jehanweerasuriya/uni-ai-dataset huggingface dataset:
Quantitative Analysis of Software Security through Fuzzy PROMETHEE-II Methodology: A Design Perspective
Authors: Suhel Ahmad Khan, Mohd Nadeem, Alka Agrawal, Raees Ahmad Khan, Rajeev Kumar
Published in: International Journal of Modern Education and Computer Science (2021-12-08)

The objective of this research study is to develop secure and multi-functional software or web application with controlled complexity. The demand of software security in different IT sectors is the main focus of the present endeavor. The different design factors and their prioritization are the need and demand of the system. We have selected the case of banking software or application. Security assessment is an integral part of risk management practices which provides an analytical mechanism to control and integrate security features for valuable opinion during the design phase. The designing of secure software and the impact of security factor is adopted and evaluated by the Preference Ranking Organization Method for Enrichment Evaluation (PROMETHEE)-II method. The PROMETHEE-II methodology evaluates the impact of factors with respect to the design alternatives. The current priority is to work on the state-of-theart security attributes or alternatives of software design. Decision makers are generally responsible for evaluating various responses within their technical or scientific jurisdiction and rank them accordingly. Fuzzy set theories are the most appropriate tools to provide results for modeling qualitative information because of their ability to handle the impreciseness that is common in rating alternatives. The proposed work highlights the effectiveness of fuzzy PROMETHEE-II method in this context. We have enlisted this methodology for comparing software security factors in design perspective by using linguistic variables. The quantitative analysis attempted in our study was highly accurate for evaluating the security attributes and ranking them as per their priority, particularly in the context of banking software design. The study concludes with the advantages of employing the Fuzzy PROMETHEE-II vis- -vis the other methodologies in analyzing the software security in the context of design.
Password security
Authors: Robert Morris, Ken Thompson
Published in: Communications of the ACM (1979-11-01)

This paper describes the history of the design of the password security scheme on a remotely accessed time-sharing system. The present design was the result of countering observed attempts to penetrate the system. The result is a compromise between extreme security and ease of use.
MUD-Based Behavioral Profiling Security Framework for Software-Defined IoT Networks
Authors: Prabhakar Krishnan, Kurunandan Jain, Rajkumar Buyya, Pandi Vijayakumar, Anand Nayyar, Muhammad Bilal, Houbing Song
Published in: IEEE Internet of Things Journal (2021-09-17)

The rapid development and deployment of Internet of Things (IoT) devices in modern networks and Industry 4.0 have attracted substantial interest from cybersecurity researchers. In this study, we propose a software-defined framework that improves network intrusion detection systems by using manufacturer usage description (MUD) to enhance the behavioral monitoring in IoT networks. We aim to explore whether Industrial IoT (IIoT) devices typically serve a common role in cyber&#x2013;physical systems, and their communications exhibit predictable patterns that can be defined in MUD profile(s) formally and succinctly. We design a framework that utilizes the concept of digital twins and software-defined networking to improve the security of IIoT environments. The MUD data are profiled, and the actions are evaluated on the network digital twin before they are used in the physical network. The behavioral profiling system is updated in real time, thereby improving the overall system security and compliance to policies in the IoT deployment. Evaluation results show that our solution outperforms existing approaches substantially in terms of attack detection accuracy, predicting security incidents, response time, and resource usage.
A DEVELOPMENT FRAMEWORK FOR SOFTWARE SECURITY IN NUCLEAR SAFETY SYSTEMS: INTEGRATING SECURE DEVELOPMENT AND SYSTEM SECURITY ACTIVITIES
Authors: Jaekwan Park, Yong-Suk Suh
Published in: Nuclear Engineering and Technology (2014-02-01)

The protection of nuclear safety software is essential in that a failure can result in significant economic loss and physical damage to the public. However, software security has often been ignored in nuclear safety software development. To enforce security considerations, nuclear regulator commission recently issued and revised the security regulations for nuclear computer-based systems. It is a great challenge for nuclear developers to comply with the security requirements. However, there is still no clear software development process regarding security activities. This paper proposes an integrated development process suitable for the secure development requirements and system security requirements described by various regulatory bodies. It provides a three-stage framework with eight security activities as the software development process. Detailed descriptions are useful for software developers and licensees to understand the regulatory requirements and to establish a detailed activity plan for software design and engineering.
Measuring Security Durability of Software through Fuzzy-Based Decision-Making Process
Authors: Rajeev Kumar, Mohammad Zarour, Mamdouh Alenezi, Alka Agrawal, Raees Ahmad Khan
Published in: International Journal of Computational Intelligence Systems (2019-01-01)

