point of regard. Wearable eye trackers can estimate the gaze direction, but lack own processing capabilities. We enable mobile gaze-aware applications by developing an open-source platform which supports mobile eye tracking based on the Pupil headset and a smartphone running Android OS. Through our platform, we offer researchers and developers a rapid prototyping environment for gaze-enabled applications. We describe the concept, our current progress, and research implications. ACM Classification

Awareness of the emotion of those who communicate with others is a fundamental challenge in building affective intelligent systems. Emotion is a complex state of the mind influenced by external events, physiological changes, or relationships with others. Because emotions can represent a user's internal context or intention, researchers suggested various methods to measure the user's emotions from analysis of physiological signals, facial expressions, or voice. However, existing methods have practical limitations to be used with consumer devices, such as smartphones; they may cause inconvenience to users and require special equipment such as a skin conductance sensor. Our approach is to recognize emotions of the user by inconspicuously collecting and analyzing user-generated data from different types of sensors on the smartphone. To achieve this, we adopted a machine learning approach to gather, analyze and classify device usage patterns, and developed a social network service client for Android smartphones which unobtrusively find various behavioral patterns and the current context of users. Also, we conducted a pilot study to gather real-world data which imply various behaviors and situations of a participant in her/his everyday life. From these data, we extracted 10 features and applied them to build a Bayesian Network classifier for emotion recognition. Experimental results show that our system can classify user emotions into 7 classes such as happiness, surprise, anger, disgust, sadness, fear, and neutral with a surprisingly high accuracy. The proposed system applied to a smartphone demonstrated the feasibility of an unobtrusive emotion recognition approach and a user scenario for emotion-oriented social communication between users.

Google's Android platform is a widely anticipated open source operating system for mobile phones. This article describes Android's security model and attempts to unmask the complexity of secure application development. The authors conclude by identifying lessons and opportunities for future enhancements.

This paper presents an Internet of Things (IoT) approach to Human Activity Recognition (HAR) using remote monitoring of vital signs in the context of a healthcare system for self-managed chronic heart patients. Our goal is to create a HAR-IoT system using learning algorithms to infer the activity done within 4 categories (lie, sit, walk and run) as well as the time consumed performing these activities and, finally giving feedback during and after the activity. Alike in this work, we provide a comprehensive insight on the cloud-based system implemented and the conclusions after implementing two different learning algorithms and the results of the overall system for larger implementations.

We present a contactless solution for detecting sleep apnea events on smartphones. To achieve this, we introduce a novel system that monitors the minute chest and abdomen movements caused by breathing on smartphones. Our system works with the phone away from the subject and can simultaneously identify and track the fine-grained breathing movements from multiple subjects. We do this by transforming the phone into an active sonar system that emits frequency-modulated sound signals and listens to their reflections; our design monitors the minute changes to these reflections to extract the chest movements. Results from a home bedroom environment shows that our design operates efficiently at distances of up to a meter and works even with the subject under a blanket.
 Building on the above system, we develop algorithms that identify various sleep apnea events including obstructive apnea, central apnea, and hypopnea from the sonar reflections. We deploy our system at the UW Medicine Sleep Center at Harborview and perform a clinical study with 37 patients for a total of 296 hours. Our study demonstrates that the number of respiratory events identified by our system is highly correlated with the ground truth and has a correlation coefficient of 0.9957, 0.9860, and 0.9533 for central apnea, obstructive apnea and hypopnea respectively. Furthermore, the average error in computing of rate of apnea and hypopnea events is as low as 1.9 events/hr.


Question: Real-time collection of primary memory information from Android cell phones and smartwatches.

This paper presents an innovative acquisition technique for Android smartphones, leveraging the firmware update protocols to overcome the challenges posed by new security features. With Android's continued dominance in the smartphone market, despite iOS's temporary surge during the iPhone 6 launch, the diversity of Android devices has prompted forensic investigations into data acquisition and analysis methodologies. However, the implementation of advanced security measures in recent Android versions has complicated the use of conventional forensic approaches. To tackle this issue, we introduce a novel data acquisition strategy that involves scrutinizing the firmware update protocols of Android smartphones. By reverse engineering the bootloader's firmware update protocol, we can execute a physical acquisition of the device using a flash memory read command. Our empirical findings reveal that this proposed method outperforms traditional forensic techniques in several key aspects, including enhanced integrity assurance, faster acquisition rates, and the capability to perform physical dumps on screen-locked smartphones with USB debugging disabled. This research underscores the importance of adapting forensic methodologies to address the evolving security landscape in Android devices.

This report describes an analysis of the Fitbit Flex ecosystem. Our objectives are to describe (1) the data Fitbit collects from its users, (2) the data Fitbit provides to its users, and (3) methods of recovering data not made available to device owners. Our analysis covers four distinct attack vectors. First, we analyze the security and privacy properties of the Fitbit device itself. Next, we observe the Bluetooth traffic sent between the Fitbit device and a smartphone or personal computer during synchronization. Third, we analyze the security of the Fitbit Android app. Finally, we study the security properties of the network traffic between the Fitbit smartphone or computer application and the Fitbit web service. We provide evidence that Fitbit unnecessarily obtains information about nearby Flex devices under certain circumstances. We further show that Fitbit does not provide device owners with all of the data collected. In fact, we find evidence of per-minute activity data that is sent to the Fitbit web service but not provided to the owner. We also discovered that MAC addresses on Fitbit devices are never changed, enabling usercorrelation attacks. BTLE credentials are also exposed on the network during device pairing over TLS, which might be intercepted by MITM attacks. Finally, we demonstrate that actual user activity data is authenticated and not provided in plaintext on an end-to-end basis from the device to the Fitbit web service.

Sensors in everyday devices, such as our phones, wearables, and computers, leave a stream of digital traces. Personal sensing refers to collecting and analyzing data from sensors embedded in the context of daily life with the aim of identifying human behaviors, thoughts, feelings, and traits. This article provides a critical review of personal sensing research related to mental health, focused principally on smartphones, but also including studies of wearables, social media, and computers. We provide a layered, hierarchical model for translating raw sensor data into markers of behaviors and states related to mental health. Also discussed are research methods as well as challenges, including privacy and problems of dimensionality. Although personal sensing is still in its infancy, it holds great promise as a method for conducting mental health research and as a clinical tool for monitoring at-risk populations and providing the foundation for the next generation of mobile health (or mHealth) interventions.

Android OS is one of the widely used mobile Operating Systems. The number of malicious applications and adwares are increasing constantly on par with the number of mobile devices. A great number of commercial signature based tools are available on the market which prevent to an extent the penetration and distribution of malicious applications. Numerous researches have been conducted which claims that traditional signature based detection system work well up to certain level and malware authors use numerous techniques to evade these tools. So given this state of affairs, there is an increasing need for an alternative, really tough malware detection system to complement and rectify the signature based system. Recent substantial research focused on machine learning algorithms that analyze features from malicious application and use those features to classify and detect unknown malicious applications. This study summarizes the evolution of malware detection techniques based on machine learning algorithms focused

Smartphone platforms and applications (apps) have gained tremendous popularity recently. Due to the novelty of the smartphone platform and tools, and the low barrier to entry for app distribution, apps are prone to errors, which affects user experience and requires frequent bug fixes. An essential step towards correcting this situation is understanding the nature of the bugs and bug-fixing processes associated with smartphone platforms and apps. However, prior empirical bug studies have focused mostly on desktop and server applications. Therefore, in this paper, we perform an in-depth empirical study on bugs in the Google Android smartphone platform and 24 widely-used open-source Android apps from diverse categories such as communication, tools, and media. Our analysis has three main thrusts. First, we define several metrics to understand the quality of bug reports and analyze the bug-fix process, including developer involvement. Second, we show how differences in bug life-cycles can affect the bug-fix process. Third, as Android devices carry significant amounts of security-sensitive information, we perform a study of Android security bugs. We found that, although contributor activity in these projects is generally high, developer involvement decreases in some projects, similarly, while bug-report quality is high, bug triaging is still a problem. Finally, we observe that in Android apps, security bug reports are of higher quality but get fixed slower than non-security bugs. We believe that the findings of our study could potentially benefit both developers and users of Android apps.

