jehanweerasuriya/uni-ai-dataset huggingface dataset:
Development of graphicanalytical models for the software security testing algorithm
Authors: Serhii Semenov, Оксана Сіра, Nina Kuchuk
Published in: Eastern-European Journal of Enterprise Technologies (2018-03-28)

An analysis of one of the main types of software testing, namely security testing has been made. It was established that there are a number of specific features associated with the possibility of negative manipulation with software products. A graphic-analytical model of the algorithm of testing software security was developed. The model based on the theory of semi-Markov processes provides an adequate structural description of the actual testing process. However, accuracy of this model essentially depends on accuracy of reproduction of densities of distribution of duration of the system residence in each of the possible states. An alternative model that uses the method of probability-time graphs is less demanding. For its implementation, it is sufficient to know the mean values of duration of residence in each of the states and the probability of transitions from one state to another. Correlations were obtained for calculating statistical characteristics and density of distribution of the mean time of execution of the software security testing algorithm. The model can be used to study basic stages of software security testing. Application of this model will reduce software vulnerability and improve security of the IT project as a whole. Also, the model is applicable when developing new methods, algorithms, and procedures for managing the IT projects
SOFTWARE SECURITY TESTING A PERTINENT FRAMEWORK
Authors: Rajeev Kumar, Suhel Ahmad Khan, Raees Ahmad Khan
Published in: Journal of Global Research in Computer Sciences (2014-04-13)

Different surveys point toward that over the past several years’ software security has raised its precedence for many software organizations. Software security testing is upgraded with the help of security attributes, security models, testing tools and most importantly test case used in testing. Software security testing was once considered a technical obligation performed by software developers. At that time, software security was much important during the test phase of software development life cycle. Present time an emergent number of security incidents and a growing awareness among business owners about invalidated software due to security issues have moved security testing into software world of testers. It is often impossible to find all the errors in a program. This basics problem in testing thus arise an open question, as to what would be the policy that we would adopt for testing. Thus now security testing is important in each phase of development life cycle. Here is a proposed framework is finalized for that security testing.
Towards an Architectural Treatment of Software Security: a Connector-Centric Approach
Authors: Jie Ren, Richard Taylor, Paul Dourish, David Redmiles
Published in:  (2005-01-01)

Security is a very important concern for software architecture and software components. Previous modeling approaches provide insufficient support for an in-depth treatment of security. This paper argues for a more comprehensive treatment based on software connectors. Connectors provide a suitable vehicle to model, capture, and enforce security. Our approach models security principal, privilege, trust, and context of architectural constituents. Extending our existing architecture description language and support tools, our approach can facilitate describing the security characteristics of an architecture generating enabling infrastructure, and monitoring run-time conformance. Initial results of applying this approach are illustrated through a case study. The contribution of this research is a deeper and more comprehensive treatment of architectural security through software connectors.
Automated Risk Management Based Software Security Vulnerabilities Management
Authors: Raghavendra Rao Althar, Debabrata Samanta, Manjit Kaur, Dilbag Singh, Heung-No Lee
Published in: IEEE Access (2022-01-01)

An automated risk assessment approach is explored in this work. The focus is to optimize the conventional threat modeling approach to explore software system vulnerabilities. Data produced in the software development processes are better leveraged using Machine Learning approaches. A large amount of industry knowledge around security vulnerabilities can be leveraged to enhance current threat modeling approaches. Work done here is in the ecosystem of software development processes that use Agile methodology. Insurance business domain data are explored as a target for this study. The focus is to enhance the traditional threat modeling approach with a better quantitative approach and reduce the biases introduced by the people who are part of software development processes. This effort will help bridge multiple data sources prevalent across the software development ecosystem. Bringing these various data sources together will assist in understanding patterns associated with security aspects of the software systems. This perspective further helps to understand and devise better controls. Approaches explored so far have considered individual areas of software development and their influence on improving security. There is a need to build an integrated approach for a total security solution for the software systems. A wide variety of machine learning approaches and ensemble approaches will be explored. The insurance business domain is considered for the research here. CWE (Common Weaknesses Enumeration) mapping from industry knowledge are leveraged to validate the security needs from the industry perspective. This combination of industry and company data will help get a holistic picture of the software system&#x2019;s security. Combining the industry and company data helps lay down the path for an integrated security management system in software development. The risk management framework with the quantitative threat modeling process is the work&#x2019;s uniqueness. This work contributes towards making the software systems secure and robust with time.
Research on software security awareness
Authors: C. Banerjee, S. K. Pandey
Published in: ACM SIGSOFT Software Engineering Notes (2010-10-22)

