jehanweerasuriya/uni-ai-dataset huggingface dataset:
On the Design of IoT Security: Analysis of Software Vulnerabilities for Smart Grids
Authors: Christos-Minas Mathas, Costas Vassilakis, Nicholas Kolokotronis, Charilaos C. Zarakovitis, Michail‐Alexandros Kourtis
Published in: Energies (2021-05-14)

The 5G communication network will underpin a vast number of new and emerging services, paving the way for unprecedented performance and capabilities in mobile networks. In this setting, the Internet of Things (IoT) will proliferate, and IoT devices will be included in many 5G application contexts, including the Smart Grid. Even though 5G technology has been designed by taking security into account, design provisions may be undermined by software-rooted vulnerabilities in IoT devices that allow threat actors to compromise the devices, demote confidentiality, integrity and availability, and even pose risks for the operation of the power grid critical infrastructures. In this paper, we assess the current state of the vulnerabilities in IoT software utilized in smart grid applications from a source code point of view. To that end, we identified and analyzed open-source software that is used in the power grid and the IoT domain that varies in characteristics and functionality, ranging from operating systems to communication protocols, allowing us to obtain a more complete view of the vulnerability landscape. The results of this study can be used in the domain of software development, to enhance the security of produced software, as well as in the domain of automated software testing, targeting improvements to vulnerability detection mechanisms, especially with a focus on the reduction of false positives.
Enhancing Network Slicing Security: Machine Learning, Software-Defined Networking, and Network Functions Virtualization-Driven Strategies
Authors: José Cunha, Pedro Ferreira, Eva M. Castro Barbero, Paula Oliveira, Maria João Nicolau, Iván Núñez, Xosé Ramón Sousa, Carlos Serôdio
Published in: Future Internet (2024-06-27)

The rapid development of 5G networks and the anticipation of 6G technologies have ushered in an era of highly customizable network environments facilitated by the innovative concept of network slicing. This technology allows the creation of multiple virtual networks on the same physical infrastructure, each optimized for specific service requirements. Despite its numerous benefits, network slicing introduces significant security vulnerabilities that must be addressed to prevent exploitation by increasingly sophisticated cyber threats. This review explores the application of cutting-edge technologies—Artificial Intelligence (AI), specifically Machine Learning (ML), Software-Defined Networking (SDN), and Network Functions Virtualization (NFV)—in crafting advanced security solutions tailored for network slicing. AI’s predictive threat detection and automated response capabilities are analysed, highlighting its role in maintaining service integrity and resilience. Meanwhile, SDN and NFV are scrutinized for their ability to enforce flexible security policies and manage network functionalities dynamically, thereby enhancing the adaptability of security measures to meet evolving network demands. Thoroughly examining the current literature and industry practices, this paper identifies critical research gaps in security frameworks and proposes innovative solutions. We advocate for a holistic security strategy integrating ML, SDN, and NFV to enhance data confidentiality, integrity, and availability across network slices. The paper concludes with future research directions to develop robust, scalable, and efficient security frameworks capable of supporting the safe deployment of network slicing in next-generation networks.
Detection of Software Security Weaknesses Using Cross-Language Source Code Representation (CLaSCoRe)
Authors: Sergiu Zaharia, Traian Rebedea, Ștefan Trăușan-Matu
Published in: Applied Sciences (2023-07-04)

The research presented in the paper aims at increasing the capacity to identify security weaknesses in programming languages that are less supported by specialized security analysis tools, based on the knowledge gathered from securing the popular ones, for which security experts, scanners, and labeled datasets are, in general, available. This goal is vital in reducing the overall exposure of software applications. We propose a solution to expand the capabilities of security gaps detection to downstream languages, influenced by their more popular “ancestors” from the programming languages’ evolutionary tree, using language keyword tokenization and clustering based on word embedding techniques. We show that after training a machine learning algorithm on C, C++, and Java applications developed by a community of programmers with similar behavior of writing code, we can detect, with acceptable accuracy, similar vulnerabilities in C# source code written by the same community. To achieve this, we propose a core cross-language representation of source code, optimized for security weaknesses classifiers, named CLaSCoRe. Using this method, we can achieve zero-shot vulnerability detection—in our case, without using any training data with C# source code.
Security quality requirements engineering (SQUARE) methodology
Authors: Nancy R. Mead, Ted Stehney
Published in: ACM SIGSOFT Software Engineering Notes (2005-05-15)

