jehanweerasuriya/uni-ai-dataset huggingface dataset:
Research On Software Security Testing
Authors: GU Tian-yang, Shi Yin-sheng, Fang You-yuan
Published in:  (2010-09-21)

Software security testing is an important means to ensure software security and trustiness. This paper first mainly discusses the definition and classification of software security testing, and investigates methods and tools of software security testing widely. Then it analyzes and concludes the advantages and disadvantages of various methods and the scope of application, presents a taxonomy of security testing tools. Finally, the paper points out future focus and development directions of software security testing technology.
Who Should Be Responsible for Software Security? A Comparative Analysis of Liability Policies in Network Environments
Authors: Terrence August, Tunay I. Tunca
Published in: Management Science (2011-03-26)

In recent years, vendor liability for software security vulnerabilities has been the center of an important debate in the software community and a topic gaining government attention in legislative committees and hearings. The importance of this question surrounding vendor security liability is amplified when one considers the increasing emergence of zero-day attacks where hackers take advantage of vulnerabilities before the software vendor has a chance to release protective patches. In this paper, we compare the effectiveness of three software liability policies: vendor liability for damages, vendor liability for patching costs, and government imposed security standards. We find that vendor liability for losses is not effective in improving social welfare in the short run, while liability for patching costs can be effective if either patching costs are large and the likelihood of a zero-day attack is low, or patching costs are small and zero-day likelihood is high. In the long run, when the vendor can invest in reducing the likelihood of security vulnerabilities, loss liability is still ineffective when the zero-day attack probability is high but can increase both vendor investment in security and social welfare when zero-day attack likelihood is sufficiently low. When the zero-day attack probability is high, patch liability is ineffective if user patching costs are large, but partial patch liability can boost vendor investment and improve welfare when patching costs are small. In contrast, in an environment with low zero-day attack probability, full vendor patch liability can be optimal. Finally, comparing the effectiveness of the three liability policies under study, we find that government imposed standards on software security investment can be preferable to both patching and loss liability on the vendor, if zero-day attack likelihood is sufficiently low. However, if zero-day attacks are a common occurrence and patching costs are not too high, partial patch liability is the most effective policy. This paper was accepted by Sandra Slaughter, information systems.
Software Defined Networking Architecture, Security and Energy Efficiency: A Survey
Authors: Danda B. Rawat, Swetha R. Reddy
Published in: IEEE Communications Surveys & Tutorials (2016-10-19)

Software-defined networking (SDN) is an emerging paradigm, which breaks the vertical integration in traditional networks to provide the flexibility to program the network through (logical) centralized network control. SDN has the capability to adapt its network parameters on the fly based on its operating environment. The decoupled structure of SDN serves as a solution for managing the network with more flexibility and ease. In SDN, the centralized cost effective architecture provides network visibility which helps to achieve efficient resource utilization and high performance. Due to the increasingly pervasive existence of smart programmable devices in the network, SDN provides security, energy efficiency, and network virtualization for enhancing the overall network performance. We present various security threats that are resolved by SDN and new threats that arise as a result of SDN implementation. The recent security attacks and countermeasures in SDN are also summarized in the form of tables. We also provide a survey on the different strategies that are implemented to achieve energy efficiency and network security through SDN implementation. In an effort to anticipate the future evolution of this new paradigm, we discuss the main ongoing research efforts, challenges, and research trends in this area. With this paper, readers can have a more thorough understanding of SDN architecture, different security attacks and countermeasures, and energy efficiency.
Using complexity metrics to improve software security
Authors: Sara Moshtari, Ashkan Sami, Mahdi Azimi
Published in: Computer Fraud & Security (2013-05-01)

Information technology is quickly spreading across critical infrastructures and software has become an inevitable part of industries and organisations. At the same time, many cyberthreats are the result of poor software coding. Stuxnet, which was the most powerful cyber-weapon used against industrial control systems, exploited zero-day vulnerabilities in Microsoft Windows.1 The US Department of Homeland Security (DHS) also announced that software vulnerabilities are among the three most common cyber-security vulnerabilities in Industrial Control Systems (ICSs).2 Therefore, improving software security has an important role in increasing the security level of computer-based systems. Software vulnerability prediction is a tedious task, so automating vulnerability prediction would save a lot of time and resources. One recently used methodology in vulnerability prediction is based on automatic fault prediction using software metrics. Here, Sara Moshtari, Ashkan Sami and Mahdi Azimi of Shiraz University, Iran build on previous studies by providing more complete vulnerability information. They show what can be achieved using different classification techniques and more complete vulnerability information.
Revisiting Software Security: Durability Perspective
Authors: Rajeev Kumar, Suhel Ahmad Khan, Raees Ahmad Khan
Published in: International Journal of Hybrid Information Technology (2015-02-28)

