jehanweerasuriya/uni-ai-dataset huggingface dataset:
Design of a software architecture supporting business-to-government information sharing to improve public safety and security
Authors: Sélinde van Engelenburg, Marijn Janssen, Bram Klievink
Published in: Journal of Intelligent Information Systems (2017-07-27)

To ensure public safety and security, it is vitally important for governments to collect information from businesses and analyse it. Such information can be used to determine whether transported goods might be suspicious and therefore require physical inspection. Although businesses are obliged to report some information, they are reluctant to share additional information for fear of sharing competitively sensitive information, becoming liable and not being compliant with the law. These reasons are often overlooked in the design of software architectures for information sharing. In the present research, we followed a design science approach to develop a software architecture for business-to-government information sharing. Based on literature and a case study, we elicited the requirements an architecture that provides for the sharing of information should meet to make it acceptable to businesses. We then developed the architecture and evaluated it against the requirements. The architecture consists of a blockchain that stores events and rules for information sharing that are controlled by businesses. For each event, two parties use their private keys to encrypt its Merkle root to confirm that they know the data are correct. This makes it easy to check whether information is reliable and whether an event should be accepted. Access control, metadata and context information enable the context-based sharing of information. This is combined with the encryption and decryption of data to provide access to certain data within an organisation.
Automatically Detect Software Security Vulnerabilities Based on Natural Language Processing Techniques and Machine Learning Algorithms
Authors: Do Xuan Cho, Vu Ngoc Son, Duong Tuan Duc
Published in: Journal of ICT Research and Applications (2022-05-11)

Nowadays, software vulnerabilities pose a serious problem, because cyber-attackers often find ways to attack a system by exploiting software vulnerabilities. Detecting software vulnerabilities can be done using two main methods: i) signature-based detection, i.e. methods based on a list of known security vulnerabilities as a basis for contrasting and comparing; ii) behavior analysis-based detection using classification algorithms, i.e., methods based on analyzing the software code. In order to improve the ability to accurately detect software security vulnerabilities, this study proposes a new approach based on a technique of analyzing and standardizing software code and the random forest (RF) classification algorithm. The novelty and advantages of our proposed method are that to determine abnormal behavior of functions in the software, instead of trying to define behaviors of functions, this study uses the Word2vec natural language processing model to normalize and extract features of functions. Finally, to detect security vulnerabilities in the functions, this study proposes to use a popular and effective supervised machine learning algorithm.
Essential Factors for Successful Software Security Awareness Training
Authors: Kenneth R. van Wyk, John Steven
Published in: IEEE Security & Privacy (2006-09-01)

As organizations flesh out their enterprise software security framework (ESSF), they quickly spot an overwhelming gap between their current state of practice and their eventual goals for building secure applications. To address this gap, the application security group must bring ESSF plans to other parts of the organization: corporate, engineering, business, training, and IT groups, to name a few. Such socialization helps organizational participants understand their role in framework adoption and roll out, and it should cover what tools people will need, how they'll interact with each other, and what levels of effort they can expect to put forth.
A Security Metrics Taxonomization Model for Software-Intensive Systems
Authors: Reijo Savola
Published in: Journal of Information Processing Systems (2009-12-31)

We introduce a novel high-level security metrics objective taxonomization model for software- intensive systems. The model systematizes and organizes security metrics development activities. It focuses on the security level and security performance of technical systems while taking into account the alignment of metrics objectives with different business and other management goals. The model emphasizes the roles of security-enforcing mechanisms, the overall security quality of the system under investigation, and secure system lifecycle, project and business management. Security correctness, effectiveness and efficiency are seen as the fundamental measurement objectives, determining the directions for more detailed security metrics development. Integration of the proposed model with riskdriven security metrics development approaches is also discussed.
Improving Software Security by Eliminating the CWE Top 25 Vulnerabilities
Authors: Michael Howard
Published in: IEEE Security & Privacy (2009-05-01)

CWE, which stands for Common Weakness Enumeration, is a project sponsored by the National Cyber Security Division of the US Department of Homeland Security to classify security bugs. It assigns a unique number to weakness types such as buffer overruns or cross-site scripting bugs (for example, CWE- 327 is "Use of a Broken or Risky Cryptographic Algorithm"). Shortly after the Top 25 list's release, Microsoft unveiled a document entitled, "The Microsoft SDL and the CWE/SANS Top 25," to explain how Microsoft's security processes can help prevent the worst offenders (http://blogs.msdn.com/sdl/ archive/2009/01/27/sdl-and-the -cwe-sans-top-25. aspx).
Taxonomy of security considerations and software quality
Authors: Huaiqing Wang, Chen Wang
Published in: Communications of the ACM (2003-06-01)

