jehanweerasuriya/uni-ai-dataset huggingface dataset:
Towards Blockchain-Based Software-Defined Networking: Security Challenges and Solutions
Authors: Wenjuan Li, Weizhi Meng, Zhiqiang Liu, Man-Ho Au
Published in: IEICE Transactions on Information and Systems (2020-01-31)

Software-Defined Networking (SDN) enables flexible deployment and innovation of new networking applications by decoupling and abstracting the control and data planes. It has radically changed the concept and way of building and managing networked systems, and reduced the barriers to entry for new players in the service markets. It is considered to be a promising solution providing the scale and versatility necessary for IoT. However, SDN may also face many challenges, i.e., the centralized control plane would be a single point of failure. With the advent of blockchain technology, blockchain-based SDN has become an emerging architecture for securing a distributed network environment. Motivated by this, in this work, we summarize the generic framework of blockchain-based SDN, discuss security challenges and relevant solutions, and provide insights on the future development in this field.
20 Years of Software Security
Authors: John Viega
Published in: Computer (2020-10-22)

This article examines how the software security industry has evolved and where it must still improve.
Software-Defined Networking for Unmanned Aerial Vehicular Networking and Security: A Survey
Authors: James David McCoy, Danda B. Rawat
Published in: Electronics (2019-12-03)

Despite the immense benefits offered by the utilization of unmanned aerial vehicles (UAVs) in civilian and military applications, significant work needs to be done to ensure that these systems are able to securely communicate and resiliently operate to accomplish the mission. As the UAVs grow with their popularity and usability for different applications, there is a dire need to ensure that UAVs and their networks are capable of mitigating cyber-attacks on the fly. One approach that has gained considerable popularity is Software-Defined Networking (SDN) based solutions. SDN is a networking paradigm that has gained attention due to its dynamic flexibility to program networks and increase network visibility, and its potential to assist in the mitigating security vulnerabilities in the network including the network of UAVs. This article provides an overview of recent advances, and current state of art related to security vulnerabilities and SDN enabled countermeasures. This paper also presents a comparison of different approaches in a tabular form and a discussion of challenges and future research directions with respect to UAV security.
Changing the Game of Software Security
Authors: Timothy Vidas, Per Larsen, Hamed Okhravi, Ahmad‐Reza Sadeghi
Published in: IEEE Security & Privacy (2018-03-01)

For a large part of the world population, software increasingly touches all aspects of life. Clearly there are societal and business benefits to be gained, but the pervasiveness of software also presents unprecedented risk. The lack of capable people to either analyze existing or safely create new software paired with the sheer volume and accelerating pace of software development lends to automated approaches to address this risk. The Cyber Grand Challenge presented an opportunity to advance the state of the art and science in autonomous reasoning in software security. The culmination of this contest presented seven fully autonomous systems vying against each other hacking and defending previously unseen computer software, ultimately making sense of zero-day attacks, entirely without any human assistance. This collection of works presents many aspects of autonomous software security from differing perspectives. The authors detail solution approaches as well as evidence of the challenges that remain. As with many aspects of computing, while much has been accomplished software security, much work remains.
Uptane: Security and Customizability of Software Updates for Vehicles
Authors: Trishank Karthik Kuppusamy, Lois Anne DeLong, Justin Cappos
Published in: IEEE Vehicular Technology Magazine (2018-02-01)

In this article we discuss Uptane, the first, to our knowledge, compromise-resilient software update security system designed specifically for vehicles. It is designed to make obtaining all the pieces required to control a vehicle extremely difficult for attackers.
HASTE: Software Security Analysis for Timing Attacks on Clear Hardware Assumption
Authors: Prabuddha Chakraborty, Jonathan Cruz, Christopher Posada, Sandip Ray, Swarup Bhunia
Published in: IEEE Embedded Systems Letters (2021-11-08)

Information leakage via timing side-channel analysis can compromise embedded systems used in diverse applications that are otherwise secure. Most state-of-the-art timing side-channel detection techniques focus on analyzing the software code while paying little to no attention to the underlying hardware. This limits the ability of such techniques in terms of detection and repair. In this letter, we propose a timing side-channel analysis framework that takes into consideration both the software and the underlying hardware microarchitecture to detect vulnerabilities with high precision. We also propose a set of metrics to quantify the severity of the vulnerabilities. We verify our proposed framework on two different computation subroutines which are widely used in crypto and secure systems.
Architectural support for copy and tamper resistant software
Authors: David Lie Chandramohan Thekkath, Mark L. Mitchell, Patrick Lincoln, Dan Boneh, John C. Mitchell, Mark Horowitz
Published in: ACM SIGARCH Computer Architecture News (2000-11-12)