Devices with integrated Wi-Fi chips broadcast beacons for network connection management purposes. Such information can be captured with inexpensive monitors and used to extract user behavior. To understand the behavior of visitors, we deployed our passive monitoring system---CrowdProbe, in a multi-floor museum for six months. We used a Hidden Markov Models (HMM) based trajectory inference algorithm to infer crowd movement using more than 1.7 million opportunistically obtained probe request frames.
 However, as more devices adopt schemes to randomize their MAC addresses in the passive probe session to protect user privacy, it becomes more difficult to track crowd and understand their behavior. In this paper, we try to make use of historical transition probability to reason about the movement of those randomized devices with spatial and temporal constraints. With CrowdProbe, we are able to achieve sufficient accuracy to understand the movement of visitors carrying devices with randomized MAC addresses.

The popularity and utility of smartphones rely on their vibrant application markets; however, plagiarism threatens the long-term health of these markets. In this paper, we present a scalable approach to detecting similar Android apps based on semantic information. We implement our approach in a tool called AnDarwin and evaluate it on 265,359 apps collected from 17 markets including Google Play and numerous third-party markets. In contrast with earlier approaches, AnDarwin does not compare apps pairwise, thus greatly increasing its scalability. Additionally, AnDarwin does not rely on information other than the app code — such as the app’s market, signature, or description — thus greatly increasing its reliability. AnDarwin can automatically detect library code and remove it from the similarity analysis. We present two use cases for AnDarwin: finding similar apps by different developers (“clones”) and similar apps from the same developer (“rebranded”). In ten hours, AnDarwin detected at least 4,295 apps which have been the victims of cloning and 36,106 apps that are rebranded. By analyzing the clusters found by AnDarwin, we found 88 new variants of malware and identified 169 malicious apps based on differences in the requested permissions. In contrast to earlier approaches, AnDarwin can detect both full and partial app similarity. Additionally, AnDarwin can automatically detect similar code that is injected into many apps, which may indicate the spread of malware. Our evaluation demonstrates AnDarwin’s ability to accurately detect similar apps on a large scale.

In this paper, we introduce a novel and secure solution to mitigate side-channel attacks to capture the PINs like touchID and other credentials of touch-enabled devices. Our approach can protect haptic feedback enabled devices from potential direct observation techniques such as cameras and motion sense techniques including such as accelerometers in smart-watch. Both attacks use the concept of shoulder surfing in social engineering and were published recently (CCS'14 and CCS'15). Hand-held devices universally employ small vibration motors as an inexpensive way to provide haptic feedback. The strength of the haptic feedback depends on the brand and the device manufacturer. They are usually strong enough to produce sliding movement and make audible noises if the device is resting on the top of a desk when the vibration motor turns. However, when the device is held in the hand the vibration can only be sensed by the holder; it is usually impossible or uncertain for an observer to know when the vibration motor turns. Our proposed solution uses the haptic feedback to inform the internal state of the keypad to the user and takes advantage of the fact that the effect of haptic feedback can be easily cloaked in such a way that direct observation techniques and indirect sensing techniques will fail. We develop an application on Android cell phones to demonstrate it and invite users to test the code. Moreover, we use real smart-watch to sense the vibration of Android cell phones. Our experimental results show that our approach can mitigate the probability of sensing a 4-digit or 6-digit PINs using smart-watch to below practical value. Our approach also can mitigate the probability of recognizing a 4-digit or 6-digit PINs using a camera within 1 meter to below practical value because the user does not need to move his or her hand during the internal states to input different PINs.

Mobile devices are among the most disruptive technologies of the last years, gaining even more diffusion and success in the daily life of a wide range of people categories. Unfortunately, while the number of mobile devices implicated in crime activities is relevant and growing, the capability to perform the forensic analysis of such devices is limited both by technological and methodological problems. In this paper, we focus on Anti-Forensic techniques applied to mobile devices, presenting some fully automated instances of such techniques to Android devices. Furthermore, we tested the effectiveness of such techniques versus both the cursory examination of the device and some acquisition tools. a 2010 Digital Forensic Research Workshop. Published by Elsevier Ltd. All rights reserved.

This paper presents Open Data Kit (ODK), an extensible, open-source suite of tools designed to build information services for developing regions. ODK currently provides four tools to this end: Collect, Aggregate, Voice, and Build. Collect is a mobile platform that renders application logic and supports the manipulation of data. Aggregate provides a "click-to-deploy" server that supports data storage and transfer in the "cloud" or on local servers. Voice renders application logic using phone prompts that users respond to with keypad presses. Finally, Build is a application designer that generates the logic used by the tools. Designed to be used together or independently, ODK core tools build on existing open standards and are supported by an open-source community that has contributed additional tools. We describe four deployments that demonstrate how the decisions made in the system architecture of ODK enable services that can both push and pull information in developing regions.

Applications for mobile platforms are being developed at a tremendous rate, but often without proper security implementation. Insecure mobile applications can cause serious information security and data privacy issues and can have severe repercussions on users and organizations alike.


Question: Real-time collection of primary memory information from Android cell phones and smartwatches.

This study delves into the forensic examination of social media applications on mobile devices, highlighting their importance in criminal investigations. With the proliferation of social networking on smartphones, these devices have become treasure troves for digital forensic analysts seeking evidence. The research specifically targets three prominent social media platforms—Facebook, Twitter, and MySpace—and evaluates their forensic footprint on BlackBerry, iPhone, and Android devices. The methodology involved the installation of these applications on each device, simulating typical user interactions, and then capturing a forensically sound logical image of the device's memory for analysis. The aim was to ascertain whether user activities on these applications were preserved within the device's storage, and if so, to what extent and in what form. The investigation revealed that while BlackBerry devices left no traceable evidence, both iPhone and Android devices retained substantial data that could be of significant value to forensic examiners. This finding underscores the potential of these devices as sources of critical evidence in legal proceedings. © 2012 A. Marrington, N. Al Mutawa & I. Baggili. Published by Elsevier Ltd. All rights reserved.

A method for the introspection of virtual machines is proposed. The main distinctive feature of this method is that it makes it possible to obtain information about the system operation using the minimum knowledge about its internal organization. The proposed approach uses rarely changing parts of the application binary interface, such as identifiers and parameters of system calls, calling conventions, and the formats of executable files. The lightweight property of the introspection method is due to the minimization of the knowledge about the system and by its high performance. The introspection infrastructure is based on the QEMU emulator, version 2.8. Presently, monitoring the file operations, processes, and API function calls are implemented. The available introspection tools (RTKDSM, Panda, and DECAF) get data for the analysis using kernel structures. All the data obtained (addresses of structures, etc.) is written to special profiles. Since the addresses and offsets strongly depend not only on the version of the operating system but also on the parameters of its assembly, these tools have to store a large number of profiles. We propose to use parts of the application binary interface because they are rarely modified and it is often possible to use one profile for a family of OSs. The main idea underlying the proposed method is to intercept the system and library function calls and read parameters and returned values. The processor provides special instructions for calling system and user defined functions. The capabilities of QEMU are extended by an instrumentation mechanism to enable one to track each executed instruction and find the instructions of interest among them. When a system call occurs, the control is passed to the system call detector that checks the number of the call and decides to which module the job should be forwarded. In the case of an API function call, the situation is similar, but the API function detector checks the function address. An introspection tool consisting of a set of modules is developed. These modules are dynamic libraries that are plugged in QEMU. The modules can interact by exchanging data.

Pervasive care and chronic disease management to reduce institutionalization is a priority for most western countries. The realization of next generation ubiquitous and pervasive healthcare systems will be a challenging task, as these systems are likely to involve a complex structure. Such systems will consist of various devices, ranging from resource-constrained sensors and actuators to complex multimedia devices, supporting time critical applications. This is further compounded by cultural and socio-economical factors that must be addressed for next generation healthcare systems to be widely diffused and used. In this study, the requirements for a vital sign monitoring solution space is derived and mPHASiS is developed based on these requirements. mPHASiS is an end to end solution not only providing sensor networking and vital sign monitoring but also closing the loop by signaling alert messages to the caregiver and allowing pervasive access to vital signs of a patient using smartphones over a heterogeneous network. A role based access control mechanism is developed to limit access to sensitive data. The end to end delay and delay variations for both vital sign data collection and pervasive access are analyzed. mPHASiS is developed as a complementary solution augmenting functionality of a hospital information system and can be loosely couple with the hospital information system using webservices. & 2010 Elsevier Ltd. All rights reserved.

