jehanweerasuriya/uni-ai-dataset huggingface dataset:
Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software
Authors: James Newsome, Dawn Song
Published in: INDIGO (University of Illinois at Chicago) (2018-06-29)

Software vulnerabilities have had a devastating effect on the Internet. Worms such as CodeRed and Slammer can compromise hundreds of thousands of hosts within hours or even minutes, and cause millions of dollars of damage [26, 43]. To successfully combat these fast automatic Internet attacks, we need fast automatic attack detection and filtering mechanisms. In this paper we propose dynamic taint analysis for automatic detection of overwrite attacks, which include most types of exploits. This approach does not need source code or special compilation for the monitored program, and hence works on commodity software. To demonstrate this idea, we have implemented TaintCheck, a mechanism that can perform dynamic taint analysis by performing binary rewriting at run time. We show that TaintCheck reliably detects most types of exploits. We found that TaintCheck produced no false positives for any of the many different programs that we tested. Further, we describe how TaintCheck could improve automatic signature generation in several ways.
Evaluating software security maturity using OWASP SAMM: Different approaches and stakeholders perceptions
Authors: Davide Fucci, Emil Alégroth, Michael Felderer, Christoffer Johannesson
Published in: Journal of Systems and Software (2024-04-22)

Recent years have seen a surge in cyber-attacks, which can be prevented or mitigated using software security activities. OWASP SAMM is a maturity model providing a versatile way for companies to assess their security posture and plan for improvements. We perform an initial SAMM assessment in collaboration with a company in the financial domain. Our objective is to assess a holistic inventory of the company security-related activities, focusing on how different roles perform the assessment and how they perceive the instrument used in the process. We perform a case study to collect data using SAMM in a lightweight and novel manner through assessment using an online survey with 17 participants and a focus group with seven participants. We show that different roles perceive maturity differently and that the two assessments deviate only for specific practices making the lightweight approach a viable and efficient solution in industrial practice. Our results indicate that the questions included in the SAMM assessment tool are answered easily and confidently across most roles. Our results suggest that companies can productively use a lightweight SAMM assessment. We provide nine lessons learned for guiding industrial practitioners in the evaluation of their current security posture as well as for academics wanting to utilize SAMM as a research tool in industrial settings. Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.
Object Oriented Software Security in Design Phase
Authors: Mohammad Ubaidullah Bokhari, Shams Tabrez Siddiqui, Hatem Hammatta
Published in:  (2021-09-13)

Object oriented design and development has become popular in today’s software development environment. As development of object oriented software is raising security problem is also increasing. The software security focuses on the effort and cost spent in lateral phases is much greater than the initial phase of software development process. It is understandable that most of the software is not well designed with respect to security concern. Therefore, to secure the software after deployment is not only costlier but difficult too. The aim of the paper is to study better way of design consideration to secure the object oriented software and discuss the tools which are required for the secure software development. This paper will provide an opportunity to understand the requirement for developing a technique at design phase.
Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection
Authors: Christian Collberg, Jasvir Nagra
Published in:  (2009-07-24)

This book gives thorough, scholarly coverage of an area of growing importance in computer security and is a must have for every researcher, student, and practicing professional in software protection. Mikhail Atallah, Distinguished Professor of Computer Science at Purdue University Theory, Techniques, and Tools for Fighting Software Piracy, Tampering, and Malicious Reverse EngineeringThe last decade has seen significant progress in the development of techniques for resisting software piracy and tampering. These techniques are indispensable for software developers seeking to protect vital intellectual property. Surreptitious Software is the first authoritative, comprehensive resource for researchers, developers, and students who want to understand these approaches, the level of security they afford, and the performance penalty they incur.Christian Collberg and Jasvir Nagra bring together techniques drawn from related areas of computer science, including cryptography, steganography, watermarking, software metrics, reverse engineering, and compiler optimization. Using extensive sample code, they show readers how to implement protection schemes ranging from code obfuscation and software fingerprinting to tamperproofing and birthmarking, and discuss the theoretical and practical limitations of these techniques. Coverage includesMastering techniques that both attackers and defenders use to analyze programsUsing code obfuscation to make software harder to analyze and understandFingerprinting software to identify its author and to trace software pirates Tamperproofing software using guards that detect and respond to illegal modifications of code and dataStrengthening content protection through dynamic watermarking and dynamic obfuscation Detecting code theft via software similarity analysis and birthmarking algorithmsUsing hardware techniques to defend software and media against piracy and tampering Detecting software tampering in distributed systemUnderstanding the theoretical limits of code obfuscation
Towards maturity of information security maturity criteria: six lessons learned from software maturity criteria
Authors: Mikko Siponen
Published in: Information Management & Computer Security (2002-11-05)

