jehanweerasuriya/uni-ai-dataset huggingface dataset:
STORE: Security Threat Oriented Requirements Engineering Methodology
Authors: Md Tarique Jamal Ansari, Dhirendra Pandey, Mamdouh Alenezi
Published in: Journal of King Saud University - Computer and Information Sciences (2018-12-17)

As we are continuously depending on information technology applications by adopting electronic channels and software applications for our business, online transaction and communication, software security is increasingly becoming a necessity and more advanced concern. Both the functional and non-functional requirements are important and provide the necessary needs at the early phases of the software development process, specifically in the requirement phase. The aim of this research is to identify security threats early in the software development process to help the requirement engineer elicit appropriate security requirements in a more systematic manner throughout the requirement engineering process to ensure a secure and quality software development. This article proposes the STORE methodology for security requirement elicitation based on security threats analysis, which includes the identification of four points: PoA, PoB, PoC and PoD for effective security attack analysis. Further, the proposed STORE methodology is also validated by a case study of an ERP System. We also compare our STORE methodology with two existing techniques, namely, SQUARE and MOSRE. We have shown that more effective and efficient security requirements can be elicited by the STORE methodology and that it helps the security requirement engineer to elicit security requirements in a more organized manner.
Integrating Formal Methods for Security in Software Security Education
Authors: Paolo Modesti
Published in: Informatics in Education (2020-09-16)

As the number of software vulnerabilities discovered increases, the industry is facing difficulties to find specialists to cover the vacancies for security software developers. Considering relevant teaching and learning theories, along with existing approaches in software security education, we present the pedagogic rationale and the concrete implementation of a course on security protocol development that integrates formal methods for security research into the teaching practice. A novelty of the framework is the adoption of a conceptual model aligned with the level of abstraction used for the symbolic (high-level) representation of cryptographic and communication primitives. This is aimed not only at improving skills in secure software development, but also at bridging the gap between the formal representation and the actual implementation, making formal methods and tools more accessible to students and practitioners.
Software-Defined Networking (SDN) and Distributed Denial of Service (DDoS) Attacks in Cloud Computing Environments: A Survey, Some Research Issues, and Challenges
Authors: Qiao Yan, F. Richard Yu, Qingxiang Gong, Jianqiang Li
Published in: IEEE Communications Surveys & Tutorials (2015-10-05)

Distributed denial of service (DDoS) attacks in cloud computing environments are growing due to the essential characteristics of cloud computing. With recent advances in software-defined networking (SDN), SDN-based cloud brings us new chances to defeat DDoS attacks in cloud computing environments. Nevertheless, there is a contradictory relationship between SDN and DDoS attacks. On one hand, the capabilities of SDN, including software-based traffic analysis, centralized control, global view of the network, dynamic updating of forwarding rules, make it easier to detect and react to DDoS attacks. On the other hand, the security of SDN itself remains to be addressed, and potential DDoS vulnerabilities exist across SDN platforms. In this paper, we discuss the new trends and characteristics of DDoS attacks in cloud computing, and provide a comprehensive survey of defense mechanisms against DDoS attacks using SDN. In addition, we review the studies about launching DDoS attacks on SDN, as well as the methods against DDoS attacks in SDN. To the best of our knowledge, the contradictory relationship between SDN and DDoS attacks has not been well addressed in previous works. This work can help to understand how to make full use of SDN's advantages to defeat DDoS attacks in cloud computing environments and how to prevent SDN itself from becoming a victim of DDoS attacks, which are important for the smooth evolution of SDN-based cloud without the distraction of DDoS attacks.
A Novel Software Protection Approach for Code Obfuscation to Enhance Software Security
Authors: Pratiksha Gautam, Hemraj Saini
Published in: International Journal of Mobile Computing and Multimedia Communications (2017-01-01)

Over the past few decades ago, software developers analyzed robustly several forms of software protection against illegal copying or piracy. With the expansion in digital technology, the risk of illegal copying of software also amplifies. The increasing piracy rate has posed a serious threat to software developers leading to the development of various software protection techniques. However, various techniques have been proposed for copyright protection such as software watermarking, obfuscation, tamper-proofing and diversity. The code transformation (obfuscation) is a method of transforming a program into a form which is more complicated for an adversary to understand or change the original code from an illegitimate process of reverse engineering. None of the current code obfuscation approaches provide resistance from reverse engineering attacks. The reverse engineering threat occurs due to the unconfined software code to the user. Malicious reverse engineering of software codes can be harder by exertion of code transformation on software programs. To address this, we acquaint a peculiar code transformation approach for software protection. The proposed approach is used semantically equivalent to code clone within the source code to protect logical part of program text. We have successfully implement our approach using open source java project Gantt project system and open source java obfuscator's tools. In this paper, we present our approach and demonstrate it with an illustration. The intent of this method is to prevent static analysis attack and make dynamic attack compact for an adversary. This makes it worthwhile against reverse engineering attacks.
An Integrative Model of Managing Software Security during Information Systems Development
Authors: Vijay V. Raghavan, Xiaoni Zhang
Published in: Journal of international technology and information management (2017-12-01)

