arXiv subjects

Lei Wu

Publications and source records attributed to Lei Wu.

At least 253 records · Page 14Linked to original sources

arXiv2021

Lifting The Grey Curtain: A First Look at the Ecosystem of CULPRITWARE

Mobile apps are extensively involved in cyber-crimes. Some apps are malware which compromise users' devices, while some others may lead to privacy leakage. Apart from them, there also exist apps which directly make profit from victims through deceiving, threatening or other criminal actions. We name these apps as CULPRITWARE. They have become emerging threats in recent years. However, the characteristics and the ecosystem of CULPRITWARE remain mysterious. This paper takes the first step towards systematically studying CULPRITWARE and its ecosystem. Specifically, we first characterize CULPRITWARE by categorizing and comparing them with benign apps and malware. The result shows that CULPRITWARE have unique features, e.g., the usage of app generators (25.27%) deviates from that of benign apps (5.08%) and malware (0.43%). Such a discrepancy can be used to distinguish CULPRITWARE from benign apps and malware. Then we understand the structure of the ecosystem by revealing the four participating entities (i.e., developer, agent, operator and reaper) and the workflow. After that, we further reveal the characteristics of the ecosystem by studying the participating entities. Our investigation shows that the majority of CULPRITWARE (at least 52.08%) are propagated through social media rather than the official app markets, and most CULPRITWARE (96%) indirectly rely on the covert fourth-party payment services to transfer the profits. Our findings shed light on the ecosystem, and can facilitate the community and law enforcement authorities to mitigate the threats. We will release the source code of our tools to engage the community.

cs.CR↗

arXiv2021

A Measurement Study on the (In)security of End-of-Life (EoL) Embedded Devices

Embedded devices are becoming popular. Meanwhile, researchers are actively working on improving the security of embedded devices. However, previous work ignores the insecurity caused by a special category of devices, i.e., the End-of-Life (EoL in short) devices. Once a product becomes End-of-Life, vendors tend to no longer maintain its firmware or software, including providing bug fixes and security patches. This makes EoL devices susceptible to attacks. For instance, a report showed that an EoL model with thousands of active devices was exploited to redirect web traffic for malicious purposes. In this paper, we conduct the first measurement study to shed light on the (in)security of EoL devices. To this end, our study performs two types of analysis, including the aliveness analysis and the vulnerability analysis. The first one aims to detect the scale of EoL devices that are still alive. The second one is to evaluate the vulnerabilities existing in (active) EoL devices. We have applied our approach to a large number of EoL models from three vendors (i.e., D-Link, Tp-Link, and Netgear) and detect the alive devices in a time period of ten months. Our study reveals some worrisome facts that were unknown by the community. For instance, there exist more than 2 million active EoL devices. Nearly 300,000 of them are still alive even after five years since they became EoL. Although vendors may release security patches after the EoL date, however, the process is ad hoc and incomplete. As a result, more than 1 million active EoL devices are vulnerable, and nearly half of them are threatened by high-risk vulnerabilities. Attackers can achieve a minimum of 2.79 Tbps DDoS attack by compromising a large number of active EoL devices. We believe these facts pose a clear call for more attention to deal with the security issues of EoL devices.

cs.CR↗

arXiv2021

Characteristic cycles associated to holonomic $\mathscr D$-modules

We study relative and logarithmic characteristic cycles associated to holonomic $\mathscr D$-modules. As applications, we obtain: (1) an alternative proof of Ginsburg's log characteristic cycle formula for lattices of regular holonomic $\mathscr D$-modules following ideas of Sabbah and Briancon-Maisonobe-Merle, and (2) the constructibility of the log de Rham complexes for lattices of holonomic $\mathscr D$-modules, which is a natural generalization of Kashiwara's constructibility theorem.

math.AG↗

arXiv2021

Hands-on Guidance for Distilling Object Detectors

Knowledge distillation can lead to deploy-friendly networks against the plagued computational complexity problem, but previous methods neglect the feature hierarchy in detectors. Motivated by this, we propose a general framework for detection distillation. Our method, called Hands-on Guidance Distillation, distills the latent knowledge of all stage features for imposing more comprehensive supervision, and focuses on the essence simultaneously for promoting more intense knowledge absorption. Specifically, a series of novel mechanisms are designed elaborately, including correspondence establishment for consistency, hands-on imitation loss measure and re-weighted optimization from both micro and macro perspectives. We conduct extensive evaluations with different distillation configurations over VOC and COCO datasets, which show better performance on accuracy and speed trade-offs. Meanwhile, feasibility experiments on different structural networks further prove the robustness of our HGD.

