OpenRaiser/Intern-Atlas huggingface dataset:
Leveraging Flawed Tutorials for Seeding Large-Scale Web Vulnerability Discovery
Venue: arXiv cs.CR 2017
Year: 2017

The Web is replete with tutorial-style content on how to accomplish programming tasks. Unfortunately, even top-ranked tutorials suffer from severe security vulnerabilities, such as cross-site scripting (XSS), and SQL injection (SQLi). Assuming that these tutorials influence real-world software development, we hypothesize that code snippets from popular tutorials can be used to bootstrap vulnerability discovery at scale. To validate our hypothesis, we propose a semi-automated approach to find recurring vulnerabilities starting from a handful of top-ranked tutorials that contain vulnerable code snippets. We evaluate our approach by performing an analysis of tens of thousands of open-source web applications to check if vulnerabilities originating in the selected tutorials recur. Our analysis framework has been running on a standard PC, analyzed 64,415 PHP codebases hosted on GitHub thus far, and found a total of 117 vulnerabilities that have a strong syntactic similarity to vulnerable code snippets present in popular tutorials. In addition to shedding light on the anecdotal belief that programmers reuse web tutorial code in an ad hoc manner, our study finds disconcerting evidence of insufficiently reviewed tutorials compromising the security of open-source projects. Moreover, our findings testify to the feasibility of large-scale vulnerability discovery using poorly written tutorials as a starting point.
Performance Analysis of Reliable Video Streaming with Strict Playout Deadline in Multi-Hop Wireless Networks
Venue: arXiv cs.MM 2017
Year: 2017

Motivated by emerging vision-based intelligent services, we consider the problem of rate adaptation for high quality and low delay visual information delivery over wireless networks using scalable video coding. Rate adaptation in this setting is inherently challenging due to the interplay between the variability of the wireless channels, the queuing at the network nodes and the frame-based decoding and playback of the video content at the receiver at very short time scales. To address the problem, we propose a low-complexity, model-based rate adaptation algorithm for scalable video streaming systems, building on a novel performance model based on stochastic network calculus. We validate the model using extensive simulations. We show that it allows fast, near optimal rate adaptation for fixed transmission paths, as well as cross-layer optimized routing and video rate adaptation in mesh networks, with less than $10$\% quality degradation compared to the best achievable performance.
Joint Spatial Multiplexing and Transmit Diversity in MIMO Ad Hoc Networks
Venue: arXiv cs.NI 2017
Year: 2017

This paper investigates the performance of MIMO ad hoc networks that employ transmit diversity, as delivered by the Alamouti scheme, and/or spatial multiplexing, according to the Vertical Bell Labs Layered Space-Time system (V-BLAST). Both techniques are implemented in a discrete-event network simulator by focusing on their overall effect on the resulting signal-to-interference-plus-noise ratio (SINR) at the intended receiver. Unlike previous works that have studied fully-connected scenarios or have assumed simple abstractions to represent MIMO behavior, this paper evaluates MIMO ad hoc networks that are not fully connected by taking into account the effects of multiple antennas on the clear channel assessment (CCA) mechanism of CSMA-like medium access control (MAC) protocols. In addition to presenting a performance evaluation of ad hoc networks operating according to each individual MIMO scheme, this paper proposes simple modifications to the IEEE 802.11 DCF MAC to allow the joint operation of both MIMO techniques. Hence, each pair of nodes is allowed to select the best MIMO configuration for the impending data transfer. The joint operation is based on three operation modes that are selected based on the estimated SINR at the intended receiver and its comparision with a set of threshold values. The performance of ad hoc networks operating with the joint MIMO scheme is compared with their operation using each individual MIMO scheme and the standard SISO IEEE 802.11. Performance results are presented based on MAC-level throughput per node, delay, and fairness under saturated traffic conditions.
Incentive-rewarding mechanisms to stimulate participation in heterogeneous DTNs
Venue: arXiv cs.GT 2017
Year: 2017

Delay Tolerant Networks (DTNs) rely on the cooperation of nodes in a network to forward a message from its source to its destination. Most of previous studies on DTNs have focused on the design of routing schemes under the hypothesis that each relay node is willing to participate in the forwarding process. However, the delivery of a message incurs energy and memory costs. In this paper we handle the problem of how to incentivize mobile nodes to participate in relaying messages using a reward mechanism. We consider heterogeneous relay nodes where the cost for taking part in the forwarding process varies as a function of the mobility patterns of the relays. We show that under fairly weak assumptions on the mobility pattern, the expected reward the source pays remains the same irrespective of the information it conveys to the relays, provided that the type of information does not vary dynamically over time. We also characterize the effect of time to live (TTL) counters on the delivery probability and memory usage. Using simulations based on a synthetic mobility model and real mobility traces, we perform a few tests that show a good accordance among theoretical and simulation results.
Business Process Modeling: Blueprinting
Venue: arXiv cs.SE 2017
Year: 2017