Although there have been attempts to develop code transformations that yield tamper-resistant software, no reliable software-only methods are know. This paper studies the hardware implementation of a form of execute-only memory (XOM) that allows instructions stored in memory to be executed but not otherwise manipulated. To support XOM code we use a machine that supports internal compartments---a process in one compartment cannot read data from another compartment. All data that leaves the machine is encrypted, since we assume external memory is not secure. The design of this machine poses some interesting trade-offs between security, efficiency, and flexibility. We explore some of the potential security issues as one pushes the machine to become more efficient and flexible. Although security carries a performance penalty, our analysis indicates that it is possible to create a normal multi-tasking machine where nearly all applications can be run in XOM mode. While a virtual XOM machine is possible, the underlying hardware needs to support a unique private key, private memory, and traps on cache misses. For efficient operation, hardware assist to provide fast symmetric ciphers is also required.
Layered obfuscation: a taxonomy of software obfuscation techniques for layered security
Authors: Hui Xu, Yangfan Zhou, Jiang Ming, Michael R. Lyu
Published in: Cybersecurity (2020-04-03)

Abstract Software obfuscation has been developed for over 30 years. A problem always confusing the communities is what security strength the technique can achieve. Nowadays, this problem becomes even harder as the software economy becomes more diversified. Inspired by the classic idea of layered security for risk management, we propose layered obfuscation as a promising way to realize reliable software obfuscation. Our concept is based on the fact that real-world software is usually complicated. Merely applying one or several obfuscation approaches in an ad-hoc way cannot achieve good obscurity. Layered obfuscation, on the other hand, aims to mitigate the risks of reverse software engineering by integrating different obfuscation techniques as a whole solution. In the paper, we conduct a systematic review of existing obfuscation techniques based on the idea of layered obfuscation and develop a novel taxonomy of obfuscation techniques. Following our taxonomy hierarchy, the obfuscation strategies under different branches are orthogonal to each other. In this way, it can assist developers in choosing obfuscation techniques and designing layered obfuscation solutions based on their specific requirements.
Hybrid Conventional and Quantum Security for Software Defined and Virtualized Networks
Authors: Alejandro Aguado, Vı́ctor López, Jesús Martínez-Mateo, Thomas Szyrkowiec, Achim Autenrieth, Momtchil Peev, Diego López, Vicente Martín
Published in: Journal of Optical Communications and Networking (2017-09-12)

Today&#x2019;s networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure from central offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKD systems with well-known protocols and methodologies to secure the network&#x2019;s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.
Improving security using extensible lightweight static analysis
Authors: David Evans, David Larochelle
Published in: IEEE Software (2002-01-01)

Most security attacks exploit instances of well-known classes of implementation flaws. Developers could detect and eliminate many of these flaws before deploying the software, yet these problems persist with disturbing frequency-not because the security community doesn't sufficiently understand them but because techniques for preventing them have not been integrated into the software development process. This article describes an extensible tool that uses lightweight static analysis to detect common security vulnerabilities (including buffer overflows and format string vulnerabilities).
Security Issues and Software Updates Management in the Industrial Internet of Things (IIoT) Era
Authors: Imanol Mugarza, José Luis Flores, Jose Luis Montero
Published in: Sensors (2020-12-14)

New generation Industrial Automation and Control Systems (IACS) are providing advanced connectivity features, enabling new automation applications, services and business models in the Industrial Internet of Things (IIoT) era. Nevertheless, due to the extended attack surface and increasing number of cyber-attacks against industrial equipment, security concerns arise. Hence, these systems should provide enough protection and resiliency against cyber-attacks throughout their entire lifespan, which, in the case of industrial systems, may last several decades. A sound and complete management of security issues and software updates is fundamental to achieve such goal, since leading-edge security countermeasures implemented in the development phase may eventually become out-of-date. In this article, a review of the IEC 62443 industrial security standard concerning the security maintenance of IIoT systems and components is given, along with guidelines for the implementation of such processes. As concluded, the security issues and software updates management shall jointly be addressed by the asset owner, service providers and product suppliers. These security processes should also be compatible with the safety procedures established by safety standards.
Evaluating the Usable-Security of Healthcare Software Through Unified Technique of Fuzzy Logic, ANP and TOPSIS
Authors: Fahad Ahmed Al-Zahrani
Published in: IEEE Access (2020-01-01)