cs.CV↗

arXiv2021

DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications

The rapid growth of Decentralized Finance (DeFi) boosts the Ethereum ecosystem. At the same time, attacks towards DeFi applications (apps) are increasing. However, to the best of our knowledge, existing smart contract vulnerability detection tools cannot be directly used to detect DeFi attacks. That's because they lack the capability to recover and understand high-level DeFi semantics, e.g., a user trades a token pair X and Y in a Decentralized EXchange (DEX). In this work, we focus on the detection of two types of new attacks on DeFi apps, including direct and indirect price manipulation attacks. The former one means that an attacker directly manipulates the token price in DEX by performing an unwanted trade in the same DEX by attacking the vulnerable DeFi app. The latter one means that an attacker indirectly manipulates the token price of the vulnerable DeFi app (e.g., a lending app). To this end, we propose a platform-independent way to recover high-level DeFi semantics by first constructing the cash flow tree from raw Ethereum transactions and then lifting the low-level semantics to high-level ones, including token trade, liquidity mining, and liquidity cancel. Finally, we detect price manipulation attacks using the patterns expressed with the recovered DeFi semantics. We have implemented a prototype named \tool{} and applied it to more than 350 million transactions. It successfully detected 432 real-world attacks in the wild. We confirm that they belong to four known security incidents and five zero-day ones. We reported our findings. Two CVEs have been assigned. We further performed an attack analysis to reveal the root cause of the vulnerability, the attack footprint, and the impact of the attack. Our work urges the need to secure the DeFi ecosystem.

cs.CR↗

arXiv2021

Towards A First Step to Understand Flash Loan and Its Applications in DeFi Ecosystem

Flash Loan, as an emerging service in the decentralized finance ecosystem, allows users to request a non-collateral loan. While providing convenience, it also enables attackers to launch malicious operations with a large amount of asset that they do not have. Though there exist spot media reports of attacks that leverage Flash Loan, there lacks a comprehensive understanding of existing Flash Loan services. In this work, we take the first step to study the Flash Loan service provided by three popular platforms. Specifically, we first illustrate the interactions between Flash Loan providers and users. Then, we design three patterns to identify Flash Loan transactions. Based on the patterns, 76, 303 transactions are determined. The evaluation results show that the Flash Loan services get more popular over time. At last, we present four Flash Loan applications with real-world examples and propose two potential research directions.

cs.CR↗

arXiv2021

Global fits of axion-like particles to XENON1T and astrophysical data

The excess of electron recoil events seen by the XENON1T experiment has been interpreted as a potential signal of axion-like particles (ALPs), either produced in the Sun, or constituting part of the dark matter halo of the Milky Way. It has also been explained as a consequence of trace amounts of tritium in the experiment. We consider the evidence for the solar and dark-matter ALP hypotheses from the combination of XENON1T data and multiple astrophysical probes, including horizontal branch stars, red giants, and white dwarfs. We briefly address the influence of ALP decays and supernova cooling. While the different datasets are in clear tension for the case of solar ALPs, all measurements can be simultaneously accommodated for the case of a sub-dominant fraction of dark-matter ALPs. Nevertheless, this solution requires the tuning of several a priori unknown parameters, such that for our choices of priors a Bayesian analysis shows no strong preference for the ALP interpretation of the XENON1T excess over the background hypothesis.

astro-ph.CO↗

arXiv2021

Zero loci of Bernstein-Sato ideals -- II

We have recently proved a precise relation between Bernstein-Sato ideals of collections of polynomials and monodromy of generalized nearby cycles. In this article we extend this result to other ideals of Bernstein-Sato type.