The ubiquity of smartphones together with their ever-growing computing, networking and sensing powers have been changing the landscape of people’s daily life. Among others, activity recoginition, which takes the raw sensor reading as inputs and predicts a user’s motion activity, has become an active research area in recent years. It is the core building block in many high-impact applications, ranging from health and fitness monitoring, personal biometric signature, urban computing, assistive technology and elder-care, to indoor localization and navigation, etc. This paper presents a comprehensive survey of the recent advances in activity recognition with smartphones’ sensors. We start with the basic concepts such as sensors, activity types, etc. We review the core data mining techniques behind the main stream activity recognition algorithms, analyze their major challenges and introduce a variety of real applications enabled by activity recognition. Professor: Dr. Hanghang Tong Signature: Date: 06-12-2014 Professor: Dr. Ping Ji Signature: Date: 06-12-2014 Professor: Dr. Ted Brown Signature: Date: 06-12-2014 Advisor: Dr. Hanghang Tong

When compared to image recognition, object detection is a much more challenging task because it requires the accurate real-time localization of an object in the target image. In interaction scenarios, this pipeline can be simplified by incorporating the users’ point of regard. Wearable eye trackers can estimate the gaze direction, but lack own processing capabilities. We enable mobile gaze-aware applications by developing an open-source platform which supports mobile eye tracking based on the Pupil headset and a smartphone running Android OS. Through our platform, we offer researchers and developers a rapid prototyping environment for gaze-enabled applications. We describe the concept, our current progress, and research implications. ACM Classification

In this demo, we present LLAP, a hand tracking system that uses ultrasound to localize the hand of the user to enable device-free gesture inputs. LLAP utilizes speakers and microphones on Commercial-Off-The-Shelf (COTS) mobile devices to play and record sound waves that are inaudible to humans. By measuring the phase of the sound signal reflected by the hands or fingers of the user, we can accurately measure the gesture movements. With a single pair of speaker/microphone, LLAP can track hand movement with accuracy of 3.5 mm. For devices with two microphones, LLAP enables drawing-in-the air capability with tracking accuracy of 4.6 mm. Moreover, the latency for LLAP is smaller than 15 ms for both the Android and the iOS platforms so that LLAP can be used for real-time applications.

Ever increasing number of Android malware, has always been a concern for cybersecurity professionals. Even though plenty of anti-malware solutions exist, a rational and pragmatic approach for the same is rare and has to be inspected further. In this paper, we propose a novel two-set feature selection approach based on Rough Set and Statistical Test named as RSST to extract relevant system calls. To address the problem of higher dimensional attribute set, we derived suboptimal system call space by applying the proposed feature selection method to maximize the separability between malware and benign samples. Comprehensive experiments conducted on a dataset consisting of 3500 samples with 30 RSST derived essential system calls resulted in an accuracy of 99.9%, Area Under Curve (AUC) of 1.0, with 1% False Positive Rate (FPR). However, other feature selectors (Information Gain, CFsSubsetEval, ChiSquare, FreqSel and Symmetric Uncertainty) used in the domain of malware analysis resulted in the accuracy of 95.5% with 8.5% FPR. Besides, empirical analysis of RSST derived system calls outperform other attributes such as permissions, opcodes, API, methods, call graphs, Droidbox attributes and network traces.

Mobile virtualization has emerged fairly recently and is considered a valuable way to mitigate security risks on Android devices. However, major challenges in mobile virtualization include runtime, hardware, resource overhead, and compatibility. In this paper, we propose a lightweight Android virtualization solution named Condroid, which is based on container technology. Condroid utilizes resource isolation based on namespaces feature and resource control based on cgroups feature. By leveraging them, Condroid can host multiple independent Android virtual machines on a single kernel to support mutilple Android containers. Furthermore, our implementation presents both a system service sharing mechanism to reduce memory utilization and a filesystem sharing mechanism to reduce storage usage. The evaluation results on Google Nexus 5 demonstrate that Condroid is feasible in terms of runtime, hardware resource overhead, and compatibility. Therefore, we find that Condroid has a higher performance than other virtualization solutions.

The mission of tracking a pedestrian is valuable for many applications including walking distance estimation for the purpose of pervasive healthcare, museum and shopping mall guides, and locating emergency responders. In this paper, we show how accurate and ubiquitous tracking of a pedestrian can be performed using only the inertial sensors embedded in his/her mobile phone. Our work depends on performing dead reckoning to track the user's movement. The main challenge that needs to be addressed is handling the noise of the low cost low quality inertial sensors in cell phones. Our proposed system combines two novel contributions: a novel step count estimation technique and a gait-based accurate variable step size detection algorithm. The step count estimation technique is based on a lightweight finite state machine approach that leverages orientation-independent features. In order to capture the varying stride length of the user, based on his changing gait, we employ a multi-class hierarchical Support Vector Machine classifier. Combining the estimated number of steps with the an accurate estimate of the individual stride length, we achieve ubiquitous and accurate tracking of a person in indoor environments. We implement our system on different Android-based phones and compare it to the state-of-the-art techniques in indoor and outdoor testbeds with arbitrary phone orientation. Our results in two different testbeds show that we can provide an accurate step count estimation with an error of 5.72%. In addition, our gait type classifier has an accuracy of 97.74%. This leads to a combined tracking error of 6.9% while depending only on the inertial sensors and turning off the GPS sensor completely. This highlights the ability of the system to provide ubiquitous, accurate, and energy efficient tracking.

Smartphones and "app" markets are raising concerns about how third-party applications may misuse or improperly handle users' privacy-sensitive data. Fortunately, unlike in the PC world, we have a unique opportunity to improve the security of mobile applications thanks to the centralized nature of app distribution through popular app markets. Thorough validation of apps applied as part of the app market admission process has the potential to significantly enhance mobile device security. In this paper, we propose AppInspector, an automated security validation system that analyzes apps and generates reports of potential security and privacy violations. We describe our vision for making smartphone apps more secure through automated validation and outline key challenges such as detecting and analyzing security and privacy violations, ensuring thorough test coverage, and scaling to large numbers of apps.

Recent advances in small inexpensive sensors, low-power processing, and activity modeling have enabled applications that use on-body sensing and machine learning to infer people's activities throughout everyday life. To address the growing rate of sedentary lifestyles, we have developed a system, UbiFit Garden, which uses these technologies and a personal, mobile display to encourage physical activity. We conducted a 3-week field trial in which 12 participants used the system and report findings focusing on their experiences with the sensing and activity inference. We discuss key implications for systems that use on-body sensing and activity inference to encourage physical activity.


Question: Real-time collection of primary memory information from Android cell phones and smartwatches.

Introducing "Memory Miner": An Advanced Dynamic Analysis Tool for Recovering Data Structures in Stripped Binaries

In the realm of reverse engineering and digital forensics, the absence of data structures in stripped binaries poses significant challenges. Despite advancements in reverse engineering techniques, the recovery of data structures in these binaries remains a complex task. To address this issue, we have developed "Memory Miner," a novel solution that excels in extracting data structures from C binaries, even in the absence of symbol tables. Our method surpasses previous approaches in accuracy, enabling the creation of partial symbol tables without the need for source code access. This breakthrough not only facilitates debugging of stripped binaries but also simplifies the reverse engineering process. Furthermore, we demonstrate that "Memory Miner" can fortify existing binaries against common memory corruption attacks, all without requiring source code. Unlike static analysis tools, our system leverages dynamic analysis on a QEMU-based emulator to identify data structures by monitoring memory usage patterns during program execution. This innovative approach significantly enhances the effectiveness of reverse engineering and forensic analysis in the context of stripped binaries.

Emerging mobile applications involve continuous sensing and complex computations on sensed data streams. Examples include cognitive apps (e.g., speech recognition, natural language translation, as well as face, object, or gesture detection and recognition) and anticipatory apps that proactively track and provide services when needed. Unfortunately, today's mobile devices cannot keep pace with such apps, despite advances in hardware capability. Traditional approaches address this problem by computation offloading. One approach offloads by sending sensed streams to remote cloud servers via cellular networks or to cloudlets via Wi-Fi, where a clone of the app runs [2, 3, 4]. However, cloudlets may not be widely deployed and access to cloud infrastructure may yield high network delays and can be intermittent due to mobility. Morever, users might hesitate to upload private sensing data to the cloud or cloudlet. A second approach offloads to accelerators by rewriting code to use DSP or GPU within mobile devices. However, using accelerators requires substantial programming effort and produces varied benefits for diverse codes on heterogeneous devices.

