jehanweerasuriya/uni-ai-dataset huggingface dataset:
Security and Privacy on Blockchain
Authors: Rui Zhang, Rui Xue, Ling Liu
Published in: ACM Computing Surveys (2019-07-03)

Blockchain offers an innovative approach to storing information, executing transactions, performing functions, and establishing trust in an open environment. Many consider blockchain as a technology breakthrough for cryptography and cybersecurity, with use cases ranging from globally deployed cryptocurrency systems like Bitcoin, to smart contracts, smart grids over the Internet of Things, and so forth. Although blockchain has received growing interests in both academia and industry in the recent years, the security and privacy of blockchains continue to be at the center of the debate when deploying blockchain in different applications. This article presents a comprehensive overview of the security and privacy of blockchain. To facilitate the discussion, we first introduce the notion of blockchains and its utility in the context of Bitcoin-like online transactions. Then, we describe the basic security properties that are supported as the essential requirements and building blocks for Bitcoin-like cryptocurrency systems, followed by presenting the additional security and privacy properties that are desired in many blockchain applications. Finally, we review the security and privacy techniques for achieving these security properties in blockchain-based systems, including representative consensus algorithms, hash chained storage, mixing protocols, anonymous signatures, non-interactive zero-knowledge proof, and so forth. We conjecture that this survey can help readers to gain an in-depth understanding of the security and privacy of blockchain with respect to concept, attributes, techniques, and systems.
Software protection and simulation on oblivious RAMs
Authors: Oded Goldreich, Rafail Ostrovsky
Published in: Journal of the ACM (1996-05-01)

Software protection is one of the most important issues concerning computer practice. There exist many heuristics and ad-hoc methods for protection, but the problem as a whole has not received the theoretical treatment it deserves. In this paper, we provide theoretical treatment of software protection. We reduce the problem of software protection to the problem of efficient simulation on oblivious RAM. A machine is oblivious if thhe sequence in which it accesses memory locations is equivalent for any two inputs with the same running time. For example, an oblivious Turing Machine is one for which the movement of the heads on the tapes is identical for each computation. (Thus, the movement is independent of the actual input.) What is the slowdown in the running time of a machine, if it is required to be oblivious? In 1979, Pippenger and Fischer showed how a two-tape oblivious Turing Machine can simulate, on-line, a one-tape Turing Machine, with a logarithmic slowdown in the running time. We show an analogous result for the random-access machine (RAM) model of computation. In particular, we show how to do an on-line simulation of an arbitrary RAM by a probabilistic oblivious RAM with a polylogaithmic slowdown in the running time. On the other hand, we show that a logarithmic slowdown is a lower bound.
Overview of 5G Security Challenges and Solutions
Authors: Ijaz Ahmad, Tanesh Kumar, Madhusanka Liyanage, Jude Okwuibe, Mika Ylianttila, Andrei Gurtov
Published in: IEEE Communications Standards Magazine (2018-03-01)

5G networks will use novel technological concepts to meet the requirements of broadband access everywhere, high user and device mobility, and connectivity of massive number of devices (e.g., the Internet of Things) in an ultra-reliable and affordable way. Software defined networking and network functions virtualization leveraging the advances in cloud computing such as mobile edge computing are the most sought out technologies to meet these requirements. However, securely using these technologies and providing user privacy in future wireless networks are the new concerns. Therefore, this article provides an overview of the security challenges in clouds, software defined networking, and network functions virtualization, and the challenges of user privacy. Henceforth, this article presents solutions to these challenges and future directions for secure 5G systems.
Estimation of Software Security Risks through CVSS: A Design Phase Perspective
Authors: Syed Anas Ansar, Savarni Prakas Srivastava, Jaya Yadav, Mohd Waris Khan, Amitabha Yadav, Raees Ahmad Khan
Published in: Turkish Online Journal of Qualitative Inquiry (2021-07-01)

In today's world, the software makes work more straightforward and more manageable for users, employees, and organizations. It makes our working environment more comfortable, but on the other hand, it has security issues. Over the last two decades, software security has become a prime focus for security organizations as well as security practitioners. As the growth of software increases, the level of security risks compromised with software also increases. In most cases, 'compromising in design’ is one of the critical security risks. Software security risks are the weakness in the software that accidentally allow hazardous operations. To give prime concern to the security mechanism, the valuable assets must be protected. Hence, prompt detection and remediation of software security risks is a crucial issue in software security. In this paper, the researchers have laid stressed on Software security risk at the design phase and listed some common software security risks from CWE, i.e., Common Weakness Enumeration. In addition, researchers have also mentioned the CVSS 3.1 vulnerability scoring mechanism and calculated the scores of listed security risks to prioritize the exploitability impact and its base score.
A Categorized Review on Software Security Testing
Authors: Neha Mahendra, Suhel Ahmad
Published in: International Journal of Computer Applications (2016-11-17)