Security is a peak significant quality element in the pitch of software engineering. Software security improvement is easily done with the support of factors, models and metrics of security. Software security should be analyzed with the help of its security factors. Security dimension is the main attribute in evaluation, executing, and calculating security in the way to organize and develop quality of software. It is to be identified that qualifications of security factors increased through inspecting damages, discriminating susceptibility and attacks in design development process. This review is discussing the description and categorization of accessible security properties. Durability is an attribute of security that refers to the capability of software to conclude of a creation on time. Software security is affected with security attributes as well as durability. A stable state of the secure software enhances additional security.
Software security and SOA: danger, Will Robinson!
Authors: Jeremy Epstein, Scott Matsumoto, Gary McGraw
Published in: IEEE Security & Privacy (2006-01-01)

The current buzzword of choice among the technical elite (at least those subject to marketing departments) is service-oriented architecture, or SOA (pronounced 'SO-uh'). As SOA moves from hype to practice, an opportunity exists to do security right, but a similar opportunity exists for disaster if security is done wrong. This article describes 13 snares that we must avoid to end up with SOA security that makes sense.
Software-Defined Networking: A Comprehensive Survey
Authors: Diego Kreutz, Fernando M. V. Ramos, Paulo Esteves Veríssimo, Christian Esteve Rothenberg, Siamak Azodolmolky, Steve Uhlig
Published in: Proceedings of the IEEE (2014-12-19)

The Internet has led to the creation of a digital society, where (almost) everything is connected and is accessible from anywhere. However, despite their widespread adoption, traditional IP networks are complex and very hard to manage. It is both difficult to configure the network according to predefined policies, and to reconfigure it to respond to faults, load, and changes. To make matters even more difficult, current networks are also vertically integrated: the control and data planes are bundled together. Software-defined networking (SDN) is an emerging paradigm that promises to change this state of affairs, by breaking vertical integration, separating the network's control logic from the underlying routers and switches, promoting (logical) centralization of network control, and introducing the ability to program the network. The separation of concerns, introduced between the definition of network policies, their implementation in switching hardware, and the forwarding of traffic, is key to the desired flexibility: by breaking the network control problem into tractable pieces, SDN makes it easier to create and introduce new abstractions in networking, simplifying network management and facilitating network evolution. In this paper, we present a comprehensive survey on SDN. We start by introducing the motivation for SDN, explain its main concepts and how it differs from traditional networking, its roots, and the standardization activities regarding this novel paradigm. Next, we present the key building blocks of an SDN infrastructure using a bottom-up, layered approach. We provide an in-depth analysis of the hardware infrastructure, southbound and northbound application programming interfaces (APIs), network virtualization layers, network operating systems (SDN controllers), network programming languages, and network applications. We also look at cross-layer problems such as debugging and troubleshooting. In an effort to anticipate the future evolution of this new paradigm, we discuss the main ongoing research efforts and challenges of SDN. In particular, we address the design of switches and control platforms - with a focus on aspects such as resiliency, scalability, performance, security, and dependability - as well as new opportunities for carrier transport networks and cloud providers. Last but not least, we analyze the position of SDN as a key enabler of a software-defined environment.
Take two software updates and see me in the morning: the case for software security evaluations of medical devices
Authors: Steven Hanna, Rolf Rolles, Andrés Molina–Markham, Pongsin Poosankam, Kevin Fu, Dawn Song
Published in:  (2011-08-09)

Abstract—Medical devices used for critical care are becoming increasingly reliant on software; however, little is understood about the security vulnerabilities facing medical devices and their software. To investigate this open question, we analyze the security of software that controls a modern Automated External Defibrillator (AED) used for treating cardiac arrhythmias. This report represents the first public embedded software security analysis of a medical device. We identify several software security vulnerabilities and discuss key insights and open challenges in improving software-controlled medical devices to be resistant to malware. We found the AED would accept counterfeit firmware updates. We did not locate any standard cryptographic controls. We conclude with recommendations and open challenges in securing medical devices. 1 I.
The Evaluation of Software Security through Quantum Computing Techniques: A Durability Perspective
Authors: Hashem Alyami, Mohd Nadeem, Abdullah Alharbi, Wael Alosaimi, Md Tarique Jamal Ansari, Dhirendra Pandey, Rajeev Kumar, Raees Ahmad Khan
Published in: Applied Sciences (2021-12-11)

