arXiv subjects

Luca Ferrari

Publications and source records attributed to Luca Ferrari.

At least 19 recordsLinked to original sources

arXiv2026

TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps

Telegram Mini Apps are Web applications embedded within the Telegram client, forming an ecosystem of third-party services within one of the world's most widely used messaging platforms. Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored. Unlike ecosystems such as WeChat, which rely on tightly controlled, proprietary execution frameworks, Telegram adopts a different model: Mini Apps run inside a WebView, combining platform-provided context with standard Web capabilities and unrestricted outbound networking. This enables applications to transmit sensitive information to analytics, advertising, tracking, or other third parties through ordinary Web requests, often with limited visibility. Privacy disclosures are therefore critical for transparency. Telegram allows Mini Apps either to define an application-specific privacy policy or to rely on a platform-provided default policy. While the latter reduces the developer's disclosure burden, it may lead to generic statements that do not accurately capture actual data practices of individual Mini Apps. In this paper, we present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps by capturing runtime network traffic, identifying third-party communications, and comparing observed data flows against disclosed privacy information. We evaluate 278 working Mini Apps collected from tApps Center, a community-driven catalogue for discovering third-party applications in Telegram. We find that 59.4% contact at least one undisclosed third party, 78.8% rely exclusively on Telegram's default privacy policy, and none provides a consent or opt-out mechanism. These findings expose a substantial transparency and compliance gap in a widely used yet understudied ecosystem.

cs.CR↗

arXiv2026

Evaluating LLMs for Obfuscation Detection and Classification in Android Apps

Android applications (apps) developers increasingly rely on code obfuscation techniques to hinder reverse engineering and protect intellectual property. However, obfuscation also reduces the effectiveness of static analysis and vulnerability detection tools, creating challenges for Android security analysis. Existing approaches for detecting obfuscation in Android apps predominantly rely on handcrafted heuristics, engineered features, or task-specific learning pipelines, which may struggle to generalize across evolving obfuscation strategies. This paper presents a large-scale empirical study investigating the capability of Large Language Models (LLMs) to detect obfuscation in Android apps through semantic reasoning. Our study evaluates whether off-the-shelf LLMs can identify obfuscated code without relying on handcrafted rules, predefined signatures, or dedicated model training. The empirical evaluation is conducted on both a controlled benchmark containing an app obfuscated with multiple techniques and a real-world dataset of Android apps collected from Google Play. The study further examines the impact of prompt design, model selection, and decision thresholds across several open-weight and proprietary LLMs. Finally, the analysis compares LLM-based reasoning with existing SAST-based obfuscation-detection approaches and discusses the broader implications and limitations of applying LLMs to Android security analysis.

cs.SE↗

arXiv2026

Proceedings of the 14th edition of the conference on Random Generation of Combinatorial Structures

This volume contains the proceedings of GASCom 2026, held on June 8-12 2026, in Malosco (Italy). This series of conferences brings together researchers in combinatorics, algorithms, probabilities, and more generally mathematical computer science, around the theme of random and exhaustive generation of combinatorial structures, mostly considered from a theoretical point of view. In connection with this main theme, contributions in enumerative or analytic combinatorics, and interactions with other areas of mathematics, computer science, physics or biology are wellcome. The topics cover both the methods for random or exhaustive generation, and original results on combinatorial or algorithmic problems, whose solution has been made possible by an approach involving random or exhaustive generation. A (non exhaustive) list of topics of the conference is: random and exhaustive generation of combinatorial objects; tilings and polyominoes; bijective, enumerative, algebraic and analytic combinatorics; algorithmic aspects: analysis of algorithms, probabilistic algorithms; interactions: bio-informatics, combinatorics on words, number theory.

cs.DM↗

arXiv2026

The mex statistic on combinatorial structures

We extend the notion of mex, which is central in combinatorial number theory, to an arbitrary combinatorial structure, and we prove a general theorem to determine the generating function of the objects having fixed mex. We then study this new mex statistic for several classical combinatorial structures, by providing the mex generating function and/or a closed formula for its coefficients in each of the cases.