Android platform has become the main target of the malware developers in the past few years. One of Android's main defense mechanisms against malicious apps is a permission-based access control mechanism. It is a feasible approach to detect a potential malicious application based on the permissions it requested. In this paper, we proposed a two-layered permission based detection scheme for detecting malicious Android applications. Comparing with previous researches, we consider the apps requested permission pairs as the additional condition, and we also consider used permissions to improve detection accuracy. The result of an evaluation, performed using 28548 benign apps and 1536 malicious apps, indicates that a two-layered permission-based detector has high detection rate of malware.

In this paper we have proposed and designed FindingHuMo (Finding Human Motion), a real-time user tracking system for Smart Environments. FindingHuMo can perform device-free tracking of multiple (unknown and variable number of) users in the Hallway Environments, just from non-invasive and anonymous (not user specific) binary motion sensor data stream. The significance of our designed system are as follows: (a) fast tracking of individual targets from binary motion data stream from a static wireless sensor network in the infrastructure. This needs to resolve unreliable node sequences, system noise and path ambiguity, (b) Scaling for multi-user tracking where user motion trajectories may crossover with each other in all possible ways. This needs to resolve path ambiguity to isolate overlapping trajectories, FindingHumo applies the following techniques on the collected motion data stream: (i) a proposed motion data driven adaptive order Hidden Markov Model with Viterbi decoding (called Adaptive-HMM), and then (ii) an innovative path disambiguation algorithm (called CPDA). Using this methodology the system accurately detects and isolates motion trajectories of individual users. The system performance is illustrated with results from real-time system deployment experience in a Smart Environment.

One approach to defending against malicious Android applications has been to analyze them to detect potential information leaks. This paper describes a new static taint analysis for Android that combines and augments the FlowDroid and Epicc analyses to precisely track both inter-component and intra-component data flow in a set of Android applications. The analysis takes place in two phases: given a set of applications, we first determine the data flows enabled individually by each application, and the conditions under which these are possible; we then build on these results to enumerate the potentially dangerous data flows enabled by the set of applications as a whole. This paper describes our analysis method, implementation, and experimental results.

Much of the stress and strain of student life remains hidden. The StudentLife continuous sensing app assesses the day-to-day and week-by-week impact of workload on stress, sleep, activity, mood, sociability, mental well-being and academic performance of a single class of 48 students across a 10 week term at Dartmouth College using Android phones. Results from the StudentLife study show a number of significant correlations between the automatic objective sensor data from smartphones and mental health and educational outcomes of the student body. We also identify a Dartmouth term lifecycle in the data that shows students start the term with high positive affect and conversation levels, low stress, and healthy sleep and daily activity patterns. As the term progresses and the workload increases, stress appreciably rises while positive affect, sleep, conversation and activity drops off. The StudentLife dataset is publicly available on the web.

With recent advances in technology, various wearable sensors have been developed for the monitoring of human physiological parameters. A Body Sensor Network (BSN) consisting of such physiological and biomedical sensor nodes placed on, near or within a human body can be used for real-time health monitoring. In this paper, we describe an on-going effort to develop a system consisting of interconnected BSNs for real-time health monitoring of soldiers. We discuss the background and an application scenario for this project. We describe the preliminary prototype of the system and present a blast source localization application.

In early days the mobile phones are considered to perform only telecommunication operation. This scenario of mobile phones as communication devices changed with the emergence of a new class of mobile devices called the smart phones. These smart phones in addition to being used as a communication device are capable of doing things that a computer does. In recent times the smart phone are becoming more and more powerful in both computing and storage aspects. The data generated by the smart phone provide a means to get new knowledge about various aspects like usage, movement of the user etc. This paper provides an introduction to Mobile Data Mining and its types.

As smart, embedded devices are increasingly integrated into our daily life, the security of these devices has become a major concern. The ARM processor family, which powers more than 60% of embedded devices, introduced TrustZone technology to offer security protection via an isolated execution environment called secure world. Caches in TrustZone-enabled processors are extended with a nonsecure (NS) bit to indicate whether a cache line is used by the secure world or the normal world. This cache design improves system performance by eliminating the need to perform cache flush during world switches; however, it also enables cache contention between the two worlds. In this work, we present TruSpy, the first study of timingbased cache side-channel information leakage of TrustZone. Our proposed attack exploits the cache contention between normal world and secure world to recover secret information from secure world. Two attacks are proposed in TruSpy, namely, the normal world OS attack and the normal world Android app attack. In the OS-based attack, the attacker is able to access virtual-to-physical address translation and high precision timers. In the Android app-based attack, these tools are unavailable to the attacker, so we devise a novel method that uses the expected channel statistics to allocate memory for cache probing. We also show how an attacker might use the less accurate performance event interface as a timer. Using the T-table based AES implementation in OpenSSL 1.0.1f as an example, we demonstrate that it is possible for a normal world attacker to steal a fine-grained secret from the secure world using a timing-based cache side-channel. We can recover the full AES encryption key via either the OS-based attack or the Android app-based attack. Since our zero permission TruSpy attack is based on the cache design in TrustZone enabled ARM processors, it poses a significant threat to a wide array of devices. To mitigate the newly discovered threat, we also propose both application-based and system-oriented countermeasures.

Smartphone pedometry offers the possibility of ubiquitous health monitoring, context awareness and indoor location tracking through Pedestrian Dead Reckoning (PDR) systems. However, there is currently no detailed understanding of how well pedometry works when applied to smartphones in typical, unconstrained use.
 This paper evaluates common walk detection (WD) and step counting (SC) algorithms applied to smartphone sensor data. Using a large dataset (27 people, 130 walks, 6 smartphone placements) optimal algorithm parameters are provided and applied to the data. The results favour the use of standard deviation thresholding (WD) and windowed peak detection (SC) with error rates of less than 3%. Of the six different placements, only the back trouser pocket is found to degrade the step counting performance significantly, resulting in undercounting for many algorithms.

We present the design, implementation, and early results of ioCane, a mobility aid for blind cane users that uses detachable cane-mounted ultrasonic sensors connected to a circuit board to send contextual data wirelessly to an Android phone application. The system uses the built-in mobile phone modalities of vibrations and chimes to alert the user to object height and proximity. We believe this plug-and-play solution for visually impaired users has the potential to enhance user mobility and object avoidance with a minimal learning curve. A pilot study testing the performance of the ioCane with blind cane users showed a 47.3% improvement in obstacle avoidance. To our knowledge, the ioCane is the first sensor-based mobility assistance system to integrate natively with a mobile phone without any modifications to the phone or the system, as well as the first system of its kind to be evaluated by actual visually-impaired cane users. ACM Classification


Question: Directly obtaining main memory information from Android-based smartphones and smartwatches during operation.

This study explores the forensic analysis of iPhone 3GS devices through logical backup acquisition using Apple's iTunes Backup Utility. Given the widespread use of the iPhone, thanks to its advanced computing features, ample storage space, and intuitive touch interface, it has become a common source of digital evidence in criminal cases. As a result, forensic examination of iPhones has become a critical skill for digital forensics and security professionals. This research specifically focuses on the logical backup acquisition process of the iPhone 3GS model using Apple's iTunes backup utility. The investigation revealed that a significant amount of data pertinent to forensic investigations, including emails, text and multimedia messages, calendar entries, web browsing history, GPRS location data, contacts, call logs, and voicemail recordings, can be effectively retrieved through this acquisition method. This highlights the utility of iTunes Backup Utility in gathering comprehensive digital evidence from iPhones for forensic analysis.