math.AG↗

arXiv2021

Beyond the Virus: A First Look at Coronavirus-themed Mobile Malware

As the COVID-19 pandemic emerged in early 2020, a number of malicious actors have started capitalizing the topic. Although a few media reports mentioned the existence of coronavirus-themed mobile malware, the research community lacks the understanding of the landscape of the coronavirus-themed mobile malware. In this paper, we present the first systematic study of coronavirus-themed Android malware. We first make efforts to create a daily growing COVID-19 themed mobile app dataset, which contains 4,322 COVID-19 themed apk samples (2,500 unique apps) and 611 potential malware samples (370 unique malicious apps) by the time of mid-November, 2020. We then present an analysis of them from multiple perspectives including trends and statistics, installation methods, malicious behaviors and malicious actors behind them. We observe that the COVID-19 themed apps as well as malicious ones began to flourish almost as soon as the pandemic broke out worldwide. Most malicious apps are camouflaged as benign apps using the same app identifiers (e.g., app name, package name and app icon). Their main purposes are either stealing users' private information or making profit by using tricks like phishing and extortion. Furthermore, only a quarter of the COVID-19 malware creators are habitual developers who have been active for a long time, while 75% of them are newcomers in this pandemic. The malicious developers are mainly located in US, mostly targeting countries including English-speaking countries, China, Arabic countries and Europe. To facilitate future research, we have publicly released all the well-labelled COVID-19 themed apps (and malware) to the research community. Till now, over 30 research institutes around the world have requested our dataset for COVID-19 themed research.

cs.CR↗

arXiv2021

General synthetic iterative scheme for unsteady rarefied gas flows

In rarefied gas flows, the spatial grid size could vary by several orders of magnitude in a single flow configuration (e.g., inside the Knudsen layer it is at the order of mean free path of gas molecules, while in the bulk region it is at a much larger hydrodynamic scale). Therefore, efficient implicit numerical method is urgently needed for time-dependent problems. However, the integro-differential nature of gas kinetic equations poses a grand challenge, as the gain part of the collision operator is non-invertible. Hence an iterative solver is required in each time step, which usually takes a lot of iterations in the (near) continuum flow regime where the Knudsen number is small; worse still, the solution does not asymptotically preserve the fluid dynamic limit when the spatial cell size is not refined enough. Inspired by our general synthetic iteration scheme for steady-state solution of the Boltzmann equation, we propose two numerical schemes to push the multiscale simulation of unsteady rarefied gas flows to a new boundary, that is, the numerical solution not only converges within dozens of iterations in each time step, but also asymptotic preserves the Navier-Stokes-Fourier limit at coarse spatial grid, even when the time step is large (e.g., in the extreme slow decay of two-dimensional Taylor vortex, the time step is at the order of vortex decay time). The properties of fast convergence and asymptotic preserving of the proposed schemes are not only rigorously proven by the Fourier stability analysis, but also demonstrated by solid numerical examples.

physics.flu-dyn↗

arXiv2021

The Barron Space and the Flow-induced Function Spaces for Neural Network Models

One of the key issues in the analysis of machine learning models is to identify the appropriate function space and norm for the model. This is the set of functions endowed with a quantity which can control the approximation and estimation errors by a particular machine learning model. In this paper, we address this issue for two representative neural network models: the two-layer networks and the residual neural networks. We define the Barron space and show that it is the right space for two-layer neural network models in the sense that optimal direct and inverse approximation theorems hold for functions in the Barron space. For residual neural network models, we construct the so-called flow-induced function space, and prove direct and inverse approximation theorems for this space. In addition, we show that the Rademacher complexity for bounded sets under these norms has the optimal upper bounds.

cs.LG↗

arXiv2021

Towards Understanding and Demystifying Bitcoin Mixing Services

One reason for the popularity of Bitcoin is due to its anonymity. Although several heuristics have been used to break the anonymity, new approaches are proposed to enhance its anonymity at the same time. One of them is the mixing service. Unfortunately, mixing services have been abused to facilitate criminal activities, e.g., money laundering. As such, there is an urgent need to systematically understand Bitcoin mixing services. In this paper, we take the first step to understand state-of-the-art Bitcoin mixing services. Specifically, we propose a generic abstraction model for mixing services and observe that there are two mixing mechanisms in the wild, i.e. {swapping} and {obfuscating}. Based on this model, we conduct a transaction-based analysis and successfully reveal the mixing mechanisms of four representative services. Besides, we propose a method to identify mixing transactions that leverage the obfuscating mechanism. The proposed approach is able to identify over $92$\% of the mixing transactions. Based on identified transactions, we then estimate the profit of mixing services and provide a case study of tracing the money flow of stolen Bitcoins.

cs.CR↗

arXiv2021

On the Quantum Boltzmann Equation near Maxwellian and Vacuum

We consider the non-relativistic quantum Boltzmann equation for fermions and bosons. Using the nonlinear energy method and mild formulation, we justify the global well-posedness when the density function is near the global Maxwellian and vacuum. This work is a generalization and adaptation of the classical Boltzmann theory. Our main contribution is a detailed analysis of the nonlinear operator $Q$ in the quantum context. This is the first piece of a long-term project on the quantum kinetic equations.