It is critical to develop secure software with long-term performance and capability to withstand and forestall the growing competition in the software development industry. To enhance the potential of Confidentiality, Integrity, and Availability (CIA), a mechanism is required to built in and secure the durability at the time of software development. Security of a software product is durable if the software works efficiently for user's satisfaction up to the expected duration. Despite the fact that focusing on security which is durable enough considerably reduces maintenance cost, the work done on addressing security as well as durability issues simultaneously during software development remains minimal. To achieve durable security, there is a need to fill the gap between security and durability through identifying and establishing a relationship between security and durability attributes. This article extends the concept of the life span of security services and assesses as well as prioritizes security durability attributes by taking a real-time case study. While building durable security, security experts often face complicated decision problems. Hence, multi-criteria decision-making techniques have been used to solve the issues of measuring conflicting tangible/intangible criteria. In addition, the fuzzy simple average method is used for finding out the rating of security durability attributes. The work has been demonstrated by taking a case study. The results of the study would be useful for security developers to assure the importance of attributes for improving the duration of security.
Influencing the security prioritisation of an agile software development project
Authors: Inger Anne Tøndel, Daniela S. Cruzes, Martin Gilje Jaatun, Guttorm Sindre
Published in: Computers & Security (2022-04-25)

Software security is a complex topic, and for development projects it can be challenging to assess what security is necessary and cost-effective. Agile Software Development (ASD) values self-management. Thus, teams and their Product Owners are expected to also manage software security prioritisation. In this paper we build on the notion that security experts who want to influence the priority given to security in ASD need to do this through interactions and support for teams rather than prescribing certain activities or priorities. But to do this effectively, there is a need to understand what hinders and supports teams in prioritising security. Based on a longitudinal case study, this article offers insight into the strategy used by one security professional in an SME to influence the priority of security in software development projects in the company. The main result is a model of influences on security prioritisation that can assist in understanding what supports or hinders the prioritisation of security in ASD, thus providing recommendations for security professionals. Two alternative strategies are outlined for software security in ASD – prescribed and emerging – where we hypothesise that an emerging approach can be more relevant for SMEs doing ASD, and that this can impact how such companies should consider software security maturity.
Bug, Fault, Error, or Weakness: Demystifying Software Security Vulnerabilities
Authors: Irena Bojanova, Carlos Eduardo C. Galhardo
Published in: IT Professional (2023-01-01)

In this work, we define the notions of software bug, weakness, and vulnerability in the context of cybersecurity and elucidate their causal relations.
Enhance Software-Defined Network Security with IoT for Strengthen the Encryption of Information Access Control
Authors: Vrince Vimal, R. Muruganantham, R. Prabha, A. N. Arularasan, P. Nandal, K. Chanthirasekaran, Gopi Reddy Ranabothu
Published in: Computational Intelligence and Neuroscience (2022-10-03)

The Internet of Things (IoT) is legitimately growing quicker. The operators have already started setting up a diligent infrastructure for these gadgets. Various technologies need to be developed for this type of sensor, including enterprise safety initiatives. This paper covers the stability routing protocol, which assumes an assessment of credibility in gadgets and packet flow. To build reliable Software-Defined Network (SDN) routes, build on the trust between network element flows and Quality of Service (QoS) or energy conditions. The SDN architecture is used for the Cognitive Protocol Network (CPN) technical platform to increase the energy level. Stochastic Neural Networks (SNNs) are accredited with information extracted from perceptual packets and make decentralized decisions. The proposed network infrastructure is designed and integrated into the SerIoT techniques to strengthen IoT encryption for information access control. The versatility of the technology is to circumvent the unpredictable connectivity of the system and the node decreases in terms of potential cryptographic capacity, limited interval, a target node, and deterministic energy. Based on factual statistical data, appropriate marketing generates an end-to-end antitheft solution that meets a set of predetermined circuit restrictions. A study must collaborate by demonstrating numerous flaws due to the obvious instability of clusters, which is essential for the efficiency of the platform.
Hacker Behavior, Network Effects, and the Security Software Market
Authors: Debabrata Dey, Atanu Lahiri, Guoying Zhang
Published in: Journal of Management Information Systems (2012-10-01)

The market for security software has witnessed an unprecedented growth in recent years. A closer examination of this market reveals certain idiosyncrasies that are not observed in a traditional market. For example, it is a highly competitive market with over 80 vendors. Yet the market coverage is relatively low. Prior research has not attempted to explain what makes this market so different. In this paper, we develop an economic model to find possible answers to this question. Our model uses existing classification of different types of attacks and models their resulting network effects. We find that the negative network effect from indirect attacks, which is further enhanced by value-based targeted attacks, provides a possible explanation for the unique structure of this market. Overall, our results highlight the unique nature of the security software market, furnish rigorous arguments for several counterintuitive observations in the real world, and provide managerial insights for vendors on market competition.
Let the Pirates Patch? An Economic Analysis of Software Security Patch Restrictions
Authors: Terrence August, Tunay I. Tunca
Published in:  (2006-05-01)

