jehanweerasuriya/uni-ai-dataset huggingface dataset:
Security Framework for Internet-of-Things-Based Software-Defined Networks Using Blockchain
Authors: Shalli Rani, Himanshi Babbar, Gautam Srivastava, Thippa Reddy Gadekallu, Gaurav Dhiman
Published in: IEEE Internet of Things Journal (2022-11-21)

Presently, trillions of Internet of Things (IoT) devices are in use, with many more projected to join IoT networks in the future. These IoT devices create a massive volume of data, which cannot be transmitted over the network without proper security and privacy. Furthermore, as the amount of information and variety of interconnected devices grows, problems, including excessive response time, bandwidth constraints, and scalability, emerge in proper network design. To solve the constraints of today’s smart cities for next-generation networks, an effective, secure, and scalable distributed framework must be designed bringing computing and storage resources nearer to endpoints. In this article, combining the strengths of software-defined networks (SDNs) and blockchain technology, an innovative adaptable network infrastructure for smart cities is developed. The network is divided into different domains in which SDN will detect potential attacks and transmit the secured data to the blockchain. Our in-depth experimental analysis on performance evaluation show that the proposed framework achieves 12.75% improvement over baseline methodologies.
Formal analysis and design for engineering security automated derivation of formal software security specifications from goal-oriented security requirements
Authors: Rayan N. Makki Hassan, Mohamed Eltoweissy, Shawn Bohner, Sherif El-Kassas
Published in: IET Software (2010-03-30)

Formal methods have long been advocated for the development of provably secure software. However, the lack of formal requirements elaboration and the limited scalability afforded by such methods have led to employing informal or semi-formal methods for large-scale software development. In our effort to produce highly secure software in a systematic, provable and cost-effective manner, the authors have proposed formal analysis and design for engineering security (FADES) as the first goal-oriented software security engineering approach that provides an automated bridge between the goal-oriented semi-formal Knowledge Acquisition for autOmated Specifications (KAOS) framework and the B formal method. Automating the transition from requirements to specifications; considered one of the most difficult steps in the software development lifecycle, is vital to the success of FADES. Further, the automated derivation of a suite of acceptance test cases from the requirements model in FADES provides means to verify security implementation against the requirements model. In this study, the authors propose an automated process using FADES to systematically derive B specifications and a suite of acceptance test cases from goal-oriented security requirements. Further, the authors empirically validate the effectiveness of the FADES automated bridge that paves the grounds for formal design and implementation. The empirical validation involves both security engineering practitioners and experts in formal methods for security. The extensive results obtained demonstrate the effectiveness of the FADES automated bridge in producing secure software in a cost-effective manner.
A survey: Typical security issues of software-defined networking
Authors: Yifan Liu, Bo Zhao, Pengyuan Zhao, Peiru Fan, Hui Liu
Published in: China Communications (2019-07-01)

Software-Defined Networking (SDN) has been a hot topic for future network development, which implements the different layers of control plane and data plane respectively. Despite providing high openness and programmability, the "three-layer two-interface" architecture of SDN changes the traditional network and increases the network attack nodes, which results in new security issues. In this paper, we firstly introduced the background, architecture and working process of SDN. Secondly, we summarized and analyzed the typical security issues from north to south: application layer, northbound interface, control layer, southbound interface and data layer. Another contribution is to review and analyze the existing solutions and latest research progress of each layer, mainly including: authorized authentication module, application isolation, DoS/DDoS defense, multi-controller deployment and flow rule consistency detection. Finally, a conclusion about the future works of SDN security and an idealized global security architecture is proposed.
An improvised software security awareness model
Authors: C. Banerjee, Arpita Banerjee, P. D. Murarka
Published in: JIMS8I - International Journal of Information Communication and Computing Technology (2013-01-01)