math.AP↗

arXiv2021

The Generalization Error of the Minimum-norm Solutions for Over-parameterized Neural Networks

We study the generalization properties of minimum-norm solutions for three over-parametrized machine learning models including the random feature model, the two-layer neural network model and the residual network model. We proved that for all three models, the generalization error for the minimum-norm solution is comparable to the Monte Carlo rate, up to some logarithmic terms, as long as the models are sufficiently over-parametrized.

stat.ML↗

arXiv2021

VM Matters: A Comparison of WASM VMs and EVMs in the Performance of Blockchain Smart Contracts

WebAssemly is an emerging runtime for Web applications and has been supported in almost all browsers. Recently, WebAssembly is further regarded to be a the next-generation environment for blockchain applications, and has been adopted by Ethereum, namely eWASM, to replace the state-of-the-art EVM. However, whether and how well current eWASM outperforms EVM on blockchain clients is still unknown. This paper conducts the first measurement study, to measure the performance on WASM VM and EVM for executing smart contracts on blockchain. To our surprise, the current WASM VM does not perform in expected performance. The overhead introduced by WASM is really non-trivial. Our results highlight the challenges when deploying WASM in practice, and provide insightful implications for improvement space.

cs.CR↗

arXiv2021

Observation of the Anomalous Hall Effect in a Collinear Antiferromagnet

Time-reversal symmetry breaking is the basic physics concept underpinning many magnetic topological phenomena such as the anomalous Hall effect (AHE) and its quantized variant. The AHE has been primarily accompanied by a ferromagnetic dipole moment, which hinders the topological quantum states and limits data density in memory devices, or by a delicate noncollinear magnetic order with strong spin decoherence, both limiting their applicability. A potential breakthrough is the recent theoretical prediction of the AHE arising from collinear antiferromagnetism in an anisotropic crystal environment. This new mechanism does not require magnetic dipolar or noncollinear fields. However, it has not been experimentally observed to date. Here we demonstrate this unconventional mechanism by measuring the AHE in an epilayer of a rutile collinear antiferromagnet RuO$_2$. The observed anomalous Hall conductivity is large, exceeding 300 S/cm, and is in agreement with the Berry phase topological transport contribution. Our results open a new unexplored chapter of time-reversal symmetry breaking phenomena in the abundant class of collinear antiferromagnetic materials.

cond-mat.mtrl-sci↗

arXiv2020

Preferential imbibition in a dual-permeability pore network

A deep understanding of two-phase displacement in porous media with permeability contrast is essential for the design and optimisation of enhanced oil recovery processes. In this paper, we investigate the forced imbibition behaviour in two dual-permeability geometries that are of equal permeability contrast. First, a mathematical model is developed for the imbibition in a pore doublet, which shows that the imbibition dynamics can be fully described by the viscosity ratio $λ$ and capillary number $Ca_m$ which creatively incorporates the influence of channel width and length. Through the finite difference solution of the mathematical model, a $λ-Ca_m$ phase diagram is established to characterise the imbibition preference in the pore doublet. We then investigate the imbibition process in a dual-permeability pore network using a well-established lattice Boltzmann method, focusing on the competition between the viscous and capillary forces. Like in the pore doublet, the preferential imbibition occurs in high permeability zone at high $Ca_{m}$ but in low permeability zone at low $Ca_{m}$. When $Ca_m$ is not sufficiently high, an oblique advancing pattern is observed which is attributed to non-trivial interfacial tension. Thanks to the newly defined capillary number, the critical $Ca_{m}$ curve on which the breakthrough simultaneously occurs in both permeability zones, is found to match perfectly with that from the pore doublet and it is the optimal condition for maximising the imbibition efficiency in the entire pore network.

physics.flu-dyn↗

arXiv2020

Towards a Mathematical Understanding of Neural Network-Based Machine Learning: what we know and what we don't

The purpose of this article is to review the achievements made in the last few years towards the understanding of the reasons behind the success and subtleties of neural network-based machine learning. In the tradition of good old applied mathematics, we will not only give attention to rigorous mathematical results, but also the insight we have gained from careful numerical experiments as well as the analysis of simplified models. Along the way, we also list the open problems which we believe to be the most important topics for further study. This is not a complete overview over this quickly moving field, but we hope to provide a perspective which may be helpful especially to new researchers in the area.

cs.LG↗