People attack software deliberately to steal highly sensitive as well as personal information with the sole intention of carrying out well-funded, destructive and unethical goals that could harm individuals, nations or the whole world. Available technological controls could be implemented to tighten access and minimize persistent threats but the complete solution of secure software could only be provided by changing the behavior of the people involved. This can be achieved through effective security awareness techniques implemented by individuals because they are, in most cases, the first target for gaining access into the system. This paper highlights the utility of security awareness with the help of recent published work for building more secure software . In addition, areas that need further investigations are identified in the paper.
Analyzing the Data of Software Security Life-Span: Quantum Computing Era
Authors: Hashem Alyami, Mohd Nadeem, Wael Alosaimi, Abdullah Alharbi, Rajeev Kumar, Bineet Kumar Gupta, Alka Agrawal, Raees Ahmad Khan
Published in: Intelligent Automation & Soft Computing (2021-09-22)

Software or web application security is the main objective in the era of Information Technology (IT) and Artificial Intelligence (AI). Distinguishing proof of security at the initial stage produces significant results to comprehend the administration of security relics for best potential outcomes. A security alternative gives several methods and algorithms to ensure the software security. Security estimation is the vital factor in assessing, administrating, controlling security to improve the nature of security. It is to be realized that assessment of security at early stage of development helps in identifying distinctive worms, dangers, weaknesses and threats. This paper will talk about the definition and characterization of quantum computing in software security. For software security, we use different cryptography (methods or algorithms to secure our financial organizations, medical devices, military weapons, planes, ships, automobiles, navigators, etc. However, many cryptosystems are likely to collapse when the large quantum computer is developed. Recently, Google developed the Sycamore Processor 53 qubits. Such innovations indicate the advent of large quantum computer in future. Since cryptographic algorithm can be solved by the quantum computers, the present cryptosystem would be rendered obsolete. Hence, it is imperative to focus more on intensive research in the context of the present quantum cyber security. The main challenges in quantum era would be cryptography methods that fulfill the demands of security usability and flexibility without sacrificing the users’ confidence. This research study, in particular, focuses on ‘Software durability’ which is a quality of security that alludes to the capacity to execution of an item on schedule. In the context of software and web application, a thorough assessment of security factors will significantly influence the software’s durability in the era of quantum computing.
Security Aspects in Software Defined Radio and Cognitive Radio Networks: A Survey and A Way Ahead
Authors: Gianmarco Baldini, Taj A. Sturman, Abdur Rahim Biswas, Ruediger Leschhorn, Győző Gódor, Michael Street
Published in: IEEE Communications Surveys & Tutorials (2011-04-06)

Software Defined Radio (SDR) and Cognitive Radio (CR) are promising technologies, which can be used to alleviate the spectrum shortage problem or the barriers to communication interoperability in various application domains. The successful deployment of SDR and CR technologies will depend on the design and implementation of essential security mechanisms to ensure the robustness of networks and terminals against security attacks. SDR and CR may introduce entirely new classes of security threats and challenges including download of malicious software, licensed user emulation and selfish misbehaviors. An attacker could disrupt the basic functions of a CR network, cause harmful interference to licensed users or deny communication to other CR nodes. The research activity in this area has started only recently and many challenges are still to be resolved. This paper presents a survey of security aspects in SDR and CR. We identify the requirements for the deployment of SDR and CR, the main security threats and challenges and the related protection techniques. This paper provides an overview of the SDR and CR certification process and how it is related to the security aspects. Finally, this paper summarizes the most critical challenges in the context of the future evolution of SDR/CR technologies.
A security and trust framework for virtualized networks and software-defined networking
Authors: Zheng Yan, Peng Zhang, Athanasios V. Vasilakos
Published in: Security and Communication Networks (2015-03-26)

