jehanweerasuriya/uni-ai-dataset huggingface dataset:
A framework for software security in UML with assurance
Authors: Thuong Nguyen Doan
Published in: OpenCommons - UConn (University of Connecticut) (2008-01-01)

Software security is becoming increasingly invasive in all aspects of a software application but the inclusion of security in software development has often been an afterthought and delayed to latter stages of the software development life cycle instead of performed from the beginning of the design phase. That practice may result in serious and costly aftermaths. Unified Modeling Language (UML) is a well-known language for specifying, visualizing, constructing and documenting software artifacts but lacks the facilities to directly integrate security features into the UML diagrams and a mechanism of analysis and verification of secure designs at the design phase. To support the security integration at the design phase and overcome the shortfalls of UML in terms of security assurance, this dissertation provides a practical approach with a formal underpinning to incorporate and maintain security features during an application's requirement and design phases of the software process via UML. Specifically, this dissertation includes a three-component framework consisting of: (i). UML Extended with Security Capabilities - This aspect of our work integrates the security requirements and design into the software process by augmenting UML requirements definition (use case diagram) and design (class and sequence diagrams) with visual and non-visual security extensions and constraints for RBAC, MAC, and lifetimes. The intent is to provide the means for stakeholders to define, verify, analyze, evolve, etc., the security requirements as an application is created and modified in UML; (ii). Persistent and Dynamic State Capturing and Maintenance - UML plus security extensions as realized within a formal functional model provides the means to define and maintain a design state. Our approach tracks the content of design for an application (security and non-security) and all actions taken by stakeholders as part of the process. Our work provides the specification of design actions as (meta-)functions on the current state and a design element to generate a new state (as a state function); and (iii). Security Assurance via Constraint Checking - This final component of our work involves the ability to offer a degree of security conformity assurance via the checking of security constraints as an application's design are created and changed over time. To accomplish this, we define the concept of a security conforming design state and two modes of checking: design-time (instantly check whenever the designer draws a new design element or edits an existing design element in the UML design) and post-design (execute the checks across all design elements at once after the designer has reached a milestone or version in an application's UML design). Therefore, our approach specifies a new direction of semi-automatic tracking, checking, and maintaining the security conformity status of a UML design that improves the integrity of the software application in terms of security concerns. ^
What topics should or should not be included in software security education—Qualitative content analysis
Authors: Shouki A. Ebad
Published in: Computer Applications in Engineering Education (2022-07-22)

Abstract Software security education is still not preparing students for the types of high‐skilled technical roles that represent the most severe workforce shortage. Recognizing this, academia has begun redefining the knowledge area concepts of software security curricula to meet the current workforce shortage. This article studies the software security courses in Arab Gulf academic programs and benchmarks their descriptions with the corresponding knowledge area from cybersecurity Curricula (CSEC). 2017, the first set of global cybersecurity curricular guidelines. Using content analysis, six concepts or essentials are investigated: security requirements, secure design principles, secure source code, analysis and testing, patch, and ethics. It was found that no course follows all the CSEC. 2017 essentials. The analysis and testing essential were considered by all courses, and security after deployment, including the patch essential, needs more attention because it was not included in any course. Similarly, the security requirements and ethics essentials were also considered by a few courses. However, software success depends on requirements, and ethics has become critical in the cybersecurity and information assurance fields that depend on law and forensics. The secure source code essential was covered by most courses. The well‐known types of code attacks were covered, and over half of the courses discussed secure design principles essential. However, security by design is an emerging development philosophy. The article discussed observations and recommendations that will assist program managers and their staff in making effective decisions about the essentials and concepts that should be included when they are developing the software security curriculum.
Research Directions in Software Supply Chain Security
Authors: Laurie Williams, Giacomo Benedetti, Sivana Hamer, Ranindya Paramitha, Ishtiaq Rahman, Mahzabin Tamanna, Greg Tystahl, Nusrat Zahan, Patrick Morrison, Yasemin Acar, Michel Cukier, Christian Kästner, Alexandros Kapravelos, Dominik Wermke, William Enck
Published in: ACM Transactions on Software Engineering and Methodology (2025-01-27)

