Field experience with obfuscating million-user iOS apps in large enterprise mobile development

In recent years, mobile apps have become the infrastructure of many popular Internet services. It is now common that a mobile app serves millions of users across the globe. By examining the code of these apps, reverse engineers can learn various knowledge about the design and implementation of the apps. Real-world cases have shown that the disclosed critical information allows malicious parties to abuse or exploit the app-provided services for unrightful profits, leading to significant financial losses. One of the most viable mitigations against malicious reverse engineering is to obfuscate the apps. Despite that security by obscurity is typically considered to be an unsound protection methodology, software obfuscation can indeed increase the cost of reverse engineering, thus delivering practical merits for protecting mobile apps. In this paper, we share our experience of applying obfuscation to multiple commercial iOS apps, each of which has millions of users. We discuss the necessity of adopting obfuscation for protecting modern mobile business, the challenges of software obfuscation on the iOS platform, and our efforts in overcoming these obstacles. We especially focus on factors that are unique to mobile software development that may affect the design and deployment of obfuscation techniques. We report the outcome of our obfuscation with empirical experiments. We additionally elaborate on the follow-up case studies about how our obfuscation affected the app publication process and how we responded to the negative impacts. This experience report can benefit mobile developers, security service providers, and Apple as the administrator of the iOS ecosystem.     

A lightweight and distributed middleware to provide presence awareness in mobile ubiquitous systems

Several researchers have identified the need to count on presence awareness in ubiquitous systems that support mobile activities, particularly when these systems are used to perform loosely-coupled mobile work. In such a work style, mobile users conduct face-to-face on-demand interactions, therefore counting on awareness information about the position and availability of potential collaborators becomes mandatory for these applications. Most proposed solutions that provide user presence awareness involve centralized components, have reusability limitations, or simply address a part of that service. This article presents a lightweight and fully distributed middleware named Moware, which allows developers to embed presence awareness services in mobile ubiquitous systems in a simple way. The article also describes the Moware architecture, its main components and strategies used to deal with several aspects of the presence awareness support. These design strategies can be reused by software designers to provide presence awareness capabilities into middleware and specific software applications. Moware services were embedded in a mobile ubiquitous system that supports inspectors during the construction inspection process. The preliminary results indicate that the middleware was easy to use for developers, and its services were useful for the end-users.     

Personalized blog content recommender system for mobile phone users

Compared to newspaper columnists and broadcast media commentators, bloggers do not have organizations actively promoting their content to users; instead, they rely on word-of-mouth or casual visits by web surfers. We believe the WAP Push service feature of mobile phones can help bridge the gap between internet and mobile services, and expand the number of potential blog readers. Since mobile phone screen size is very limited, content providers must be familiar with individual user preferences in order to recommend content that matches narrowly defined personal interests. To help identify popular blog topics, we have created (a) an information retrieval process that clusters blogs into groups based on keyword analyses, and (b) a mobile content recommender system (M-CRS) for calculating user preferences for new blog documents. Here we describe results from a case study involving 20,000 mobile phone users in which we examined the effects of personalized content recommendations. Browsing habits and user histories were recorded and analyzed to determine individual preferences for making content recommendations via the WAP Push feature. The evaluation results of our recommender system indicate significant increases in both blog-related push service click rates and user time spent reading personalized web pages. The process used in this study supports accurate recommendations of personalized mobile content according to user interests. This approach can be applied to other embedded systems with device limitations, since document subject lines are elaborated and more attractive to intended users.     