The primary goal of this research study, in the field of information technology (IT), is to improve the security and durability of software. A quantum computing-based security algorithm springs quite a lot of symmetrical approaches and procedures to ensure optimum software retreat. The accurate assessment of software’s durability and security is a dynamic aspect in assessing, administrating, and controlling security for strengthening the features of security. This paper essentially emphasises the demarcation and depiction of quantum computing from a software security perspective. At present, different symmetrical-based cryptography approaches or algorithms are being used to protect different government and non-government sectors, such as banks, healthcare sectors, defense, transport, automobiles, navigators, weather forecasting, etc., to ensure software durability and security. However, many crypto schemes are likely to collapse when a large qubit-based quantum computer is developed. In such a scenario, it is necessary to pay attention to the security alternatives based on quantum computing. Presently, the different factors of software durability are usability, dependability, trustworthiness, and human trust. In this study, we have also classified the durability level in the second stage. The intention of the evaluation of the impact on security over quantum duration is to estimate and assess the security durability of software. In this research investigation, we have followed the symmetrical hybrid technique of fuzzy analytic hierarchy process (FAHP) and fuzzy technique for order of preference by similarity to ideal solution (FTOPSIS). The obtained results, and the method used in this estimation, would make a significant contribution to future research for organising software security and durability (SSD) in the presence of a quantum computer.
SAFE-OPS: An approach to embedded software security
Authors: Joseph Zambreno, Alok Choudhary, Rahul Simha, Bhagi Narahari, Nasir Memon
Published in: ACM Transactions on Embedded Computing Systems (2005-02-01)

The new-found ubiquity of embedded processors in consumer and industrial applications brings with it an intensified focus on security, as a strong level of trust in the system software is crucial to their widespread deployment. The growing area of software protection attempts to address the key steps used by hackers in attacking a software system. In this paper, we introduce a unique approach to embedded software protection that utilizes a hardware/software codesign methodology. Results demonstrate that this framework can be the successful basis for the development of embedded applications that meet a wide range of security and performance requirements.
The Effect of Liability and Patch Release on Software Security: The Monopoly Case
Authors: Byung Cho Kim, Pei‐Yu Chen, Tridas Mukhopadhyay
Published in: Production and Operations Management (2010-10-19)

An abundance of flawed software has been identified as the main cause of the poor security of computer networks because major viruses and worms exploit the vulnerabilities of such software. As an incentive mechanism for software security quality improvement, software liability has been intensely discussed among both academics and practitioners for a long time. An alternative approach to managing software security is patch release, which has been widely adopted in practice. In this paper, we examine these two different ways of mitigating customer risk in the software market: liability and patch release. We study the impact of both mechanisms on a monopolistic software vendor's decision on security quality. We find the conditions under which each mechanism is effective in terms of improving security quality and increasing social surplus. The heterogeneous nature of loss is identified to be a key factor for the effectiveness of the liability mechanism. On the other hand, patch release can be effective and welfare‐enhancing regardless of the nature of loss as long as customers incur low patching cost, and/or the vendor incurs low patch development cost. We also examine the impact of customer misperception of the outcome from vulnerable software on the effectiveness of liability.
SMT solvers for software security
Authors: Julien Vanegue, Sean Heelan, Rolf Rolles
Published in:  (2012-08-06)

Computational capacity of modern hardware and algorithmic advances have allowed SAT solving to become a tractable technique to rely on for the decision of properties in industrial software. In this article, we present three practical applications of SAT to software security in static vulnerability checking, exploit generation, and the study of copy protections. These areas are some of the most active in terms of both theoretical research and practical solutions. Investigating the successes and failures of approaches to these problems is instructive in providing guidance for future work on the problems themselves as well as other SMT-based systems.
Detecting Software Security Vulnerabilities Via Requirements Dependency Analysis
Authors: Wentao Wang, Faryn Dumont, Nan Niu, Glen Horton
Published in: IEEE Transactions on Software Engineering (2020-10-13)