In present day information age, software is considered as an integral and essential part of life. The world's economy is depended on its secured use. Security adds value to the software with respect to people trust. When the software is attacked, the sole intention of the attacker is to carry out well funded, destructive and unethical objective to cause harm to an organizational unit. The software is attacked and the system is threatened both by the outsider and the insider. The insider normally exploits those potential security loopholes which are left unnoticed or unattended during requirement engineering, system analysis, system design, system coding, system implementation, and system maintenance phases of SDLC. Numerous tool, techniques, methods, standards, models and technology are available which provides some kind of safeguard for the system from outside attack. When an insider attacks a system, a more strategic and tactical procedure need to be adopted in the form of psychological treatment of people involved which is creating awareness among the people involved supported with inter-functional and intra-functional dimensions. This paper proposes an improvised software security awareness model entitled “ISSAM” which is an outcome of mapped and synchronized software development teams, software development life cycle phases with the various identified tools, techniques and methods of creating software security awareness. It is found that after applying the proposed model an extensive and exhaustive set of software security awareness program could be implemented which can aid in comprehensive creation of awareness about software security among the people involved.
Security protection and checking for embedded system integration against buffer overflow attacks via hardware/software
Authors: Zili Shao, Chun Jason Xue, Qingfeng Zhuge, Meikang Qiu, Bin Xiao, Edwin H.‐M. Sha
Published in: IEEE Transactions on Computers (2006-03-22)

With more embedded systems networked, it becomes an important problem to effectively defend embedded systems against buffer overflow attacks. Due to the increasing complexity and strict requirements, off-the-shelf software components are widely used in embedded systems, especially for military and other critical applications. Therefore, in addition to effective protection, we also need to provide an approach for system integrators to efficiently check whether software components have been protected. In this paper, we propose the HSDefender (Hardware/Software Defender) technique to perform protection and checking together. Our basic idea is to design secure call instructions so systems can be secured and checking can be easily performed. In the paper, we classify buffer overflow attacks into two categories and provide two corresponding defending strategies. We analyze the HSDefender technique with respect to hardware cost, security, and performance. We experiment with our HSDefender technique on the simplescalar/ARM simulator with benchmarks from MiBench, an embedded benchmark suite. The results show that our HSDefender technique can defend a system against more types of buffer overflow attacks with less overhead compared with the previous work.
Capturing security requirements for software systems
Authors: Hassan El-Hadary, Sherif El-Kassas
Published in: Journal of Advanced Research (2014-03-14)

Security is often an afterthought during software development. Realizing security early, especially in the requirement phase, is important so that security problems can be tackled early enough before going further in the process and avoid rework. A more effective approach for security requirement engineering is needed to provide a more systematic way for eliciting adequate security requirements. This paper proposes a methodology for security requirement elicitation based on problem frames. The methodology aims at early integration of security with software development. The main goal of the methodology is to assist developers elicit adequate security requirements in a more systematic way during the requirement engineering process. A security catalog, based on the problem frames, is constructed in order to help identifying security requirements with the aid of previous security knowledge. Abuse frames are used to model threats while security problem frames are used to model security requirements. We have made use of evaluation criteria to evaluate the resulting security requirements concentrating on conflicts identification among requirements. We have shown that more complete security requirements can be elicited by such methodology in addition to the assistance offered to developers to elicit security requirements in a more systematic way.
Software Security Analysis in 2030 and Beyond: A Research Roadmap
Authors: Marcel Böhme, Eric Bodden, Tevfik Bultan, Cristian Cadar, Yang Liu, Giuseppe Scanniello
Published in: ACM Transactions on Software Engineering and Methodology (2024-12-19)

As our lives, our businesses, and indeed our world economy become increasingly reliant on the secure operation of many interconnected software systems, the software engineering research community is faced with unprecedented research challenges, but also with exciting new opportunities. In this roadmap article, we outline our vision of software security analysis for the systems of the future. Given the recent advances in generative AI, we need new methods to assess and maximize the security of code co-written by machines. As our systems become increasingly heterogeneous, we need practical approaches that work even if some functions are automatically generated, e.g., by deep neural networks. As software systems depend evermore on the software supply chain, we need tools that scale to an entire ecosystem. What kind of vulnerabilities exist in future systems and how do we detect them? When all the shallow bugs are found, how do we discover vulnerabilities hidden deeply in the system? Assuming we cannot find all security flaws, how can we nevertheless protect our system? To answer these questions, we start our roadmap with a survey of recent advances in software security, then discuss open challenges and opportunities, and conclude with a long-term perspective for the field.
An Attack Surface Metric
Authors: Pratyusa K. Manadhata, Jeannette M. Wing
Published in: IEEE Transactions on Software Engineering (2010-06-14)

