jehanweerasuriya/uni-ai-dataset huggingface dataset:
Identification and Removal of Software Security Vulnerabilities using Source Code Analysis: A Case Study on a Java File Writer Program with Password Validation Features
Authors: Natarajan Meghanathan
Published in: Journal of Software (2013-09-30)

We illustrate the use of source code analysis to identify and remove the following software security vulnerabilities: (i) Hardcoded Password, (ii) Empty Password Initialization, (iii) Denial of Service, (iv) System Information Leak, (v) Unreleased Resource and (vi) Path Manipulation. We propose one or more solution approaches to remove or at least mitigate each of these vulnerabilities that have the potential to significantly impact the security of software programs if they are left unattended. In this context, we conduct an exhaustive source code analysis of a file writer program, developed in Java, embedded with features for password validation in order to illustrate the Hardcoded password and Empty password initialization vulnerabilities. We also illustrate the occurrence of one or more new vulnerabilities as a result of incorporating a patch (code) to remove an existing vulnerability. Our solution approaches to remove the above vulnerabilities can also be adapted to other high-level programming languages like C/C++. We use the Fortify Source Code Analyzer (SCA) software to conduct the automated source code analysis of the file writer program to test for software security, including both identification and removal of the vulnerabilities.
Software security: experiments on the .NET common language run-time and the shared source common language infrastructure
Authors: Frank Piessens, Bart Jacobs, Wouter Joosen
Published in: IEE Proceedings - Software (2003-01-01)

As more and more software applications are directly or indirectly accessible from the Internet, the importance of the security of these applications grows steadily. Hence, it is important that university curricula for computer scientists and software engineers include courses on secure software development. Such courses should make students familiar with the programming language technology, run-time support and available APIs for security, and they should also teach them how to use these technological means appropriately. The .NET framework is a good example of the current state-of-the-art support for secure development. The Shared Source Common Language Infrastructure (SSCLI) provides a source for some of the security related aspects of the framework. The paper describes how the secure software development course at the Katholieke Universiteit Leuven uses the .NET framework and the SSCLI. An overview is given of the contents of the course, and a number of example project assignments based on .NET or the SSCLI are presented.
Monitoring, Security, and Dynamic Configuration with the DynamicTAO Reflective ORB
Authors: Fábio Kon, Manuel Román, Ping Liu, Jina Mao, Tomonori Yamane, Luiz Claudio Magalhães, Luiz Claudio, Roy H. Campbell
Published in:  (2000-01-01)

Conventional middleware systems fail to address important issues related to dynamism. Modern computer systems have to deal not only with heterogeneity in the underlying hardware and software platforms but also with highly dynamic environments. Mobile and distributed applications are greatly affected by dynamic changes of the environment characteristics such as security constraints and resource availability. Existing middleware is not prepared to react to these changes. In many cases, application developers know when adaptive changes in communication and security strategies would improve system performance. But often, they are not able to bene t from it because the middleware lacks the mechanisms to support monitoring (to detect when adaptation should take place) and on-the-y recon guration. dynamicTAO is a CORBA-compliant reective ORB that supports dynamic con guration. It maintains an explicit representation of its own internal structure and uses it to carry out runtime customizat...
The Use of Security Tactics in Open Source Software Projects
Authors: Jungwoo Ryoo, Bryan Malone, Phillip A. Laplante, Priya Anand
Published in: IEEE Transactions on Reliability (2015-12-22)

Despite the best intentions of software architects, it is often the case that individual developers do not faithfully implement the original security design decisions. Such a scenario sometimes leads to a situation in which while an architect claims the use of a secure architecture in the form of some tactic, the corresponding source code does not support the claim. To bridge this gap, the first critical step is to verify whether the source code reflects at least some of the structural or behavioral features required for a tactic. In this study, we examine the extent of this discrepancy between an architect's vision of what security tactics need to be adopted in the software and the actual implementation. We accomplish this research goal by 1) exploring an architect's intention to use security tactics, 2) checking whether the tactic is manifested in the design, and finally 3) recovering the evidence of efforts to implement the design in the source code. To avoid limitations to accessing documentation and source code, we use open source projects to conduct our research.
A Survey of Applications and Security Issues in Software Defined Networking
Authors: Azka, S. Revathi, Angelina Geetha
Published in: International Journal of Computer Network and Information Security (2017-03-08)