We study the question of whether a software vendor should allow users of unlicensed (pirated) copies of a software product to apply security patches. We present a joint model of network software security and software piracy and contrast two policies that a software vendor can enforce: (i) restriction of security patches only to legitimate users or (ii) provision of access to security patches to all users whether their copies are licensed or not. We find that when the software security risk is high and the piracy enforcement level is low, or when tendency for piracy in the consumer population is high, it is optimal for the vendor to restrict unlicensed users from applying security patches. When piracy tendency in the consumer population is low, applying software security patch restrictions is optimal for the vendor only when the piracy enforcement level is high. If patching costs are sufficiently low, however, an unrestricted patch release policy maximizes vendor profits. We also show that the vendor can use security patch restrictions as a substitute to investment in software security, and this effect can significantly reduce welfare. Furthermore, in certain cases, increased piracy enforcement levels can actually hurt vendor profits. We also show that governments can increase social surplus and intellectual property protection simultaneously by increasing piracy enforcement and utilizing the strategic interaction of piracy patch restrictions and network security. Finally, we demonstrate that, although unrestricted patching can maximize welfare when the piracy enforcement level is low, contrary to what one might expect, when the piracy enforcement level is high, restricting security patches only to licensed users can be socially optimal.
High-speed high-security signatures
Authors: Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo‐Yin Yang
Published in: Journal of Cryptographic Engineering (2012-08-13)

This paper shows that a $390 mass-market quad-core 2.4GHz Intel Westmere (Xeon E5620) CPU can create 109000 signatures per second and verify 71000 signatures per second on an elliptic curve at a 2 128 security level. Public keys are 32 bytes, and signatures are 64 bytes. These performance figures include strong defenses against software side-channel attacks: there is no data flow from secret keys to array indices, and there is no data flow from secret keys to branch conditions.
Research on Cross-Company Defect Prediction Method to Improve Software Security
Authors: Yanli Shao, Jingru Zhao, Xingqi Wang, Weiwei Wu, Jinglong Fang
Published in: Security and Communication Networks (2021-08-24)

As the scale and complexity of software increase, software security issues have become the focus of society. Software defect prediction (SDP) is an important means to assist developers in discovering and repairing potential defects that may endanger software security in advance and improving software security and reliability. Currently, cross-project defect prediction (CPDP) and cross-company defect prediction (CCDP) are widely studied to improve the defect prediction performance, but there are still problems such as inconsistent metrics and large differences in data distribution between source and target projects. Therefore, a new CCDP method based on metric matching and sample weight setting is proposed in this study. First, a clustering-based metric matching method is proposed. The multigranularity metric feature vector is extracted to unify the metric dimension while maximally retaining the information contained in the metrics. Then use metric clustering to eliminate metric redundancy and extract representative metrics through principal component analysis (PCA) to support one-to-one metric matching. This strategy not only solves the metric inconsistent and redundancy problem but also transforms the cross-company heterogeneous defect prediction problem into a homogeneous problem. Second, a sample weight setting method is proposed to transform the source data distribution. Wherein the statistical source sample frequency information is set as an impact factor to increase the weight of source samples that are more similar to the target samples, which improves the data distribution similarity between the source and target projects, thereby building a more accurate prediction model. Finally, after the above two-step processing, some classical machine learning methods are applied to build the prediction model, and 12 project datasets in NASA and PROMISE are used for performance comparison. Experimental results prove that the proposed method has superior prediction performance over other mainstream CCDP methods.
Software assurance for security
Authors: Gary McGraw
Published in: Computer (1999-04-01)

The article discusses an approach to security analysis that we have applied successfully over the past several years (to 1999) at Reliable Software Technologies. Our approach is no magic bullet, but it offers a reasoned methodology that has proven to be useful in the trenches. Our methodology, like many useful things, is a mix of art and engineering. The idea is straightforward: design a system with security in mind, analyze the system in light of known and anticipated risks, rank the risks according to their severity, test to the risks, and cycle broken systems back through the design process. The process outlined above has one essential underlying goal: avoiding the unfortunately pervasive penetrate-and-patch approach to computer security-that is, avoiding the problem of desperately trying to come up with a fix to a problem that is being actively exploited by attackers. In simple economic terms, finding and removing bugs in a software system before its release is orders of magnitude cheaper and more effective than trying to fix systems after release.
Mobile agents and security
Authors: Michael S. Greenberg, L.C. Byington, David G. Harper
Published in: IEEE Communications Magazine (1998-07-01)