Usability study of ME2.0

Mobile context-aware applications execute in the background of hosts mobile devices. The applications source process and aggregate hosts’ contextual and personal information. This information is disclosed to ubiquitously pervasive services that adapt their offerings to individual preferences. Unfortunately, many developers continue to ignore the user perspective in context-aware application designs as they complicate their overall task and generate exponential requirements. The additional incorporation of privacy mechanisms in context-aware applications to safeguard context and personal information disclosures also complicates users’ tasks resulting to misconfigured or completely abandoned applications. Misconfigured applications give end-users a false assurance of privacy exposing them to comprising services. We present a usability study on Mobile Electronic Personality Version 2 a privacy enhanced context-aware mobile application for personalising ubiquitous services and adapting pervasive smart-spaces. We draw conclusions on key issues related to user needs, based on user interviews, surveys, prototypes and field evaluations. Users’ needs are evaluated against five themes, learn-ability, efficiency, memorability, errors, satisfaction and privacy contention. In addition, design layout preferences, privacy manageability and consensus design comprehension are also evaluated. Clarity of priorities in context-aware mobile applications shaped by usability studies effectively increases the acceptance of levels of potential users.     

Mobile business application for service and maintenance processes: Using ex post evaluation by end-users as input for iterative design

Although mobile technologies are increasingly used for business purposes, many companies have found it difficult to successfully implement them. Not only do the rapid technological changes increase the risks of companies’ investments into mobile technologies, but many such applications have also failed to gain user acceptance. In contrast to the consumer domain, there are very few empirical studies of mobile applications’ effectiveness from the perspectives of professional end users. Furthermore, designing mobile business applications has become an increasingly iterative and incremental activity, and ex post evaluations by actual users can provide crucial feedback to an iterative design process. In this study, we seek to contribute to establishing a design cycle that closely links the building and the evaluation of mobile business applications. Our objectives are to (1) gain a better understanding of mobile business applications’ success by means of ex post evaluations from end users, and to (2) leverage these empirical insights to inform the design of mobile business applications. We conducted the study in collaboration with DEKRA Automotive, which offers expert services in the automotive sector with experience in mobile business applications. Our primary contribution is a systematic approach to using ex post evaluation as input for the iterative design of mobile business applications. We suggest an adapted version of the D&M information system (IS) Success Model, which has process quality as an additional construct, as a basis for ex post evaluations of a mobile business application by its end users. Furthermore, we illustrate how a performance-based analysis of the empirical results enables one to derive priorities and recommendations for future design iterations. Our results reveal that system quality and process quality are the main determinants of individual benefits of using mobile business applications. Our findings thus contradict other studies that identify information quality as a significant motivator of (consumer-oriented) mobile data services. We conclude that a mobile business application's design should focus on process quality, emphasizing functional support for operational tasks in a specific work context while ensuring system quality, which is largely affected by technology platform choices.     

An unsupervised approach to modeling personalized contexts of mobile users

Mobile context modeling is a process of recognizing and reasoning about contexts and situations in a mobile environment, which is critical for the success of context-aware mobile services. While there are prior works on mobile context modeling, the use of unsupervised learning techniques for mobile context modeling is still under-explored. Indeed, unsupervised techniques have the ability to learn personalized contexts, which are difficult to be predefined. To that end, in this paper, we propose an unsupervised approach to modeling personalized contexts of mobile users. Along this line, we first segment the raw context data sequences of mobile users into context sessions where a context session contains a group of adjacent context records which are mutually similar and usually reflect the similar contexts. Then, we exploit two methods for mining personalized contexts from context sessions. The first method is to cluster context sessions and then to extract the frequent contextual feature-value pairs from context session clusters as contexts. The second method leverages topic models to learn personalized contexts in the form of probabilistic distributions of raw context data from the context sessions. Finally, experimental results on real-world data show that the proposed approach is efficient and effective for mining personalized contexts of mobile users.     