The current research efforts in the security domain are essentially inspired by the intention to ensure both healthcare software's security and usability. Practitioners are continuously working on techniques that can optimise security while affording the ease of use. Inspite of the numerous efforts by the developers and security experts in this context, the level of usability-security is not the same as it should be. Furthermore, it is important to do more work on the most effective strategies for evaluating and increasing the usable-security of healthcare technology. Quantitative usability and security assessment is an important part of increasing the standards of software security especially with regard to software used in healthcare. This study's objective, in particular, is to evaluate the usability-security of healthcare software. Thereafter, based on the empirical analysis of comprehensive data, the study recommends the strategies that would facilitate in designing healthcare software with optimum security while preserving its' usability. Decision makers often find it difficult to integrate highly secure software with maximum usability while developing the software. Hence, this research endeavour enlists the assimilation of usability and safety with their contributory attributes. Moreover, this study proposes the use of a novel technique of combining the Analytic Network Method (ANP), Fuzzy Sets (FS), and Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) to test usability together with security. The researchers employed the suggested methodology on six applications of the hospital management systems in Mecca, Saudi Arabia, to ascertain the utility of the FS-AHP-TOPSIS hybrid solution technique. Usability results along with security assessment corroborated that the most accurate and effective method for evaluating the usable-security of healthcare applications will be this innovative hybrid approach. Most relevantly, these findings will be useful in the security management without impacting the usability for the end users.
Security and privacy in sensor networks
Authors: Haowen Chan, Adrian Perrig
Published in: Computer (2003-10-01)

Sensor networks offer economically viable solutions for a variety of applications. For example, current implementations monitor factory instrumentation, pollution levels, freeway traffic, and the structural integrity of buildings. Other applications include climate sensing and control in office buildings and home environmental sensing systems for temperature, light, moisture, and motion. Sensor networks are key to the creation of smart spaces, which embed information technology in everyday home and work environments. The miniature wireless sensor nodes, or motes, developed from low-cost off-the-shelf components at the University of California, Berkeley, as part of its smart dust projects, establish a self-organizing sensor network when dispersed into an environment. The privacy and security issues posed by sensor networks represent a rich field of research problems. Improving network hardware and software may address many of the issues, but others will require new supporting technologies.
Software security evaluation using multilevel vulnerability discovery modeling
Authors: Ruchi Sharma, Avinash K. Shrivastava, Hoang Pham
Published in: Quality Engineering (2022-11-01)

In this work, we propose a new vulnerability discovery model by predicting the number and probability of occurrence of vulnerabilities of different severity levels in software. The severity prediction assumes that the vulnerability score is a continuous variable distributed over a range of 0–10 as per the widely accepted common vulnerability scoring system. We have further developed a risk assessment model which can be used to define the security level of software and is helpful in risk assessment and patch management. A numerical illustration is done on real-life dataset to validate the proposed model.
Cloud Computing: Security Issues and Challenges
Authors: Muhammad Aamir Nadeem
Published in: Journal of Wireless Communications (2016-12-05)

Cloud Computing is a recently emerged paradigm, for sure out of infancy but yet not matured, is aiming at provisioning of computing resources in most efficient and economical way. Virtualization is the key technique behind Cloud Computing. It adopts Service Oriented Architecture which enables its clients to transform their requirements problems into services thus benefited by the solution provided by the Cloud. Besides provisioning of computing and storage resources, it expanded the traditional threat environment. The vulnerabilities and threats to Cloud are the issues which if successfully overcome would make Cloud a digital fort for its users. This paper surveys the weaknesses in Cloud architecture, internet protocols, operating system and application software, and in crypto system. It also identifies the challenges related to Cloud security and counter measures to resolve those issues.
Building Security In: Preparing for a Software Security Career
Authors: Nancy R. Mead, Thomas B. Hilburn
Published in: IEEE Security & Privacy (2013-11-01)

