jehanweerasuriya/uni-ai-dataset huggingface dataset:
Software Security Estimation Using the Hybrid Fuzzy ANP-TOPSIS Approach: Design Tactics Perspective
Authors: Alka Agrawal, Adil Hussain Seh, Abdullah Baz, Hosam Alhakami, Wajdi Alhakami, Mohammed Baz, Rajeev Kumar, Raees Ahmad Khan
Published in: Symmetry (2020-04-09)

Increasing the number of threats against software vulnerabilities and rapidly growing data breaches have become a key concern for both the IT industry and stakeholders. Developing secure software systems when there is a high demand for software products from individuals as well as the organizations is in itself a big challenge for the designers and developers. Meanwhile, adopting traditional and informal learnings to address security issues of software products has made it easier for cyber-criminals to expose software vulnerabilities. Hence, it is imperative for the security practitioners to employ a symmetric mechanism so as to achieve the desired level of software security. In this context, a decision-making approach is the most symmetrical technique to assess the security of software in security tactics perspective. Since the security tactics directly address the quality attribute concerns, this symmetric approach will be highly effective in making the software systems more secure. In this study, the authors have selected three main attributes and fifteen sub-attributes at level 1 and level 2, respectively, with ten different software of an institute as alternatives. Furthermore, this study uses a fuzzy-based symmetrical decision-making approach to assess the security of software with respect to tactics. Fuzzy Analytic Network Process (F-ANP) is applied to evaluate the weights of criteria and fuzzy-Symmetrical technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) is used to determine impact of alternatives. The proposed symmetrical assessment in this study will be beneficial for both the designers and developers to categorize and prioritize the security attributes and understand the importance of security tactics during software development life cycle.
Improving software security with static automated code analysis in an industry setting
Authors: Dejan Baca, Bengt Carlsson, Kai Petersen, Lars Lundberg
Published in: Software Practice and Experience (2012-02-20)

SUMMARY Software security can be improved by identifying and correcting vulnerabilities. In order to reduce the cost of rework, vulnerabilities should be detected as early and efficiently as possible. Static automated code analysis is an approach for early detection. So far, only few empirical studies have been conducted in an industrial context to evaluate static automated code analysis. A case study was conducted to evaluate static code analysis in industry focusing on defect detection capability, deployment, and usage of static automated code analysis with a focus on software security. We identified that the tool was capable of detecting memory related vulnerabilities, but few vulnerabilities of other types. The deployment of the tool played an important role in its success as an early vulnerability detector, but also the developers perception of the tools merit. Classifying the warnings from the tool was harder for the developers than to correct them. The correction of false positives in some cases created new vulnerabilities in previously safe code. With regard to defect detection ability, we conclude that static code analysis is able to identify vulnerabilities in different categories. In terms of deployment, we conclude that the tool should be integrated with bug reporting systems, and developers need to share the responsibility for classifying and reporting warnings. With regard to tool usage by developers, we propose to use multiple persons (at least two) in classifying a warning. The same goes for making the decision of how to act based on the warning. Copyright © 2012 John Wiley &amp; Sons, Ltd.
Software piracy and software security in business schools: an ethical perspective
Authors: Jin Hyouk Im, Pamela D. Van Epps
Published in: ACM SIGMIS Database the DATABASE for Advances in Information Systems (1991-06-01)

Many business schools have become heavily dependent on microcomputers for educational purposes. That exposes them to a new type of ethical issue---the ramifications involved with unauthorized software copying by faculty, staff, and students. This article presents the results of a field survey on software piracy and software security in 241 member schools of the American Assembly of Collegiate Schools of Business (AACSB). The authors discuss some important findings concerning software security procedures and policies to reduce legal responsibilities for copyright infringements by faculty, staff and students. The article concludes with some recommendations for creating and sustaining an environment where conditions contributing to software piracy and security issues are minimized.
Novel Obfuscation Algorithms for Software Security.
Authors: Suma Venkatesh, Levent Ertaul
Published in: Software Engineering Research and Practice (2005-01-01)

Over the years, several software protection techniques have been developed to avoid global software piracy, which has increased over 40% and has caused $11 billion loss. Code Obfuscation is one of these techniques and it is very promising one. Code obfuscation is a form of software protection against unauthorized reverse-engineering. In this paper, we give information about available software obfuscation tool kits in the market, along with JHide and their comparison. We propose three new obfuscation techniques, based on composite functions, which are Array Index Transformation, Method Argument Transformation and Hiding Constants. In addition to that, we also propose a new obfuscation algorithm based on Discrete Logs to Pack the Words and another one, based on Affine Ciphers, to Encode String Literals. Finally, we conclude our paper identifying the need for reviewing the performance of the algorithms as the future scope of our work.
Managing software security risks
Authors: Gary McGraw
Published in: Computer (2002-01-01)