Contextualized mobile recommendation service based on interactive social network discovered from mobile users

Personal context is the most significant information for providing contextualized mobile recommendation services at a certain time and place. However, it is very difficult for service providers to be aware of the personal contexts, because each person’s activities and preferences are very ambiguous and depending on numerous unknown factors. In order to deal with this problem, we have focused on discovering social relationships (e.g., family, friends, colleagues and so on) between people. We have assumed that the personal context of a certain person is interrelated with those of other people, and investigated how to employ his neighbor’s contexts, which possibly have a meaningful influence on his personal context. It indicates that we have to discover implicit social networks which express the contextual dependencies between people. Thereby, in this paper, we propose an interactive approach to build meaningful social networks by interacting with human experts. Given a certain social relation (e.g., isFatherOf), this proposed systems can evaluate a set of conditions (which are represented as propositional axioms) asserted from the human experts, and show them a social network resulted from data mining tools. More importantly, social network ontology has been exploited to consistently guide them by proving whether the conditions are logically verified, and to refine the discovered social networks. We expect these social network is applicable to generate context-based recommendation services. In this research project, we have applied the proposed system to discover the social networks between mobile users by collecting a dataset from about two millions of users.     

A reusable structural design for mobile collaborative applications

Architecting mobile collaborative applications has always been a challenge for designers. However, counting on a structural design as a reference can help developers to reduce risks and efforts involved in system design. This article presents a reusable architecture which helps modeling the communication and coordination services required by mobile collaborative applications to support collaboration among users. This architecture has been used as a basis for the design of several mobile systems. Two of them are presented in this article to show the applicability of the proposal to real world collaborative systems.     

Cluster-group based trusted computing for mobile social networks using implicit social behavioral graph

Mobile Social Networks (MSNs) facilitate connections between mobile devices, and are capable of providing an effective mobile computing environment for users to access, share, and distribute information. However, MSNs are virtual social spaces, the available information may not be trustworthy to all. Therefore, trust inference plays a critical role for establishing social links between mobile users. In MSNs, users’ transactions will more and more be complemented with group contact. Hence, future usage patterns of mobile devices will involve more group contacts. In this paper, we describe the implicit social behavioral graph, i.e., ego-i graph which is formed by users’ contacts, and present an algorithm for initiating ego-i graph. We rate these relationships to form a dynamic contact rank, which enables users to evaluate the trust values between users within the context of MSNs. We, then, calculate group-based trust values according to the level of contacts, interaction evolution, and users’ attributes. Based on group-based trust, we obtain a cluster trust by the aggregation of inter group-based trust values. Due to the unique nature of MSNs, we discuss the propagation of cluster trust values for global MSNs. Finally, we evaluate the performance of our trust model through simulations, and the results demonstrate the effectiveness of group-based behavioural relationships in MSNs’ information sharing system.     

Involving users in expert system development

Abstract: The ultimate criterion of success for interactive expert systems is that they will be used, and used to effect, by individuals other than the system developers. A key ingredient of success in most systems is involving users in the specification and development of systems as they are being built. However, until recently, system designers have paid little attention to ascertaining user needs and to developing systems with corresponding functionality and appropriate interfaces to match those requirements. Although the situation is beginning to change, many developers do not know how to go about involving users, or else tackle the problem in an inadequate way. This paper discusses the need for user involvement and considers why many developers are still not involving users in an optimal way. It looks at the different ways in which users can be involved in the development process and describes how to select appropriate techniques and methods for studying users. Finally, it discusses some of the problems inherent in involving users in expert system development, and recommends an approach which incorporates both ethnographic analysis and formal user testing.     

Predicting the passenger demand on bus services for mobile users

Public transport, especially the bus transport, can reduce the private car usage and fuel consumption, and alleviate traffic congestion. However, when traveling in buses, the travelers not only care about the waiting time, but also care about the crowdedness in the bus itself. Excessively overcrowded bus may drive away the anxious travelers and make them reluctant to take buses. So accurate, real-time and reliable passenger demand prediction becomes necessary, which can help determine the bus headway and help reduce the waiting time of passengers. Based on a large database from a real bus system, this paper aims to present a passenger demand prediction system for mobile users. The system includes a server-side bus information data stream processing and mining program and a client-side mobile application for Android smartphones. The server program continuously monitors for each bus stop the number of passengers waiting at the bus stop, the number of passengers that will pass the bus stop, as well as the traffic conditions in the area around the stop. It delivers real time bus and traffic information to mobile users via restful web services. The client-side location-based mobile application consumes these services to help mobile users make informed transportation choices. For example the availability of buses might be a deterrent when they are too crowded. However, there are three major challenges for predicting the passenger demands on bus services: inhomogeneous, seasonal bursty periods and periodicities. To overcome the challenges, we propose three predictive models and further take a data stream ensemble framework to predict the number of passengers. We develop a prototype system with different types of Android based mobile phones and comprehensively experiment over a 22-week period. The evaluation results suggest that the proposed system achieves outstanding prediction accuracy among 86,411 passenger demands on bus services, more than 78% of them are accurately forecasted.     

