jehanweerasuriya/uni-ai-dataset huggingface dataset:
Software security models and frameworks: an overview and current trends
Authors: Fridah C. Korir
Published in: World Journal of Advanced Engineering Technology and Sciences (2023-03-18)

The continued dependence on information technology applications has led to the adoption of electronic channels and software applications to support businesses, online transactions and communications. In this perspective, both functional and non-functional requirements are critical for the provision of necessary needs at the early phases of the software development process. This is specifically important in the requirement phase of the software development process. Software security is increasingly becoming a necessity concern in this environment. Unfortunately, security concepts such as access control requirements are mostly considered after the functional requirement definition stage. In addition, majority of the developers and organizations regard security as an activity that can be incorporated after the development of a system. This leads to flaws and security defects in the access control mechanism. Therefore, software security issues must be given higher priority in the early stages of the development process. The aim of this paper is to offer a survey of the software security techniques, frameworks and models that have been developed to deal with these issues. The results obtained indicate that software vulnerabilities have made it possible for attackers to exploit them to cause havoc in computerized systems and has become one of the most critical risks facing modern corporate networks. Since most of these vulnerabilities involve exploitable weaknesses introduced through badly written code, the cyber security community has tried to come up with techniques to enhance software products.
The Oracle Problem in Software Testing: A Survey
Authors: Earl T. Barr, Mark Harman, Phil McMinn, Muzammil Shahbaz, Shin Yoo
Published in: IEEE Transactions on Software Engineering (2014-11-20)

Testing involves examining the behaviour of a system in order to discover potential faults. Given an input for a system, the challenge of distinguishing the corresponding desired, correct behaviour from potentially incorrect behavior is called the “test oracle problem”. Test oracle automation is important to remove a current bottleneck that inhibits greater overall test automation. Without test oracle automation, the human has to determine whether observed behaviour is correct. The literature on test oracles has introduced techniques for oracle automation, including modelling, specifications, contract-driven development and metamorphic testing. When none of these is completely adequate, the final source of test oracle information remains the human, who may be aware of informal specifications, expectations, norms and domain specific information that provide informal oracle guidance. All forms of test oracles, even the humble human, involve challenges of reducing cost and increasing benefit. This paper provides a comprehensive survey of current approaches to the test oracle problem and an analysis of trends in this important area of software testing research and practice.
A Survey of Software Clone Detection From Security Perspective
Authors: Haibo Zhang, Kouichi Sakurai
Published in: IEEE Access (2021-01-01)

For software engineering, if two code fragments are closely similar with minor modifications or even identical due to a copy-paste behavior, that is called software/code clone. Code clones can cause trouble in software maintenance and debugging process because identifying all copied compromised code fragments in other locations is time-consuming. Researchers have been working on code clone detection issues for a long time, and the discussion mainly focuses on software engineering management and system maintenance. Another considerable issue is that code cloning provides an easy way to attackers for malicious code injection. A thorough survey work of code clone identification/detection from the security perspective is indispensable for providing a comprehensive review of existing related works and proposing future potential research directions. This paper can satisfy above requirements. We review and introduce existing security-related works following three different classifications and various comparison criteria. We then discuss three further research directions, (i) deep learning-based code clone vulnerability detection, (ii) vulnerable code clone detection for 5G-Internet of Things devices, and (iii) real-time detection methods for more efficiently detecting clone attacks. These methods are more advanced and adaptive to technological development than current technologies, and still have enough research space for future studies.
Principled design of the modern Web architecture
Authors: Roy T. Fielding, Richard N. Taylor
Published in: ACM Transactions on Internet Technology (2002-05-01)

The World Wide Web has succeeded in large part because its software architecture has been designed to meet the needs of an Internet-scale distributed hypermedia application. The modern Web architecture emphasizes scalability of component interactions, generality of interfaces, independent deployment of components, and intermediary components to reduce interaction latency, enforce security, and encapsulate legacy systems. In this article we introduce the Representational State Transfer (REST) architectural style, developed as an abstract model of the Web architecture and used to guide our redesign and definition of the Hypertext Transfer Protocol and Uniform Resource Identifiers. We describe the software engineering principles guiding REST and the interaction constraints chosen to retain those principles, contrasting them to the constraints of other architectural styles. We then compare the abstract model to the currently deployed Web architecture in order to elicit mismatches between the existing protocols and the applications they are intended to support.
IoT Privacy and Security: Challenges and Solutions
Authors: Lo’ai Tawalbeh, Fadi Muheidat, Mais Tawalbeh, Muhannad Quwaider
Published in: Applied Sciences (2020-06-15)