The main objective of security testing is to check the weaknesses of the implemented security mechanism. It is done for finding the vulnerabilities of a system and to determine whether the system is protected from intruders or not. Security testing can be done prior to production or after the production of the system. But, if the security testing is done after the production, then cost will be more and the huge amount of rework will be required to remove the problems. Also the time between the vulnerability is get known and the malicious attack against it, is becoming less. Therefore it is required to include the security testing in the early phases of software development life cycle. The present paper deals with the review of software security testing approaches and techniques proposed so far. The review is presented in a categorized way and tabulated for the last one and half decade (2000)(2001)(2002)(2003)(2004)(2005)(2006)(2007)(2008)(2009)(2010)(2011)(2012)(2013)(2014)(2015).
Evaluating and Mitigating Software Supply Chain Security Risks
Authors: Robert J. Ellison, John B. Goodenough, Charles B. Weinstock, Carol Woody
Published in: Figshare (2010-01-01)

The Department of Defense (DoD) is concerned that security vulnerabilities could be inserted into software that has been developed outside of the DoD's supervision or control. This report presents an initial analysis of how to evaluate and mitigate the risk that such unauthorized insertions have been made. The analysis is structured in terms of actions that should be taken in each phase of the DoD acquisition life cycle.
A Comprehensive Review of Cyber Security Vulnerabilities, Threats, Attacks, and Solutions
Authors: Ömer Aslan, Semih Serkant Aktuğ, Merve Ozkan-Okay, Abdullah Asım Yılmaz, Erdal Akin
Published in: Electronics (2023-03-11)

Internet usage has grown exponentially, with individuals and companies performing multiple daily transactions in cyberspace rather than in the real world. The coronavirus (COVID-19) pandemic has accelerated this process. As a result of the widespread usage of the digital environment, traditional crimes have also shifted to the digital space. Emerging technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and cryptocurrencies are raising security concerns in cyberspace. Recently, cyber criminals have started to use cyber attacks as a service to automate attacks and leverage their impact. Attackers exploit vulnerabilities that exist in hardware, software, and communication layers. Various types of cyber attacks include distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware. Due to new-generation attacks and evasion techniques, traditional protection systems such as firewalls, intrusion detection systems, antivirus software, access control lists, etc., are no longer effective in detecting these sophisticated attacks. Therefore, there is an urgent need to find innovative and more feasible solutions to prevent cyber attacks. The paper first extensively explains the main reasons for cyber attacks. Then, it reviews the most recent attacks, attack patterns, and detection techniques. Thirdly, the article discusses contemporary technical and nontechnical solutions for recognizing attacks in advance. Using trending technologies such as machine learning, deep learning, cloud platforms, big data, and blockchain can be a promising solution for current and future cyber attacks. These technological solutions may assist in detecting malware, intrusion detection, spam identification, DNS attack classification, fraud detection, recognizing hidden channels, and distinguishing advanced persistent threats. However, some promising solutions, especially machine learning and deep learning, are not resistant to evasion techniques, which must be considered when proposing solutions against intelligent cyber attacks.
A Coverage and Slicing Dependencies Analysis for Seeking Software Security Defects
Authors: Hui He, Dong‐Yan Zhang, Min Liu, Weizhe Zhang, Dongmin Gao
Published in: The Scientific World JOURNAL (2014-01-01)

Software security defects have a serious impact on the software quality and reliability. It is a major hidden danger for the operation of a system that a software system has some security flaws. When the scale of the software increases, its vulnerability has becoming much more difficult to find out. Once these vulnerabilities are exploited, it may lead to great loss. In this situation, the concept of Software Assurance is carried out by some experts. And the automated fault localization technique is a part of the research of Software Assurance. Currently, automated fault localization method includes coverage based fault localization (CBFL) and program slicing. Both of the methods have their own location advantages and defects. In this paper, we have put forward a new method, named Reverse Data Dependence Analysis Model, which integrates the two methods by analyzing the program structure. On this basis, we finally proposed a new automated fault localization method. This method not only is automation lossless but also changes the basic location unit into single sentence, which makes the location effect more accurate. Through several experiments, we proved that our method is more effective. Furthermore, we analyzed the effectiveness among these existing methods and different faults.
Security Risks in the Software Development Lifecycle
Authors: Mamdouh Alenezi, Sadiq Almuairfi
Published in: International Journal of Recent Technology and Engineering (IJRTE) (2019-09-30)