An Intents-based approach for dynamic service discovery

Service discovery has been a very active research field attracting many researchers around the world. Most of the previous research efforts on service discovery have been based on the ternary classification of participant roles in web services, including service providers, brokers, and consumers. This classification is insufficient because it fails to make a difference between application developers and end users who both belong to service consumers. As a result, application developers usually take the responsibility of seeking services while end users who ultimately use the application are ignored. In order to address this issue, this paper presents an Intents-based approach for dynamic service discovery. The proposed approach is motivated from two industrial protocols: Android Intents and web Intents. It improves the two protocols by a generic model from the aspects of architecture, intent messages and their resolving process, Intents services, and user agents. It classifies the implicit intents into authoritative and naïve intents and is compatible with the current web service triangular architecture. This paper also illustrates a way of creating Intents services from SOAP and REST web services and presents two cases to demonstrate some benefits of the proposed approach.     

Worth-centred mobile phone design for older users

The twenty-first century society fights against an inherent tendency to over-classify and label people. In the case of the aged, despite all efforts, the perception of the helpless, feeble older person still prevails. The truth of the matter is that people over sixty often do not fit this profile. The aged are a heterogeneous group with varying different skills and abilities in many different areas. This paper challenges prevalent mobile phone design decisions that appear to have been made based on the erroneous pre-conception of the incapable elder. Designers currently produce “senior” mobile phones that are, at best, inadequate and, at worst, insulting to a sector of society that deserves respect and consideration. Age does indeed influence mobile phone usage, and people over sixty often have specific and special needs, quite apart from age-related limitations, that predict their use of mobile phones. Most mobile phones designed for older users simply reduce the number of features: the so-called simplification approach. Apart from reducing the effectiveness of the phone, this approach often incorporates the fatal design flaw of using numbers or letters, on speed-dial buttons, which requires the user to remember the button–person mappings. In fact, this design rationale reduces the value of the phone to the user. This paper argues that mobile phone design for older users should be worth-centred (Cockton G in Designing worth is worth designing. In: Proceedings of the 4th Nordic conference on human–computer interaction: changing roles. Oslo, Norway, pp 165–174, 2006) rather than simplification-driven. The worth-centred approach maximises worth to the user of the phone. This is achieved by maximising effectiveness while accommodating reduced capabilities. To maximise ease of use, and consequent accessibility, features may have to be reduced in an informed way. To facilitate this, a mapping process is proposed whereby user needs are linked to uses of the phone, and then to the features that facilitate these uses. Needs fall into a number of categories, and each category is characterised by a number of different uses, which form a usage space. Features can be linked to one or more usage spaces, and thus be used to support needs. The first step in the conducted research entailed the identification of the needs of the older mobile phone user. Then, it was determined whether these needs were indeed being met by the uses afforded in existing phones. Having concluded that most users’ needs were not being met, the next step was to capture data on the needs, limitations and expectations of people over the age of sixty. This was achieved by conducting a series of one-to-one interviews with a number of older mobile phone users and also supervising a participatory design experiment. Using the findings of the analysis, a usage space model is proposed, which serves to align feature inclusion with user needs. Based on this usage space model (the theoretical contribution), a prototype mobile phone design is presented as the practical contribution of the paper.     