math.CO↗

arXiv2026

PolicyGapper: Automated Detection of Inconsistencies Between Google Play Data Safety Sections and Privacy Policies Using LLMs

Mobile application developers are required to disclose how they collect, use, and share user data in compliance with privacy regulations. To support transparency, major app marketplaces have introduced standardized disclosure mechanisms. In 2022, Google mandated the Data Safety Section (DSS) on Google Play, requiring developers to summarize their data practices. However, compiling accurate DSS disclosures is challenging, as they must remain consistent with the corresponding privacy policy (PP), and no automated tool currently verifies this alignment. Prior studies indicate that nearly 80% of popular apps contain incomplete or misleading DSS declarations. We present PolicyGapper, an LLM-based methodology for automatically detecting discrepancies between DSS disclosures and privacy policies. PolicyGapper operates in four stages: scraping, pre-processing, analysis, and post-processing, without requiring access to application binaries. We evaluate PolicyGapper on a dataset of 330 top-ranked apps spanning all 33 Google Play categories, collected in Q3 2025. The approach identifies 2,689 omitted disclosures, including 2,040 related to data collection and 649 to data sharing. Manual validation on a stratified 10% subset, repeated across three independent runs, yields an average Precision of 0.75, Recall of 0.77, Accuracy of 0.69, and F1-score of 0.76. To support reproducibility, we release a complete replication package, including the dataset, prompts, source code, and results available at https://github.com/Mobile-IoT-Security-Lab/PolicyGapper and https://doi.org/10.5281/zenodo.19628493.

cs.CR↗

arXiv2025

Sorting permutations using a pop stack with a bypass

We introduce a new sorting device for permutations which makes use of a pop stack augmented with a bypass operation. This results in a sorting machine, which is more powerful than the usual Popstacksort algorithm and seems to have never been investigated previously. In the present paper, we give a characterization of sortable permutations in terms of forbidden patterns and reinterpret the resulting enumerating sequence using a class of restricted Motzkin paths. Moreover, we describe an algorithm to compute the set of all preimages of a given permutation, thanks to which we characterize permutations having a small number of preimages. Finally, we provide a full description of the preimages of principal classes of permutations, and we discuss the device consisting of two pop stacks in parallel, again with a bypass operation.

cs.DM↗

arXiv2024

On the enumeration of permutation-invariant and complete Naples parking functions

Naples parking functions were introduced as a generalization of classical parking functions, in which cars are allowed to park backwards, by checking up to a fixed number of previous slots, before proceedings forward as usual. In our previous work (arXiv:2405.07522, 2024) we have provided a characterization of Naples parking functions in terms of the new notion of \emph{complete parking preference}. Our result also allowed us to describe a new characterization of permutation-invariant Naples parking functions, equivalent (but much simpler) to the one given by Carvalho et al.(arXiv:2109.01735, 2021) but using a completely different approach (and language). In the present article we address some natural enumerative issues concerning the above mentioned objects. We propose an effective approach to enumerate permutation-invariant Naples parking functions and complete Naples parking functions which is based on some natural combinatorial decompositions. We thus obtain formulas depending on some (generally simpler) quantities, which are of interest in their own right, and that can be described in a recursive fashion.

math.CO↗

arXiv2024

Pop Stacks with a Bypass

We consider sorting procedures for permutations making use of pop stacks with a bypass operation, and explore the combinatorial properties of the associated algorithms.

cs.DM↗

arXiv2024

Proceedings of the 13th edition of the conference on Random Generation of Combinatorial Structures. Polyominoes and Tilings

The conference GASCom brings together researchers in combinatorics, algorithms, probabilities, and more generally mathematical computer science, around the theme of random and exhaustive generation of combinatorial structures, mostly considered from a theoretical point of view. In connection with this main theme, the conference is also interested in contributions in enumerative or analytic combinatorics, and interactions with other areas of mathematics, computer science, physics or biology. The conference is both interested in methods for random or exhaustive generation and in original results on combinatorial or algorithmic questions, whose solution has been made possible by an approach involving random or exhaustive generation. The present edition of the conference includes a specific bunch of talks dedicated to polyominoes and tilings. A (not exhaustive) list of topics of the conference is: random and exhaustive generation of combinatorial objects; tilings and polyominoes; bijective, enumerative, algebraic and analytic combinatorics; algorithmic aspects: analysis of algorithms, probabilistic algorithms; interactions: bio-informatics, combinatorics on words, number theory.