With increasing number of mobile phones and smart devices, it has become hard to manage the networks proactively as well as reactively. Software Defined Networking (SDN) is an emerging technology that promises to solve majority of the challenges faced by the networks in current times. SDN is based on decoupling of data plane and control plane. SDN has a generalized control plane for all networking devices of the network which makes it simple and easy to configure devices on the fly. This paper surveys how Software Defined Networks evolved to be one of the most preferred technology of contemporary times. The architecture and working of all the planes of SDN have been discussed. SDN finds application in variety of areas, some of which have been highlighted in this paper. SDN faces many security threats in each of its planes. The major security challenges are also presented in detail at the end of the paper.
Risk-Driven Security Metrics in Agile Software Development - An Industrial Pilot Study
Authors: Ari Pietikäinen, Christian Frühwirth, Reijo Savola
Published in: Zenodo (CERN European Organization for Nuclear Research) (2020-04-07)

The need for effective and efficient information security solutions is steadily increasing in the software industry. Software and system developers require practical and systematic approaches to obtain sufficient and credible evidence of the security level in the system under development in order to guide their efforts and ensure the efficient use of resources. We present experiences of developing and using hierarchical security metrics and measurements in an industrial pilot study at Ericsson Finland. The pilot focused on risk-driven security design and implementation in the context of an Agile software development process. The pilot target was a well-established telecommunications product of Ericsson and a core component in modern mobile networks. The results of the study demonstrate the practical potential of risk-driven security metrics, particularly in offering some early visibility of security effectiveness and efficiency. Hierarchical metrics models enable the linking of security objectives with detailed measurements. Security metrics visualization was found to play a crucial role in increasing the manageability of metrics. We also found that the practical means of managing larger collections of metrics and measurements are more essential than individual security metrics. A major challenge in the use of risk-driven security metrics is the lack of evidence for security effectiveness evidence in the early phases of product development and Risk Analysis, when the needs for it are at their greatest.
A Survey on Ethereum Systems Security
Authors: Huashan Chen, Marcus Pendleton, Laurent Njilla, Shouhuai Xu
Published in: ACM Computing Surveys (2020-06-12)

Blockchain technology is believed by many to be a game changer in many application domains. While the first generation of blockchain technology (i.e., Blockchain 1.0) is almost exclusively used for cryptocurrency, the second generation (i.e., Blockchain 2.0), as represented by Ethereum, is an open and decentralized platform enabling a new paradigm of computing—Decentralized Applications (DApps) running on top of blockchains. The rich applications and semantics of DApps inevitably introduce many security vulnerabilities, which have no counterparts in pure cryptocurrency systems like Bitcoin. Since Ethereum is a new, yet complex, system, it is imperative to have a systematic and comprehensive understanding on its security from a holistic perspective, which was previously unavailable in the literature. To the best of our knowledge, the present survey, which can also be used as a tutorial, fills this void. We systematize three aspects of Ethereum systems security: vulnerabilities, attacks, and defenses. We draw insights into vulnerability root causes, attack consequences, and defense capabilities, which shed light on future research directions.
A reference measurement framework of software security product quality (SPQ <sup>NFSR</sup> )
Authors: Khalid T. Al‐Sarayreh, Mamdouh Alenezi, Mohammad Zarour, Kenza Meridji
Published in: IET Information Security (2020-12-21)

Abstract Currently, the customer's demands have expressively amplified their expectations of getting software at a high‐quality level. However, the non‐functional requirements of the software products attention have been expanded in both the academic and the industrial fields; so, there is no framework for specifying and measuring such kinds of quality constraints for the security requirements of software product quality. This paper presents an integrated framework of the early specification and measurement of the functional and non‐functional software security requirements. Such a measurement framework would help software and systems engineers to improve product qualities whether the software has already been delivered or has yet to be built. The main steps that have been followed include: identify, specify and measure the software security requirements based on ISO/IEC SQuaRE series of international standards for software product quality. A standard measurement framework used to measure the functional size of the software product quality to develop a functional size measurement of the functional and non‐functional security requirements is described. As a result, a functional size measurement framework of the functional and non‐functional security requirements (SPQ NFSR ) using international standards is proposed. An automatic teller machine case study for the measurement of security requirements based on perspectives of a software functional user requirements is presented. Finally, it is concluded that it is essential to develop such a functional size measurement framework for functional and non‐functional security requirements to support developers to face the challenges derived from early dealing with such requirements.
Network Slicing and Softwarization: A Survey on Principles, Enabling Technologies, and Solutions
Authors: Ibrahim Afolabi, Tarik Taleb, Konstantinos Samdanis, Adlen Ksentini, Hannu Flinck
Published in: IEEE Communications Surveys & Tutorials (2018-01-01)

Network slicing has been identified as the backbone of the rapidly evolving 5G technology. However, as its consolidation and standardization progress, there are no literatures that comprehensively discuss its key principles, enablers, and research challenges. This paper elaborates network slicing from an end-to-end perspective detailing its historical heritage, principal concepts, enabling technologies and solutions as well as the current standardization efforts. In particular, it overviews the diverse use cases and network requirements of network slicing, the pre-slicing era, considering RAN sharing as well as the end-to-end orchestration and management, encompassing the radio access, transport network and the core network. This paper also provides details of specific slicing solutions for each part of the 5G system. Finally, this paper identifies a number of open research challenges and provides recommendations toward potential solutions.
Security and Privacy in Smart Farming: Challenges and Opportunities
Authors: Maanak Gupta, Mahmoud Abdelsalam, Sajad Khorsandroo, Sudip Mittal
Published in: IEEE Access (2020-01-01)

