abstract: The Java programing language was implemented in such a way as to limit the amount of possible ways that a program written in Java could be exploited. Unfortunately, all of the protections and safeguards put in place for Java can be circumvented if a program created in Java utilizes internal or external libraries that were created in a separate, insecure language such as C or C++. A secure Java program can then be made insecure and susceptible to even classic vulnerabilities such as stack overflows, string format attacks, and heap overflows and corruption. Through the internal or external libraries included in the Java program, an attacker could potentially hijack the execution flow of the program. Once the Attacker has control of where and how the program executes, the attacker can spread their influence to the rest of the system. However, since these classic vulnerabilities are known weaknesses, special types of protections have been added to the compilers which create the executable code and the systems that run them. The most common forms of protection include Address SpaceLayout Randomization (ASLR), Non-eXecutable stack (NX Stack), and stack cookies or canaries. Of course, these protections and their implementations vary depending on the system. I intend to look specifically at the Android operating system which is used in the daily lives of a significant portion of the planet. Most Android applications execute in a Java context and leave little room for exploitability, however, there are also many applications which utilize external libraries to handle more computationally intensive tasks. The goal of this thesis is to take a closer look at such applications and the protections surrounding them, especially how the default system protections as mentioned above are implemented and applied to the vulnerable external libraries. However, this is only half of the problem. The attacker must get their payload inside of the application in the first place. Since it is necessary to understand how this is occurring, I will also be exploring how the Android operating system gives outside information to applications and how developers have chosen to use that information. / Dissertation/Thesis / Masters Thesis Computer Science 2020

No description available.

Submitted by Fabio Sobreira Campos da Costa (fabio.sobreira@ufpe.br) on 2016-08-08T12:21:17Z No. of bitstreams: 2 license_rdf: 1232 bytes, checksum: 66e71c371cc565284e70f40736c94386 (MD5) 2016-pbsf-msc.pdf: 596422 bytes, checksum: be9375166fe6e850180863e08b7997d8 (MD5) / Made available in DSpace on 2016-08-08T12:21:17Z (GMT). No. of bitstreams: 2 license_rdf: 1232 bytes, checksum: 66e71c371cc565284e70f40736c94386 (MD5) 2016-pbsf-msc.pdf: 596422 bytes, checksum: be9375166fe6e850180863e08b7997d8 (MD5) Previous issue date: 2016-03-04 / FACEPE / Implicit or indirect control flow allows a transfer of control to a procedure without having to call the procedure explicitly in the program. Implicit control flow is a staple design pattern that adds flexibility to system design. However, it is challenging for a static analysis to compute or verify properties about a system that uses implicit control flow. When a static analysis encounters a procedure call, the analysis usually approximates the call’s behavior by a summary, which conservatively generalizes the effects of any target of the call. In previous work, a static analysis that verifies security properties was developed for Android apps, but failed to achieve high precision in the presence of implicit control flow. This work presents static analyses for two types of implicit control flow that frequently appear in Android apps: Java reflection and Android intents. In our analyses, the summary of a method is the method’s signature. Our analyses help to resolve where control flows and what data is passed. This information improves the precision of downstream analyses, which no longer need to make conservative assumptions about implicit control flow, while maintaining the soundness. We have implemented our techniques for Java. We enhanced an existing security analysis with a more precise treatment of reflection and intents. In a case study involving ten real-world Android apps that use both intents and reflection, the precision of the security analysis was increased on average by two orders of magnitude. The precision of two other downstream analyses was also improved. / Fluxo de controle implícito, ou indireto, permite que haja uma transferência de controle para um procedimento sem que esse procedimento seja invocado de forma explícita pelo programa. Fluxo de controle implícito é um padrão de projeto comum e bastante utilizado na prática, que adiciona flexibilidade no design de um sistema. Porém, é um desafio para uma análise estática ter que computar e verificar propriedades sobre um sistema que usa fluxos de controle implícito. Quando uma análise estática encontra uma chamada a uma procedimento, geralmente a análise aproxima o comportamento da chamada de acordo com o sumário do método, generalizando de uma forma conservadora os efeitos da chamada ao procedimento. Em trabalho anterior, uma análise estática de segurança foi desenvolvida para aplicações Android, mas falhou em obter uma alta precisão na presença de fluxos de controle implícito. Este trabalho apresenta uma análise estática para dois tipos de fluxos de controle implícito que aparecem frequentemente em aplicações Android: Java reflection e Android intents. Nas nossas análises, o sumário de um método é a assinatura do método. Nossas análises ajudam a descobrir para onde o controle flui e que dados estão sendo passados. Essa informação melhora a precisão de outras análises estáticas, que não precisam mais tomar medidas conservadoras na presença de fluxo de controle implícito. Nós implementamos a nossa técnica em Java. Nós melhoramos uma análise de segurança existente através de um tratamento mais preciso em casos de reflection e intents. Em um estudo de caso envolvendo dez aplicações Android reais que usam reflection e intents, a precisão da análise de segurança aumentou em duas ordens de magnitude. A precisão de outras duas análises estáticas também foi melhorada.