Addressing security threats and risks through software quality design factors.
The Applicability of Existing Metrics for Software Security
Authors: Sree Ram T Kumar, A. Sumithra, K. Alagarsamy
Published in: International Journal of Computer Applications (2010-10-10)

With the increasing inclination of people to use software systems for most of the purposes, comes a major challenge for software engineersthe engineering of secure software systems. The concept of -Computer Security is being heavily researched and this perfectly makes sense in a world where e-commerce and egovernance are becoming the norms of the day. Along with their potential for making life easier and smarter for people, these systems also carry with them the danger of insecurity. Because any software system is an outcome of some software engineering process it makes sense to incorporate security considerations during the software engineering processes. This is easier said than done because traditional software engineering approaches are requirements driven and pay very little, if any, attention to security. Tom DeMarco [1] stated, -You can't control what you can't measure. This clearly states the importance of metrics in software engineering. Traditional software metrics do not address the issue of security well and now with security becoming an imperative necessity of most software systems, these metrics have to be adapted to take into account the security aspect. The paper discusses the applicability of some established metrics for the security aspect.
Enforceable security policies
Authors: Fred B. Schneider
Published in: ACM Transactions on Information and System Security (2000-02-01)

A precise characterization is given for the class of security policies enforceable with mechanisms that work by monitoring system execution, and automata are introduced for specifying exactly that class of security policies. Techniques to enforce security policies specified by such automata are also discussed.
Exploring a Novel Approach for providing Software Security Using Soft Computing Systems
Authors: P. Kiran Sree
Published in:  (2015-06-16)

Most of the Soft Computing algorithms will learn from human knowledge and mimic human skills. We survey the principal constituents of soft computing techniques including
OpenSec: Policy-Based Security Using Software-Defined Networking
Authors: Adrián Lara, Byrav Ramamurthy
Published in: IEEE Transactions on Network and Service Management (2016-01-12)

As the popularity of software-defined networks (SDN) and OpenFlow increases, policy-driven network management has received more attention. Manual configuration of multiple devices is being replaced by an automated approach where a software-based, network-aware controller handles the configuration of all network devices. Software applications running on top of the network controller provide an abstraction of the topology and facilitate the task of operating the network. We propose OpenSec, an OpenFlow-based security framework that allows a network security operator to create and implement security policies written in human-readable language. Using OpenSec, the user can describe a flow in terms of OpenFlow matching fields, define which security services must be applied to that flow (deep packet inspection, intrusion detection, spam detection, etc.) and specify security levels that define how OpenSec reacts if malicious traffic is detected. In this paper, we first provide a more detailed explanation of how OpenSec converts security policies into a series of OpenFlow messages needed to implement such a policy. Second, we describe how the framework automatically reacts to security alerts as specified by the policies. Third, we perform additional experiments on the GENI testbed to evaluate the scalability of the proposed framework using existing datasets of campus networks. Our results show that up to 95% of attacks in an existing data set can be detected and 99% of malicious source nodes can be blocked automatically. Furthermore, we show that our policy specification language is simpler while offering fast translation times compared to existing solutions.
Integrated Measurement and Analysis Framework for Software Security
Authors: Christopher Alberts, Julia Allen, Robert Stoddard
Published in: KiltHub Repository (2010-01-01)

In today's business and operational environments, multiple organizations routinely work collaboratively to acquire, develop, deploy, and maintain technical capabilities via a set of interdependent, networked systems. Measurement in these distributed management environments can be an extremely challenging problem. The CERT Program, part of Carnegie Mellon University's Software Engineering Institute (SEI), is developing the Integrated Measurement and Analysis Framework (IMAF) to enable effective measurement in distributed environments, including acquisition programs, supply chains, and systems of systems. The IMAF defines an approach that integrates subjective and objective data from multiple sources (targeted analysis, reports, and tactical measurement) and provides decision makers with a consolidated view of current conditions. This report is the first in a series that addresses how to measure software security in complex environments. It poses several research questions and hypotheses and presents a foundational set of measurement concepts. It also describes how meaningful measures provide the information that decision makers need when they need it and in the right form. Finally, this report provides a conceptual overview of the IMAF, describes methods for qualitatively and quantitatively collecting data to inform the framework, and suggests how to use the IMAF to derive meaningful measures for analyzing software security performance.
Security Assurance Model of Software Development for Global Software Development Vendors
Authors: Rafiq Ahmad Khan, Siffat Ullah Khan, Musaad Alzahrani, Muhammad Ilyas
Published in: IEEE Access (2022-01-01)

