jehanweerasuriya/uni-ai-dataset huggingface dataset:
A Practical Wireless Attack on the Connected Car and Security Protocol for In-Vehicle CAN
Authors: Samuel Woo, Hyo Jin Jo, Dong Hoon Lee
Published in: IEEE Transactions on Intelligent Transportation Systems (2014-01-01)

Vehicle-IT convergence technology is a rapidly rising paradigm of modern vehicles, in which an electronic control unit (ECU) is used to control the vehicle electrical systems, and the controller area network (CAN), an in-vehicle network, is commonly used to construct an efficient network of ECUs. Unfortunately, security issues have not been treated properly in CAN, although CAN control messages could be life-critical. With the appearance of the connected car environment, in-vehicle networks (e.g., CAN) are now connected to external networks (e.g., 3G/4G mobile networks), enabling an adversary to perform a long-range wireless attack using CAN vulnerabilities. In this paper we show that a long-range wireless attack is physically possible using a real vehicle and malicious smartphone application in a connected car environment. We also propose a security protocol for CAN as a countermeasure designed in accordance with current CAN specifications. We evaluate the feasibility of the proposed security protocol using CANoe software and a DSP-F28335 microcontroller. Our results show that the proposed security protocol is more efficient than existing security protocols with respect to authentication delay and communication load.
The security and privacy of smart vehicles
Authors: Jean‐Pierre Hubaux, Srdan Capkun, Jun Luo
Published in: IEEE Security & Privacy (2004-05-01)

Road safety, traffic management, and driver convenience continue to improve, in large part thanks to appropriate usage of information technology. But this evolution has deep implications for security and privacy, which the research community has overlooked so far.
Context-Based Support to Enhance Developers’ Learning of Software Security
Authors: Shao-Fang Wen
Published in: Education Sciences (2023-06-21)

Software security is an ongoing problem, largely due to a lack of security knowledge among software developers from diverse backgrounds. To counter this, security experts are attempting to offer a broad range of knowledge resources to enlighten developers about increasing cybersecurity threats. Unfortunately, the abundance of knowledge resources does not seem to have much of an impact on reducing the issue of software security. The ineffective teaching and learning approaches for software security have created difficulties for developers in learning security knowledge. This research employs a four-cycle of Design Science Research Methodology (DSRM) to integrate necessary elements in the development of a context-based learning system for security education and learning. The final artifact is an ontology-based web application that facilitates a contextualized learning process by providing security knowledge through contextual software cases. Through evaluation in pedagogical and software development environments, it is proven to contribute a viable solution to the problem domain. While these results are positive, the innovative context-based artifact benefits not only the domain of software engineering but also other educational fields, such as information security and computer security.
IoT Privacy and Security Challenges for Smart Home Environments
Authors: Huichen Lin, Neil Bergmann
Published in: Information (2016-07-13)

Often the Internet of Things (IoT) is considered as a single problem domain, with proposed solutions intended to be applied across a wide range of applications. However, the privacy and security needs of critical engineering infrastructure or sensitive commercial operations are very different to the needs of a domestic Smart Home environment. Additionally, the financial and human resources available to implement security and privacy vary greatly between application domains. In domestic environments, human issues may be as important as technical issues. After surveying existing solutions for enhancing IoT security, the paper identifies key future requirements for trusted Smart Home systems. A gateway architecture is selected as the most appropriate for resource-constrained devices, and for high system availability. Two key technologies to assist system auto-management are identified. Firstly, support for system auto-configuration will enhance system security. Secondly, the automatic update of system software and firmware is needed to maintain ongoing secure system operation.
Software Security Metric Development Framework (An Early Stage Approach)
Authors: Alka Agrawal
Published in: American Journal of Software Engineering and Applications (2013-01-01)

This paper does an extensive survey on software security metrics and put forth an effort to characterize design time software security. Misconceptions associated to security metrics have been identified and discussed. A list of characteristics good security metrics should posses is listed. In absence of any standard guideline or methodology to develop early stage security metrics, an effort has been made to provide a strong theoretical basis to develop such a framework. As a result, a Security Metrics Development Framework has been proposed in this paper. Our next effort will be to implement the proposed framework to develop security metrics in early stage of software development life cycle.
Software Security by Design
Authors: В. В. Кулямин, Alexander K. Petrenko, Ekaterina Rudina
Published in: Proceedings of the Institute for System Programming of RAS (2024-01-01)