Most organizations manage computer security risk reactively by investing in technologies designed to protect against known system vulnerabilities and monitor intrusions as they occur. However, firewalls, cryptography, and antivirus protection address the symptoms, not the root cause, of most security problems. Buying and maintaining a firewall, for example, is ineffective if external users can access remotely exploitable Internet-enabled applications through it. Because hackers attack software, improving computer security depends on proactively managing risks associated with software and software development. The current "penetrate and patch" approach of fixing broken software only after it has been compromised is insufficient to control the problem.
Adopting a Software Security Improvement Program
Authors: Deanna L. Taylor, Gary McGraw
Published in: IEEE Security & Privacy (2005-05-01)

Leading software shops (including Microsoft) are working hard to improve the way they build security into their products. Software security initiatives have proven beneficial for those organizations that have implemented them. Such initiatives involve the adoption and rollout of various types of best practices. The article describes an approach that works, with an emphasis on business process engineering that might be unfamiliar to technical practitioners. By following some commonsense steps, a software security improvement program has a greater chance of achieving its ultimate goal: software security that makes business sense.
Market Segmentation and Software Security: Pricing Patching Rights
Authors: Terrence August, Duy Dao, Kihoon Kim
Published in: Management Science (2019-08-09)

The patching approach to security in the software industry has been less effective than desired. One critical issue with the status quo is that the endowment of “patching rights” (the ability for a user to choose whether security updates are applied) lacks the incentive structure to induce better security-related decisions. However, producers can differentiate their products based on the provision of patching rights. By characterizing the price for these rights, the optimal discount provided to those who relinquish rights and have their systems automatically updated in a timely manner, and the consumption and protection strategies taken by users in equilibrium as they strategically interact because of the security externality associated with product vulnerabilities, it is shown that the optimal pricing of these rights can segment the market in a manner that leads to both greater security and greater profitability. This policy greatly reduces unpatched populations and has a relative hike in profitability that is increasing in the extent to which patches are bundled together. Social welfare may decrease when automated patching costs are small because strategic pricing contracts usage in the market and also incentivizes loss-inefficient choices. However, welfare benefits when the policy either (1) greatly expands automatic updating in cases in which it is minimally observed or (2) significantly reduces the patching process burden of those who most value the software. This paper was accepted by Anandhi Bharadwaj, information systems.
Operational disruption in healthcare associated with software functionality issue due to software security patching: a case report
Authors: Md Shafiqur Rahman Jabin
Published in: Frontiers in Digital Health (2024-03-14)

Despite many benefits, the extensive deployment of Health Information Technology (HIT) systems by healthcare organizations has encountered many challenges, particularly in the field of telemetry concerning patient monitoring and its operational workflow. These challenges can add more layers of complexity when an unplanned software security patching is performed, affecting patient monitoring and causing disruption in daily clinical operations. This study is a reflection on what happened associated with software security patching and why it happened through the lens of an incident report to develop potential preventive and corrective strategies using qualitative analyses-inductive and deductive approaches. There is a need for such analyses to identify the underlying mechanism behind such issues since very limited research has been conducted on the study of software patching. The incident was classified as a "software functionality" issue, and the consequence was an "incident with a noticeable consequence but no patient harm", and the contributing factor was a software update, i.e., software security patching. This report describes how insufficient planning of software patching, lack of training for healthcare professionals, contingency planning on unplanned system disruption, and HIT system configuration can compromise healthcare quality and cause risks to patient safety. We propose 15 preventive and corrective strategies grouped under four key areas based on the system approach and social-technical aspects of the patching process. The key areas are (i) preparing, developing, and deploying patches; (ii) training the frontline operators; (iii) ensuring contingency planning; and (iv) establishing configuration and communication between systems. These strategies are expected to minimize the risk of HIT-related incidents, enhance software security patch management in healthcare organizations, and improve patient safety. However, further discussion should be continued about general HIT problems connected to software security patching.
A case study in open source software security and privacy: Android adware
Authors: Emre Erturk
Published in: World Congress on Internet Security (2012-06-10)