This paper presents a flow-based methodology for capturing processes specified in business process modeling. The proposed methodology is demonstrated through re-modeling of an IBM Blueworks case study. While the Blueworks approach offers a well-proven tool in the field, this should not discourage workers from exploring other ways of thinking about effectively capturing processes. The diagrammatic representation presented here demonstrates a viable methodology in this context. It is hoped this explicit analysis of diverse fundamental approaches will benefit the research in the field and also advance current practices.
Precision Interfaces
Venue: arXiv cs.DB 2017
Year: 2017

Building interactive tools to support data analysis is hard because it is not always clear what to build and how to build it. To address this problem, we present Precision Interfaces, a semi-automatic system to generate task-specific data analytics interfaces. Precision Interface can turn a log of executed programs into an interface, by identifying micro-variations between the programs and mapping them to interface components. This paper focuses on SQL query logs, but we can generalize the approach to other languages. Our system operates in two steps: it first build an interaction graph, which describes how the queries can be transformed into each other. Then, it finds a set of UI components that covers a maximal number of transformations. To restrict the domain of changes to be detected, our system uses a domain-specific language, PILang. We give a full description of Precision Interface's components, showcase an early prototype on real program logs and discuss future research opportunities.
Security Analytics of Network Flow Data of IoT and Mobile Devices (Work-in-progress)
Venue: arXiv cs.CR 2017
Year: 2017

Given that security threats and privacy breaches are com- monplace today, it is an important problem for one to know whether their device(s) are in a "good state of security", or is there a set of high- risk vulnerabilities that need to be addressed. In this paper, we address this simple yet challenging problem. Instead of gaining white-box access to the device, which offers privacy and other system issues, we rely on network logs and events collected offine as well as in realtime. Our approach is to apply analytics and machine learning for network security analysis as well as analysis of the security of the overall device - apps, the OS and the data on the device. We propose techniques based on analytics in order to determine sensitivity of the device, vulnerability rank of apps and of the device, degree of compromise of apps and of the device, as well as how to define the state of security of the device based on these metrics. Such metrics can be used further in machine learning models in order to predict the users of the device of high risk states, and how to avoid such risks.
Data-efficient Deep Reinforcement Learning for Dexterous Manipulation
Venue: arXiv cs.LG 2017
Year: 2017

Deep learning and reinforcement learning methods have recently been used to solve a variety of problems in continuous control domains. An obvious application of these techniques is dexterous manipulation tasks in robotics which are difficult to solve using traditional control theory or hand-engineered approaches. One example of such a task is to grasp an object and precisely stack it on another. Solving this difficult and practically relevant problem in the real world is an important long-term goal for the field of robotics. Here we take a step towards this goal by examining the problem in simulation and providing models and techniques aimed at solving it. We introduce two extensions to the Deep Deterministic Policy Gradient algorithm (DDPG), a model-free Q-learning based method, which make it significantly more data-efficient and scalable. Our results show that by making extensive use of off-policy data and replay, it is possible to find control policies that robustly grasp objects and stack them. Further, our results hint that it may soon be feasible to train successful stacking policies by collecting interactions on real robots.
WRPN: Training and Inference using Wide Reduced-Precision Networks
Venue: arXiv cs.LG 2017
Year: 2017

For computer vision applications, prior works have shown the efficacy of reducing the numeric precision of model parameters (network weights) in deep neural networks but also that reducing the precision of activations hurts model accuracy much more than reducing the precision of model parameters. We study schemes to train networks from scratch using reduced-precision activations without hurting the model accuracy. We reduce the precision of activation maps (along with model parameters) using a novel quantization scheme and increase the number of filter maps in a layer, and find that this scheme compensates or surpasses the accuracy of the baseline full-precision network. As a result, one can significantly reduce the dynamic memory footprint, memory bandwidth, computational energy and speed up the training and inference process with appropriate hardware support. We call our scheme WRPN - wide reduced-precision networks. We report results using our proposed schemes and show that our results are better than previously reported accuracies on ILSVRC-12 dataset while being computationally less expensive compared to previously reported reduced-precision networks.
Connecting Network Science and Information Theory
Venue: arXiv cs.IT 2017
Year: 2017