Security is a significant concern in software development. Risks and errors should be reduced and as much as possible eliminated. Especially with how the computer and internet provide numerous technological benefits and are being optimally utilized in the present times, users have high expectations when it comes to secure software products. The development cycle in software design is comprised of a systematic process wherein security risk assessment should be integrated into each phase. In order to ensure quality software with a high level of security, the best practices in risk management should be implemented from the beginning and should be performed throughout the process. While developing highly secure software is a complex task, therefore, it must involve more dedicated security activities that are usually ignored in traditional SDLC. In this paper, the nature and phases of secure software development will be discussed as well as the security risk assessment models and practices involved in it. This will provide software developers, programmers, or engineers the awareness on secure software development cycle which will allow them to plan efficient strategies and enhance their performance, thus, resulting in quality and reliable output. In addition, we present a qualitative study looking at real-life practice employed towards software security risk. We reflect on how well current risk practices follow best practice, identify pitfalls, and explore why these occur &amp; mitigate.
A Hybrid Model of Hesitant Fuzzy Decision-Making Analysis for Estimating Usable-Security of Software
Authors: Rajeev Kumar, Abdullah Baz, Hosam Alhakami, Wajdi Alhakami, Mohammed Baz, Alka Agrawal, Raees Ahmad Khan
Published in: IEEE Access (2020-01-01)

The main idea for practicing research towards security is to maintain usability of the software as well. This can be achieved by making less complex and high secure software. Though considerable efforts have been made in this context by the developers and security experts, the standard of usable-security is not the same as it should be. Therefore, it is important to research more on the most conversant mechanisms for assessing and increasing the usable-security of software. The quantitative evaluation of usability and security is an important part in increasing the level of secure software. This paper, in particular, is intended to estimate the usable-security of software and achieve the objective of developing software with optimum security while retaining its usability. The decision-makers often find it difficult to integrate security and usability. Hence this paper approaches the integration of usability and security with its contributing attributes. Also, in this league, the present research study suggests a novel technique which is the hybrid of Analytic Hierarchy Process (AHP), Hesitant Fuzzy (HF) sets, and Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) to significantly assess the usability along with security. To test the usefulness of the proposed approach hybrid HF-AHP-TOPSIS technique, the researchers applied it onto software developed for Babasaheb Bhimrao Ambedkar University in India. Furthermore, the procedural sensitivity was also achieved by using the various versions of the method. The findings of the usability along with security assessment insist that this inventive hybrid procedure would be the most conversant mechanism for determining the usable-security of software. Further these findings will be helpful in managing security without affecting the usability for end user.
Fault Tree Analysis for Safety/Security Verification in Aviation Software
Authors: Andrew J. Kornecki, Mingye Liu
Published in: Electronics (2013-01-31)

The Next Generation Air Traffic Management system (NextGen) is a blueprint of the future National Airspace System. Supporting NextGen is a nation-wide Aviation Simulation Network (ASN), which allows integration of a variety of real-time simulations to facilitate development and validation of the NextGen software by simulating a wide range of operational scenarios. The ASN system is an environment, including both simulated and human-in-the-loop real-life components (pilots and air traffic controllers). Real Time Distributed Simulation (RTDS) developed at Embry Riddle Aeronautical University, a suite of applications providing low and medium fidelity en-route simulation capabilities, is one of the simulations contributing to the ASN. To support the interconnectivity with the ASN, we designed and implemented a dedicated gateway acting as an intermediary, providing logic for two-way communication and transfer messages between RTDS and ASN and storage for the exchanged data. It has been necessary to develop and analyze safety/security requirements for the gateway software based on analysis of system assets, hazards, threats and attacks related to ultimate real-life future implementation. Due to the nature of the system, the focus was placed on communication security and the related safety of the impacted aircraft in the simulation scenario. To support development of safety/security requirements, a well-established fault tree analysis technique was used. This fault tree model-based analysis, supported by a commercial tool, was a foundation to propose mitigations assuring the gateway system safety and security.
Software Diversity for Improved Network Security: Optimal Distribution of Software-Based Shared Vulnerabilities
Authors: Orcun Temizkan, Sungjune Park, Cem Saydam
Published in: Information Systems Research (2017-08-31)