The goal of this paper is to analyze the behavior and intent of recent types of privacy-invasive Android adware. This paper starts with a review of Android mobile operating system security. This paper also addresses the broader issue as to the pros and cons of an open source operating system in terms of security and privacy. Static analysis of malware can provide higher quality results and lead to a better understanding. This approach is used in this paper. As Android's market share is rapidly growing around the world, Android security will be a crucial area of research for IT security professionals and their academic counterparts. The upside of the current situation is that malware is being quickly exposed, thanks to open-source software development tools.
Improving software security with precise static and runtime analysis
Authors: Monica S. Lam, Benjamin Livshits
Published in:  (2006-01-01)

The landscape of security vulnerabilities has changed dramatically in the last several years. While buffer overruns and format string violations accounted for a large fraction of all security exploits in the 1990s, recently the picture started to change. As Web-based applications became more prominent, familiar buffer overruns are now far outnumbered by Web application vulnerabilities such as SQL injections and cross-site scripting attacks. These vulnerabilities have lead to a multitude of attacks against e-commerce sites, financial institutions, etc., leading to millions of dollars in damages. In this thesis, we describe the Griffin project, which provides a comprehensive static and runtime compiler-based solution to a wide range of Web application vulnerabilities. Our approach targets large real-life Web-based Java applications. To make our approach to both extensible and user-friendly, vulnerability specifications are expressed in PQL, a Program Query Language. The static checker generated based on the PQL, specification finds vulnerabilities by analyzing the Web-based applications. We evaluate analysis features such as context-, object- and map sensitivity that help keep the number of false positives low. As an alternative to static analysis, secured application executables can be generated based on the same PQL vulnerability specification. Moreover, runtime vulnerability recovery rules may be provided. Our experimental results show that Griffin provides effective and practical tools for finding and preventing security vulnerabilities. We were able to find a total of 98 security errors, and all but one of our 11 large real-life benchmark applications were vulnerable. Two vulnerabilities were located in commonly used libraries, thus subjecting applications using the libraries to potential vulnerabilities. Most of the security errors we reported were confirmed as exploitable vulnerabilities by their maintainers, resulting in more than a dozen code fixes. The static analysis reported false positives for only one of 11 applications we have analyzed. While the runtime overhead can be quite high for our runtime protection, information we compute statically reduces the number of necessary instrumentation points dramatically, causing the overhead to drop below 10% in most cases. Finally, our runtime system was able to recover from all exploits we performed against it in practice.
Technical debt as an indicator of software security risk: a machine learning approach for software development enterprises
Authors: Miltiadis Siavvas, Dimitrios Tsoukalas, Marija Janković, Dionysios Kehagias, Dimitrios Tzovaras
Published in: Enterprise Information Systems (2020-09-24)

Vulnerability prediction facilitates the development of secure software, as it enables the identification and mitigation of security risks early enough in the software development lifecycle. Although several factors have been studied for their ability to indicate software security risk, very limited attention has been given to technical debt (TD), despite its potential relevance to software security. To this end, in the present study, we investigate the ability of common TD indicators to indicate security risks in software products, both at project-level and at class-level of granularity. Our findings suggest that TD indicators may potentially act as security indicators as well.
Integrating Software Security into Agile-Scrum Method
Authors: Imran Ghani, Zulkarnain Azham, Seung Ryul Jeong
Published in: KSII Transactions on Internet and Information Systems (2014-02-26)

Scrum is one of the most popular and efficient agile development methods. However, like other agile methods such as Extreme Programming (XP), Feature Driven Development (FDD), and the Dynamic Systems Development Method (DSDM), Scrum has been criticized because of lack of support to develop secure software. Thus, in 2011, we published research proposing the idea of a security backlog (SB). This paper represents the continuation of our previous research, with a focus on the evaluation in industry-based case study. Our findings highlight an improved agility in Scrum after the integration of SB. Furthermore, secure software can be developed quickly, even in situations involving requirement changes of software. Based on our experimental findings, we noticed that, when integrating SB, it is quite feasible to develop secure software using an agile Scrum model.
Smart Contract Security: A Software Lifecycle Perspective
Authors: Yongfeng Huang, Yiyang Bian, Renpu Li, Jianjun Zhao, Peizhong Shi
Published in: IEEE Access (2019-01-01)