Traditionally, information security management standards listing generic means of protection have received a lot of attention in the field of information security management. In the background a few information security management‐oriented maturity criteria have been laid down. These criteria can be regarded as the latest promising innovations on the information security checklist‐standard family tree. Whereas information security maturity criteria have so far received inadequate attention in information security circles, software maturity endeavours have been the focus of constructive debate in software engineering circles. Aims to analyze what the alternative maturity criteria for developing secure information systems (IS) and software can learn from these debates on software engineering maturity criteria. First, advances a framework synthesized from the information systems (IS) and software engineering literatures, including six lessons that information security maturity criteria can learn from. Second, pores over the existing information security maturity criteria in the light of this framework. Third, presents, on the basis of results of this analysis, implications for practice and research.
Static Detecting Techniques of Software Security Flaws
Authors: Qingkai Zeng
Published in: Jisuanji gongcheng (2008-01-01)

This paper summarizes two strategies of software security flaw detection,named static analysis and program verification.Several static detection methods such as lexical analysis,rule checking,type theory deduction,model checking,theorem proving,and symbol execution are also synthetically reviewed.It discusses the advantage,applicability and tendency of static detecting techniques.
A BPMN Extension for the Modeling of Security Requirements in Business Processes
Authors: Alfonso Rodríguez, Eduardo Fernández‐Medina, Mario Piattini
Published in: IEICE Transactions on Information and Systems (2007-03-01)

Business Processes are considered a crucial issue by many enterprises because they are the key to maintain competitiveness. Moreover, business processes are important for software developers, since they can capture from them the necessary requirements for software design and creation. Besides, business process modeling is the center for conducting and improving how the business is operated. Security is important for business performance, but traditionally, it is considered after the business processes definition. Empirical studies show that, at the business process level, customers, end users, and business analysts are able to express their security needs. In this work, we will present a proposal aimed at integrating security requirements through business process modeling. We will summarize our Business Process Modeling Notation extension for modeling secure business process through Business Process Diagrams, and we will apply this approach to a typical health-care business process.
Is finding security holes a good idea?
Authors: Eric Rescorla
Published in: IEEE Security & Privacy (2005-01-01)

Despite the large amount of effort that goes toward finding and patching security holes, the available data does not show a clear improvement in software quality as a result. This article aims to measure the effect of vulnerability finding. Any attempt to measure this kind of effect is inherently rough, depending as it does on imperfect data and several simplifying assumptions. Because I'm looking for evidence of usefulness, where possible, I bias such assumptions in favor of a positive result - explicitly calling out those assumptions biased in the opposite direction. Thus, the analysis in this article represents the best-case scenario, consistent with the data and my ability to analyze it, for the vulnerability finding's usefulness
SECURITY IN THE SOFTWARE DEVELOPMENT LIFECYCLE
Authors: Swati Kaushik, Tanu Mohan
Published in:  (2014-01-01)

The purpose of this paper is to help you understand the important role that security plays in the Software Development Life Cycle (SDLC). The paper defines security as it applies to the SDLC and discusses overall SDLC security issues. It then covers each phase of the SDLC and specific security controls and issues for each phase. Note that the SDLC acronym is also used to represent System Development Life Cycle. In many cases, a decision is made to purchase or outsource the software and associated hardware and network systems needed to implement a new application. This is often referred to as the or decision. Buy means you will purchase a finished product from a vendor and means you will hire someone to develop it for you. This paper focuses on the Software Development Life Cycle, but most of the phases, terms, and issues discussed apply to both the buy and build process.
Quantitative Security Evaluation for Software System from Vulnerability Database
Authors: Hiroyuki Okamura, Masataka Tokuzane, Tadashi Dohi
Published in: Journal of Software Engineering and Applications (2013-01-01)