Requirements engineering, a vital component in successful project development, often neglects sufficient attention to security concerns. Further, industry lacks a useful model for incorporating security requirements into project development. Studies show that upfront attention to security saves the economy billions of dollars. Industry is thus in need of a model to examine security and quality requirements in the development stages of the production lifecycle.In this paper, we examine a methodology for both eliciting and prioritizing security requirements on a development project within an organization. We present a model developed by the Software Engineering Institute's Networked Systems Survivability (NSS) Program, and then examine two case studies where the model was applied to a client system. The NSS Program continues to develop this useful model, which has proven effective in helping an organization understand its security posture.
Research on Software Security Vulnerability Discovery Based on Fuzzing
Authors: Tong Li, Xuan Huang, Rui Huang
Published in: Applied Mechanics and Materials (2014-09-01)

Nowadays, fuzzing is one of the most effective ways to identify software security vulnerabilities, especially when we want to discover vulnerabilities about documents. According to the principles and ideas of Fuzzing, a vulnerability discovery system named WFuzzer is developed. This system can overcome the disadvantage of old ways; it also effectively improves the detection of potential unknown security vulnerabilities. This system is more automated and performs better in finding new security vulnerabilities.
Software‐defined networking security for private data center networks and clouds: Vulnerabilities, attacks, countermeasures, and solutions
Authors: Abdallah Mustafa Abdelrahman, Joel J. P. C. Rodrigues, Mukhtar M. E. Mahmoud, Kashif Saleem, Ashok Kumar Das, Valery V. Korotaev, S. A. Kozlov
Published in: International Journal of Communication Systems (2020-12-15)

Summary Software‐defined networking (SDN) is an agile, modern networking approach that facilitates innovations in the networking paradigm. The abstracted and centralized network operating system facilitates the network management and reduces operational expenditure (OPEX). The open nature and simplicity of the data‐forwarding plane dramatically reduces capital expenditure (CAPEX) by leveraging commodity servers and switches. SDN also lends itself very well to address major cloud computing issues and complement cloud services, especially in terms of network virtualization and networking as a service (NaaS). As a new technology, SDN does involve certain security challenges, which include distributed denial of service (DDoS) threats, build and run time injected malware, insider (tenant) attacks, and security holes resulting from controller misconfigurations. These are severe threats that can cripple an entire network. It is crucial to address the SDN vulnerabilities to ensure its successful deployment in private data center networks, on cloud platforms and beyond. Some security solutions leverage the built‐in features of SDN, such as its controller software component, while other solutions provide external SDN applications running above the controller. This study reviews the security solutions for the vulnerabilities of state‐of‐the‐art SDN controllers and the available countermeasures. Furthermore, an in‐depth analysis of the SDN features that support security is presented, and some unresolved research issues on SDN controllers are identified.
A method and validation for auditing e-Health applications based on reusable software security requirements specifications
Authors: Carlos Michael Mejía Granda, José Luis Fernández‐Alemán, Juan Manuel Carrillo de Gea, José A. García‐Berná
Published in: International Journal of Medical Informatics (2024-11-10)

OBJECTIVE: This article deals with the complex process of obtaining security requirements for e-Health applications. It introduces a tailored audit and validation methodology particularly designed for e-Health applications. Additionally, it presents a comprehensive security catalog derived from primary sources such as law, guides, standards, best practices, and a systematic literature review. This catalog is characterized by its continuous improvement, clarity, completeness, consistency, verifiability, modifiability, and traceability. METHODS: The authors reviewed electronic health security literature and gathered primary sources of law, guides, standards, and best practices. They organized the catalog according to the ISO/IEC/IEEE 29148:2018 standard and proposed a methodology to ensure its reusability. Moreover, the authors proposed SEC-AM as an audit method. The applicability of the catalog was validated through the audit method, which was conducted on a prominent medical application, OpenEMR. RESULTS: The proposed method and validation for auditing e-Health Applications through the catalog provided a comprehensive framework for developing or evaluating new applications. Through the audit of OpenEMR, several security vulnerabilities were identified, such as DDOs, XSS, JSONi, and CMDi, resulting in a "Secure" classification of OpenEMR with a compliance rate of 66.97%. CONCLUSION: The study demonstrates the proposed catalog's feasibility and effectiveness in enhancing health software security. The authors suggest continuous improvement by incorporating new regulations, knowledge from additional sources, and addressing emerging zero-day vulnerabilities. This approach is crucial for providing practical, safe, and quality medical care amidst increasing cyber threats in the healthcare industry.
What Do Systems Users Have to Fear? Using Fear Appeals to Engender Threats and Fear that Motivate Protective Security Behaviors1
Authors: Scott R. Boss, Dennis F. Galletta, Paul Benjamin Lowry, Gregory D. Moody, Peter Polák
Published in: MIS Quarterly (2015-12-01)