Physically Unclonable Functions (PUFs) are commonly used in cryptography to identify devices based on the uniqueness of their physical microstructures. DRAM-based PUFs have numerous advantages over PUF designs that exploit alternative substrates: DRAM is a major component of many modern systems, and a DRAM-based PUF can generate many unique identiers. However, none of the prior DRAM PUF proposals provide implementations suitable for runtime-accessible PUF evaluation on commodity DRAM devices. Prior DRAM PUFs exhibit unacceptably high latencies, especially at low temperatures (e.g., >125.8s on average for a 64KiB memory segment below 55C), and they cause high system interference by keeping part of DRAM unavailable during PUF evaluation. In this paper, we introduce the DRAM latency PUF, a new class of fast, reliable DRAM PUFs. The key idea is to reduce DRAM read access latency below the reliable datasheet specications using software-only system calls. Doing so results in error patterns that reect the compound eects of manufacturing variations in various DRAM structures (e.g., capacitors, wires, sense ampli- ers). Based on a rigorous experimental characterization of 223 modern LPDDR4 DRAM chips, we demonstrate that these error patterns 1) satisfy runtime-accessible PUF requirements, and 2) are quickly generated (i.e., at 88.2ms) irrespective of operating temperature using a real system with no additional hardware modications. We show that, for a constant DRAM capacity overhead of 64KiB, our implementation of the DRAM latency PUF enables an average (minimum, maximum) PUF evaluation time speedup of 152x (109x, 181x) at 70C and 1426x (868x, 1783x) at 55C when compared to a DRAM retention PUF and achieves greater speedups at even lower temperatures.

With the roaring growth and wide adoption of smart mobile devices, users are continuously integrating with culture of the mobile applications (apps). These apps are not only gaining access to information on the smartphone but they are also able gain users' authorization to access remote servers on their behalf. The Open standard for Authorization (OAuth) is widely used in mobile apps for gaining access to user's resources on remote service providers. In this paper, we analyze the different OAuth implementations adopted by the SDKs of the popular resource providers on smartphones and demonstrate possible attacks on most OAuth implementations. By analyzing source code of more than 430 popular Android apps we summarized the trends followed by the service providers and by the OAuth development choices made by application developers. In addition, we propose an application-based OAuth Manager framework, that provides a secure OAuth flow in smartphones that is based on the concept of privilege separation and does not require high overhead.

Much of the stress and strain of student life remains hidden. The StudentLife continuous sensing app assesses the day-to-day and week-by-week impact of workload on stress, sleep, activity, mood, sociability, mental well-being and academic performance of a single class of 48 students across a 10 week term at Dartmouth College using Android phones. Results from the StudentLife study show a number of significant correlations between the automatic objective sensor data from smartphones and mental health and educational outcomes of the student body. We also identify a Dartmouth term lifecycle in the data that shows students start the term with high positive affect and conversation levels, low stress, and healthy sleep and daily activity patterns. As the term progresses and the workload increases, stress appreciably rises while positive affect, sleep, conversation and activity drops off. The StudentLife dataset is publicly available on the web.

Mobile devices have become ubiquitous due to centralization of private user information, contacts, messages and multiple sensors. Google Android, an open-source mobile Operating System (OS), is currently the market leader. Android popularity has motivated the malware authors to employ set of cyber attacks leveraging code obfuscation techniques. Obfuscation is an action that modifies an application (app) code, preserving the original semantics and functionality to evade anti-malware. Code obfuscation is a contentious issue. Theoretical code analysis techniques indicate that, attaining a verifiable and secure obfuscation is impossible. However, obfuscation tools and techniques are popular both among malware developers (to evade anti-malware) and commercial software developers (protect intellectual rights). We conducted a survey to uncover answers to concrete and relevant questions concerning Android code obfuscation and protection techniques. The purpose of this paper is to review code obfuscation and code protection practices, and evaluate efficacy of existing code de-obfuscation tools. In particular, we discuss Android code obfuscation methods, custom app protection techniques, and various de-obfuscation methods. Furthermore, we review and analyze the obfuscation techniques used by malware authors to evade analysis efforts. We believe that, there is a need to investigate efficiency of the defense techniques used for code protection. This survey would be beneficial to the researchers and practitioners, to understand obfuscation and de-obfuscation techniques to propose novel solutions on Android.

This paper presents the state of the art from the available literature on mobile health care. The study was performed by means of a systematic review, a way of assessing and interpreting all available research on a particular topic in a given area, using a reliable and rigorous method. From an initial amount of 1,482 papers, we extracted and analysed data via a full reading of 40 (2.69%) of the papers that matched our selection criteria. Our analysis since 2010 show current development in 10 application areas and present ongoing trends and technical hallenges on the subject. The application areas include: patient monitoring, infrastructure, software architecture, modeling, framework, security, fications, multimedia, mobile cloud computing, and literature reviews on the topic. The most relevant challenges include the low battery life of devices, ultiplatform development, data transmission and security. Our paper consolidates ecent findings in the field and serves as a resourceful guide for future research planning and development.

Memory-based vulnerabilities are a major source of attack vectors. They allow attackers to gain unauthorized access to computers and their data. Previous research has made significant progress in detecting attacks. However, developers still need to locate and fix these vulnerabilities, a mostly manual and time-consuming process. They face a number of challenges. Particularly, the manifestation of an attack does not always coincide with the exploited vulnerabilities, and many attacks are hard to reproduce in the lab environment, leaving developers with limited information to locate them. In this paper, we propose Ravel, an architectural approach to pinpoint vulnerabilities from attacks. Ravel consists of an online attack detector and an offline vulnerability locator linked by a record & replay mechanism. Specifically, Ravel records the execution of a production system and simultaneously monitors it for attacks. If an attack is detected, the execution is replayed to reveal the targeted vulnerabilities by analyzing the program's memory access patterns under attack. We have built a prototype of Ravel based on the open-source FreeBSD operating system. The evaluation results in security and performance demonstrate that Ravel can effectively pinpoint various types of memory vulnerabilities and has low performance overhead.

It is hardly appropriate to call the devices many use to receive the occasional phone call a telephone any more. The capability of these devices is growing, as is the number of people utilizing them. By the end of 2009, 46.3% of mobile phones in use in the United States were reported to be smart phones (AdMob, 2010). With the increased availability of these powerful devices, there is also a potential increase for criminals to use this technology as well. Criminals could use smart phones for a number of activities such as committing fraud over e-mail, harassment through text messages, trafficking of child pornography, communications related to narcotics, etc. The data stored on smart phones could be extremely useful to analysts through the course of an investigation. Indeed, mobile devices are already showing themselves to have a large volume of probative information that is linked to an individual with just basic call history, contact, and text message data; smart phones contain even more useful information, such as e-mail, browser history, and chat logs. Mobile devices probably have more probative information that can be linked to an individual per byte examined than most computers -and this data is harder to acquire in a forensically proper fashion. Part of the problem lies in the plethora of cell phones available today and a general lack of hardware, software, and/or interface standardization within the industry. These differences range from the media on which data is stored and the file system to the operating system and the effectiveness of certain tools. Even different model cell phones made by the same manufacture may require different data cables and software to access the phone's information. The good news is there are numerous people in the field working on making smart phone forensics easier. Already there is material available on how to conduct an examination on Blackberry phones and a growing number of resources about the iPhone. However, there is a new smart phone OS on the market named Android and it will likely gain in appeal and market share over the next year. While Android initially launched with only one phone on T-Mobile, phones are now available on Sprint, Verizon and AT&T as well.

Smartphone applications’ performance has a vital impact on user experience. However, many smartphone applications suffer from bugs that cause significant performance degradation, thereby losing their competitive edge. Unfortunately, people have little understanding of these performance bugs. They also lack effective techniques to fight with such bugs. To bridge this gap, we conducted a study of 70 real-world performance bugs collected from eight large-scale and popular Android applications. We studied the characteristics (e.g., bug types and how they manifested) of these bugs and identified their common patterns. These findings can support follow-up research on performance bug avoidance, testing, debugging and analysis for smartphone applications. To demonstrate the usefulness of our findings, we implemented a static code analyzer, PerfChecker, to detect our identified performance bug patterns. We experimentally evaluated PerfChecker by applying it to 29 popular Android applications, which comprise 1.1 million lines of Java code. PerfChecker successfully detected 126 matching instances of our performance bug patterns. Among them, 68 were quickly confirmed by developers as previously-unknown issues that affect application performance, and 20 were fixed soon afterwards by following our optimization suggestions.