Stocker de grandes quantités de données complexifie les interactions avec les systèmes de Business Intelligence (BI). Les systèmes de recommandation semblent un choix logique pour aider les utilisateurs dans leur analyse. Ils extraient des comportements de données historiques et suggèrent des actions personnalisées, potentiellement redondantes, via des scores de similarité. La diversité est essentielle pour améliorer la satisfaction des utilisateurs, d’où l’intérêt particulier accordé aux recommandations complémentaires. Nous avons étudié deux problèmes concrets d’exploration de données en BI et proposons de découvrir et exploiter les intentions utilisateur pour fournir deux recommandeurs de requête. Le premier, un recommandeur collaboratif réactif original basé sur l’intention, recommande des séquences de requêtes à l’utilisateur pour poursuivre son analyse. Le second propose proactivement un ensemble de requêtes pour compléter un rapport BI, en fonction di contexte utilisateur. / The storage of big amounts of data may lead to a series of long questions towards the expected solution which complicates user interactions with Business Intelligence (BI) systems. Recommender systems appear as a natural solution to help the users complete their analysis. They try to discover user behaviors from the past logs and to suggest personalized actions by predicting lists of likeness scores, which may lead to redundant recommendations. Nowadays, diversity is becoming essential to improve users’ satisfaction, thus, a special interest is dedicated to complementary recommendation. We studied two concrete data exploration problems in BI and we propose to discover and leverage the user intents to provide two query recommenders. The first, an original reactive collaborative Intent-based Recommender, recommends sequences of queries for the user to pursue her analysis. The second one proactively proposes a bundle of queries to complete user BI report, based on the user intents.