The number of security attacks and the impact has grown considerably in the recent several years. As a result, new emerging software development models are required that assist in developing software that is secure by default. This article reviews the most widely used security software models. It proposes a new Security Assurance Model (SAM) for Software Development that is adaptable to all contemporary scenarios, emphasizing global software development (GSD) vendor companies. The SAM of Software Development was developed after studying 11 well-known development models and analyzing results obtained from a systematic literature review (SLR) and questionnaire survey. The SAM of Software Development consists of seven security assurance levels: Governance and Security Threat Analysis, Secure Requirement Analysis, Secure Design, Secure Coding, Secure Testing and Review, Secure Deployment, and Security Improvement. The security assurance levels of SAM of software development consist of 46 critical software security risks (CSSRs) and 388 practices for addressing these risks. The proposed SAM of Software Development was assessed based on a tool created by Motorola, which is used to evaluate the present state of a company&#x2019;s software processes and find areas for improvement. We conducted 3 case studies on software development companies, using data from real software projects to examine the results of a practical experiment in each company. The results of the case studies indicate that the proposed SAM of Software Development helps measure the security assurance level of an organization. In addition, it can potentially serve as a framework for researchers to develop new software security measures.
Integration of Artificial Intelligence in Facial Recognition Systems for Software Security
Authors: W.B. Santoso, Rahayu Safitri, Samidi Samidi
Published in: SinkrOn (2024-04-30)

Facial recognition technology, a cornerstone in modern software security, has seen significant advancements through the integration of Artificial Intelligence (AI). This research focuses on enhancing facial recognition systems by incorporating sophisticated machine learning algorithms and deep neural networks. By doing so, the goal is to increase the accuracy and reliability of these systems in security applications. The study uses a variety of facial datasets to train AI models that are adept at extracting facial features and recognizing patterns. These models are subjected to rigorous testing to evaluate their performance in terms of identification accuracy, processing speed, and adaptability to different environmental conditions. One of the key challenges addressed in the research is the system's vulnerability to errors and potential misuse. Ethical considerations and privacy concerns are at the forefront of the study. The research highlights the importance of designing AI-based facial recognition systems that respect user privacy and are resistant to biases, thus fostering trust and acceptance among users. The results of the study show a marked improvement in system performance, demonstrating enhanced recognition accuracy and speed, while maintaining robustness across different conditions. By offering practical recommendations for the development of secure, ethical, and privacy-aware facial recognition systems, this research contributes valuable insights into the integration of AI in software security. It underscores the importance of continuous innovation and ethical responsibility in the deployment of facial recognition technologies, shaping the future landscape of technological security measures
Ontology-based context-sensitive software security knowledge management modeling
Authors: Mamdouh Alenezi
Published in: International Journal of Power Electronics and Drive Systems/International Journal of Electrical and Computer Engineering (2020-09-18)

The disconcerting increase in the number of security attacks on software calls for an imminent need for including secure development practices within the software development life cycle. The software security management system has received considerable attention lately and various efforts have been made in this direction. However, security is usually only considered in the early stages of the development of software. Thus, this leads to stating other vulnerabilities from a security perspective. Moreover, despite the abundance of security knowledge available online and in books, the systems that are being developed are seldom sufficiently secure. In this paper, we have highlighted the need for including application context sensitive modeling within a case-based software security management system. Furthermore, we have taken the context-driven and ontology-based frameworks and prioritized their attributes according to their weights which were achieved by using the Fuzzy AHP methodology.
Secure Coding: Building Security into the Software Development Life Cycle
Authors: Russell L. Jones, Abhinav Rastogi
Published in: Information Systems Security (2004-11-01)

Many of the security properties that are outlined repeatedly in the newer regulations and standards can easily be side-stepped. Too often the culprits are unsophisticated software development techniques, a lack of security- focused quality assurance, and scarce security training for software developers, software architects, and project managers. To meet future needs, opportunities, and threats associated with information security, security needs to be “baked in” to the overall systems development life-cycle process.
Toward a Context-Based Approach for Software Security Learning
Authors: Shao-Fang Wen, Basel Katt
Published in: Journal of Applied Security Research (2019-06-04)