Privacy and security are among the significant challenges of the Internet of Things (IoT). Improper device updates, lack of efficient and robust security protocols, user unawareness, and famous active device monitoring are among the challenges that IoT is facing. In this work, we are exploring the background of IoT systems and security measures, and identifying (a) different security and privacy issues, (b) approaches used to secure the components of IoT-based environments and systems, (c) existing security solutions, and (d) the best privacy models necessary and suitable for different layers of IoT driven applications. In this work, we proposed a new IoT layered model: generic and stretched with the privacy and security components and layers identification. The proposed cloud/edge supported IoT system is implemented and evaluated. The lower layer represented by the IoT nodes generated from the Amazon Web Service (AWS) as Virtual Machines. The middle layer (edge) implemented as a Raspberry Pi 4 hardware kit with support of the Greengrass Edge Environment in AWS. We used the cloud-enabled IoT environment in AWS to implement the top layer (the cloud). The security protocols and critical management sessions were between each of these layers to ensure the privacy of the users’ information. We implemented security certificates to allow data transfer between the layers of the proposed cloud/edge enabled IoT model. Not only is the proposed system model eliminating possible security vulnerabilities, but it also can be used along with the best security techniques to countermeasure the cybersecurity threats facing each one of the layers; cloud, edge, and IoT.
Software Diversity for Future Systems Security
Authors: Abdelouahed Gherbi, Robert Charpentier, Mario Couture
Published in: Espace ÉTS (ETS) (2011-09-01)

Abstract : Software security represents a major concern as cyber attacks continue to grow in number and sophistication. One security-weakening factor is related to the standardized software ecosystem that facilitates the spread of malware in systems that share common vulnerabilities. In this overview article, the main concepts associated with diversity and software redundancy are described in the perspective of improving attack resistance. The remarkable progress made in this area, where commercial implementations are now emerging, is also highlighted.
A Software Security Assessment System Based On Analysis of Vulnerabilities
Authors: Chenmeng Sui -, Yanzhao Liu -, Yun Liu
Published in: Journal of Convergence Information Technology (2012-04-30)

In recent years, software security plays an important role in verifying system safety and avoiding the casualties and property losses, but it is difficult to assess system security in traditional software engineering and software test. Focusing on the software security assessment system, this paper based on the vulnerability analysis method, which takes the advantage of both qualitative analysis and quantitative analysis to assess the security of software. The major methods of domestic and foreign software security measurement are discussed. Through the comparative analysis of existing vulnerability rating system, especially the CVSS and VRSS, this paper discovers their respective advantages and proposes a more accurate rating system to obtain the final security score of the software system. An example application is provided in the paper, which shows that the assessment system we proposed is practical.
Software Security: Role in SDLC
Authors: Shanky Goyal, Navleen Kaur, Sachin Majithia
Published in: CGC International Journal of Contemporary Technology and Research (2021-07-17)

This research emphasizes mainly on the need for software security. Softwares are developing at a faster pace so it is required to impose security on them in order to secure them from cybercrimes. Softwares have been facing problems by the attackers who are constantly kept on breaching the Data. Therefore this survey comprises the phases that are an integral part of the SDLC from the security point of views such as Design and testing phase. Moreover, it quests upon the data related to threats and attacks. Not only this, but it also involves the prerequisites that have to be determined before developing the software like, what are the approaches that should be followed and what are the best suitable designs to secure the software?
Frama-C: A software analysis perspective
Authors: Florent Kirchner, Nikolaï Kosmatov, Virgile Prévosto, Julien Signoles, Boris Yakobowski
Published in: Formal Aspects of Computing (2015-01-08)

Abstract Frama-C is a source code analysis platform that aims at conducting verification of industrial-size C programs. It provides its users with a collection of plug-ins that perform static analysis, deductive verification, and testing, for safety- and security-critical software. Collaborative verification across cooperating plug-ins is enabled by their integration on top of a shared kernel and datastructures, and their compliance to a common specification language. This foundational article presents a consolidated view of the platform, its main and composite analyses, and some of its industrial achievements.
A Survey on Smart Agriculture: Development Modes, Technologies, and Security and Privacy Challenges
Authors: Xing Yang, Lei Shu, Jianing Chen, Mohamed Amine Ferrag, Jun Wu, Edmond Nurellari, Kai Huang
Published in: IEEE/CAA Journal of Automatica Sinica (2020-11-25)