Due to the quantum leap in functionality, the rate of upgrading traditional mobile phones to smartphones is tremendous. One of the most attractive features of smartphones is the availability of a large number of apps for users to download and install. However, it also means hackers can easily distribute malware to smartphones, launching various attacks. This issue should be addressed by both preventive approaches and effective detection techniques. This article first discusses why smartphones are vulnerable to security attacks. Then it presents malicious behavior and threats of malware. Next, it reviews the existing malware prevention and detection techniques. Besides more research in these directions, it points out efforts from app developers, app store administrators, and users, who are also required to defend against such malware.

Cache side-channel attacks have been extensively studied on x86 architectures, but much less so on ARM processors. The technical challenges to conduct side-channel attacks on ARM, presumably, stem from the poorly documented ARM cache implementations, such as cache coherence protocols and cache flush operations, and also the lack of understanding of how different cache implementations will affect side-channel attacks. This paper presents a systematic exploration of vectors for flush-reload attacks on ARM processors. flush-reload attacks are among the most well-known cache side-channel attacks on x86. It has been shown in previous work that they are capable of exfiltrating sensitive information with high fidelity. We demonstrate in this work a novel construction of flush-reload side channels on last-level caches of ARM processors, which, particularly, exploits return-oriented programming techniques to reload instructions. We also demonstrate several attacks on Android OS (e.g., detecting hardware events and tracing software execution paths) to highlight the implications of such attacks for Android devices.


Question: Investigating data lineage in the Internet of Things ecosystem.

This paper presents a comprehensive review of trust computation models designed for service management in Internet of Things (IoT) systems, focusing on the critical decision of selecting IoT devices as service providers. With the anticipated proliferation of IoT systems, connecting the physical world to cyberspace through an immense network of smart objects, the economic implications are significant. However, trust computation in IoT environments, particularly in addressing the potential misconduct of device owners providing services to other devices, has received scant attention. Our methodology involves categorizing existing trust computation models for service management in IoT systems according to five pivotal design aspects: trust composition, trust propagation, trust aggregation, trust update, and trust formation. We critically analyze the strengths and weaknesses of each dimension's alternatives, emphasizing the efficacy of defensive strategies against malevolent assaults. Moreover, we compile a summary of the most, least, and scarcely explored trust computation methods in the academic literature, offering insights into their applicability within IoT systems. Lastly, we pinpoint the existing research lacunae in IoT trust computation and propose promising avenues for future investigations.

Due to the increasing pervasiveness of Internet of Things (IoT) and Internet of Everything (IoE) devices, securing both their communications and operations has become of capital importance. Among the several existing IoT protocols, Message Queue Telemetry Transport (MQTT) is a widely-used general purpose one, usable in both constrained and powerful devices, which coordinates data exchanges through a publish/subscribe approach. In this paper, we propose a methodology to increase the security of the MQTT protocol, by including Usage Control in its operative workflow. The inclusion of usage control enables a fine-grained dynamic control of the rights of subscribers to access data and data-streams over time, by monitoring mutable attributes related to the subscriber, the environment or data itself. We will present the architecture and workflow of MQTT enhanced through Usage Control, also presenting a real implementation on Raspberry Pi 3 for performance

Internet, a revolutionary invention, is always transforming into some new kind of hardware and software making it unavoidable for anyone. The form of communication that we see now is either human-human or human-device, but the Internet of Things (IoT) promises a great future for the internet where the type of communication is machine-machine (M2M). This paper aims to provide a comprehensive overview of the IoT scenario and reviews its enabling technologies and the sensor networks. Also, it describes a six-layered architecture of IoT and points out the related key challenges.

Internet of Things (IOT) visualizes a future of anything anywhere by anyone at any time. The Information and communication technologies help in creating a revolution in digital technology. IOT are known for interconnecting various physical devices with the networks. In IOT, various physical devices are embedded with different types of sensors and other devices to exchange data between them. An embedded system is a combination of software and hardware where they are programmed for functioning specific functions. These data can be accessed from any parts of the world by making use of cloud. This can be used for creating a digital world, smart homes, healthcare systems and real life data exchange like smart banking. Though Internet of things has emerged long back, it is now becoming popular and gaining attention lately. In healthcare industry, some of the hospitals started using sensors implemented in the bed to get the status of patient's movement and other activities. This paper contains various IOT applications and the role of IOT in the healthcare system, challenges in the healthcare system using IOT. Also, introduced a secured surveillance monitoring system for reading and storing patient's details using low power for transmitting the data.

Many Internet of Things (IoT) technologies have been used in applications for money flow, logistics flow, people flow, interactive art design, and so on. To manage these increasing disparate devices and connectivity options, ETSI has specified end-to-end machine-to-machine (M2M) system architecture for IoT applications. Based on this architecture, we develop an IoT EasyConnect system to manage IoT devices. In our approach, an IoT device is characterized by its “features” (e.g., temperature, vibration, and display) that are manipulated by the network applications. If a network application handles the individual device features independently, then we can write a software module for each device feature, and the network application can be simply constructed by including these brick-like device feature modules. Based on the concept of device feature, brick-like software modules can provide simple and efficient mechanism to develop IoT device applications and interactions.

Stealth address prevents public association of a blockchain transaction’s output with a recipient’s wallet address and hides the actual destination address of a transaction. While stealth address provides an effective privacy-enhancing technology for a cryptocurrency network, it requires blockchain nodes to actively monitor all the transactions and compute the purported destination addresses, which restricts its application for resource-constrained environments like Internet of Things (IoT). In this paper, we propose DKSAP-IoT, a faster dual-key stealth address protocol for blockchain-based IoT systems. DKSAP-IoT utilizes a technique similar to the TLS session resumption to improve the performance and reduce the transaction size at the same time between two communication peers. Our theoretical analysis as well as the extensive experiments on an embedded computing platform demonstrate that DKSAPIoT is able to reduce the computational overhead by at least 50% when compared to the state-of-the-art scheme, thereby paving the way for its application to blockchain-based IoT systems.

The nature of healthcare and the computational and physical technologies and constraints present a number of challenges to systems designers and implementers. In spite of the challenges, there is a significant market for systems and products to support caregivers in their tasks as the number of people needing assistance grows substantially. In this paper, we present a structured approach for describing Internet of Things (IoT) for healthcare systems. We illustrate the approach for three use cases and discuss relevant quality issues that arise, in particular, the need to consider caring as a requirement.

The current Internet of Things (IoT) ecosystem consists of non-interoperable products and services. The Web of Things (WoT) advances the IoT by allowing consumers to interact with the IoT ecosystem through the open and standard web technologies. But the Web alone does not solve the interoperability issues. It is widely acknowledged that Semantic Web Technologies hold the potential of achieving data and platform interoperability in both the IoT and WoT landscapes. In this context, the paper attempts to review and analyze the current state of ontology-based software tools for semantic interoperability.

The Internet of Things is currently getting significant interest from the scientific community. Academia and industry are both focused on moving ahead in attempts to enhance usability, maintainability, and security through standardization and development of best practices.We focus on security because of its impact as one of themost limiting factors to wider Internet ofThings adoption. Numerous research areas exist in the security domain, ranging from cryptography to network security to identitymanagement.This paper provides a survey of existing research applicable to the Internet of Things environment at the application layer in the areas of identity management, authentication, and authorization. We survey and analyze more than 200 articles, categorize them, and present current trends in the Internet of Things security domain.

The Internet of Things (IoT) has inspired solutions that are already available for addressing problems in various application scenarios, such as healthcare, security, emergency support and tourism. However, there is no clear approach to modeling these systems and envisioning their capabilities at the design time. Therefore, the process of designing these systems is ad hoc and its real impact is evaluated once the solution is already implemented, which is risky and expensive. This paper proposes a modeling approach that uses human-centric wireless sensor networks to specify and evaluate models of IoT-based systems at the time of design, avoiding the need to spend time and effort on early implementations of immature designs. It allows designers to focus on the system design, leaving the implementation decisions for a next phase. The article illustrates the usefulness of this proposal through a running example, showing the design of an IoT-based solution to support the first responses during medium-sized or large urban incidents. The case study used in the proposal evaluation is based on a real train crash. The proposed modeling approach can be used to design IoT-based systems for other application scenarios, e.g., to support security operatives or monitor chronic patients in their homes.