With the great success of the second-generation wireless telephone technology and the third-generation mobile telecommunications technology, and the fast development of the fourth-generation mobile telecommunications technology, the phase of fifth-generation mobile networks or fifth-generation wireless systems (5G) is coming. In this article, we indicate the open research issues of 5G security and trust in the context of virtualized networking and software-defined networking. We further propose a framework of security and trust focusing on solving 5G network security issues. The proposed framework applies adaptive trust evaluation and management technologies and sustainable trusted computing technologies to ensure computing platform trust and achieve software-defined network security. It adopts cloud computing to securely deploy various trustworthy security services over the virtualized networks. We analyze that the framework can support and satisfy all security requirements specified in standardization. We also suggest future research work according to the proposed framework and discuss the advantages of our framework in terms of practical deployment. Copyright © 2015 John Wiley & Sons, Ltd.
Operating System Structures to Support Security and Reliable Software
Authors: Theodore A. Linden
Published in: ACM Computing Surveys (1976-12-01)

article Free Access Share on Operating System Structures to Support Security and Reliable Software Author: Theodore A. Linden Institute for Computer Sciences and Technology, National Bureau of Standards, Washington, D.C. Institute for Computer Sciences and Technology, National Bureau of Standards, Washington, D.C.View Profile Authors Info & Claims ACM Computing SurveysVolume 8Issue 4Dec. 1976 pp 409–445https://doi.org/10.1145/356678.356682Published:01 December 1976Publication History 116citation3,245DownloadsMetricsTotal Citations116Total Downloads3,245Last 12 Months347Last 6 weeks54 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF
Software security in an Internet world: an executive summary
Authors: Timothy J. Shimeall, J.J. McDermott
Published in: IEEE Software (1999-01-01)

Businesses of all sizes use the Internet for sales, purchasing, and collaborations. They all need reliable systems. Faced with substantial numbers of reported security problems, Internet users must decide how much risk they are willing to take to participate in what the Internet world offers. After presenting the scope and origin of the Net's security problems, the authors outline three immediate steps we can take to help ensure software security. The third, examination and repair of existing systems, rivals the magnitude of the Y2K worldwide effort.
Software security is software reliability
Authors: Felix Lindner
Published in: Communications of the ACM (2006-06-01)

Enlist hacker expertise, but stay with academic fault naming conventions, when defending against the risk of exploitation of vulnerabilities and intrusions.
Cloud Implications on Software Network Structure and Security Risks
Authors: Terrence August, Marius Florin Niculescu, Hyoduk Shin
Published in: Information Systems Research (2014-07-21)

By software vendors offering, via the cloud, software-as-a-service (SaaS) versions of traditionally on-premises application software, security risks associated with usage become more diversified. This can greatly increase the value associated with the software. In an environment where negative security externalities are present and users make complex consumption and patching decisions, we construct a model that clarifies whether and how SaaS versions should be offered by vendors. We find that the existence of version-specific security externalities is sufficient to warrant a versioned outcome, which has been shown to be suboptimal in the absence of security risks. In high security-loss environments, we find that SaaS should be geared to the middle tier of the consumer market if patching costs and the quality of the SaaS offering are high, and geared to the lower tier otherwise. In the former case, when security risk associated with each version is endogenously determined by consumption choices, strategic interactions between the vendor and consumers may cause a higher tier consumer segment to prefer a lower inherent quality product. Relative to on-premises benchmarks, we find that software diversification leads to lower average security losses for users when patching costs are high. However, when patching costs are low, surprisingly, average security losses can increase as a result of SaaS offerings and lead to lower consumer surplus. We also investigate the vendor’s security investment decision and establish that, as the market becomes riskier, the vendor tends to increase investments in an on-premises version and decrease investments in a SaaS version. On the other hand, in low security-loss environments, we find that SaaS is optimally targeted to a lower tier of the consumer market, average security losses decrease, and consumer surplus increases as a result. Security investments increase for both software versions as risk increases in these environments.
Time for Addressing Software Security Issues: Prediction Models and Impacting Factors
Authors: Lotfi Ben Othmane, Golriz Chehrazi, Eric Bodden, Petar Tsalovski, Achim D. Brucker
Published in: Data Science and Engineering (2016-09-27)