Measurement of software security is a long-standing challenge to the research community. At the same time, practical security metrics and measurements are essential for secure software development. Hence, the need for metrics is more pressing now due to a growing demand for secure software. In this paper, we propose using a software system's attack surface measurement as an indicator of the system's security. We formalize the notion of a system's attack surface and introduce an attack surface metric to measure the attack surface in a systematic manner. Our measurement method is agnostic to a software system's implementation language and is applicable to systems of all sizes; we demonstrate our method by measuring the attack surfaces of small desktop applications and large enterprise systems implemented in C and Java. We conducted three exploratory empirical studies to validate our method. Software developers can mitigate their software's security risk by measuring and reducing their software's attack surfaces. Our attack surface reduction approach complements the software industry's traditional code quality improvement approach for security risk mitigation and is useful in multiple phases of the software development lifecycle. Our collaboration with SAP demonstrates the use of our metric in the software development process.
Towards an architectural treatment of software security
Authors: Jie Ren, Richard G. Taylor, Paul Dourish, David Redmiles
Published in: ACM SIGSOFT Software Engineering Notes (2005-05-15)

Security is a very important concern for software architecture and software components. Previous modeling approaches provide insufficient support for an in-depth treatment of security. This paper argues for a more comprehensive treatment based on software connectors. Connectors provide a suitable vehicle to model, capture, and enforce security. Our approach models security principal, privilege, trust, and context of architectural constituents. Extending our existing architecture description language and support tools, our approach can facilitate describing the security characteristics of an architecture generating enabling infrastructure, and monitoring run-time conformance. Initial results of applying this approach are illustrated through a case study. The contribution of this research is a deeper and more comprehensive treatment of architectural security through software connectors.
Managing software security risks
Authors: G. McGraw
Published in: Computer (2002-03-01)

Most organizations manage computer security risk reactively by investing in technologies designed to protect against known system vulnerabilities and monitor intrusions as they occur. However, firewalls, cryptography, and antivirus protection address the symptoms, not the root cause, of most security problems. Buying and maintaining a firewall, for example, is ineffective if external users can access remotely exploitable Internet-enabled applications through it. Because hackers attack software, improving computer security depends on proactively managing risks associated with software and software development. The current "penetrate and patch" approach of fixing broken software only after it has been compromised is insufficient to control the problem.
On the Security of SDN: A Completed Secure and Scalable Framework Using the Software-Defined Perimeter
Authors: Ahmed Sallam, Ahmed Refaey, Abdallah Shami
Published in: IEEE Access (2019-01-01)

The widespread adoption and evolution of Software Defined Networking (SDN) have enabled the service providers to successfully simplify network management. Along with the traffic explosion, there is decreasing CAPEX and OPEX as well as an increase in the average revenue per user. However, this wide adoption of SDNs is posing real challenges and concerns in terms of security aspects. The main challenges are how to provide proper authentication, access control, data privacy, and data integrity among others for the API-driven orchestration of network routing. Herein, the Software Defined Perimeter (SDP) is proposed as a framework to provide an orchestration of connections. The expectation is a framework that restricts network access and connections between objects on the SDN-enabled network infrastructures. There are several potential benefits as a result of the integration between SDP systems and SDNs. In particular, it provides a completely scalable and managed security solution. Consequently, it leads to flexible deployment that can be tailored to fit the need of any generic network security perimeter. The proposed Integrated frameworks are examined through virtualized network testbeds. The testing results demonstrate that the proposed framework is malleable to both port scanning (PS) attack and Denial of Service (DoS) bandwidth attack. In addition, it clarifies some interesting potential integration points between the SDP systems and SDNs to further research in this area.
In Search of Architectural Patterns for Software Security
Authors: Jungwoo Ryoo, Phil Laplante, Rick Kazman
Published in: Computer (2009-06-01)

Software architects design by combining and tailoring styles, patterns, and tactics with known properties. A security-relevant research agenda will give architects a principled body of knowledge from which to reason.
Top Five Challenges in Software Supply Chain Security: Observations From 30 Industry and Government Organizations
Authors: William Enck, Laurie Williams
Published in: IEEE Security & Privacy (2022-03-01)