Learning software security is one of the most challenging tasks in the information technology sector due to the vast amount of security knowledge and the difficulties in understanding its practical applications. Conventional teaching approaches give little attention to how to improve the effectiveness of learning in the domain of software security. Context-based learning has been proven to be a sound pedagogical methodology; however, it is still unclear how to synthesize the prescription in the domain of software security. In this article, a context-based approach to software security learning is proposed for structuring and presenting security knowledge. To evaluate the proposed approach, a quasi-experiment was designed and executed in the setting of a university learning environment. The experiment results indicate that the proposed context-based learning approach not only yields significant knowledge gains compared to the conventional approach but also gains better learning satisfaction of students.
Network Intrusion Detection for IoT Security Based on Learning Techniques
Authors: Nadia Chaabouni, Mohamed Mosbah, Akka Zemmari, Cyrille Sauvignac, Parvez Faruki
Published in: IEEE Communications Surveys & Tutorials (2019-01-01)

Pervasive growth of Internet of Things (IoT) is visible across the globe. The 2016 Dyn cyberattack exposed the critical fault-lines among smart networks. Security of IoT has become a critical concern. The danger exposed by infested Internet-connected Things not only affects the security of IoT but also threatens the complete Internet eco-system which can possibly exploit the vulnerable Things (smart devices) deployed as botnets. Mirai malware compromised the video surveillance devices and paralyzed Internet via distributed denial of service attacks. In the recent past, security attack vectors have evolved bothways, in terms of complexity and diversity. Hence, to identify and prevent or detect novel attacks, it is important to analyze techniques in IoT context. This survey classifies the IoT security threats and challenges for IoT networks by evaluating existing defense techniques. Our main focus is on network intrusion detection systems (NIDSs); hence, this paper reviews existing NIDS implementation tools and datasets as well as free and open-source network sniffing software. Then, it surveys, analyzes, and compares state-of-the-art NIDS proposals in the IoT context in terms of architecture, detection methodologies, validation strategies, treated threats, and algorithm deployments. The review deals with both traditional and machine learning (ML) NIDS techniques and discusses future directions. In this survey, our focus is on IoT NIDS deployed via ML since learning algorithms have a good success rate in security and privacy. The survey provides a comprehensive review of NIDSs deploying different aspects of learning techniques for IoT, unlike other top surveys targeting the traditional systems. We believe that, this paper will be useful for academia and industry research, first, to identify IoT threats and challenges, second, to implement their own NIDS and finally to propose new smart techniques in IoT context considering IoT limitations. Moreover, the survey will enable security individuals differentiate IoT NIDS from traditional ones.
Security Threats in the Data Plane of Software-Defined Networks
Authors: Shang Gao, Zecheng Li, Bin Xiao, Guiyi Wei
Published in: IEEE Network (2018-02-07)

SDN has enabled extensive network programmability and speedy network innovations by decoupling the control plane from the data plane. However, the separation of the two planes could also be a potential threat to the whole network. Previous approaches pointed out that attackers can launch various attacks from the data plane against SDN, such as DoS attacks, topology poisoning attacks, and side-channel attacks. To address the security issues, we present a comprehensive study of data plane attacks in SDN, and propose FlowKeeper, a common framework to build a robust data plane against different attacks. FlowKeeper enforces port control of the data plane and reduces the workload of the control plane by filtering out illegal packets. Experimental results show that FlowKeeper could be used to efficiently mitigate different kinds of attacks (i.e., DoS and topology poisoning attacks).
Development a mathematical model for the software security testing first stage
Authors: Serhii Semenov, Liqiang Zhang, Cao Weiling, Viacheslav Davydov
Published in: Eastern-European Journal of Enterprise Technologies (2021-06-30)

This paper reports an analysis of the software (SW) safety testing techniques, as well as the models and methods for identifying vulnerabilities. An issue has been revealed related to the reasoned selection of modeling approaches at different stages of the software safety testing process and the identification of its vulnerabilities, which reduces the accuracy of the modeling results obtained. Two steps in the process of identifying software vulnerabilities have been identified. A mathematical model has been built for the process of preparing security testing, which differs from the known ones by a theoretically sound choice of the moment-generating functions when describing transitions from state to state. In addition, the mathematical model takes into consideration the capabilities and risks of the source code verification phase for cryptographic and other ways to protect data. These features generally improve the accuracy of modeling results and reduce input uncertainty in the second phase of software safety testing. An advanced security compliance algorithm has been developed, with a distinctive feature of the selection of laws and distribution parameters that describe individual state-to-state transitions for individual branches of Graphical Evaluation and Review Technique networks (GERT-networks). A GERT-network has been developed to prepare for security testing. A GERT-network for the process of checking the source code for cryptographic and other data protection methods has been developed. A graphic-analytical GERT model for the first phase of software safety testing has been developed. The expressions reported in this paper could be used to devise preliminary recommendations and possible ways to improve the effectiveness of software safety testing algorithms