Reusable software libraries, frameworks, and components, such as those provided by open source ecosystems and third-party suppliers, accelerate digital innovation. However, recent years have shown almost exponential growth in attackers leveraging these software artifacts to launch software supply chain attacks. Past well-known software supply chain attacks include the SolarWinds, log4j, and xz utils incidents. Supply chain attacks are considered to have three major attack vectors: through vulnerabilities and malware accidentally or intentionally injected into open source and third-party dependencies/components/containers ; by infiltrating the build infrastructure during the build and deployment processes; and through targeted techniques aimed at the humans involved in software development, such as through social engineering. Plummeting trust in the software supply chain could decelerate digital innovation if the software industry reduces its use of open source and third-party artifacts to reduce risks. This article contains perspectives and knowledge obtained from intentional outreach with practitioners to understand their practical challenges and from extensive research efforts. We then provide an overview of current research efforts to secure the software supply chain. Finally, we propose a future research agenda to close software supply chain attack vectors and support the software industry.
A practical application of software security in an undergraduate software engineering course
Authors: Cynthia Y. Lester
Published in:  (2010-01-01)

Computer software is developed according to software engineering methodologies. However, as more of the economy and our social lives move online, software security has become a topic of increasing importance. Traditionally, courses in software security are offered at the graduate level or in a stand-alone course at the undergraduate level, with many undergraduate students being required to apply security principles to their software development processes as soon as they complete their degrees. Therefore, this paper posits that software security can be effectively introduced to undergraduate students in a traditionally taught software engineering course. The paper presents a modified software engineering course which introduces the secure development life cycle. Several traditional software development methodologies are presented which provide a foundation for introducing secure software principles. Additionally, the paper introduces collaborative learning and service-learning which are used in the practical application of software security concepts. Lastly, challenges and future work are presented.
Evaluating Complexity, Code Churn, and Developer Activity Metrics as Indicators of Software Vulnerabilities
Authors: Yonghee Shin, Andrew Meneely, Laurie Williams, Jason A. Osborne
Published in: IEEE Transactions on Software Engineering (2010-09-07)

Security inspection and testing require experts in security who think like an attacker. Security experts need to know code locations on which to focus their testing and inspection efforts. Since vulnerabilities are rare occurrences, locating vulnerable code locations can be a challenging task. We investigated whether software metrics obtained from source code and development history are discriminative and predictive of vulnerable code locations. If so, security experts can use this prediction to prioritize security inspection and testing efforts. The metrics we investigated fall into three categories: complexity, code churn, and developer activity metrics. We performed two empirical case studies on large, widely used open-source projects: the Mozilla Firefox web browser and the Red Hat Enterprise Linux kernel. The results indicate that 24 of the 28 metrics collected are discriminative of vulnerabilities for both projects. The models using all three types of metrics together predicted over 80 percent of the known vulnerable files with less than 25 percent false positives for both projects. Compared to a random selection of files for inspection and testing, these models would have reduced the number of files and the number of lines of code to inspect or test by over 71 and 28 percent, respectively, for both projects.
Towards the Integration of Security Practices in Agile Software Development: A Systematic Mapping Review
Authors: Yolanda Valdés, Jorge Hochstetter, Jaime Díaz, Rodrigo Cadena Martínez
Published in: Applied Sciences (2023-04-04)

Software development must be based on more than just the experience and capabilities of your programmers and your team. The importance of obtaining a quality product lies in the risks that can be exploited by software vulnerabilities, which can jeopardize organizational assets, consumer confidence, operations, and a broad spectrum of applications. Several methods, techniques, and models have been suggested and developed to address software security. However, only a few have solid evidence for creating secure software applications. The main objective of this paper is to survey the literature for methods or models suitable for considering the integration of security in all or some of the phases of the software development life cycle and which ones are most considered or neglected. This study represents the beginning of research to generate a methodology that integrates security practices in agile software development, allowing inexperienced developers to create more secure applications.
MulVAL: a logic-based network security analyzer
Authors: Xinming Ou, Sudhakar Govindavajhala, Andrew W. Appel
Published in:  (2005-07-31)