Smart contract security is an emerging research area that deals with security issues arising from the execution of smart contracts in a blockchain system. Generally, a smart contract is a piece of executable code that automatically runs on the blockchain to enforce an agreement preset between parties involved in the transaction. As an innovative technology, smart contracts have been applied in various business areas, such as digital asset exchange, supply chains, crowdfunding, and intellectual property. Unfortunately, many security issues in smart contracts have been reported in the media, often leading to substantial financial losses. These security issues pose new challenges to security research because the execution environment of smart contracts is based on blockchain computing and its decentralized nature of execution. Thus far, many partial solutions have been proposed to address specific aspects of these security issues, and the trend is to develop new methods and tools to automatically detect common security vulnerabilities. However, smart contract security is systematic engineering that should be explored from a global perspective, and a comprehensive study of issues in smart contract security is urgently needed. To this end, we conduct a literature review of smart contract security from a software lifecycle perspective. We first analyze the key features of blockchain that can cause security issues in smart contracts and then summarize the common security vulnerabilities of smart contracts. To address these vulnerabilities, we examine recent advances in smart contract security spanning four development phases: 1) security design; 2) security implementation; 3) testing before deployment; and 4) monitoring and analysis. Finally, we outline emerging challenges and opportunities in smart contract security for blockchain engineers and researchers.
Software-defined networking security: pros and cons
Authors: Mehiar Dabbagh, Bechir Hamdaoui, Mohsen Guizani, Ammar Rayes
Published in: IEEE Communications Magazine (2015-06-01)

Software-defined networking (SDN) is a new networking paradigm that decouples the forwarding and control planes, traditionally coupled with one another, while adopting a logically centralized architecture aiming to increase network agility and programability. While many efforts are currently being made to standardize this emerging paradigm, careful attention needs to be paid to security at this early design stage too, rather than waiting until the technology becomes mature, thereby potentially avoiding previous pitfalls made when designing the Internet in the 1980s. This article focuses on the security aspects of SDN networks. We begin by discussing the new security advantages that SDN brings and by showing how some of the long-lasting issues in network security can be addressed by exploiting SDN capabilities. Then we describe the new security threats that SDN is faced with and discuss possible techniques that can be used to prevent and mitigate such threats.
LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights
Authors: Ze Sheng, Z.G. Chen, Shuning Gu, Heqing Huang, Guofei Gu, Jeff Huang
Published in: ACM Computing Surveys (2025-09-23)

Large Language Models (LLMs) are emerging as transformative tools for software vulnerability detection. Traditional methods, including static and dynamic analysis, face limitations in efficiency, false-positive rates, and scalability with modern software complexity. Through code structure analysis, pattern identification, and repair suggestion generation, LLMs demonstrate a novel approach to vulnerability mitigation. This survey examines LLMs in vulnerability detection, analyzing problem formulation, model selection, application methodologies, datasets, and evaluation metrics. We investigate current research challenges, emphasizing cross-language detection, multimodal integration, and repository-level analysis. Based on our findings, we propose solutions addressing dataset scalability, model interpretability, and low-resource scenarios. Our contributions include: (1) a systematic analysis of LLM applications in vulnerability detection; (2) a unified framework examining patterns and variations across studies; and (3) identification of key challenges and research directions. This work advances the understanding of LLM-based vulnerability detection. The latest findings are maintained at https://github.com/OwenSanzas/LLM-For-Vulnerability-Detection
On the security of open source software
Authors: Christian Payne
Published in: Information Systems Journal (2002-01-01)

Abstract With the rising popularity of so‐called ‘open source’ software there has been increasing interest in both its various benefits and disadvantages. In particular, despite its prominent use in providing many aspects of the Internet's basic infrastructure, many still question the suitability of such software for the commerce‐oriented Internet of the future. This paper evaluates the suitability of open source software with respect to one of the key attributes that tomorrow's Internet will require, namely security. It seeks to present a variety of arguments that have been made, both for and against open source security and analyses in relation to empirical evidence of system security from a previous study. The results represent preliminary quantitative evidence concerning the security issues surrounding the use and development of open source software, in particular relative to traditional proprietary software.
Adopting an enterprise software security framework
Authors: John Steven
Published in: IEEE Security & Privacy (2006-03-01)

Most organizations no longer take for granted that their deployed applications are secure. But even after conducting penetration tests, network and hosting security personnel spend considerable time chasing incidents. Your organization might be one of the many that have realized the "secure the perimeter" approach doesn't stem the tide of incidents because the software it's building and buying doesn't resist attack. A new approach offers help across the enterprise
Core Software Security: Security at the Source
Authors: James F. Ransome, Anmol Misra
Published in:  (2013-12-09)

First and foremost, Ransome and Misra have made an engaging book that will empower readers in both large and small software development and engineering organizations to build security into their products. This book clarifies to executives the decisions to be made on software security and then provides guidance to managers and developers on process and procedure. Readers are armed with firm solutions for the fight against cyber threats.-Dr. Dena Haritos Tsamitis. Carnegie Mellon UniversityIn the wake of cloud computing and mobile apps, the issue of software security has never been more importan