The practicality of mobile agents hinges on realistic security techniques. Mobile agent systems are combination client/servers that transport, and provide an interface with host computers for, mobile agents. Transport of mobile agents takes place between mobile agent systems, which are located on heterogeneous platforms, making up an infrastructure that has the potential to scale to the size of any underlying network. Mobile agents can be rapidly deployed, and can respond to each other and their environment. These abilities expose flaws in current security technology. This article surveys the risks connected with the use of mobile agents, and security techniques available to protect mobile agents and their hosts. The inadequacies of the security techniques developed from the information fortress model are identified. They are the result of using a good model in an inappropriate context (i.e. a closed system model in a globally distributed networking computing base). Problems with commercially available techniques include: (1) conflicts between security techniques protecting hosts and mobile agents, (2) inability to handle multiple collaborative mobile agents, and (3) emphasis on the credentials of software instead of on the integrity of software to determine the level of trust.
Cloud Services vs. On-Premises Software: Competition Under Security Risk and Product Customization
Authors: Zan Zhang, Guofang Nan, Yong Tan
Published in: Information Systems Research (2020-09-01)

Because of its on-demand feature and flexible pay-as-you-go mechanism, cloud service dramatically reduces the up-front information technology expenses that may deter many clients from implementing on-premises software. The associated security risks and low customization capability, however, create challenges for the adoption of cloud service. We study the competitive implications of security risks and customization capability on consumer purchase choices and vendors’ pricing and investment strategies. Although cloud services are perceived to be more vulnerable to cyberattack, our results demonstrate that in high-security-loss environments, using cloud service yields a lower average expected loss for consumers as compared with on-premises software. By endogenizing vendors’ investment decisions, our investigation highlights that the cloud vendor does not necessarily economically benefit from investing in addressing cloud security, especially in low-security-loss environments. We also find that the on-premises vendor’s security and customization investments act as strategic substitutes in low-security-loss environments and, under certain conditions, complement in high-security-loss environments. We further examine welfare-maximizing security investments and find that the socially optimal investment requires greater effort to improve cloud security in low-security-loss environments and to improve on-premises software security in high-security-loss environments.
Designing a Blockchain-Based IoT With Ethereum, Swarm, and LoRa: The Software Solution to Create High Availability With Minimal Security Risks
Authors: Kazım Rıfat Özyılmaz, Arda Yurdakul
Published in: IEEE Consumer Electronics Magazine (2019-02-05)

Today, the number of Internet of Things (IoT) devices in all aspects of life is increasing exponentially. Our cities are getting smarter and informing us about our surroundings in a contextual manner. However, we face significant challenges in deploying, managing, and collecting data from these devices. In addition, we must address the problem of storing and mining that data for higher-quality IoT services. Blockchain technology, even in today's nascent form, has the potential to be the foundation for a common, distributed, trustless, and autonomous infrastructure system. This article describes a standardized IoT infrastructure where data are stored on a distributed storage service that is fault-tolerant and resistant to distributed denial of service (DDOS) attacks and data access is managed by a decentralized, trustless blockchain. The illustrated system used LoRa as the emerging network technology, Swarm as the distributed data storage platform, and Ethereum as the blockchain platform. Such a data back end will ensure high availability with minimal security risks while replacing traditional back-end systems with a single "smart contract".
Enhancing Security of Software Defined Mobile Networks
Authors: Madhusanka Liyanage, Ijaz Ahmed, Jude Okwuibe, Mika Ylianttila, Hammad Kabir, Jesús Llorente Santos, Raimo Kantola, Oscar López Perez, Mikel Uriarte, Edgardo Montes de
Published in: IEEE Access (2017-01-01)

Traffic volumes in mobile networks are rising and end-user needs are rapidly changing. Mobile network operators need more flexibility, lower network operating costs, faster service roll-out cycles, and new revenue sources. The 5th Generation (5G) and future networks aim to deliver ultra-fast and ultra-reliable network access capable of supporting the anticipated surge in data traffic and connected nodes in years to come. Several technologies have been developed to meet these emergent demands of future mobile networks, among these are software defined networking, network function virtualization, and cloud computing. In this paper, we discuss the security challenges these new technologies are prone to in the context of the new telecommunication paradigm. We present a multi-tier component-based security architecture to address these challenges and secure 5G software defined mobile network (SDMN), by handling security at different levels to protect the network and its users. The proposed architecture contains five components, i.e., secure communication, policy-based communication, security information and event management, security defined monitoring, and deep packet inspection components for elevated security in the control and the data planes of SDMNs. Finally, the proposed security mechanisms are validated using test bed experiments.