cs.DM↗

arXiv2024

Between weak and Bruhat: the middle order on permutations

We define a partial order $\mathcal{P}_n$ on permutations of any given size $n$, which is the image of a natural partial order on inversion sequences. We call this the ``middle order''. We demonstrate that the poset $\mathcal{P}_n$ refines the weak order on permutations and admits the Bruhat order as a refinement, justifying the terminology. These middle orders are distributive lattices and we establish some of their combinatorial properties, including characterization and enumeration of intervals and boolean intervals (in general, or of any given rank), and a combinatorial interpretation of their Euler characteristic. We further study the (not so well-behaved) restriction of this poset to involutions, obtaining a simple formula for the M\"obius function of principal order ideals there. Finally, we offer further directions of research, initiating the study of the canonical Heyting algebra associated with $\mathcal{P}_n$, and defining a parking function analogue of $\mathcal{P}_n$.

math.CO↗

arXiv2024

A new approach to Naples parking functions through complete parking preferences

Naples parking functions were introduced as a generalization of classical parking functions, in which cars are allowed to park backwards, by checking up to a fixed number of previous spots, before proceeding forward as usual. In this work we introduce the notion of a complete parking preference, through which we are able to give some information on the combinatorics of Naples parking functions. Roughly speaking, a complete parking preference is a parking preference such that, for any index $j$, there are more cars with preference at least $j$ than spots available from $j$ onward. We provide a characterization of Naples parking functions in terms of certain complete subsequences of them. As a consequence of this result we derive a characterization of permutation-invariant Naples parking functions which turns out to be equivalent to the one given by (Carvalho et al., 2021), but using a totally different approach (and language).

math.CO↗

arXiv2022

Preimages under the bubblesort operator

We study preimages of permutations under the bubblesort operator $\mathbf{B}$. We achieve a description of these preimages much more complete than what is known for the more complicated sorting operators $\mathbf{S}$ (stacksort) and $\mathbf{Q}$ (queuesort). We describe explicitly the set of preimages under $\mathbf{B}$ of any permutation $\pi$ from the left-to-right maxima of $\pi$, showing that there are $2^{k-1}$ such preimages if $k$ is the number of these left-to-right maxima. We further consider, for each $n$, the tree $T_n$ recording all permutations of size $n$ in its nodes, in which an edge from child to parent corresponds to an application of $\mathbf{B}$ (the root being the identity permutation), and we present several properties of these trees. In particular, for each permutation $\pi$, we show how the subtree of $T_n$ rooted at $\pi$ is determined by the number of left-to-right maxima of $\pi$ and the length of the longest suffix of left-to-right maxima of $\pi$. Building on this result, we determine the number of nodes and leaves at every height in such trees, and we recover (resp. obtain) the average height of nodes (resp. leaves) in $T_n$.

math.CO↗

arXiv2021

On the generating functions of pattern-avoiding Motzkin paths

Using a recursive approach, we show that the generating function for sets of Motzkin paths avoiding a single (not necessarily consecutive) pattern is rational over $x$ and the Catalan generating function $C(x) = \frac{1-\sqrt{1-4x^2}}{2x^2}$, where $x$ keeps track of the length of the path. Moreover, an algorithm is provided for finding the generating function in the more general case of an arbitrary set of patterns. In addition, this algorithm allows us to find a combinatorial specification for pattern-avoiding Motzkin paths, which can be used not only for enumeration, but also for exhaustive and random generation.