This study investigates the critical relationship between organizational system development policies, procedures and processes and the resulting security quality of the systems developed. We draw from a general software quality model to provide a theoretical foundation for testing this relationship. We used paper-based survey as well as online surveys to collect data from software developers and project managers. Our results revealed a significant relationship between management support and security policies and development process control. We also found significant relationships between development-process control and security quality, attitude and security quality, and the interaction between value congruence and commitment to provide security skills development. Counter-intuitively, we did not find a significant relationship between either security policy and security quality or the interaction between security policy and its legitimacy as perceived by systems development personnel. The managerial implications of the study include the need to foster a climate of security skills development through training for system development personnel and also simultaneously find strategies to more closely align their values to the security goals of the organization. Additionally, providing management support to formulate guidelines for development process control can improve the security quality of the systems developed.
Multilevel Security Framework for NFV Based on Software Defined Perimeter
Authors: Jaspreet Singh, Ahmed Refaey, Abdallah Shami
Published in: IEEE Network (2020-03-27)

The rapid increase in global IP traaffic and the adoption of mobile devices have challenged network service providers to scale and improve infrastructure to meet this new demand. To improve return on investment for scaling networking infrastructure and capitalize on advancements in virtualization technologies, Network Function Virtualization (NFV) has been proposed. NFV does present some newfound security challenges, however, by combining elements of networking and virtualization technology. These challenges include protecting against attacks like remote hypervisor attacks, Denial of Service (DoS) attacks, Virtual Machine (VM) Hopping, and port scanning. Software- Defined Perimeter (SDP) is proposed as a framework to provide logical perimeters around these services, restricting network access and connections to the SDP-enabled Virtual Network Functions (VNFs) to trusted clients only. Several security benefits present themselves as a result of a combined NFV-SDP architecture. The deployment and access control are customize-able, catering to a wide array of user needs. The aforementioned proposed architecture was tested within a virtual environment. The test results show that the combined architecture is indeed resistant to DoS attacks. Additionally, the results lead to a discussion regarding future research and implementation potentials for this architecture.
Software penetration testing
Authors: Brad Arkin, S. Stender, Gary McGraw
Published in: IEEE Security & Privacy (2005-01-01)

Quality assurance and testing organizations are tasked with the broad objective of assuring that a software application fulfills its functional business requirements. Such testing most often involves running a series of dynamic functional tests to ensure proper implementation of the application's features. However, because security is not a feature or even a set of features, security testing doesn't directly fit into this paradigm.
Risk analysis in software design
Authors: D. Verdon, Gary McGraw
Published in: IEEE Security & Privacy (2004-07-01)

Risk analysis is, at best, a good general-purpose yardstick by which we can judge our security design's effectiveness. Because roughly 50 percent of security problems are the result of design flaws, performing a risk analysis at the design level is an important part of a solid software security program. Taking the trouble to apply risk-analysis methods at the design level for any application often yields valuable, business-relevant results. The risk analysis process is continuous and applies to many different levels, at once identifying system-level vulnerabilities, assigning probability arid impact, arid determining reasonable mitigation strategies. The paper looks at how, by considering the resulting ranked risks, business stakeholders can determine how to manage particular risks and what the most cost-effective controls might be.
Developers are Not the Enemy!: The Need for Usable Security APIs
Authors: Matthew Green, Matthew Smith
Published in: IEEE Security & Privacy (2016-09-01)

Rather than recognizing software engineers' limitations, modern security practice has created an adversarial relationship between security software designers and the developers who use their software to construct applications. Using the example of cryptographic APIs, the authors show that developers aren't the enemy and that, to strengthen security systems across the board, security professionals must focus on creating developer-friendly and developer-centric approaches.
Software Vulnerability Detection Using Deep Neural Networks: A Survey
Authors: Guanjun Lin, Sheng Wen, Qing‐Long Han, Jun Zhang, Yang Xiang
Published in: Proceedings of the IEEE (2020-06-04)