Firms, and other agencies, tend to adopt widely used software to gain economic benefits of scale, which can lead to a software monoculture. This can, in turn, involve the risk of correlated computer systems failure as all systems on the network are exposed to the same software-based vulnerabilities. Software diversity has been introduced as a strategy for disrupting such a monoculture and ultimately decreasing the risk of correlated failure. Nevertheless, common vulnerabilities can be shared by different software products. We thus expand software diversity research here and consider shared vulnerabilities between different software alternatives. We develop a combinatorial optimization model of software diversity on a network in an effort to identify the optimal software distribution that best improves network security. We also develop a simulation model of virus propagation based on the susceptible-infected-susceptible model. This model allows calculation of the epidemic threshold, a measure of network resilience to virus propagation. We then test the effectiveness of the proposed software diversity strategies against the spreading of viruses through a series of experiments.
Applying a Combination of Mimic Defense and Software Diversity in the Software Security Industry
Published in: Strategic Study of CAE (2016-01-01)

With the development of the Internet, the process of computer software globalization continues to advance.A lot of identical software is installed on tens of thousands of computers.This makes widespread exploitation of software vulnerabilities easy and attractive for an attacker because the same attack vector will probably successfully affect numerous targets.Traditional software security methods can only be used to repair the vulnerabilities.Although software-diversity technology can remove the threat momentarily, it cannot eliminate the risk caused by vulnerabilities.This paper proposes a scheme of combining software diversity and mimic defense in the software security industry to eliminate the threat.
S The Security MicroVisor: A Formally-Verified Software-Based Security Architecture for the Internet of Things
Authors: Mahmoud Ammar, Bruno Crispo, Bart Jacobs, Danny Hughes, Wilfried Daniels
Published in: IEEE Transactions on Dependable and Secure Computing (2019-09-01)

The Internet of Things (IoT) is shaped by the increasing number of low-cost Internet-connected embedded devices that are becoming ubiquitous in every aspect of modern life. With their cost-sensitive design, integrating hardware-based security mechanisms into such devices is undesirable. Therefore, securing these devices is a particularly difficult challenge, especially, due to their growing popularity as attack targets, via remote malware infestations. The vast majority of such devices are bare-metal, where they execute programs in fully-accessible and unprotected memories without any operating system and even without including any form of security. This is beside the fact that IoToperating systems offer little or no protection. This paper addresses this problem through the concept of a Security MicroVisor (SμV), which provides embedded devices that lack hardware-based memory protection units with memory isolation using software virtualisation and assembly-level code verification. More specifically, our contribution is two-fold. First, we propose SμV as a software-based memory isolation technique. We then formally verify the software architecture, written in C, to prove that it is memory-safe and crash-free. Second, we propose a software-based remote attestation, as an example of a fundamental security service that can be implemented on top of SμV, to detect malware-infected devices. We first describe the design and implementation of SμV. Then, we highlight the formal verification of software architecture, and characterize the remote attestation protocol. We evaluate the SμV implementation using an 8-bit AVR microcontroller that is widely used in IoT devices. Evaluation results show that SμV provides strong security guarantees while maintaining extremely low overhead in terms of memory footprint, performance, and power consumption. Furthermore, we extend the performance evaluation also to the remote attestation scheme, illustrating its limited overhead.
A field study of the software design process for large systems
Authors: Bill Curtis, Herb Krasner, Neil Iscoe
Published in: Communications of the ACM (1988-11-01)

The problems of designing large software systems were studied through interviewing personnel from 17 large projects. A layered behavioral model is used to analyze how three of these problems—the thin spread of application domain knowledge, fluctuating and conflicting requirements, and communication bottlenecks and breakdowns—affected software productivity and quality through their impact on cognitive, social, and organizational processes.
Software Diversity for Information Security.
Authors: Pei-Yu Sharon Chen, Gaurav Kataria, Ramayya Krishnan
Published in: WEIS (2005-01-01)

In this paper we analyze a software diversification-based strategy to achieve information security. The notion of using diversity to limit correlated risks is a widely accepted strategy in many fields. Various risk management approaches strive to minimize the variance of losses faced by individuals by either risk pooling, as in insurance, or diversification, as in portfolio management. However, these approaches are advantageous only for risk-averse agents as the expected loss remains unchanged. Exploiting externalities unique to information systems, we show that diversification can not only reduce loss variance but also minimize expected loss. We formulate the optimal amount of diversity investment by a firm taking into account both the negative network externalities accruing from attacks as well as positive network effects that accrue from uniformity and interoperability.