Cyber attacks targeting software applications have a tremendous impact on our daily life. For example, attackers have utilized vulnerabilities of web applications to steal and gain unauthorized use of sensitive data stored in these systems. Previous studies indicate that security testing is highly precise, and therefore is widely applied to validate individual security requirements. However, dependencies between security requirements may cause additional vulnerabilities. Manual dependency detection faces scalability challenges, e.g., a previous study shows that the pairwise dependency analysis of 40 requirements would take around 12 hours. In this article, we present a novel approach which integrates the interdependency among high-level security requirements, such as those documented in policies, regulations, and standards. We then use automated requirements tracing methods to identify product-level security requirements and their dependencies. Our manual analysis of HIPAA and FIPS 200 leads to the identification of five types of high-level security requirements dependencies, which further inform the automated tracing methods and guide the designs of system-level security tests. Experimental results on five projects in healthcare and education domains show the significant recall improvements at 81 percent. Our case study on a deployed production system uncovers four previously unknown vulnerabilities by using the detected requirements dependencies as test paths, demonstrating our approach's value in connecting requirements engineering with security testing.
Recent Progress in Software Security
Authors: Edward G. Amoroso
Published in: IEEE Software (2018-03-01)

To reduce cybersecurity risk in software, the security community has widely adopted an approach involving a collage of techniques, tools, and methods, each addressing some aspect of the threat implications of bad code. This article briefly surveys recent progress in each element of this combined approach, including the pros and cons for reducing cybersecurity risk.
Research on Software Security Testing
Authors: LV Jin-he
Published in: Computers & Security (2010-01-01)

With a wide range of software applications and its size,complexity of the continuous improvement of software security issues become increasingly prominent. Software security testing is to ensure software security and quality,reduce the risk of an important means of software security. This paper describes the concept of software security testing,focusing on software security testing at home and abroad the main methods and tools,the last instance of a SQL injection to specify the implementation of safety testing.
Software Security, Privacy, and Dependability: Metrics and Measurement
Authors: George Hatzivasilis, Ioannis Papaefstathiou, Charalampos Manifavas
Published in: IEEE Software (2016-03-18)

Measurement of software security is an ongoing research field. Privacy is also becoming an imperative target as social networking and ubiquitous computing evolve and users exchange high volumes of personal information. However, security and privacy alone don't guarantee proper data protection; software must also be dependable. Several standards typify the main concepts and protection mechanisms for these three properties, and measurement methodologies can quantify the provided protection level. However, security, privacy, and dependability are usually dealt with in isolation. To solve this problem, researchers have proposed a practical, easy-to-use methodology that measures a software system's overall security, privacy, and dependability (SPD) on the basis of the standards for each property. The nSHIELD (New Embedded Systems Architecture for Multi-layer Dependable Solutions) project is applying the SPD methodology to evaluate configurable embedded software in a social-mobility scenario.
Software Security in Practice
Authors: B. Chess, Brad Arkin
Published in: IEEE Security & Privacy (2011-03-01)

This department is about building software with security in mind. Since it began in 2004, it has focused on the kinds of activities that constitute a secure development life cycle. As of to day, we're broadening that charter to include all the essential ingredients of a sustained soft ware security initiative. Instead of focusing on one turn of the crank that yields one new piece of software, we'll consider the ongoing organizational commitments necessary to facilitate se cure software development.
Hiding program slices for software security
Authors: Xiangyu Zhang, Rajiv Gupta
Published in:  (2003-03-23)

Given the high cost of producing software, development of technology for prevention of software piracy is important for the software industry. In this paper we present a novel approach for preventing the creation of unauthorized copies of software. Our approach splits software modules into open and hidden components. The open components are installed (executed) on an unsecure machine while the hidden components are installed (executed) on a secure machine. We assume that while open components can be stolen, to obtain a fully functioning copy of the software, the hidden components must be recovered. We describe an algorithm that constructs hidden components by slicing the original software components. We argue that recovery of hidden components constructed through slicing, in order to obtain a fully functioning copy of the software, is a complex task. We further develop security analysis to capture the complexity of recovering hidden components. Finally we apply our technique to several large Java programs to study the complexity of recovering constructed hidden components and to measure the runtime overhead introduced by splitting of software into open and hidden components. 1.