Cette thèse traite du problème du calcul des implications, c'est-à-dire des régularités de la forme "quand il y a A, il y a B", dans des ensembles de données composés d'objets décrits par des attributs. Calculer toutes les implications peut être vu comme l'énumération d'ensembles d'attributs appelés pseudo-intensions. Nous savons que ces pseudo-intensions ne peuvent pas être énumérées avec un délai polynomial dans l'ordre lectique mais aucun résultat n'existe, à l'heure actuelle, pour d'autres ordres. Bien que certains algorithmes existants n'énumèrent pas forcément dans l'ordre lectique, aucun n'a un délai polynomial. Cette absence de connaissances sur les autres ordres autorise toujours l'existence d'un algorithme avec délai polynomial et le trouver serait une avancée utile et significative. Malheureusement, les algorithmes actuels ne nous autorisent pas à choisir l'ordre d'énumération, ce qui complique considérablement et inutilement l'étude de l'influence de l'ordre dans la complexité. C'est donc pour aller vers une meilleure compréhension du rôle de l'ordre dans l'énumération des pseudo-intensions que nous proposons un algorithme qui peut réaliser cette énumération dans n'importe quel ordre qui respecte la relation d'inclusion. Dans la première partie, nous expliquons et étudions les propriétés de notre algorithme. Comme pour tout algorithme d'énumération, le principal problème est de construire tous les ensembles une seule fois. Nous proposons pour cela d'utiliser un arbre couvrant, lui-même basé sur l'ordre lectique, afin d'éviter de multiples constructions d'un même ensemble. L'utilisation de cet arbre couvrant au lieu de l'ordre lectique classique augmente la complexité spatiale mais offre plus de flexibilité dans l'ordre d'énumération. Nous montrons que, comparé à l'algorithme Next Closure bien connu, le nôtre effectue moins de fermetures logiques sur des contextes peu denses et plus de fermetures quand le nombre moyen d'attributs par objet dépasse 30% du total. La complexité spatiale de l'algorithme est aussi étudiée de façon empirique et il est montré que des ordres différents se comportent différemment, l'ordre lectique étant le plus efficace. Nous postulons que l'efficacité d'un ordre est fonction de sa distance à l'ordre utilisé dans le test de canonicité. Dans la seconde partie, nous nous intéressons au calcul des implications dans un cadre plus complexe : les données relationnelles. Dans ces contextes, les objets sont représentés à la fois par des attributs et par des relations avec d'autres objets. Le besoin de représenter les informations sur les relations produit une augmente exponentielle du nombre d'attributs, ce qui rend les algorithmes classiques rapidement inutilisables. Nous proposons une modification de notre algorithme qui énumère les pseudo-intensions de contextes dans lesquels l'information relationnelle est représentée par des attributs. Nous fournissons une étude rapide du type d'information relationnelle qui peut être prise en compte. Nous utilisons l'exemple des logiques de description comme cadre pour l'expression des données relationnelles. Dans la troisième partie, nous étendons notre travail au domaine plus général des règles d'association. Les règles d'association sont des régularités de la forme ``quand il y a A, il y a B avec une certitude de x%''. Ainsi, les implications sont des règles d'association certaines. Notre algorithme calcule déjà une base pour les implications et nous proposons une très simple modification et montrons qu'elle lui permet de calculer la base de Luxenburger en plus de la base de Duquenne-Guigues. Cela permet à notre algorithme de calculer une base de cardinalité minimale pour les règles d'association. / This thesis deals with the problem of the computation of implications, which are regularities of the form "when there is A there is B", in datasets composed of objects described by attributes. Computing all the implications can be viewed as the enumeration of sets of attributes called pseudo-intents. It is known that pseudointents cannot be enumerated with a polynomial delay in the lectic order but no such result exists for other orders. While some current algorithms do not enumerate in the lectic order, none of them have a polynomial delay. The lack of knowledge on other orders leaves the possibility for a polynomial-delay algorithm to exist and inding it would be an important and useful step. Unfortunately, current algorithms do not allow us to choose the order so studying its inuence on the complexity of the enumeration is harder than necessary. We thus take a first step towards a better understanding of the role of the order in the enumeration of pseudo-intents by providing an algorithm that can enumerate pseudo-intents in any order that respects the inclusion relation.In the first part, we explain and study the properties of our algorithm. As with all enumeration algorithms, the first problem is to construct all the sets only once.We propose to use a spanning tree, itself based on the lectic order, to avoid multiple constructions of a same set. The use of this spanning tree instead of the classic lectic order increases the space complexity but others much more exibility in the enumeration order. We show that, compared to the well-known Next Closure algorithm, ours performs less logical closures on sparse contexts and more once the average number of attributes per object exceeds 30%. The space complexity of the algorithm is also empirically studied and we show that different orders behave differently with the lectic order being the most efficient. We postulate that the efficiency of an order is function of its distance to the order used in the canonicity test. In the second part, we take an interest in the computation of implications in a more complex setting : relational data. In these contexts, objects are represented by both attributes and binary relations with other objects. The need to represent relation information causes an exponential increase in the number of attributes so naive algorithms become unusable extremely fast. We propose a modification of our algorithm that enumerates the pseudo-intents of contexts in which relational information is represented by attributes. A quick study of the type of relational information that can be considered is provided. We use the example of description logics as a framework for expressing relational data. In the third part, we extend our work to the more general domain of association rules. Association rules are regularities of the form \when there is A there is B with x% certainty" so implications are association rules with 100% certainty. Our algorithm already computes a basis for implications so we propose a very simple modification and demonstrate that it can compute the Luxenburger basis of a context along with the Duquenne-Guigues basis. This effectively allows our algorithm to compute a basis for association rules that is of minimal cardinality.