Security-by-Design is an important approach to ensure software security and reliability. It has been developing already for more than 50 years, but its principles and techniques are still not well known among wide society of software developers. To make the approach more familiar and popular we need to reestablish its goals and problems, to classify and explain its techniques, and formulate trends of its future development. This paper reformulates the main principles of Security-by-Design, provides some examples of security design patterns and anti-patterns, and also explores relations between the approach and software architecture analysis methods, hardening techniques, and safe programming languages.
Mobile Edge Computing: A Survey
Authors: Nasir Abbas, Yan Zhang, Amir Taherkordi, Tor Skeie
Published in: IEEE Internet of Things Journal (2017-09-08)

Mobile edge computing (MEC) is an emergent architecture where cloud computing services are extended to the edge of networks leveraging mobile base stations. As a promising edge technology, it can be applied to mobile, wireless, and wireline scenarios, using software and hardware platforms, located at the network edge in the vicinity of end-users. MEC provides seamless integration of multiple application service providers and vendors toward mobile subscribers, enterprises, and other vertical segments. It is an important component in the 5G architecture which supports variety of innovative applications and services where ultralow latency is required. This paper is aimed to present a comprehensive survey of relevant research and technological developments in the area of MEC. It provides the definition of MEC, its advantages, architectures, and application areas; where we in particular highlight related research and future directions. Finally, security and privacy issues and related existing solutions are also discussed.
An Integrative Method of FTA and FMEA for Software Security Analysis of a Smart Phone
Authors: Myong-Hee Kim, Wildan Toyib, Man-Gon Park
Published in: KIPS Transactions on Computer and Communication Systems (2013-12-31)

최근 우리 생활에 스마트 기술의 빠른 전파 때문에 정보 과학 및 기술 분야에 있어서는 스마트 폰의 소프트웨어 보안성이 중요한 이슈가 되고 있다. 보안성 중요 시스템인 스마트 폰은 은행 서비스, 유비쿼터스 홈 관리, 항공 고객의 검색 등의 서비스 시스템에 이용되기 때문에 비용의 리스크, 손실의 리스크, 이용가능 리스크, 그리고 사용상의 리스크에 관련 되어 있다. 스마트 폰의 보안성 이슈는 이들의 관찰된 고장들을 사용하여 소프트웨어 장애 분석을 하는 것이 핵심 접근 방법이다. 본 연구에서는 손으로 조작하는 디바이스들의 수렴하는 보안성과 신뢰성 분석 기법을 얻기 위해서 결함 트리 분석 (FTA)와 고장 모드 효과 분석(FMEA)을 사용하여 스마트 폰의 소프트웨어 보안성 분석을 위한 하나의 유효한 통합적 프레임 워크를 제안한다. 그리고 만약 하나의 고장 모드 효과 분석이 더욱 더 간단해지면 스마트 디바이스들의 보안성 개선뿐만 아니라 고장효과 의 감소를 위해서 제안된 통합적인 프레임 워크는 핵심 해법이 됨을 논의한다. Recently software security of the smart phone is an important issue in the field of information science and technology due to fast propagation of smart technology in our life. The smart phone as the security critical systems which are utilizing in terminal systems of the banking, ubiquitous home management, airline passengers screening, and so on are related to the risk of costs, risk of loss, risk of availability, and risk by usage. For the security issues, software hazard analysis of smart phone is the key approaching method by use of observed failures. In this paper, we propose an efficient integrative framework for software security analysis of the smart phone using Fault Tree Analysis (FTA) and Failure Mode Effect Analysis (FMEA) to gain a convergence security and reliability analysis technique on hand handle devices. And we discuss about that if a failure mode effect analysis performs simpler, not only for improving security but also reducing failure effects on this smart device, the proposed integrative framework is a key solution.
Analyzing Regulatory Rules for Privacy and Security Requirements
Authors: Travis D. Breaux, Annie I. Antón
Published in: IEEE Transactions on Software Engineering (2008-01-01)

Information practices that use personal, financial and health-related information are governed by U.S. laws and regulations to prevent unauthorized use and disclosure. To ensure compliance under the law, the security and privacy requirements of relevant software systems must be properly aligned with these regulations. However, these regulations describe stakeholder rules, called rights and obligations, in complex and sometimes ambiguous legal language. These "rules" are often precursors to software requirements that must undergo considerable refinement and analysis before they are implementable. To support the software engineering effort to derive security requirements from regulations, we present a methodology to extract access rights and obligations directly from regulation texts. The methodology provides statement-level coverage for an entire regulatory document to consistently identify and infer six types of data access constraints, handle complex cross-references, resolve ambiguities, and assign required priorities between access rights and obligations to avoid unlawful information disclosures. We present results from applying this methodology to the entire regulation text of the U.S. Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
The Origin and Early History of the Computer Security Software Products Industry
Authors: Jeffrey R. Yost
Published in: IEEE Annals of the History of Computing (2015-04-01)