A framework integrating information theory and network science is proposed, giving rise to a potentially new area. By incorporating and integrating concepts such as complexity, coding, topological projections and network dynamics, the proposed network-based framework paves the way not only to extending traditional information science, but also to modeling, characterizing and analyzing a broad class of real-world problems, from language communication to DNA coding. Basically, an original network is supposed to be transmitted, with or without compaction, through a sequence of symbols or time-series obtained by sampling its topology by some network dynamics, such as random walks. We show that the degree of compression is ultimately related to the ability to predict the frequency of symbols based on the topology of the original network and the adopted dynamics. The potential of the proposed approach is illustrated with respect to the efficiency of transmitting several types of topologies by using a variety of random walks. Several interesting results are obtained, including the behavior of the Barabási-Albert model oscillating between high and low performance depending on the considered dynamics, and the distinct performances obtained for two geographical models.
Actors without Borders: Amnesty for Imprisoned State
Venue: arXiv cs.PL 2017
Year: 2017

In concurrent systems, some form of synchronisation is typically needed to achieve data-race freedom, which is important for correctness and safety. In actor-based systems, messages are exchanged concurrently but executed sequentially by the receiving actor. By relying on isolation and non-sharing, an actor can access its own state without fear of data-races, and the internal behavior of an actor can be reasoned about sequentially. However, actor isolation is sometimes too strong to express useful patterns. For example, letting the iterator of a data-collection alias the internal structure of the collection allows a more efficient implementation than if each access requires going through the interface of the collection. With full isolation, in order to maintain sequential reasoning the iterator must be made part of the collection, which bloats the interface of the collection and means that a client must have access to the whole data-collection in order to use the iterator. In this paper, we propose a programming language construct that enables a relaxation of isolation but without sacrificing sequential reasoning. We formalise the mechanism in a simple lambda calculus with actors and passive objects, and show how an actor may leak parts of its internal state while ensuring that any interaction with this data is still synchronised.
Minkowski Operations of Sets with Application to Robot Localization
Venue: arXiv cs.RO 2017
Year: 2017

This papers shows that using separators, which is a pair of two complementary contractors, we can easily and efficiently solve the localization problem of a robot with sonar measurements in an unstructured environment. We introduce separators associated with the Minkowski sum and the Minkowski difference in order to facilitate the resolution. A test-case is given in order to illustrate the principle of the approach.
On the Underapproximation of Reach Sets of Abstract Continuous-Time Systems
Venue: arXiv cs.SY 2017
Year: 2017

We consider the problem of proving that each point in a given set of states ("target set") can indeed be reached by a given nondeterministic continuous-time dynamical system from some initial state. We consider this problem for abstract continuous-time models that can be concretized as various kinds of continuous and hybrid dynamical systems. The approach to this problem proposed in this paper is based on finding a suitable superset S of the target set which has the property that each partial trajectory of the system which lies entirely in S either is defined as the initial time moment, or can be locally extended backward in time, or can be locally modified in such a way that the resulting trajectory can be locally extended back in time. This reformulation of the problem has a relatively simple logical expression and is convenient for applying various local existence theorems and local dynamics analysis methods to proving reachability which makes it suitable for reasoning about the behavior of continuous and hybrid dynamical systems in proof assistants such as Mizar, Isabelle, etc.
Show, Ask, Attend, and Answer: A Strong Baseline For Visual Question Answering
Venue: arXiv cs.CV 2017
Year: 2017

This paper presents a new baseline for visual question answering task. Given an image and a question in natural language, our model produces accurate answers according to the content of the image. Our model, while being architecturally simple and relatively small in terms of trainable parameters, sets a new state of the art on both unbalanced and balanced VQA benchmark. On VQA 1.0 open ended challenge, our model achieves 64.6% accuracy on the test-standard set without using additional data, an improvement of 0.4% over state of the art, and on newly released VQA 2.0, our model scores 59.7% on validation set outperforming best previously reported results by 0.5%. The results presented in this paper are especially interesting because very similar models have been tried before but significantly lower performance were reported. In light of the new results we hope to see more meaningful research on visual question answering in the future.
Later-stage Minimum Bayes-Risk Decoding for Neural Machine Translation
Venue: arXiv cs.CL 2017
Year: 2017