This paper proposes a distributed authorization architecture for Internet of Things adopting a hyperledger fabric framework. This paper also applies Genetic Algorithm to enhance the consensus component, traditionally used for Kafka, in order to determine the best configuration over different parameters, such as input transactions and their success rates. The experimental results confirm our superior performance in that the transaction transfer rate of our optimization, called GA Kafka, outperforms the traditional Kafka by 69.43%, and 89.97% for transaction transfer success rate.


Question: Investigating data origin in the Internet of Things ecosystem.

This paper presents a novel trust management framework for the Internet of Things (IoT), focusing on the integration of social relationships to enhance security and reliability in the interconnected environment of everyday devices. Given that many IoT devices are either human-carried or human-operated, our protocol leverages social interactions to establish trust. We incorporate a variety of trust attributes, such as honesty, cooperativeness, and community-interest, to reflect the complexity of social dynamics. Nodes within the network evaluate trust selectively, focusing only on devices relevant to their specific interests. Our trust management framework is triggered by social encounters or interaction events, enabling dynamic trust assessment based on both direct experiences and indirect endorsements. We investigate the impact of trust parameters on the accuracy of trust assessments and the speed of trust convergence. Our findings reveal a trade-off between accuracy and convergence time, particularly in scenarios where malicious nodes launch false recommendation attacks. We showcase the efficacy of our trust management protocol through an application in trust-based service composition. Our results demonstrate that trust-informed service composition significantly outperforms random service composition and closely approximates the optimal performance achievable with comprehensive knowledge.

Internet of Things (IoT) is a state-of-the-art field that is affecting every aspect of human life. This paper presents a state-of-the-art overview of IoT challenges, available standards, and popular architectures. The aim is to guide future researchers in the field of IoT by highlighting the main research gaps. Moreover, it provides research recommendations to help in designing future IoT architectures that fit IoT environment characteristics.

Internet of Things is an up-and-coming information and technology industry, and in such an environment of the concept and the content and the extension of Internet of Things are not very distinctive, the project of Internet of Things which is a piece of small area with small-scale and self-system obtain gratifying achievement and bright future, it can promote the development of Internet of Things in some extent. But there are some serious hidden danger and potential crisis problems. The paper focuses on the application of Internet of Things in the nation and even in the global in the future, analysing the existed security risks of the Internet of Things 's network points, transmission, finally we propose some suggestive solutions due to these problems.

To better understand how big data interconnects firms and customers in promoting value co-creation, we propose a theoretical framework of big data-based cooperative assets based on evidence of multiple case studies. We identify four types of big data resources and four types of associated digital platforms, and we explore how firms develop the cooperative assets by transforming big data resources via the theoretical lens of service-dominant logic. This study offers a new theoretical perspective on value co-creation and an alternative competitive strategy in the era of big data for firms. ã 2016 The Author(s). Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).

Smart products adapt to environments, process contexts, users and other products. Standardized product data such as BMECat, eCl@ss, and EPC global formats are designed to support the exploitation of product data and therefore contribute to more efficient supply chains. Non-standardized product data mainly target soft benefits which targets the exploration of product data [Su04]. We present an extended product data model (SPDO) that integrates standardized and non-standardized product data. The SPDO model consists of five product information types that receive product data and, if available, associated explicit semantics. Explicit semantics are used for advanced services, such as compatibility testing or product bundling. Exemplified by the GS1 approach, we present how standardized product data is retrieved via RFID-based Electronic Product Codes (EPC) and stored in SPDO instantiations.

The technologies associated with the Internet of Things have great potential for application in the domain of food and agriculture, especially in view of the societal and environmental challenges faced by this sector. From farm to fork, IoT technologies could transform the sector, contributing to food safety, and the reduction of agricultural inputs and food waste. A major step toward greater uptake of these technologies will be the execution of IoT-based large-scale pilots (LSPs) in the entire supply chain. This article outlines the challenges and constraints that an LSP deployment of IoT in this domain must consider. Sectoral and technological challenges are described in order to identify a set of technological and agrifood requirements. An architecture based on a system of systems approach is briefly presented, the importance of addressing the interoperability challenges faced by this sector is highlighted, and we elaborate on requirements for new business models, security, privacy, and data governance. A description of the technologies and solutions involved in designing pilots for four agrifood domains (dairy, fruit, arable, meat and vegetable supply chain) is eventually provided. In conclusion, it is noted that for IoT to be successful in this domain, a significant change of culture is needed.

Storage is an important research direction of the data management of the Internet of Things. Massive and heterogeneous data of the Internet of Things brings the storage huge challenges. Based on the analysis of the IoT data characteristics, this paper proposed a storage management solution called IOTMDB based on NoSQL as current storage solutions are not well support storing massive and heterogeneous IoT data. Besides, the storage strategies about expressing and organizing IoT data in a uniform manner were proposed, some evaluations were carried out. Furthermore, we not only just concerned about descripting the data itself, but also cared for sharing of the data, so a data sharing mechanism based on ontology was proposed. Finally, index was studied and a set of query syntaxes to meet the needs of different kinds of IoT queries based NoSQL was given.

The Internet of Things (IoT) concept is evolving rapidly and influencing new developments in various application domains, such as the Internet of Mobile Things (IoMT), Autonomous Internet of Things (A-IoT), Autonomous System of Things (ASoT), Internet of Autonomous Things (IoAT), Internet of Things Clouds (IoT-C) and the Internet of Robotic Things (IoRT) etc. that are progressing/advancing by using IoT technology. The IoT influence represents new development and deployment challenges in different areas such as seamless platform integration, context based cognitive network integration, new mobile sensor/actuator network paradigms, things identification (addressing, naming in IoT) and dynamic things discoverability and many others. The IoRT represents new convergence challenges and their need

Modern Industrial Control Systems (ICS) rely on enterprise to plant floor connectivity. Where the size, diversity, and therefore complexity of ICS increase, operational requirements, goals, and challenges defined by users across various sub-systems follow. Recent trends in Information Technology (IT) and Operational Technology (OT) convergence may cause operators to lose a comprehensive understanding of end-to-end data flow requirements. This presents a risk to system security and resilience. Sensors were once solely applied for operational process use, but now act as inputs supporting a diverse set of organisational requirements. If these are not fully understood, incomplete risk assessment, and inappropriate implementation of security controls could occur. In search of a solution, operators may turn to standards and guidelines. This paper reviews popular standards and guidelines, prior to the presentation of a case study and conceptual tool, highlighting the importance of data flows, critical data processing points, and system-to-user relationships. The proposed approach forms a basis for risk assessment and security control implementation, aiding the evolution of ICS security and resilience.

Collection and analysis of various logs (e.g., process logs, network logs) are fundamental activities in computer forensics. Ensuring the security of the activity logs is therefore crucial to ensure reliable forensics investigations. However, because of the black-box nature of clouds and the volatility and co-mingling of cloud data, providing the cloud logs to investigators while preserving users' privacy and the integrity of logs is challenging. The current secure logging schemes, which consider the logger as trusted cannot be applied in clouds since there is a chance that cloud providers (logger) collude with malicious users or investigators to alter the logs. In this paper, we analyze the threats on cloud users' activity logs considering the collusion between cloud users, providers, and investigators. Based on the threat model, we propose Secure-Logging-as-a-Service ( SecLaaS), which preserves various logs generated for the activity of virtual machines running in clouds and ensures the confidentiality and integrity of such logs. Investigators or the court authority can only access these logs by the RESTful APIs provided by SecLaaS, which ensures confidentiality of logs. The integrity of the logs is ensured by hash-chain scheme and proofs of past logs published periodically by the cloud providers. In prior research, we used two accumulator schemes Bloom filter and RSA accumulator to build the proofs of past logs. In this paper, we propose a new accumulator scheme - Bloom-Tree, which performs better than the other two accumulators in terms of time and space requirement.

The Internet of Things (IoT) is an impending technology that captured the industries and research interests in a brief period. Presently, the number of Internet-connected devices are estimated at billions and by 2020 many studies expect to have around 50 billion devices that are connected to the Internet. The IoT devices have produced a significant amount of data that could be threatening to the security and directing the flow of data in the network. One of the alternative solutions for problems caused by IoT is to have some kind of solutions that are based on programming and primary control. Software Define Network (SDN) offers a programmable and primary control for the basic network without variability of the current architecture of the network. This paper discusses some solutions for various domains for the combined SDN based on IoT and current directions in studies. The relative analysis of these solutions prepares a simple and brief view of those directions.