In the second half of the 1970s, established computer firms and new IT start-ups chose alternative paths to offer commercial access control systems to organizational mainframe computer users. These developments in effect launched the computer security software products industry with IBM's Resource Access Control Facility (RACF) and SKK's Access Control Facility 2 (ACF2).
Raising the bar on software security testing
Authors: Alden Dima, Julian Friedrich Wack, S. Wakid
Published in: IT Professional (1999-01-01)

Industry and government are promoting open security testing. The authors consider how one free tool can help find malicious code in Java apps. They discuss white-box testing, cryptography and firewall testing.
Security Requirements Engineering for Evolving Software Systems
Authors: Armstrong Nhlabatsi, Bashar Nuseibeh, Yijun Yu
Published in: International Journal of Secure Software Engineering (2010-01-01)

Long-lived software systems often undergo evolution over an extended period. Evolution of these systems is inevitable as they need to continue to satisfy changing business needs, new regulations and standards, and introduction of novel technologies. Such evolution may involve changes that add, remove, or modify features; or that migrate the system from one operating platform to another. These changes may result in requirements that were satisfied in a previous release of a system not being satisfied in subsequent versions. When evolutionary changes violate security requirements, a system may be left vulnerable to attacks. In this article we review current approaches to security requirements engineering and conclude that they lack explicit support for managing the effects of software evolution. We then suggest that a cross fertilization of the areas of software evolution and security engineering would address the problem of maintaining compliance to security requirements of software systems as they evolve.
Information Security Antipatterns in Software Requirements Engineering
Authors: Miroslav Kis
Published in:  (2002-01-01)

Requirements engineering is one of the key activities in the software development process. The rapid expansion of e-commerce and internet applications increases the need for adequate application security. Yet, conventional requirements engineering methodologies rarely mention information security aspects. The information security community, on the other hand, has developed system security requirements specification methodologies. These methodologies, from the software architect&amp;apos;s point of view, are often hard to understand and too general to be applied. By following conventional methodologies and failing to thoroughly understand the security consequences, architects end up with inadequate application security. This paper presents two commonly observed cases - antipatterns. In the first case, an old and well-known (perimeter security) model is applied in a new context without analysis of the security requirements. In the second case, the impact of lacking data sensitivity classification and threat analyses is considered.
DevOps for Better Software Security in the Cloud
Authors: Ravi Teja Yarlagadda
Published in:  (2020-09-07)

The DevOps model ensures that the organization's growth and processes are work together. As far as security is concerned, DevOps security tools are significant in relaying information on external attackers which can be traced back to development, allowing for quicker elimination of potential vulnerabilities. It is a process that is particularly critical in cloud deployments, whereby release intervals can be less than24 hours. This paper will explore how DevOps can be used in cloud solutions to increase the overall security of systems and applications. DevOps delivers improved automation across the product delivery chain, prevents errors, nullifies risk and downtime, and enables security to be further integrated into the cloud environment. The paper covers the main facets of DevOps in securing cloud solutions with examples provided on practical applications by companies like IBM. The significance of the research to the U.S is also covered especially for organizations looking to secure their serverless systems.
A Deep Learning Assisted Software Defined Security Architecture for 6G Wireless Networks: IIoT Perspective
Authors: Md. Abdur Rahman, M. Shamim Hossain
Published in: IEEE Wireless Communications (2022-04-01)

The 6G wireless network is expected to drive cyber-physical systems (CPS) from merely connected things to securely connected intelligence. While 6G will offer real-time communication between cyber and physical entities, due to convergence of operational technology (OT) and information technology (IT) networks, security, and trustworthiness of the massive amount of data shared between cyber and physical entities will remain of great concern. Attackers having AI capability will be able to mount massive numbers of automated and novel attacks on the future 6G network. Human security specialists teaming with an AI-powered adaptive defense mechanism will be needed to counter emerging AI-based attacks on the massively connected CPS through 6G wireless networks. 6G networks are expected to add industrial immunity to IT, OT, and IIoT networks with the help of AI. 6G is expected to offer deep learning (DL) assisted security function virtualization (SFV) to support software defined security (SDS) architecture for dynamic defense mechanisms, intelligently monitor network traffic anomalies at different network endpoints and segments, and offer increased visibility across attack surfaces. In this article, we study the security challenges in 6G networks posed by the recent convergence of OT and IT networks and propose distributed DL-assisted SDS for 6G vertical that will autonomously detect, localize, and isolate security threats via SFV. Finally, we present future directions and the challenges ahead.
Reducing human factors in software security architectures
Authors: Eric Bodden, Ben Hermann, Johannes Lerch, Mira Mezini
Published in:  (2013-09-01)