Carnegie Mellon University's Software Engineering Institute (SEI) has developed a set of software assurance curriculum guidance documents, which provides a foundation for preparing a software security workforce. This article describes the SEI Software Assurance Curriculum Project's work and the curriculum guidance documents. A case study illustrates how individuals could use the curriculum guidance.
Using concept maps to introduce software security assurance cases
Authors: Dallas Snider, John W. Coffey, Thomas Reichherzer, Norman Wilde, Chris Terry, Joe Vandeville, Allison Heinen, Sarah Pramanik
Published in:  (2014-01-01)

To improve the security of software systems, we need to improve the software development processes used to produce them. Software security assurance cases have been proposed as a way of establishing security properties of software at different phases of the software development lifecycle; however, these assurance cases are difficult to write, communicate and introduce into an already burdened software development process. We evaluated a team-based, knowledge engineering approach to introduce software security assurance cases to neophytes through the utilization of concept maps. This approach allowed the study's participants to engage in conversations with security experts about security requirements for their software and with knowledge engineers to construct concept maps demonstrating how their software met the requirements. Our survey results and feedback show great promise for our method to be effective and efficient for disseminating knowledge about soft- ware security to new hires and students which in turn would make them cognizant of the security requirements in their organization.
Matching attack patterns to security vulnerabilities in software-intensive system designs
Authors: Michael Gegick, Laurie Williams
Published in: ACM SIGSOFT Software Engineering Notes (2005-05-15)

Fortifying software applications from attack is often an effort that occurs late in the software development process. Applying patches to fix vulnerable applications in the field is a common approach to securing applications. Abstract representations of attacks such as attack trees and attack nets can be used for identifying potential threats before a system is released. We have constructed attack patterns that can illuminate security vulnerabilities in a software-intensive system design. Matching our attack patterns to vulnerabilities in the design phase may stimulate security efforts to start early and to become integrated with the software process. The intent is that our attack patterns can be used to effectively encode software vulnerabilities in vulnerability databases. A case study of our approach with undergraduate students in a security course indicated that our attack patterns can provide general descriptions of vulnerabilities. The students were able to accurately map the patterns to vulnerabilities in a system design.
Data Security for Software as a Service
Authors: Pradeep Kumar Tiwari, Sandeep Joshi
Published in: International Journal of Service Science Management Engineering and Technology (2015-06-12)

Cloud computing is a BUZZ word of modern computing scenario. Cloud computing services are flexible and cost effective with resource utilization. Cloud computing have three service models SaaS (Software as a Service) PaaS (Plateform as a Service) and Iaas (Infrastructure as a Service). SaaS provide on demand application services such as email, ERP and CRM etc. Multi user can access applications and they can interact to each other at same time. All users data can be reside at same place. This flexibility of SaaS service also gives the security breaches. Loop holes of SaaS harder to find and maintain. The authors discuss here security vulnerabilities of SaaS with possible solutions. This study would be helpful to elaborate to understand data security issues and privacy solutions over SaaS.
Security without identification: transaction systems to make big brother obsolete
Authors: David Chaum
Published in: Communications of the ACM (1985-10-01)

The large-scale automated transaction systems of the near future can be designed to protect the privacy and maintain the security of both individuals and organizations.
Policy and implementation assurance for software security
Authors: John Wilander
Published in:  (2005-01-01)

To build more secure software, accurate and consistent security requirements must be specified. We have investigated current practice by doing a field study of eleven requirement specifications on IT systems. The overall conclusion is that security requirements are poorly specified due to three things: inconsistency in the selection of requirements, inconsistency in level of detail, and almost no requirements on standard security solutions. To build more secure software we specifically need assurance requirements on code. A way to achieve implementation assurance is to use effective methods and tools that solve or warn for known vulnerability types in code. We have investigated the effectiveness of four publicly available tools for run-time prevention of buffer over flow attacks. Our comparison shows that the best tool is effective against only 50 % of the attacks and there are six attack forms which none of the tools can handle. We have also investigated the effectiveness of ve publicly available compile-time intrusion prevention tools. The test results show high rates of false positives for the tools building on lexical analysis and low rates of true positives for the tools building on syntactical and semantical analysis. As a rst step toward a more effective and generic solution we propose dependence graphs decorated with type and range information as a way of modeling and pattern matching security properties of code. These models can be used to characterize both good and bad programming practice. They can also be used to visually explain code properties to the programmer.