Because violations of information security (ISec) and privacy have become ubiquitous in both personal and work environments, academic attention to ISec and privacy has taken on paramount importance. Consequently, a key focus of ISec research has been discovering ways to motivate individuals to engage in more secure behaviors. Over time, the protection motivation theory (PMT) has become a leading theoretical foundation used in ISec research to help motivate individuals to change their security-related behaviors to protect themselves and their organizations. Our careful review of the foundation for PMT identified four opportunities for improving ISec PMT research. First, extant ISec studies do not use the full nomology of PMT constructs. Second, only one study uses fear-appeal manipulations, even though these are a core element of PMT. Third, virtually no ISec study models or measures fear. Fourth, whereas these studies have made excellent progress in predicting security intentions, none of them have addressed actual security behaviors. This article describes the theoretical foundation of these four opportunities for improvement. We tested the nomology of PMT, including manipulated fear appeals, in two different ISec contexts that model the modern theoretical treatment of PMT more closely than do extant ISec studies. The first data collection was a longitudinal study in the context of data backups. The second study was a short-term cross-sectional study in the context of anti-malware software. Our new model demonstrated better results and stronger fit than the existing models and confirms the efficacy of the four potential improvements we identified.
Software Security Requirement Engineering for Risk and Compliance Management
Authors: D. Kavitha, S. Ravikumar
Published in: International Journal of Innovative Technology and Exploring Engineering (2021-03-30)

The objective of the research work is to propose a software based security requirement engineering model using categorical and morphisms theory. The earlier security requirement engineering models focus different viewpoints on parallel processing and develop rewrite based knowledge centred models but does not include different functional mappings between the security objects to select the best strategy. The security models have not considered the needed security functions that are to be implemented in different environments with different levels of executions. The proposed requirement engineering model is based on the formal theory of category of objects and the morphisms between them in addition to n categories and multiple morphisms that were used to organize the security requirement functional objects of different categories. The on demand security requirement objects, morphisms and the uncertain events in any one of the subsystems are considered to manage this security requirement category as an algebraic data types. The collection of security requirement objects using classification and clustering techniques are implicitly applied by the formation of category and morphism. The risk and compliances both in the form of direct and indirect categories are mapped so as to provide a security assurance functors with minimum risk on the requirements to the next design state. An ‘n’ category and ‘n’ morphic model for software security requirement model is proposed towards for minimum security risks through efficient compliance management techniques.
A survey on security patterns
Authors: Nobukazu Yoshioka, Hironori Washizaki, Katsuhisa Maruyama
Published in: Progress in Informatics (2008-03-01)

Security has become an important topic for many software systems. Security patterns are reusable solutions to security problems. Although many security patterns and techniques for using them have been proposed, it is still difficult to adapt security patterns to each phase of software development. This paper provides a survey of approaches to security patterns. As a result of classifying these approaches, a direction for the integration and future research topics is illustrated.
Security for Machine Learning-based Software Systems: A Survey of Threats, Practices, and Challenges
Authors: Huaming Chen, Muhammad Ali Babar
Published in: ACM Computing Surveys (2023-12-28)