Internet of Things (IoT) and smart computing technologies have revolutionized every sphere of 21stcentury humans. IoT technologies and the data driven services they offer were beyond imagination just a decade ago. Now, they surround us and influence a variety of domains such as automobile, smart home, healthcare, etc. In particular, the Agriculture and Farming industries have also embraced this technological intervention. Smart devices are widely used by a range of people from farmers to entrepreneurs. These technologies are used in a variety of ways, from finding real-time status of crops and soil moisture content to deploying drones to assist with tasks such as applying pesticide spray. However, the use of IoT and smart communication technologies introduce a vast exposure to cybersecurity threats and vulnerabilities in smart farming environments. Such cyber attacks have the potential to disrupt the economies of countries that are widely dependent on agriculture. In this paper, we present a holistic study on security and privacy in a smart farming ecosystem. The paper outlines a multi layered architecture relevant to the precision agriculture domain and discusses the security and privacy issues in this dynamic and distributed cyber physical environment. Further more, the paper elaborates on potential cyber attack scenarios and highlights open research challenges and future directions.
Critical Software Security Weaknesses
Authors: Assane Gueye, Carlos Galhardo, Irena Bojanova
Published in: IT Professional (2023-07-01)

In this work, we extend our historical study on the most significant software security weaknesses, reevaluate our findings, and look closely at the injection and memory corruption/disclosure weaknesses through the NIST Bugs Framework lenses. Our goal is to continue raising awareness about the patterns of reoccurring software security vulnerabilities that enable malicious activity.
Software Security Testing Based on Threat Model
Authors: Shi Yin-sheng
Published in: Computers & Security (2010-01-01)

Security testing focuses on negative requirements while most traditional software testing deals with positive requirements. Security testing based on threat model is from the adversary’s perspective. Threats to security policies are modeled with UML (Unified Modeling Language) sequence diagrams. The message sequences can derived from the threat models, and the threat traces can derived from the message sequences. When the code becomes baseline, it can be instrumented using the threat model as a guide, so as to record the trace of threat related method calling and method execution at runtime. The instrumented code is executed using test cases generated on design model. The execution traces are collected and analyzed to verify whether the execution traces are matched with the threat traces. If an execution trace matches a threat trace, a message will be produced to report the violation of security policies.
Analysis and Evaluating Security of Component-Based Software Development: A Security Metrics Framework
Authors: Irshad Ahmad Mir, S. M. K. Quadri
Published in: International Journal of Computer Network and Information Security (2012-10-09)

Evaluating the security of software systems is a complex problem for the research communities due to the multifaceted and complex operational environment of the system involved. Many efforts towards the secure system development methodologies like secSDLC by Microsoft have been made but the measurement scale on which the security can be measured got least success. As with a shift in the nature of software development from standalone applications to distributed environment where there are a number of potential adversaries and threats present, security has been outlined and incorporated at the architectural level of the system and so is the need to evaluate and measure the level of security achieved . In this paper we present a framework for security evaluation at the design and architectural phase of the system development. We have outlined the security objectives based on the security requirements of the system and analyzed the behavior of various software architectures styles.
Predicting Vulnerable Software Components via Text Mining
Authors: Riccardo Scandariato, James Walden, Aram Hovsepyan, Wouter Joosen
Published in: IEEE Transactions on Software Engineering (2014-07-18)

This paper presents an approach based on machine learning to predict which components of a software application contain security vulnerabilities. The approach is based on text mining the source code of the components. Namely, each component is characterized as a series of terms contained in its source code, with the associated frequencies. These features are used to forecast whether each component is likely to contain vulnerabilities. In an exploratory validation with 20 Android applications, we discovered that a dependable prediction model can be built. Such model could be useful to prioritize the validation activities, e.g., to identify the components needing special scrutiny.
An Integrated Software Suite for Surface-based Analyses of Cerebral Cortex
Authors: David C. Van Essen, Heather A. Drury, James M. Dickson, John Harwell, D. Hanlon, Charles H. Anderson
Published in: Journal of the American Medical Informatics Association (2001-09-01)