For extended periods of time, sequence generation models rely on beam search algorithm to generate output sequence. However, the correctness of beam search degrades when the a model is over-confident about a suboptimal prediction. In this paper, we propose to perform minimum Bayes-risk (MBR) decoding for some extra steps at a later stage. In order to speed up MBR decoding, we compute the Bayes risks on GPU in batch mode. In our experiments, we found that MBR reranking works with a large beam size. Later-stage MBR decoding is shown to outperform simple MBR reranking in machine translation tasks.
Modeling of Information Diffusion on Social Networks with Applications to WeChat
Venue: arXiv cs.SI 2017
Year: 2017

Traces of user activities recorded in online social networks such as the creation, viewing and forwarding/sharing of information over time open new possibilities to quantitatively and systematically understand the information diffusion process on social networks. From an online social network like WeChat, we could collect a large number of information cascade trees, each of which tells the spreading trajectory of a message/information such as which user creates the information and which users view or forward the information shared by which neighbors. In this work, we propose two heterogeneous non-linear models. Both models are validated by the WeChat data in reproducing and explaining key features of cascade trees. Specifically, we firstly apply the Random Recursive Tree (RRT) to model the cascade tree topologies, capturing key features, i.e. the average path length and degree variance of a cascade tree in relation to the number of nodes (size) of the tree. The RRT model with a single parameter $θ$ describes the growth mechanism of a tree, where a node in the existing tree has a probability $d_i^θ$ of being connected to a newly added node that depends on the degree $d_i$ of the existing node. The identified parameter $θ$ quantifies the relative depth or broadness of the cascade trees, indicating that information propagates via a star-like broadcasting or viral-like hop by hop spreading. The RRT model explains the appearance of hubs, thus a possibly smaller average path length as the cascade size increases, as observed in WeChat. We further propose the stochastic Susceptible View Forward Removed (SVFR) model to depict the dynamic user behaviors including creating, viewing, forwarding and ignoring a message on a given social network.
Weighted k-Server Bounds via Combinatorial Dichotomies
Venue: arXiv cs.DS 2017
Year: 2017

The weighted $k$-server problem is a natural generalization of the $k$-server problem where each server has a different weight. We consider the problem on uniform metrics, which corresponds to a natural generalization of paging. Our main result is a doubly exponential lower bound on the competitive ratio of any deterministic online algorithm, that essentially matches the known upper bounds for the problem and closes a large and long-standing gap. The lower bound is based on relating the weighted $k$-server problem to a certain combinatorial problem and proving a Ramsey-theoretic lower bound for it. This combinatorial connection also reveals several structural properties of low cost feasible solutions to serve a sequence of requests. We use this to show that the generalized Work Function Algorithm achieves an almost optimum competitive ratio, and to obtain new refined upper bounds on the competitive ratio for the case of $d$ different weight classes.
Enhancement of Physical Layer Security Using Destination Artificial Noise Based on Outage Probability
Venue: arXiv cs.IT 2017
Year: 2017

In this paper, we study using Destination Artificial Noise (DAN) besides Source Artificial Noise (SAN) to enhance physical layer secrecy with an outage probability based approach. It is assumed that all nodes in the network (i.e. source, destination and eavesdropper) are equipped with multiple antennas. In addition, the eavesdropper is passive and its channel state and location are unknown at the source and destination. In our proposed scheme, by optimized allocation of power to the SAN, DAN and data signal, a minimum value for the outage probability is guaranteed at the eavesdropper, and at the same time a certain level of signal to noise ratio (SNR) at the destination is ensured. Our simulation results show that using DAN along with SAN brings a significant enhancement in power consumption compared to methods that merely adopt SAN to achieve the same outage probability at the eavesdropper.
Next Generation Business Intelligence and Analytics: A Survey
Venue: arXiv cs.AI 2017
Year: 2017

Business Intelligence and Analytics (BI&A) is the process of extracting and predicting business-critical insights from data. Traditional BI focused on data collection, extraction, and organization to enable efficient query processing for deriving insights from historical data. With the rise of big data and cloud computing, there are many challenges and opportunities for the BI. Especially with the growing number of data sources, traditional BI\&A are evolving to provide intelligence at different scales and perspectives - operational BI, situational BI, self-service BI. In this survey, we review the evolution of business intelligence systems in full scale from back-end architecture to and front-end applications. We focus on the changes in the back-end architecture that deals with the collection and organization of the data. We also review the changes in the front-end applications, where analytic services and visualization are the core components. Using a uses case from BI in Healthcare, which is one of the most complex enterprises, we show how BI\&A will play an important role beyond the traditional usage. The survey provides a holistic view of Business Intelligence and Analytics for anyone interested in getting a complete picture of the different pieces in the emerging next generation BI\&A solutions.