No description available.

Submitted by CARLA MARIA GOULART DE MORAES (carlagm) on 2015-06-25T14:00:14Z No. of bitstreams: 1 IlzaRodriguesJardim.pdf: 1092179 bytes, checksum: cfb19e5173e7ed852bf4d8810cba1503 (MD5) / Made available in DSpace on 2015-06-25T14:00:14Z (GMT). No. of bitstreams: 1 IlzaRodriguesJardim.pdf: 1092179 bytes, checksum: cfb19e5173e7ed852bf4d8810cba1503 (MD5) Previous issue date: 2011 / Nenhuma / A tese tem como tema compreender o agir pedagógico do aluno de Licenciatura em Matemática da Universidade Federal do Rio Grande do Sul nos Cursos Pré-vestibular Populares (CPVP), lugar de formação e início da experiência docente o qual junta-se à formação em desenvolvimento na graduação. Através deste, objetiva-se interpretar o dizer dos professores, os enunciados pedagógicos, tendo como recurso para tal seis intenções de enunciação, que acercam o enunciado pedagógico do professor. Compreender as intenções de enunciação como estratégias de interação para o ensinar e aprender, e que, por meio destas, o professor e o aluno excursionam entre os saberes e criam um lugar na sala de aula, lugar este no qual constatei, a partir dos episódios pedagógicos dos professores Saturno, Sol e Netuno, que o aluno concorda, indaga e questiona. E nesta perspectiva, o enunciado pedagógico é uma soma de fatos enunciativos provocada pelo ir e vir no qual os protagonistas participam como falantes e ouvintes. Como instrumento de coleta de informações, foram realizadas entrevistas com coordenadores de cursos CPVP e com seus professores para que se pudesse conhecer suas trajetórias de formação na educação básica; gravações das suas aulas em DVD e transcrições dos áudios (das aulas). Para tanto, os teóricos de referência são Benveniste, na Teoria da Enunciação, Gadamer e sua produção sobre compreensão e linguagem, e Cunha, com seus entendimentos acerca do professor e sua formação. / The theme of this thesis is to understand the pedagogical practice of Mathematics Degree students at Universidade Federal do Rio Grande do Sul, their teaching-learning environment, and the beginning of their teaching carrier in Popular Preparation Courses for the entrance examinations in universities (CPVP) along with the development of their graduation course. We aim to interpret their discourse and pedagogical utterances relying on six intents of elocution which are embraced by the teacher’s pedagogical enunciations. Understanding the intentions of the enunciations as interaction strategies to teach and learn so teacher and student explore knowledge and design a space in the classroom, in which I’ve realized, from the Saturno, Sol, and Netuno events, that the student agrees, queries, and inter rogates. From this perspective, the pedagogical enunciation is the addition of enunciative facts stimulated by the turn-taking in which the protagonists take part as speakers and listeners. Interviews with the popular courses coordinators and their teaching staff are the instruments for the data collection, being able to learn about their background and development in their basic education. Class video recording and their audio transcriptions are also instruments for data collection. The theoretical foundations are based upon the works of Benveniste, on the Enunciation Theory, Gadamer and his works on comprehension and language, and Cunha, with her understanding about teachers and their training.

The goal of this thesis is to create a mobile application for the Android operating system, which makes organizing a community shopping easier for its users and their friends. Each user can build a community of their own that offers collective purchasing of products, or can offer their products for purchase. They categorize these offers to their channels and their friends choose only those channels that they find interesting. If their friends accept their offer, they see the necessary information about their individual purchases. Thus, this application enables users to offer shared purchasing to their friends e.g. at a grower from whom these people could not buy individually. They can procure quality produce together at a competitive price and they can also reduce production of plastic packaging by purchasing as a group.