Barriers common to mobile and disabled web users

World Wide Web accessibility and best practice audits and evaluations are becoming increasingly complicated, time consuming, and costly because of the increasing number of conformance criteria which need to be tested. In the case of web access by disabled users and mobile users, a number of commonalities have been identified in usage, which have been termed situationally-induced impairments; in effect the barriers experienced by mobile web users have been likened to those of visually disabled and motor impaired users. In this case, we became interested in understanding if it was possible to evaluate the problems of mobile web users in terms of the aggregation of barriers-to-access experienced by disabled users; and in this way attempt to reduce the need for the evaluation of the additional conformance criteria associated with mobile web best practice guidelines. We used the Barrier Walkthrough (BW) method as our analytical framework. Capable of being used to evaluate accessibility in both the disabled and mobile contexts, the BW method would also enable testing and aggregation of barriers across our target user groups.We tested 61 barriers across four user groups each over four pages with 19 experts and 57 non-experts focusing on the validity and reliability of our results. We found that 58% of the barrier types that were correctly found were identified as common between mobile and disabled users. Further, if our aggregated barriers alone were used to test for mobile conformance only four barrier types would be missed. Our results also showed that mobile users and low vision users have the most common barrier types, while low vision and motor impaired users experiencing similar rates of severity in the barriers they experienced. We conclude that the aggregated evaluation results for blind, low vision and motor impaired users can be used to approximate the evaluation results for mobile web users.     

User involvement in developing mobile and temporarily interconnected systems

Information systems (IS) research on user involvement has primarily theorized relationships between developers, managers and users in systems development. However, so far, marginal attention has been paid to differences in user involvement practices between information systems. This paper explores user involvement in developing mobile and temporarily interconnected systems (MTIS). We refer to MTIS as heterogeneous systems that rely on network technologies for increasing the ubiquity of information services for users on the move. Such systems are becoming increasingly important in leveraging, e.g. car infotainment, supply chain management and wireless e‐commerce. With particular emphasis on the nature of MTIS and its implications for user involvement, the paper analyses the systems development process of an action research project. The findings suggest that user involvement practices need to be adapted to accommodate features of this class of systems. Being an early attempt to trace the implications of technology features such as use context switches and temporary system relationships, the paper contributes to the development of an updated theory of the user role in an era of increased system complexity and stakeholder ambiguity.     

Mobile technology acceptance model: An investigation using mobile users to explore smartphone credit card

Smartphone credit card (SCC) is an emerging payment method using NFC-enabled smartphones. The proximity payment allows consumers to pay their products and services by waving their smartphones with a NFC reader. While there are advantageous adopting SCC, the adoption rate has not been encouraging. Interestingly, existing research work on past information technology and system models have so far focused primarily on organizational context and adopted specifically for work. Furthermore, past antecedents were mainly constructed using electronic commerce literatures which do not reflect the actual mobile environment. In contrast SCC is mainly adopted voluntarily by mobile users and for personal purposes. Thus this leads to the difficulty in drawing meaningful conclusion. The study addresses these limitations by proposing a new mobile technology acceptance model (MTAM) which consists of mobile usefulness (MU) and mobile ease of use (MEU) to determine SCC adoption. In anticipating on the complexity which exists in the mobile environment, additional mobile constructs namely mobile perceived security risk (MPSR), mobile perceived trust (MPT), mobile perceived compatibility (MPC) and mobile perceived financial resources (MPFR) were incorporated into the parsimonious MTAM. The integrated model was applied to 459 mobile users through a questionnaire approach and tested using partial least square-structural equation modelling-artificial neural network (PLS-SEM-ANN) has provided a new impact and a possible new research methodology paradigm as it is able to capture both linear and non-linear relationships. While the model confirms the role of MU in MTAM, MEU needs for more attention in practice. The results from the extended model showed that only three of the proposed hypotheses were non-significant in this study and thus warrant further investigation. The study contributes to academia by proposing new mobile constructs that brings together MTAM to assess the likelihood of mobile users to adopt SCC. The study also offers several important managerial implications which can be generalized to the mobile studies of other transportation, hotel, banking, and tourism industries.     