The constantly increasing number of disclosed security vulnerabilities have become an important concern in the software industry and in the field of cybersecurity, suggesting that the current approaches for vulnerability detection demand further improvement. The booming of the open-source software community has made vast amounts of software code available, which allows machine learning and data mining techniques to exploit abundant patterns within software code. Particularly, the recent breakthrough application of deep learning to speech recognition and machine translation has demonstrated the great potential of neural models’ capability of understanding natural languages. This has motivated researchers in the software engineering and cybersecurity communities to apply deep learning for learning and understanding vulnerable code patterns and semantics indicative of the characteristics of vulnerable code. In this survey, we review the current literature adopting deep-learning-/neural-network-based approaches for detecting software vulnerabilities, aiming at investigating how the state-of-the-art research leverages neural techniques for learning and understanding code semantics to facilitate vulnerability discovery. We also identify the challenges in this new field and share our views of potential research directions.
Practical malware analysis the hands-on guide to dissecting malicious software
Authors: Michael Sikorski, Andrew Honig
Published in:  (2012-01-01)

Praise for Practical Malware Analysis The book every malware analyst should keep handy. --Richard Bejtlich, CSO, Mandiant & Founder of TaoSecurity An excellent crash course in malware analysis. --Dino Dai Zovi, Independent Security Consultant . . . the most comprehensive guide to analysis of malware, offering detailed coverage of all the essential skills required to understand the specific challenges presented by modern malware. --Chris Eagle, Senior Lecturer of Computer Science at the Naval Postgraduate School A hands-on introduction to malware analysis. I'd recommend it to anyone who wants to dissect Windows malware. --Ilfak Guilfanov, Creator of IDA Pro . . . a great introduction to malware analysis. All chapters contain detailed technical explanations and hands-on lab exercises to get you immediate exposure to real malware. --Sebastian Porst, Google Software Engineer . . . brings reverse engineering to readers of all skill levels. Technically rich and accessible, the labs will lead you to a deeper understanding of the art and science of reverse engineering. I strongly recommend this book for beginners and experts alike. --Danny Quist, PhD, Founder of Offensive Computing If you only read one malware book or are looking to break into the world of malware analysis, this is the book to get. --Patrick Engbretson, IA Professor at Dakota State University and Author of The Basics of Hacking and Pen Testing . . . an excellent addition to the course materials for an advanced graduate level course on Software Security or Intrusion Detection Systems. The labs are especially useful to students in teaching the methods to reverse engineer, analyze and understand malicious software. --Sal Stolfo, Professor, Columbia University
To Docker or Not to Docker: A Security Perspective
Authors: Théo Combe, Antony Martin, Roberto Di Pietro
Published in: IEEE Cloud Computing (2016-09-01)

The need for ever-shorter development cycles, continuous delivery, and cost savings in cloud-based infrastructures led to the rise of containers, which are more flexible than virtual machines and provide near-native performance. Among all container solutions, Docker, a complete packaging and software delivery tool, currently leads the market. This article gives an overview of the container ecosystem and discusses the Docker environment's security implications through realistic use cases. The authors define an adversary model, point out several vulnerabilities affecting current Docker usage, and discuss further research directions.
A Novel Approach to Determine Software Security Level using Bayes Classifier via Static Code Metrics
Authors: Güncel Sarıman, Ecir Uğur Küçüksille
Published in: Elektronika ir Elektrotechnika (2016-03-30)

Technological developments are increasing day by day and software products are growing in an uncontrolled way. This leads to the development of applications which do not comply with principles of design. Software which has not passed security testing may put the end user into danger. During the processes of error detection and verification of developed software, static and dynamic analysis may be used. Static code analysis provides analysis in different categories while coding without code compile. Source code metrics are also within these categories. Code metrics evaluate software quality, level of risk, and interchangeability by analysing software based on those metrics. In this study, we will describe our web-based application which is developed to determine the level of security in software. In this scope, software's metric calculation method will be explained. The scoring system we used to determine the security level calculation will be explained, taking into account metric thresholds that are acceptable in the literature. Bayes Classifier Method, distinguishing risks in the project files with the analysis of uploaded sample software files, will be described. Finally, objectives of this analysis method and planned activities will be explained.DOI: http://dx.doi.org/10.5755/j01.eie.22.2.12177
A Digital Twin Based Industrial Automation and Control System Security Architecture
Authors: Christian Gehrmann, Martin Gunnarsson
Published in: IEEE Transactions on Industrial Informatics (2019-09-03)