Question: Investigating data lineage in the Internet of Things ecosystem.

Incorporating Interaction: Engaging with the Internet of Things
The Internet of Things (IoT) paradigm envisions a world where objects possess digital capabilities and can be autonomously identified and monitored. Embedded interaction seeks to capitalize on the novel prospects that emerge for interactive systems, emphasizing the immediate benefits users can derive. Through the development and experimentation with various prototypes, the researchers have investigated innovative approaches to human-computer interaction (HCI) facilitated by the IoT and associated technologies. Drawing from these practical insights, they have formulated a series of guidelines aimed at seamlessly integrating interfaces into the fabric of daily human activities. This approach underscores the importance of user-centric design in the IoT landscape, ensuring that technology is not only functional but also intuitive and accessible in everyday life scenarios.

The majority of business activity of our integrated and connected world takes place in networks based on cloud computing infrastructure that cross national, geographic and jurisdictional boundaries. Such an efficient entity interconnection is made possible through an emerging networking paradigm, Software Defined Networking (SDN) that intends to vastly simplify policy enforcement and network reconfiguration in a dynamic manner. However, despite the obvious advantages this novel networking paradigm introduces, its increased attack surface compared to traditional networking deployments proved to be a thorny issue that creates skepticism when safety-critical applications are considered. Especially when SDN is used to support Internet-of-Things (IoT)-related networking elements, additional security concerns rise, due to the elevated vulnerability of such deployments to specific types of attacks and the necessity of inter-cloud communication any IoT application would require. The overall number of connected nodes makes the efficient monitoring of all entities a real challenge, that must be tackled to prevent system degradation and service outage. This position paper provides an overview of common security issues of SDN when linked to IoT clouds, describes the design principals of the recently introduced Blockchain paradigm and advocates the reasons that render Blockchain as a significant security factor for solutions where SDN and IoT are involved.

The Internet of Things assumes that objects have digital functionality and can be identified and tracked automatically. The main goal of embedded interaction is to look at new opportunities that arise for interactive systems and the immediate value users gain. The authors developed various prototypes to explore novel ways for human-computer interaction (HCI), enabled by the Internet of Things and related technologies. Based on these experiences, they derive a set of guidelines for embedding interfaces into people's daily lives.

The recent proliferation of the Internet of Things (IoT) technology poses major security and privacy concerns. Specifically, the use of personal IoT devices, such as tablets, smartphones, and even smartwatches, as part of the Bring Your Own Device (BYOD) trend, may result in severe network security breaches in enterprise environments. Such devices increase the attack surface by weakening the digital perimeter of the enterprise network and opening new points of entry for malicious activities. In this paper we demonstrate a novel attack scenario in an enterprise environment by exploiting the smartwatch device of an innocent employee. Using a malicious application running on a suitable smartwatch, the device imitates a real Wi-Fi direct printer service in the network. Using this attack scenario, we illustrate how an advanced attacker located outside of the organization can leak/steal sensitive information from the organization by utilizing the compromised smartwatch as a means of attack. An attack mitigation process and countermeasures are suggested in order to limit the capability of the remote attacker to execute the attack on the network, thus minimizing the data leakage by the smartwatch.

The Internet of Things (IoT) is an emerging classical model, envisioned as a system of billions of small interconnected devices for posing the state-of-the-art findings to real-world glitches. Over the last decade, there has been an increasing research concentration in the IoT as an essential design of the constant convergence between human behaviors and their images on Information Technology. With the development of technologies, the IoT drives the deployment of across-the-board and self-organizing wireless networks. The IoT model is progressing toward the notion of a cyber-physical world, where things can be originated, driven, intermixed, and modernized to facilitate the emergence of any feasible association. This paper provides a summary of the existing IoT research that underlines enabling technologies, such as fog computing, wireless sensor networks, data mining, context awareness, real-time analytics, virtual reality, and cellular communications. Also, we present the lessons learned after acquiring a thorough representation of the subject. Thus, by identifying numerous open research challenges, it is presumed to drag more consideration into this novel paradigm.

The Internet of Things (IoT) presents unique challenges in detecting anomaly and monitoring all connected devices in a network. Moreover, one of the objectives of anonymity in communication is to protect the data traffic of devices. The summary status visualization is indispensable to depict all devices/sensors that are most indicative of a pending failure and a predictive power/energy. Thus, this paper proposes a multi-platform monitoring and anomaly detection system that supports heterogeneous devices. The proposed system addresses the problems of: (i) how to monitor the network to prevent device failures and (ii) how to design a comprehensive feature for the early anomaly detection of IoT communication.

Recent advances and innovations in smart sensor technologies, energy storage, data communications, and distributed computing paradigms are enabling technological breakthroughs in very large sensor networks. There is an emerging surge of next-generation sensor-rich computers in consumer mobile devices as well as tailor-made field platforms wirelessly connected to the Internet. Billions of such sensor computers are posing both challenges and opportunities in relation to scalable and reliable management of the peta- and exa-scale time series being generated over time. This paper presents a Cloud-computing approach to this issue based on the two well-known data storage and processing paradigms: Bigtable and MapReduce.

The Internet of Things (IoT) could be described as the pervasive and global network which aids and provides a system for the monitoring and control of the physical world through the collection, processing and analysis of generated data by IoT sensor devices. It is projected that by 2020 the number of connected devices is estimated to grow exponentially to 50 billion. The main drivers for this growth are our everyday devices such as cars, refrigerators, fans, lights, mobile phones and other operational technologies including the manufacturing infrastructures which are now becoming connected systems across the world. It is apparent that security will pose a fundamental enabling factor for the successful deployment and use of most IoT applications and in particular secure routing among IoT sensor nodes thus, mechanisms need to be designed to provide secure routing communications for devices enabled by the IoT technology. This survey analyzes existing routing protocols and mechanisms to secure routing communications in IoT, as well as the open research issues. We further analyze how existing approaches ensure secure routing in IoT, their weaknesses, threats to secure routing in IoT and the open challenges and strategies for future research work for a better secure IoT routing.

Internet of Things (IoT) has been a massive advancement in the Information and Communication Technology (ICT). It is projected that over 50 billion devices will become part of the IoT in the next few years. Security of the IoT network should be the foremost priority. In this paper, we evaluate the security challenges in the four layers of the IoT architecture and their solutions proposed from 2010 to 2016. Furthermore, important security technologies like encryption are also analyzed in the IoT context. Finally, we discuss countermeasures of the security attacks on different layers of IoT and highlight the future research directions within the IoT architecture.

We present a scalable system for high-throughput real-time analysis of heterogeneous data streams. Our architecture enables incremental development of models for predictive analytics and anomaly detection as data arrives into the system. In contrast with batch data-processing systems, such as Hadoop, that can have high latency, our architecture allows for ingest and analysis of data on the fly, thereby detecting and responding to anomalous behavior in near real time. This timeliness is important for applications such as insider threat, financial fraud, and network intrusions. We demonstrate an application of this system to the problem of detecting insider threats, namely, the misuse of an organization's resources by users of the system and present results of our experiments on a publicly available insider threat dataset.

Owing to the unprecedented growth in computing power, electronics miniaturization and mobile and wireless network interconnections the internet has metamorphosed into Internet of Things (IoT) which refers to next stage of the information revolution whose context involves billions of individuals and devices interconnected to facilitate exchange of huge volume of data and information from diverse locations, demanding the consequent necessity for smart data aggregation followed by an increased obligation to index, hoard and process data with higher efficiency and effectiveness. But along with its myriad offered benefits and applications, emerges a novel complexity aspect in terms of many inherent hassles primarily security concerns during data transfer phases in IoT covering mostly data confidentiality and integrity features. Thus to enhance safe data transfer in smart IoT environment, a security scheme is proposed in this paper which addresses both the aforesaid issues, employing an integrated approach of lightweight cryptography and steganography (Simple LSB Substitution) technique during data transfer between IoT device and Home Server and adoption of combined approach of cryptography and steganography (Proposed MSB-LSB Substitution) technique during data transfer phases between Home Server and Cloud Servers.