The authors describe and illustrate an integrated trio of software programs for carrying out surface-based analyses of cerebral cortex. The first component of this trio, SureFit (Surface Reconstruction by Filtering and Intensity Transformations), is used primarily for cortical segmentation, volume visualization, surface generation, and the mapping of functional neuroimaging data onto surfaces. The second component, Caret (Computerized Anatomical Reconstruction and Editing Tool Kit), provides a wide range of surface visualization and analysis options as well as capabilities for surface flattening, surface-based deformation, and other surface manipulations. The third component, SuMS (Surface Management System), is a database and associated user interface for surface-related data. It provides for efficient insertion, searching, and extraction of surface and volume data from the database.
Safeware: System Safety and Computers
Authors: Nancy G. Leveson
Published in:  (1995-01-01)

I The Nature Of Risk. Risk In Modern Society. Changing Attitudes Toward Risk. Is Increased Concern Justified?. Unique Risk Factors in Industrialized Society. Computers And Risk. The Role of Computers in Accidents. Software Myths. Why Software Engineering is hard. The Reality We Face. Causes Of Accidents. The Concept of Causality. Flaws in the Safety Culture. Ineffective Organizational Structure. Ineffective Technical Activities. Human Error And Risk. Do Humans Cause Most Accidents?. The Need for Humans in Automated Systems. Human Error as Human-Task Mismatch. Conclusions. The Role Of Humans In Automated Systems. Mental Models. The Human as Monitor. The Human as Backup. The Human as Partner. Conclusions. II Introduction To System Safety. Foundations Of System Safety. Safety Engineering Pre-World War II. Systems Theory. Systems Engineering. Systems Analysis. Fundamentals Of System Safety. Historical Development. Basic Concepts. Software System Safety. Cost and Effectiveness of System Safety. Other Approaches To Safety. Industrial Safety. Reliability Engineering. Application-Specific Approaches to Safety. III Definitions And Models. Terminology. Failure and Error. Accident and Incident. Hazard. Risk. Safety. Safety and Security. Accident And Human Error Models. Accident Models. Human Task and Error Models. Summary. IV Elements Of A Safeware Program. Managing Safety. The Role of General Management. Place in the Organizational Structure. Documentation. The System And Software Safety Process. The General Tasks. Conceptual Development. Design. Full-Scale Development. Production and Deployment. Operation. Examples. Hazard Analysis. The Hazard Analysis Process. Types of System Models. General Types of Analysis. Limitations and Criticisms of Hazard Analysis. Hazard Analysis Models And Techniques. Checklists. Hazard Indices. Fault Tree Analysis. Management Oversight and Risk Tree (MORT) Analysis. Event Tree Analysis. Cause-Consequence analysis (CCA). Hazards and Operability Analysis (HAZOP). Interface Analyses. Failure Modes and Effects Analysis (FMEA). Failure Modes, Effects, and Criticality Analysis (FMECA). Fault Hazard Analysis (FHA). State Machine Hazard Analysis (SMHA). Task and Human Error Analysis Techniques. Evaluations of Hazard Analysis Techniques. Software Hazard And Requirements Analysis. Process Considerations. Requirements Specification Components. Completeness in Requirements Specifications. Completeness Criteria for Requirements Analysis. Constraint Analysis. Designing For Safety. The Design Process. Design Techniques. Design Modification and Maintenance. Design Of The Human-Machine Interface. General Process Considerations. Matching Tasks to Human Characteristics. Reducing Safety-Critical Human Errors. Providing Appropriate Information and Feedback. Training and Maintaining Skills. Guidelines for Safe HMI Design. Verification Of Safety. Dynamic Analysis. Static Analysis. Independent Verification and Validation. Summary.
Current and Future Trends for Sustainable Software Development: Software Security in Agile and Hybrid Agile through Bibliometric Analysis
Authors: Siti Sarah Maidin
Published in: Journal of Applied Data Sciences (2024-01-01)

The industrial growth of digitalized era has given rise to a growing concern in software development. The present research investigates the prevailing and projected patterns in sustainable software development, especially those related to process innovation, with a particular emphasis on software security within Agile and Hybrid Agile approaches, employing bibliometric analysis. However, a comprehensive understanding of the security concerns of both agile and hybrid agile is crucial and needs further garnered. However, it is expected that a thorough comprehension of the hybrid agile model landscape would uncover various themes encompassing its implementation. The analysis aims to provide a comprehensive overview of the current, present, and future state of software security for agile and hybrid agile. The study employed a bibliometric approach to gather a total of 1593 journals from the Web of Science (WOS) database. This study utilizes co-citation and co-word analysis techniques to identify the most significant articles, delineate the fundamentals framework, and provide a prognosis for future development. The present investigation has successfully discovered four distinct co-citation and three distinct co-word clusters. This study offers valuable insights regarding the software security in agile and hybrid agile. The increasing evolution of the software ecosystem necessitates the prioritization of bridging the gap between agility and security. This paper provides a detailed roadmap for scholars and practitioners who are navigating this intersection