With the deep combination of both modern information technology and traditional agriculture, the era of agriculture 4.0, which takes the form of smart agriculture, has come. Smart agriculture provides solutions for agricultural intelligence and automation. However, information security issues cannot be ignored with the development of agriculture brought by modern information technology. In this paper, three typical development modes of smart agriculture (precision agriculture, facility agriculture, and order agriculture) are presented. Then, 7 key technologies and 11 key applications are derived from the above modes. Based on the above technologies and applications, 6 security and privacy countermeasures (authentication and access control, privacy-preserving, blockchain-based solutions for data integrity, cryptography and key management, physical countermeasures, and intrusion detection systems) are summarized and discussed. Moreover, the security challenges of smart agriculture are analyzed and organized into two aspects: 1) agricultural production, and 2) information technology. Most current research projects have not taken agricultural equipment as potential security threats. Therefore, we did some additional experiments based on solar insecticidal lamps Internet of Things, and the results indicate that agricultural equipment has an impact on agricultural security. Finally, more technologies (5 G communication, fog computing, Internet of Everything, renewable energy management system, software defined network, virtual reality, augmented reality, and cyber security datasets for smart agriculture) are described as the future research directions of smart agriculture.
An Aspect-Oriented Approach for Software Security Hardening: from Design to Implementation
Authors: Djedjiga Mouheb, Chamseddine Talhi, Azzam Mourad, Vitor Lima, Mourad Debbabi, Lingyu Wang, Makan Pourzandi
Published in: Frontiers in artificial intelligence and applications (2009-01-01)

Security is a very challenging task in software engineering. Enforcing security policies should be taken care of during the early phases of the software development life cycle to prevent security breaches in the final product. Since security is a crosscutting concern that pervades the entire software, integrating security solutions at the software design level may result in scattering and tangling security features throughout the entire design. To address this issue, we propose in this paper an aspect-oriented approach for specifying and enforcing security hardening solutions. This approach provides software designers with UML-based capabilities to perform security hardening in a clear and organized way, at the UML design level, without the need to be security experts. We also present the SHP profile, a UML-based security hardening language to describe and specify security hardening solutions at the UML design level. Finally, we explore the efficiency and the relevance of our approach by applying it to a real world case study and present the experimental results.
Security Strength Measurement for Dongle-Protected Software
Authors: Ugo Piazzalunga, Paolo Salvaneschi, Francesco Balducci, Pablo Jacomuzzi, Cristiano Moroncelli
Published in: IEEE Security & Privacy (2007-11-01)

Many people consider dongles to be among the strongest forms of copy protection, but how much security do they actually offer? The model presented here aims to monetize the security strength of dongle-protected software by forecasting the amount of time a hypothetical attacker would take to break it.
An Approach for Certifying Security in Software Components
Authors: A. K. Ghosh, Gary McGraw
Published in:  (1998-01-01)

The growth of Internet-based electronic commerce, with its potential to create new business markets and streamline corporate operations, has been hindered over the past three years by concerns over the security of the system. While several secure transaction protocols have emerged to allay concerns, most security violations in practice are made possible by flaws in e-commerce client/server software. The approach outlined in this paper develops a certification process for testing software components for security properties. The anticipated results from this research is a process and set of core white-box and black-box testing technologies to certify the security of software components. The manifestation of the product is a stamp of approval in the form of a digital signature. 1 Introduction Component-based Internet technologies such as Java and ActiveX are making the use of software components easier and more pervasive than ever before. Today, the Internet is being harnessed by main-s...
Research on software design level security vulnerabilities
Authors: Shafiq ur Réhman, Khurram Mustafa
Published in: ACM SIGSOFT Software Engineering Notes (2009-12-03)

One of the major problems in software security is the lack of knowledge about security among software developers. Even if a developer has good knowledge about current software vulnerabilities, they generally have little or no idea about the causes and measures that can avoid those vulnerabilities. Now it is established fact that most of the vulnerabilities arise in design phase of the software development lifecycle. Keeping in view the importance of software design level security, a study of current software design level vulnerabilities and their cause is conducted. In this paper, we discuss current practices in specific software design tasks, vulnerabilities and mitigation mechanism. On the basis of the critical review, areas of research are identified that warrant further investigation.
A Survey of Machine Learning Techniques Applied to Software Defined Networking (SDN): Research Issues and Challenges
Authors: Junfeng Xie, F. Richard Yu, Tao Huang, Renchao Xie, Jiang Liu, Chenmeng Wang, Yunjie Liu
Published in: IEEE Communications Surveys & Tutorials (2018-08-23)

In recent years, with the rapid development of current Internet and mobile communication technologies, the infrastructure, devices and resources in networking systems are becoming more complex and heterogeneous. In order to efficiently organize, manage, maintain and optimize networking systems, more intelligence needs to be deployed. However, due to the inherently distributed feature of traditional networks, machine learning techniques are hard to be applied and deployed to control and operate networks. Software defined networking (SDN) brings us new chances to provide intelligence inside the networks. The capabilities of SDN (e.g., logically centralized control, global view of the network, software-based traffic analysis, and dynamic updating of forwarding rules) make it easier to apply machine learning techniques. In this paper, we provide a comprehensive survey on the literature involving machine learning algorithms applied to SDN. First, the related works and background knowledge are introduced. Then, we present an overview of machine learning algorithms. In addition, we review how machine learning algorithms are applied in the realm of SDN, from the perspective of traffic classification, routing optimization, quality of service/quality of experience prediction, resource management and security. Finally, challenges and broader perspectives are discussed.
Research on Software Security Testing Methods
Authors: Xuan Chen
Published in:  (2009-01-01)