Software is complex, not only due to the code within a given project, but also due to the vast ecosystem of dependencies and transitive dependencies upon which each project relies. Recent years have observed a sharp uptick of attacks on the software supply chain spurring invigorated interest by industry and government alike. We held three summits with a diverse set of organizations and report on the top five challenges in software supply chain security.
Software Vulnerability Analysis and Discovery Using Machine-Learning and Data-Mining Techniques
Authors: Seyed Mohammad Ghaffarian, Hamid Reza Shahriari
Published in: ACM Computing Surveys (2017-08-25)

Software security vulnerabilities are one of the critical issues in the realm of computer security. Due to their potential high severity impacts, many different approaches have been proposed in the past decades to mitigate the damages of software vulnerabilities. Machine-learning and data-mining techniques are also among the many approaches to address this issue. In this article, we provide an extensive review of the many different works in the field of software vulnerability analysis and discovery that utilize machine-learning and data-mining techniques. We review different categories of works in this domain, discuss both advantages and shortcomings, and point out challenges and some uncharted territories in the field.
Why, How and Where of Delays in Software Security Patch Management: An Empirical Investigation in the Healthcare Sector
Authors: Nesara Dissanayake, Mansooreh Zahedi, Asangi Jayatilaka, Muhammad Ali Babar
Published in: Proceedings of the ACM on Human-Computer Interaction (2022-11-07)

Numerous security attacks that resulted in devastating consequences can be traced back to a delay in applying a security patch. Despite the criticality of timely patch application, not much is known about why and how delays occur when applying security patches in practice, and how the delays can be mitigated. Based on longitudinal data collected from 132 delayed patching tasks over a period of four years and observations of patch meetings involving eight teams from two organisations in the healthcare domain, and using quantitative and qualitative data analysis approaches, we identify a set of reasons relating to technology, people and organisation as key explanations that cause delays in patching. Our findings also reveal that the most prominent cause of delays is attributable to coordination delays in the patch management process and a majority of delays occur during the patch deployment phase. Towards mitigating the delays, we describe a set of strategies employed by the studied practitioners. This research serves as the first step toward understanding the practical reasons for delays and possible mitigation strategies in vulnerability patch management. Our findings provide useful insights for practitioners to understand what and where improvement is needed in the patch management process and guide them towards taking timely actions against potential attacks. Also, our findings help researchers to invest effort into designing and developing computer-supported tools to better support a timely security patch management process.
A fuzzy TOPSIS based analysis toward selection of effective security requirements engineering approach for trustworthy healthcare software development
Authors: Md Tarique Jamal Ansari, Fahad Ahmed Al-Zahrani, Dhirendra Pandey, Alka Agrawal
Published in: BMC Medical Informatics and Decision Making (2020-09-18)

BACKGROUND: Today's healthcare organizations want to implement secure and quality healthcare software as cyber-security is a significant risk factor for healthcare data. Considering security requirements during trustworthy healthcare software development process is an essential part of the quality software development. There are several Security Requirements Engineering (SRE) methodologies, framework, process, standards available today. Unfortunately, there is still a necessity to improve these security requirements engineering approaches. Determining the most suitable security requirements engineering method for trustworthy healthcare software development is a challenging process. This study is aimed to present security experts' perspective on the relative importance of the criteria for selecting effective SRE method by utilizing the multi-criteria decision making methods. METHODS: The study was planned and conducted to identify the most appropriate SRE approach for quality and trustworthy software development based on the security expert's knowledge and experience. The hierarchical model was evaluated by using fuzzy TOPSIS model. Effective SRE selection criteria were compared in pairs. 25 security experts were asked to response the pairwise criteria comparison form. RESULTS: The impact of the recognized selection criteria for effective security requirements engineering approaches has been evaluated quantitatively. For each of the 25 participants, comparison matrixes were formed based on the scores of their responses in the form. The consistency ratios (CR) were found to be smaller than 10% (CR = 9.1% < 10%). According to pairwise comparisons result; with a 0.842 closeness coefficient (Ci), STORE methodology is the most effective security requirements engineering approach for trustworthy healthcare software development. CONCLUSIONS: The findings of this research study demonstrate various factors in the decision-making process for the selection of a reliable method for security requirements engineering. This is a significant study that uses multi-criteria decision-making tools, specifically fuzzy TOPSIS, which used to evaluate different SRE methods for secure and trustworthy healthcare application development.