To determine the security impact software vulnerabilities have on a particular network, one must consider interactions among multiple network elements. For a vulnerability analysis tool to be useful in practice, two features are crucial. First, the model used in the analysis must be able to automatically integrate formal vulnerability specifications from the bug-reporting community. Second, the analysis must be able to scale to networks with thousands of machines. We show how to achieve these two goals by presenting MulVAL, an end-to-end framework and reasoning system that conducts multihost, multistage vulnerability analysis on a network. MulVAL adopts Datalog as the modeling language for the elements in the analysis (bug specification, configuration description, reasoning rules, operating-system permission and privilege model, etc.). We easily leverage existing vulnerability-database and scanning tools by expressing their output in Datalog and feeding it to our MulVAL reasoning engine. Once the information is collected, the analysis can be performed in seconds for networks with thousands of machines. We implemented our framework on the Red Hat Linux platform. Our framework can reason about 84 % of the Red Hat bugs reported in OVAL, a formal vulnerability definition language. We tested our tool on a real network with hundreds of users. The tool detected a policy violation caused by software vulnerabilities and the system administrators took remediation measures. 1
Practicing Safe Computing: A Multimethod Empirical Examination of Home Computer User Security Behavioral Intentions1
Authors: Catherine Anderson, Agarwal
Published in: MIS Quarterly (2010-09-01)

Although firms are expending substantial resources to develop technology and processes that can help safeguard the security of their computing assets, increased attention is being focused on the role people play in maintaining a safe computing environment. Unlike employees in a work setting, home users are not subject to training, nor are they protected by a technical staff dedicated to keeping security software and hardware current. Thus, with over one billion people with access to the Internet, individual home computer users represent a significant point of weakness in achieving the security of the cyber infrastructure. We study the phenomenon of conscientious cybercitizens, defined as individuals who are motivated to take the necessary precautions under their direct control to secure their own computer and the Internet in a home setting. Using a multidisciplinary, phased approach, we develop a conceptual model of the conscientious cybercitizen. We present results from two studies—a survey and an experiment—conducted to understand the drivers of intentions to perform security-related behavior, and the interventions that can positively influence these drivers. In the first study, we use protection motivation theory as the underlying conceptual foundation and extend the theory by drawing upon the public goods literature and the concept of psychological ownership. Results from a survey of 594 home computer users from a wide range of demographic and socioeconomic backgrounds suggest that a home computer user’s intention to perform security-related behavior is influenced by a combination of cognitive, social, and psychological components. In the second study, we draw upon the concepts of goal framing and self-view to examine how the proximal drivers of intentions to perform security-related behavior identified in the first study can be influenced by appropriate messaging. An experiment with 101 subjects is used to test the research hypotheses. Overall, the two studies shed important new light on creating more conscientious cybercitizens. Theoretical and practical implications of the findings are discussed.2
Advancing Software Security - The Software Protection Initiative
Authors: Jeff Hughes, Martin R. Stytz
Published in: Defense Technical Information Center (DTIC) (2003-06-01)

In December 2001, the Software Protection Initiative (SPI) was established to prevent the unauthorized distribution and exploitation of national security application software by our adversaries. To achieve this, the SPI has several goals, which are to institutionalize software protection within the software development life-cycle, educate and train the community, develop user-friendly protection techniques, and ensure that protection technology and policy are appropriately applied, balancing mission requirements with security. The focus of the SPI is to improve protections for critical scientific, engineering, and modeling and simulation software running on desktops through supercomputers. Not only does software of this nature represent a significant portion of DoD's intellectual property (IP), it also enables the development of next generation weapon systems. In addition to the traditional two components of information assurance, namely network security and operating system integrity, SPI adds a new component, a "third leg" to the information assurance triad, based on an application-centric approach to protecting important DoD software. The SPI program is accomplishing these goals by providing military-strength application protection, focused investigation, research and development of advanced technologies for software protection across the entire spectrum of computational hardware.
A Software Security Optimization Architecture (SoSOA) and its Adaptation for Mobile Applications
Authors: Amr Abozeid, AbdAllah A. AlHabshy, Kamal A. ElDahshan
Published in: International Journal of Interactive Mobile Technologies (iJIM) (2021-06-04)

Security attacks become daily news due to an exposure of a security threat in a widely used software. Taking software security into consideration during the analysis, design, and implementation phases is a must. A software application should be protected against any security threat such as unauthorized distribution or code retrieval. Due to the lack of applying a software security standard architecture, developers may create software that may be vulnerable to many types of security threats. This paper begins by reviewing different types of known software security threats and their countermeasure mechanisms. Then, it proposes a new security optimization architecture for software applications. This architecture is a step towards establishing a standard to guarantee the software's security. Furthermore, it proposes an adapted software security optimization architecture for mobile applications. Besides, it presents an algorithmic implementation of the newly proposed architecture, then it proves its security. Moreover, it builds a secure mobile application based on the newly proposed architecture.
An Enhanced Code Encryption Approach with HNT Transformations for Software Security
Authors: N. Sasirekha, M. Hemalatha
Published in: International Journal of Computer Applications (2012-09-25)