The rapid development of Machine Learning (ML) has demonstrated superior performance in many areas, such as computer vision and video and speech recognition. It has now been increasingly leveraged in software systems to automate the core tasks. However, how to securely develop the machine learning-based modern software systems (MLBSS) remains a big challenge, for which the insufficient consideration will largely limit its application in safety-critical domains. One concern is that the present MLBSS development tends to be rushed, and the latent vulnerabilities and privacy issues exposed to external users and attackers will be largely neglected and hard to be identified. Additionally, machine learning-based software systems exhibit different liabilities towards novel vulnerabilities at different development stages from requirement analysis to system maintenance, due to its inherent limitations from the model and data and the external adversary capabilities. The successful generation of such intelligent systems will thus solicit dedicated efforts jointly from different research areas, i.e., software engineering, system security, and machine learning. Most of the recent works regarding the security issues for ML have a strong focus on the data and models, which has brought adversarial attacks into consideration. In this work, we consider that security for machine learning-based software systems may arise from inherent system defects or external adversarial attacks, and the secure development practices should be taken throughout the whole lifecycle. While machine learning has become a new threat domain for existing software engineering practices, there is no such review work covering the topic. Overall, we present a holistic review regarding the security for MLBSS, which covers a systematic understanding from a structure review of three distinct aspects in terms of security threats. Moreover, it provides a thorough state-of-the-practice for MLBSS secure development. Finally, we summarize the literature for system security assurance and motivate the future research directions with open challenges. We anticipate this work provides sufficient discussion and novel insights to incorporate system security engineering for future exploration.
The Impact of Securities Litigation Reform on the Disclosure of Forward‐Looking Information By High Technology Firms
Authors: Marilyn F. Johnson, Ron Kasznik, Karen K. Nelson
Published in: Journal of Accounting Research (2001-09-01)

This study evaluates corporate voluntary disclosure of forward‐looking information under the safe harbor provision of the Private Securities Litigation Reform Act of 1995. Using a sample of 523 computer hardware, computer software, and pharmaceutical firms, we find a significant increase in both the frequency of firms issuing earnings and sales forecasts and the mean number of forecasts issued following the Act’s passage. To provide more direct evidence that our findings are attributable to the Act reducing firms’ legal exposure, we develop a proxy for litigation risk and examine whether the increase in disclosure is more pronounced for firms at greatest risk of a lawsuit. As expected, we find that the change in disclosure is increasing in firms’ ex ante risk of litigation. Finally, we report that the safe harbor had no adverse impact on the quality of forward‐looking information. Forecast errors, whether directional or non‐directional, were not significantly affected by the Act’s passage.
Software Security Modeling Based On Petri Nets
Authors: Ali Mohsenzadeh
Published in: Journal of Mathematics and Computer Science (2015-07-15)

Nowadays, mostly security solutions are mainly focused on how to defend against various threats, including insider threats and outsider threats, instead of trying to solve security issues from their sources. This paper proposes a security modeling process and an approach to modeling and quantifying component security based on Petri Nets (PN) in the software design phase. Security prediction in the design phase provides the possibility to investigate and compare different solutions to the target system before realization. The analysis results can be used to trace back to the critical part for security enhancing.
Security Requirements in the Software Defined Networking Model
Authors: Sam Hartman, Dacheng Zhang
Published in:  (2013-04-17)

Software defined/driven networks provide new dimensions of flexibility in network design. This document analyzes security requirements as we design protocols to support multiple network applications on an SDN in an open manner.
Automatic Software Repair
Authors: Martin Monperrus
Published in: ACM Computing Surveys (2018-01-23)

This article presents a survey on automatic software repair. Automatic software repair consists of automatically finding a solution to software bugs without human intervention. This article considers all kinds of repairs. First, it discusses behavioral repair where test suites, contracts, models, and crashing inputs are taken as oracle. Second, it discusses state repair, also known as runtime repair or runtime recovery, with techniques such as checkpoint and restart, reconfiguration, and invariant restoration. The uniqueness of this article is that it spans the research communities that contribute to this body of knowledge: software engineering, dependability, operating systems, programming languages, and security. It provides a novel and structured overview of the diversity of bug oracles and repair operators used in the literature.
The Role Of Testing In Software Security Assurance
Authors: Anatolii Tymoshchuk
Published in: International Journal Of Engineering And Computer Science (2025-03-29)

The article examines the role of testing in ensuring software security, a topic of growing relevance due to the increasing complexity of IT systems and the rise in cyber threats. Software has become a critical component of enterprise infrastructure, government institutions, and everyday human life. Therefore, ensuring software security through effective testing has become one of the key priorities in the modern IT industry. This study explores contemporary security testing methods, encompassing both traditional approaches such as functional testing, penetration testing, static and dynamic code analysis, as well as modern automation techniques leveraging machine learning algorithms. A comprehensive analysis of publicly available scientific publications was conducted, focusing on the integration of security testing into the software development lifecycle (SDLC), with an emphasis on CI/CD practices, distributed testing, and continuous monitoring. The practical significance of this research lies in the applicability of the examined approaches to enhancing the security of information systems in a rapidly evolving IT landscape. The article will be of interest to cybersecurity specialists, lead developers, testing methodology researchers, and academics seeking to integrate advanced testing approaches into strategic cybersecurity measures for software systems.