Software security testing is an important means to ensure software security. This paper discusses the main features and content of software security testing and analyzes the major methods of domestic and foreign software security testing. In conclusion, the paper summarizes the present study and point out future focus and development directions of software security testing technology.
Exploiting Software: How to Break Code
Authors: Greg Hoglund, Gary McGraw
Published in:  (2004-01-01)

Attack Patterns. Foreword. Preface. What This Book Is About. How to Use This Book. But Isn't This Too Dangerous? Acknowledgments. 1. Software-The Root of the Problem. A Brief History of Software. Bad Software Is Ubiquitous. The Trinity of Trouble. The Future of Software. What Is Software Security? Conclusion. 2. Attack Patterns. A Taxonomy. An Open-Systems View. Tour of an Exploit. Attack Patterns: Blueprints for Disaster. An Example Exploit: Microsoft's Broken C++ Compiler. Applying Attack Patterns. Attack Pattern Boxes. Conclusion. 3. Reverse Engineering and Program Understanding. Into the House of Logic. Should Reverse Engineering Be Illegal? Reverse Engineering Tools and Concepts. Methods of the Reverser. Writing Interactive Disassembler (IDA) Plugins. Decompiling and Disassembling Software. Decompilation in Practice: Reversing helpctr.exe. Automatic, Bulk Auditing for Vulnerabilities. Writing Your Own Cracking Tools. Building a Basic Code Coverage Tool. Conclusion. 4. Exploiting Server Software. The Trusted Input Problem. The Privilege Escalation Problem. Finding Injection Points. Input Path Tracing. Exploiting Trust through Configuration. Specific Techniques and Attacks for Server Software. Conclusion. 5. Exploiting Client Software. Client-side Programs as Attack Targets. In-band Signals. Cross-site Scripting (XSS). Clients Scripts and Malicious Code. Content-Based Attacks. Backwash Attacks: Leveraging Client-side Buffer. Conclusion. 6. Crafting (Malicious) Input. The Defender's Dilemma. Intrusion Detection (Not). Partition Analysis. Tracing Code. Reversing Parser Code. Example: Reversing I-Planet Server 6.0 through the Front Door. Misclassification. Building Equivalent Requests. Audit Poisoning. Conclusion. 7. Buffer Overflow. Buffer Overflow 101. Injection Vectors: Input Rides Again. Buffer Overflows and Embedded Systems. Database Buffer Overflows. Buffer Overflows and Java?! Content-Based Buffer Overflow. Audit Truncation and Filters with Buffer Overflow. Causing Overflow and Environment Variables. The Multiple Operation Problem. Finding Potential Buffer Overflows. Stack Overflow. Arithmetic Errors in Memory Management. Format String Vulnerabilities. Heap Overflows. Buffer Overflows and C++. Payloads. Payloads on RISC Architectures. Multiplatform Payloads. Prolog/Epilog Code to Protect Functions. Conclusion. 8. Rootkits. Subversive Programs. A Simple Windows XP Kernel Rootkit. Call Hooking. Trojan Executable Redirection. Hiding Files and Directories. Patching Binary Code. The Hardware Virus. Low-Level Disk Access. Adding Network Support to a Driver. Interrupts. Key Logging. Advanced Rootkit Topics. Conclusion. References. Index.
A Novel Method to Solve Real Time Security Issues in Software Industry Using Advanced Cryptographic Techniques
Authors: B. Gobinathan, M. A. Mukunthan, S. Surendran, K. Somasundaram, Syed Abdul Moeed, P. Niranjan, V. Gouthami, G. Ashmitha, Gouse Baig Mohammad, V. K. Shanmuganathan, Yuvaraj Natarajan, K. Srihari, Venkatesa Prabhu Sundramurthy
Published in: Scientific Programming (2021-12-28)

In recent times, the utility and privacy are trade-off factors with the performance of one factor tends to sacrifice the other. Therefore, the dataset cannot be published without privacy. It is henceforth crucial to maintain an equilibrium between the utility and privacy of data. In this paper, a novel technique on trade-off between the utility and privacy is developed, where the former is developed with a metaheuristic algorithm and the latter is developed using a cryptographic model. The utility is carried out with the process of clustering, and the privacy model encrypts and decrypts the model. At first, the input datasets are clustered, and after clustering, the privacy of data is maintained. The simulation is conducted on the manufacturing datasets over various existing models. The results show that the proposed model shows improved clustering accuracy and data privacy than the existing models. The evaluation with the proposed model shows a trade-off privacy preservation and utility clustering in smart manufacturing datasets.