Finding and fixing software vulnerabilities have become a major struggle for most software development companies. While generally without alternative, such fixing efforts are a major cost factor, which is why companies have a vital interest in focusing their secure software development activities such that they obtain an optimal return on this investment. We investigate, in this paper, quantitatively the major factors that impact the time it takes to fix a given security issue based on data collected automatically within SAP’s secure development process, and we show how the issue fix time could be used to monitor the fixing process. We use three machine learning methods and evaluate their predictive power in predicting the time to fix issues. Interestingly, the models indicate that vulnerability type has less dominant impact on issue fix time than previously believed. The time it takes to fix an issue instead seems much more related to the component in which the potential vulnerability resides, the project related to the issue, the development groups that address the issue, and the closeness of the software release date. This indicates that the software structure, the fixing processes, and the development groups are the dominant factors that impact the time spent to address security issues. SAP can use the models to implement a continuous improvement of its secure software development process and to measure the impact of individual improvements. The development teams at SAP develop different types of software, adopt different internal development processes, use different programming languages and platforms, and are located in different cities and countries. Other organizations, may use the results—with precaution—and be learning organizations.
Understanding Software Security from Design to Deployment
Authors: Mehdi Mirakhorli, Matthias Galster, Laurie Williams
Published in: ACM SIGSOFT Software Engineering Notes (2020-04-28)

Analyzing, implementing and maintaining security requirements of software-intensive systems and achieving truly secure software requires planning for security from ground up, and continuously assuring that security is maintained across the software's lifecycle and even after deployment when software evolves. Given the increasing complexity of software systems, new application domains, dynamic and often critical operating conditions, the distributed nature of many software systems, and fast moving markets which put pressure on software vendors, building secure systems from ground up becomes even more challenging. Security-related issues have previously been targeted in software engineering sub-communities and venues. In the second edition of the International Workshop on Security from Design to Deployment (SEAD) at the International Conference on Automated Software Engineering (ASE) 2020, we aimed to bring the research and practitioner communities of requirements engineers, security experts, architects, developers, and testers together to identify foundations, and challenges, and to formulate solutions related to automating the analysis, design, implementation, testing, and maintenance of secure software systems.
Software Security Requirements Gathering Instrument
Authors: Smriti Jain, Maya Ingle
Published in: International Journal of Advanced Computer Science and Applications (2011-01-01)

Security breaches are largely caused by the vulnerable software. Since individuals and organizations mostly depend on softwares, it is important to produce in secured manner. The first step towards producing secured software is through gathering security requirements. This paper describes Software Security Requirements Gathering Instrument (SSRGI) that helps gather security requirements from the various stakeholders. This will guide the developers to gather security requirements along with the functional requirements and further incorporate security during other phases of software development. We subsequently present case studies that describe the integration of the SSRGI instrument with Software Requirements Specification (SRS) document as specified in standard IEEE 830-1998. Proposed SSRGI will support the software developers in gathering security requirements in detail during requirements gathering phase.
Security in agile software development: A practitioner survey
Authors: Kalle Rindell, Jukka Ruohonen, Johannes Holvitie, Sami Hyrynsalmi, Ville Leppänen
Published in: Information and Software Technology (2020-11-20)

Context: Software security engineering provides the means to define, implement and verify security in software products. Software security engineering is performed by following a software security development life cycle model or a security capability maturity model . However, agile software development methods and processes, dominant in the software industry, are viewed to be in conflict with these security practices and the security requirements. Objective: Empirically verify the use and impact of software security engineering activities in the context of agile software development , as practiced by software developer professionals. Method: A survey ( N = 61 ) was performed among software practitioners in Finland regarding their use of 40 common security engineering practices and their perceived security impact, in conjunction with the use of 16 agile software development items and activities. Results: The use of agile items and activities had a measurable effect on the selection of security engineering practices. Perceived impact of the security practices was lower than the rate of use would imply: This was taken to indicate a selection bias, caused by e.g. developers’ awareness of only certain security engineering practices, or by difficulties in applying the security engineering practices into an iterative software development workflow. Security practices deemed to have most impact were proactive and took place in the early phases of software development. Conclusion: Systematic use of agile practices conformed, and was observed to take place in conjunction with the use of security practices. Security activities were most common in the requirement and implementation phases. In general, the activities taking place early in the life cycle were also considered most impactful. A discrepancy between the level of use and the perceived security impact of many security activities was observed. This prompts research and methodological development for better integration of security engineering activities into software development processes, methods, and tools.
Revisiting Software Security Risks
Authors: Rajeev Kumar, Suhel Ahmad Khan, Raees Ahmad Khan
Published in: British Journal of Mathematics & Computer Science (2015-01-10)

International audience
Static analysis for security
Authors: B. Chess, Gary McGraw
Published in: IEEE Security & Privacy (2004-11-01)

All software projects are guaranteed to have one artifact in common $source code. Together with architectural risk analysis, code review for security ranks very high on the list of software security best practices. We look at how to automate source-code security analysis with static analysis tools.