The digital twin is a rather new industrial control and automation systems concept. While the approach so far has gained interest mainly due to capabilities to make advanced simulations and optimizations, recently the possibilities for enhanced security have got attention within the research community. In this article, we discuss how a digital twin replication model and corresponding security architecture can be used to allow data sharing and control of security-critical processes. We identify design-driving security requirements for digital twin based data sharing and control. We show that the proposed state synchronization design meets the expected digital twin synchronization requirements and give a high-level design and evaluation of other security components of the architecture. We also make performance evaluations of a proof of concept for protected software upgrade using the proposed digital twin design. Our new security framework provides a foundation for future research work in this promising new area.
Software Security Static Analysis False Alerts Handling Approaches
Authors: Aymen Akremi
Published in: International Journal of Advanced Computer Science and Applications (2021-01-01)

False Positive Alerts (FPA), generated by Static Analyzers Tools (SAT), reduce the effectiveness of the automatic code review, letting them be underused in practice. Researchers conduct a lot of tests to improve SAT accuracy while keeping FPA at a lower rate. They use different simulated and production datasets to validate their proposed methods. This paper surveys recent approaches dealing with FPA filtering; it compares them and discusses their usefulness. It also studies the used datasets to validate the identified methods and show their effectiveness to cover most program defects. This study focuses mainly on the security bugs covered by the datasets and handled by the existing methods.
Sanctum: Minimal Hardware Extensions for Strong Software Isolation
Authors: Victor Costan, Ilia A. Lebedev, Srinivas Devadas
Published in:  (2016-01-01)

Sanctum offers the same promise as Intel’s Software Guard Extensions (SGX), namely strong provable isolation of software modules running concurrently and sharing resources, but protects against an important class of additional software attacks that infer private information from a program’s memory access patterns. Sanctum shuns unnecessary complexity, leading to a simpler security analysis. We follow a principled approach to eliminating entire attack surfaces through isolation, rather than plugging attack-specific privacy leaks. Most of Sanctum’s logic is implemented in trusted software, which does not perform cryptographic operations using keys, and is easier to analyze than SGX’s opaque microcode, which does. Our prototype targets a Rocket RISC-V core, an open implementation that allows any researcher to reason about its security properties. Sanctum’s extensions can be adapted to other processor cores, because we do not change any major CPU building block. Instead, we add hardware at the interfaces between generic building blocks, without impacting cycle time. Sanctum demonstrates that strong software isolation is achievable with a surprisingly small set of minimally invasive hardware changes, and a very reasonable overhead.
Security policies and the software developer
Authors: D. Verdon
Published in: IEEE Security & Privacy (2006-07-01)

A wide range of legal and regulatory issues surround Web software development, including the need to protect consumer information. A good set of security policies limit company exposure. Understanding and implementing good policies is therefore as essential as implementing SSL. In this article, we consider two simple questions: why should software architects and developers work with corporate information security policies and, just as important, how? But first, a disclaimer: by virtue of this discussion, we inevitably have to consider relevant state and federal laws and regulations. However, this article isn't predominantly about the law and isn't meant to render legal advice. Instead, we hope to understand how policy compliance plays a pivotal role in obtaining protection both under and from the law. This article doesn't provide an exhaustive study of all the relevant laws, but we cited some sources of further information
Enhancing Software Security through Automation in the Software Development Lifecycle
Authors: Vandana Sharma
Published in: Journal of Artificial Intelligence & Cloud Computing (2022-11-24)

In the rapidly evolving landscape of software development, ensuring robust security measures is paramount to safeguard against an ever-expanding array of cyber threats. This article explores the critical role of security automation in fortifying software security throughout the Software Development Lifecycle (SDLC). From the early stages of code development to the deployment and post-deployment phases, we delve into key components of security automation, shedding light on how they contribute to a proactive and comprehensive approach to software security. By understanding and implementing these automated security measures, developers and organizations can bolster their defenses, mitigate vulnerabilities, and cultivate a security-centric culture within their development teams.
Software Security Engineering
Authors: Khaled M. Khan
Published in: International Journal of Secure Software Engineering (2012-01-01)

Muthu Ramachandran from Leeds Metropolitan University, UK has recently published a book entitled, Software Security Engineering: Design and Applications. The author claims that the book provides systematic approaches to engineering, building and assuring software security throughout software lifecycle, software security based requirements engineering, design for software security, software security implementation, best practice guideline on developing software security, test for software security, and quality validation for software security.Request access from your librarian to read this article's full text.