In the recent past it has become clear that there are inherent problems with the security models of popular programming platforms such as Java, Android, and so forth. In this work we pinpoint sources of those problems, and explain the relative strengths and weaknesses of the security models for C/C++, Java,.NET, Android and JavaScript. As it turns out, many problems are caused by the fact that the models are so complex that they overstrain not only end-users but even expert developers. Out of this experience we argue that a new line of security models, based on object-capabilities, can help reduce the inherent complexity, preparing the ground for software that is secure by design.
A Survey on Wireless Security: Technical Challenges, Recent Advances, and Future Trends
Authors: Yulong Zou, Jia Zhu, Xianbin Wang, Lajos Hanzo
Published in: Proceedings of the IEEE (2016-05-10)

Due to the broadcast nature of radio propagation, the wireless air interface is open and accessible to both authorized and illegitimate users. This completely differs from a wired network, where communicating devices are physically connected through cables and a node without direct association is unable to access the network for illicit activities. The open communications environment makes wireless transmissions more vulnerable than wired communications to malicious attacks, including both the passive eavesdropping for data interception and the active jamming for disrupting legitimate transmissions. Therefore, this paper is motivated to examine the security vulnerabilities and threats imposed by the inherent open nature of wireless communications and to devise efficient defense mechanisms for improving the wireless network security. We first summarize the security requirements of wireless networks, including their authenticity, confidentiality, integrity, and availability issues. Next, a comprehensive overview of security attacks encountered in wireless networks is presented in view of the network protocol architecture, where the potential security threats are discussed at each protocol layer. We also provide a survey of the existing security protocols and algorithms that are adopted in the existing wireless network standards, such as the Bluetooth, Wi-Fi, WiMAX, and the long-term evolution (LTE) systems. Then, we discuss the state of the art in physical-layer security, which is an emerging technique of securing the open communications environment against eavesdropping attacks at the physical layer. Several physical-layer security techniques are reviewed and compared, including information-theoretic security, artificial-noise-aided security, security-oriented beamforming, diversity-assisted security, and physical-layer key generation approaches. Since a jammer emitting radio signals can readily interfere with the legitimate wireless users, we also introduce the family of various jamming attacks and their countermeasures, including the constant jammer, intermittent jammer, reactive jammer, adaptive jammer, and intelligent jammer. Additionally, we discuss the integration of physical-layer security into existing authentication and cryptography mechanisms for further securing wireless networks. Finally, some technical challenges which remain unresolved at the time of writing are summarized and the future trends in wireless security are discussed.
Data Security and Privacy in Cloud Computing
Authors: Yunchuan Sun, Junsheng Zhang, Yongping Xiong, Guangyu Zhu
Published in: International Journal of Distributed Sensor Networks (2014-07-01)

Data security has consistently been a major issue in information technology. In the cloud computing environment, it becomes particularly serious because the data is located in different places even in all the globe. Data security and privacy protection are the two main factors of user's concerns about the cloud technology. Though many techniques on the topics in cloud computing have been investigated in both academics and industries, data security and privacy protection are becoming more important for the future development of cloud computing technology in government, industry, and business. Data security and privacy protection issues are relevant to both hardware and software in the cloud architecture. This study is to review different security techniques and challenges from both software and hardware aspects for protecting data in the cloud and aims at enhancing the data security and privacy protection for the trustworthy cloud environment. In this paper, we make a comparative research analysis of the existing research work regarding the data security and privacy protection techniques used in the cloud computing.
Distributed component software security issues on deploying a secure electronic marketplace
Authors: Stefanos Gritzalis, John Iliadis, Spyros Oikonomopoulos
Published in: Information Management & Computer Security (2000-03-01)

A secure electronic marketplace involves a significant number of real‐time transactions between remote systems, either for commercial or for authentication purposes. The underlying infrastructure of choice to support these transactions seems to be a distributed component architecture. Distributed component software (DCS) is the natural convergence of client/server network computing and object oriented technology in a mix providing reusability, scaleability and maintainability for software constructs. In DCS a client acquires references to objects provided by components located to remote machines and invokes methods of them as if they were located in its native environment. One implementation also provides the ability to pass objects by value, an approach recently examined also by others. The three major models in the distributed component software industry are OMG’s CORBA, Sun’s Enterprise Java Beans, and Microsoft’s DCOM. Besides these, we will discuss the progress for interoperable DCS systems performed in TINA, an open architecture for telecommunications services based on CORBA distributed components. In this paper the security models of each architecture are described and their efficiency and flexibility are evaluated in a comparative manner. Finally, upcoming extensions are discussed.