We investigate the computational complexity of several decision, enumeration and counting problems related to pseudo-intents. We show that given a formal context and a set of its pseudo-intents, checking whether this context has an additional pseudo-intent is in conp and it is at least as hard as checking whether a given simple hypergraph is saturated. We also show that recognizing the set of pseudo-intents is also in conp and it is at least as hard as checking whether a given hypergraph is the transversal hypergraph of another given hypergraph. Moreover, we show that if any of these two problems turns out to be conp-hard, then unless p = np, pseudo-intents cannot be enumerated in output polynomial time. We also investigate the complexity of finding subsets of a given Duquenne-Guigues Base from which a given implication follows. We show that checking the existence of such a subset within a specified cardinality bound is np-complete, and counting all such minimal subsets is #p-complete.

Hoër Onderwys in Suid-Afrika is in 'n proses van transformasie. Hierdie transformasie is onder meer as gevolg van internasionale wereldtendense en die historiese agterstande van onderwys in Suid-Afrika. Dit is derhalwe noodsaaklik dat instellings, soos die Oos-Rand Kampus van die Vaaldriehoekse Technikon, strategiese beplanning in sy bestuursaktiwiteite behoort te inkorporeer. Hierdie studie het strategiese bestuur as sentrale tema met komponente in die Filosofiese Antropologie en in Sakebestuur. In hierdie studie is ondersoek gedoen na strategiese bestuur as dialektiese strategiese bestuur met kenmerke van bi-polere, dualistiese en kontensieuse aard. Dit is vanuit hierdie vertrekpunt dat dialektiese strategiese bestuur in die kategoriee van menswees, soos onder meer synsopenheid, dialoog, toekomstigheid, paties-dinamiese gerelasioneerdheid, verbeelding, selfbewussyn, waardes en vryheid en besluitneming, gefundeer kan word. Dit kan gekonstateer word dat dialektiese strategiese bestuur 'n menslike aktiwiteit is wat in die Filosofiese Antropologie en in die Aksiologie gefundeer is. 'n Ondersoek is ook geloods na faktore wat die toekomstige strategiese posisie van die Oos-Rand Kampus van die Vaaldriehoekse Technikon kan beinvloed en/of bepaal Internasionale en nasionale onderwysfaktore is ondersoek en 'n nie-empiriese opname is onder personeel, studente en werkgewers uitgevoer om inligting te verkry wat in strategiese bestuur gebruik kan word. Die gevolgtrekkings van hierdie studie is in die vorm van strategiese tendense en 'n moontlike bestuursplan uiteengesit wat as 'n vertrekpunt in 'n strategiese plan vir die Oos-Rand Kampus van die Vaaldriehoekse Technikon gebruik kan word. / Higher Education in South Africa is in a process of transfonnation. This transfonnation is, amongst others, due to the international global tendencies and the historic backlog of education in South Africa It is therefore imperative that institutions, such as the East Rand Campus of the Vaal Triangle Technikon, should incorporate strategic planning in its managerial activities. This study has strategic management as a central theme with components in the Philosophical Anthropology and in Business Management. In this study strategic management has been investigated as dialectic strategic management with characteristics of a bi-polar, dualistic and contention nature. It is from this departure that dialectic strategic management can be funded in the categories of being human, namely openness to being, dialogue, futurity, pathic-dynamic relatedness, imagination, self consciousness, values and freedom and decision making. It can thus be stated that dialectic strategic management is a human activity funded in the Philosophical Anthropology and in the Axiology. An investigation has also been done pertaining factors which can influence and/or determine the future strategic position of the East Rand Campus of the Vaal Triangle Technikon. International and national educational factors have been investigated and a non-empirical survey was made among stafl: students and employers as to obtain infonnation that can be used in strategic management. The conclusion of the study is presented in the form of strategic intents and a probable management plan that can be used as a point of departure in a strategic management plan for the East Rand Campus of the Vaal Triangle Technikon. / Educational Studies / D. Ed. (Filosofie van die Opvoeding)