A Design Process for a Customer Journey Map: A Case Study on Mobile Services

A customer journey map (CJM) is a widely used tool to represent user experience with a service. Although numerous companies have used this tool to improve existing services or to develop new services, the maps are neither consistent nor mutually compatible because no clear design process for a CJM has been presented. This study aimed to develop a design process and rule sets for a CJM based on a human factors approach. The 10‐step process and the rule sets were built on case studies of 25 categories of mobile services. Large‐scale case studies were conducted with mobile service providers and combined with the result of a user diary method that collected users’ daily activities and the difficulties that the user perceived when performing a task. We suggested various methods for using the CJM to generate new service opportunities. The proposed design process and the way for opportunity discovery can help service designers to develop unified CJMs and to identify innovative service ideas.     

Group-oriented mobile services: Requirements and solutions

Emerging mobile services, including m-commerce, have received considerable interest among researchers, developers, service providers, and users. Some of these mobile services will be group-oriented and thus require the support for group communications among mobile users. In this paper, several group-oriented mobile services and their specific requirements are presented and discussed. Several wireless solutions are also presented to meet the diverse and complex requirements of group-oriented mobile services.     

一个移动应用个性化集成框架的研究及其在Android平台的实现

随着互联网和智能手机的日益普及,移动应用数量呈现爆炸式增长,海量的移动应用既是机遇也是挑战。从开发者角度看,基于大量的已有移动应用快捷构造新的移动应用成为了可能,但当前大部分的开发工具对移动应用集成的支持仅停留在应用编程接口和底层运行机制上,尚未出现更高层次的面向执行流程的集成支持;从用户角度看,从众多移动应用中选择符合自己个性化需求的应用成为了可能,但目前大量的移动应用推荐系统集中在单个应用的个性化推荐问题上,未见面向用户个性化需求的移动应用执行序列推荐方法。为此,提出一个移动应用个性化集成框架,主要包括:1)定义了一套意图流程描述执行语言,以便开发者从更为自然的执行流程角度完成新移动应用的构造;2)给出了一个移动应用序列偏好度预测算法,用于解决移动应用执行序列的个性化推荐问题。在当前典型的移动应用平台Android上,实现了相应的移动应用个性化集成开发工具和运行支撑机制,并通过实例初步验证了上述方法的合理性。     

Optimized fast handover scheme in Mobile IPv6 networks to support mobile users for cloud computing

In the future cloud computing, users will heavily use mobile devices. Mobile networks for cloud computing should be managed efficiently as well as support seamless services to mobile users regardless of their locations and movements. Hence, in mobile networks for cloud computing, it is important to support seamless mobility management to mobile users who request real-time services such as VoIP, streaming, and interactive game playing. To support seamless mobility management for various wireless technologies in cloud computing, Mobile IPv6 (MIPv6) and fast handovers for MIPv6 (FMIPv6) have been studied. FMIPv6 has been emerged to reduce long handover latency and packet loss in MIPv6. FMIPv6 may provide seamless handover by minimizing the handover latency, and prevent packet loss through buffering and tunneling. FMIPv6 uses anticipation based on layer 2 trigger information, and consists of two operation modes such as the predictive mode and the reactive mode. Several works have been done to evaluate the performance of FMIPv6 in different network environments. However, the previous works did not consider the probability of predictive mode failure (PPMF) that distinguishes two operation modes. Even in the most previous work, two operation modes of FMIPv6 are evaluated separately. However, to accurately analyze the overall performance of FMIPv6, two operation modes should be analyzed altogether. In this paper, FMIPv6 combining two operation modes is analyzed considering the PPMF that is affected by the radius of a cell, velocity of mobile nodes, and the layer 2 triggering time. The effect of system parameters, such as the PPMF, the time required to process additional layer 3 signaling, and the layer 2 trigger time, is analytically investigated with respect to the signaling cost and the packet delivery cost. Analytical results show a trade-off between performance and system parameters. Then we show methods to optimize overhead of FMIPv6. Finally, mobile networks for cloud computing can be efficiently managed through the optimized FMIPv6.