math.CO↗

arXiv2021

Preimages under the Queuesort algorithm

Following the footprints of what have been done with the algorithm Stacksort, we investigate the preimages of the map associated with a slightly less well known algorithm, called Queuesort. After having described an equivalent version of Queuesort, we provide a recursive description of the set of all preimages of a given permutation, which can be also translated into a recursive procedure to effectively find such preimages. We then deal with some enumerative issues. More specifically, we investigate the cardinality of the set of preimages of a given permutation, showing that all cardinalities are possible, except for 3. We also give exact enumeration results for the number of permutations having 0,1 and 2 preimages. Finally, we consider the special case of those permutations $\pi$ whose set of left-to-right maxima is the disjoint union of a prefix and a suffix of $\pi$: we determine a closed formula for the number of preimages of such permutations, which involves two different incarnations of ballot numbers, and we show that our formula can be expressed as a linear combination of Catalan numbers.

math.CO↗

arXiv2020

Pattern avoidance in the matching pattern poset

A matching of the set $[2n]=\{ 1,2,\ldots ,2n\}$ is a partition of $[2n]$ into blocks with two elements, i.e. a graph on $[2n]$ such that every vertex has degree one. Given two matchings $\sigma$ and $\tau$ , we say that $\sigma$ is a pattern of $\tau$ when $\sigma$ can be obtained from $\tau$ by deleting some of its edges and consistently relabelling the remaining vertices. This is a partial order relation turning the set of all matchings into a poset, which will be called the matching pattern poset. In this paper, we continue the study of classes of pattern avoiding matchings, initiated by Chen, Deng, Du, Stanley and Yan (2007), Jelinek and Mansour (2010), Bloom and Elizalde (2012). In particular, we work out explicit formulas to enumerate the class of matchings avoiding two new patterns, obtained by juxtaposition of smaller patterns, and we describe a recursive formula for the generating function of the class of matchings avoiding the lifting of a pattern and two additional patterns. Finally, we introduce the notion of unlabeled pattern, as a combinatorial way to collect patterns, and we provide enumerative formulas for two classes of matchings avoiding an unlabeled pattern of order three. In one case, the enumeration follows from an interesting bijection between the matchings of the class and ternary trees.

math.CO↗

arXiv2020

Sorting with pattern-avoiding stacks: the $132$-machine

This paper continues the analysis of the pattern-avoiding sorting machines recently introduced by Cerbai, Claesson and Ferrari [CCF]. These devices consist of two stacks, through which a permutation is passed in order to sort it, where the content of each stack must at all times avoid a certain pattern. Here we characterize and enumerate the set of permutations that can be sorted when the first stack is $132$-avoiding, solving one of the open problems proposed in [CCF]. To that end we present several connections with other well known combinatorial objects, such as lattice paths and restricted growth functions (which encode set partitions). We also provide new proofs for the enumeration of some sets of pattern-avoiding restricted growth functions and we expect that the tools introduced can be fruitfully employed to get further similar results.

math.CO↗

arXiv2019

Stack Sorting with Increasing and Decreasing Stacks

We introduce a sorting machine consisting of $k+1$ stacks in series: the first $k$ stacks can only contain elements in decreasing order from top to bottom, while the last one has the opposite restriction. This device generalizes \cite{SM}, which studies the case $k=1$. Here we show that, for $k=2$, the set of sortable permutations is a class with infinite basis, by explicitly finding an antichain of minimal nonsortable permutations. This construction can easily be adapted to each $k \ge 3$. Next we describe an optimal sorting algorithm, again for the case $k=2$. We then analyze two types of left-greedy sorting procedures, obtaining complete results in one case and only some partial results in the other one. We close the paper by discussing a few open questions.

cs.DS↗

arXiv2019

Enumerative combinatorics of intervals in the Dyck pattern poset

We initiate the study of the enumerative combinatorics of the intervals in the Dyck pattern poset. More specifically, we find some closed formulas to express the size of some specific intervals, as well as the number of their covering relations. In most of the cases, we are also able to refine our formulas by rank. We also provide the first results on the M\"obius function of the Dyck pattern poset, giving for instance a closed expression for the M\"obius function of initial intervals whose maximum is a Dyck path having exactly two peaks.

math.CO↗