Security threats such as viruses, worms, trojans and spyware affects the security and authentication of software codes, forcing software developers to build security schemes for better software protection. These software threats exploit the authenticated data of the software and confidentiality, integrity and accessibility is greatly affected by these software threats. A number of code security techniques like tamper resistant packaging, code obfuscation, register encoding etc have been developed which mainly concentrates on providing solutions for a particular type of threats and are vulnerable to code tampering and code injection by complicated attackers. Hence, code encryption technique has become an active area of research. This paper proposes a novel software protection code encryption scheme based on the index table. This approach uses a novel and efficient encryption technique called quasigroup encryption for encryption the indexed table. It provides least resemblance of the original data when encrypted. But, quasi group encryption is not efficient in diffusing the statistics of the plain text. This drawback can be overcome by using transforms. Hence, this approach uses chained Hadamard transforms and Number Theoretic Transforms to introduce diffusion along with the quasigroup transformation. The proposed approach is compared with the other encryption approaches and is observed to provide better results.
Software Security Costing Issues
Authors: Margaret E. Bisignani, Teresa S. Reed
Published in: Journal of Parametrics (1987-12-01)

Traditionally, computer security has been accomplished by providing physical system safeguards. This assumes that the threats to private information come from outside the system boundaries. However, with the advent of distributed processing, distributed databases, communications networks, and requirements for specialized operating environments, physical safeguards may not be sufficient. The need for security can be readily understood and appreciated. What is less obvious is the way to achieve security and impact it will have on system development cost. The purpose of this paper is twofold. First, the potential cost impact of security on each phase of the software lifecycle is discussed. Next, a methodology which can aid in determining the effect of security measures on cost are examined through the use of a generic example. Software costs associated with software security are estimated by parametric techniques and the adaption of parametric drivers is discussed. Even though this paper is directed towards a Department of Defense environment, the cost methodology presented is equally applicable to a commercial environment.
Software Vulnerabilities: Open Source versus Proprietary Software Security
Authors: Sanjay Sridhar, Kemal Altınkemer, Jackie Rees
Published in: Journal of the Association for Information Systems (2005-01-01)

This study seeks to empirically investigate specific security characteristics of both open source software and proprietary software. Operating system software vulnerability data spanning several years are collected and analyzed to determine if significant differences exist in terms of inter-arrival times of published vulnerabilities and patch releases. Open source software is only marginally quicker in releasing patches for reported vulnerabilities. The arguments favoring the inherent security of open source software do not appear to hold up to scrutiny. These findings provide evidence to security managers to focus more on holistic software security management, irrespective of the proprietary-nature of the underlying software.
Two views on security software liability. Let the legal system decide
Authors: Daniel J. Ryan, Corinne Heckman
Published in: IEEE Security & Privacy (2003-01-01)

Rather than use the product liability screwdriver as a chisel, why not consider a package of more effective tools. Corporations and individuals that market software despite knowledge of software security flaws should face criminal prosecution as well as civil lawsuits with punitive damages. Perhaps bounties should be available for the first to discover and establish the existence of a security flaw. Publishers should be required to post to the Web and otherwise publicize promptly patch availability. The software equivalent of an Underwriters Laboratories should establish and constantly improve security-related standards and testing protocols. It should be made readily apparent whether a program has passed and at what level. Prospective customers should be educated and encouraged to insist on software that has passed. Stronger software security is important. Software developers and publishers must do better. But product liability is not the right legal tool for the job.
Google Android: A Comprehensive Security Assessment
Authors: Asaf Shabtai, Yuval Fledel, Uri Kanonov, Yuval Elovici, Shlomi Dolev, Chanan Glezer
Published in: IEEE Security & Privacy (2010-01-26)

This research provides a security assessment of the Android framework-Google's software stack for mobile devices. The authors identify high-risk threats to the framework and suggest several security solutions for mitigating them.