This paper proposes a quantitative security evaluation for software system from the vulnerability data consisting of discovery date, solution date and exploit publish date based on a stochastic model. More precisely, our model considers a vulnerability life-cycle model and represents the vulnerability discovery process as a non-homogeneous Poisson process. In a numerical example, we show the quantitative measures for contents management system of an open source project.
Software Security Engineering Monitoring and Control
Authors: Esmiralda Moradian, Anne Håkansson
Published in:  (2011-01-01)

Abstract- Poorly constructed software can induce security weaknesses and defects, which can be exploited by attackers. Despite many security standards and mechanisms, a vast amount of software systems have security vulnerabilities. The security problems induce the necessity of monitoring and controlling software development and maintenance. In this paper, we propose a multi-agent system that supports security in development of new systems and modification of existing systems. Thus, the multi-agent system verifies and validates the goals and requirements during different phases of development lifecycle. For the verification and validation, searching for information and mapping are needed. Searching for information about the project and security documents such as, risks, list of threats and vulnerabilities is performed by software agents. Comparisons and analyzes of requirements and use cases as well as mapping of those to attack patterns is performed by meta-agents. The proposed multi-agent system supports confidentiality, integrity, availability, accountability, and non-repudiation.
Software Defined Membrane: Policy-Driven Edge and Internet of Things Security
Authors: Massimo Villari, Maria Fazio, Schahram Dustdar, Omer Rana, Lydia Y. Chen, Rajiv Ranjan
Published in: IEEE Cloud Computing (2017-07-01)

We describe the integration of security strategy as a programmatic “Security Software Defined Membrane”, to enable optimal migration of microservices and their data (referred to as MELs), between Edge and Cloud resources. The SDMem is configured based on a security policy informed by an “attacker model”-this involves a user or security analyst specifying potential attack types and resources that will be impacted. In this work, we focus on security concerns rooted in devices and the network between them. The approach advocated here can be adapted based on changes in the type of Edge and/or IoT device being considered.
Measuring Software Security using MACOQR (Misuse and Abuse Case Oriented Quality Requirement) Metrics: Defensive Perspective
Authors: C. Banerjee, Arpita Banerjee, P. D. Murarka
Published in: International Journal of Computer Applications (2014-05-21)

The present age, software is exploited and the understanding of increasing extent of risk exposure as a result is rarely developed. Security should be incorporate right from the requirements phase so that the security is inbuilt and properly incorporated into the software in development. To establish the fact that a process is improving or not is a matter that seems impossible without obtaining the measurements. Security requirements can be defined and developed using a no. of techniques like fault tree analysis, failure mode and effect analysis, threat modeling, misuse / abuse cases, attack tree etc. The obtained requirements are qualitative hence they needs to be converted into quantitative measure using some metrics. Security metrics is defined as quantifiable measures which show how much security a product or process simply possess and is normally built from the low level physical measures and at high level they can be considered as quantifiable measurements of some aspect of the system. Certain Object Oriented modeling techniques like Misuse case, Use case Abuse case are very helpful in incorporating security requirements in the early stages of software development phases.ie requirement phase. In this paper, MACOQR metrics from defensive perspective is proposed whose aim is to measure the predicated and observed ratio of flaw and flawlessness in modeling of misuse cases during requirements engineering phase. The measures and ratios obtained may help the requirements engineering team to plan eliminate defects of misuse case modeling during the requirements engineering phase.
A Software Defined Fog Node Based Distributed Blockchain Cloud Architecture for IoT
Authors: Pradip Kumar Sharma, Mu‐Yen Chen, Jong Hyuk Park
Published in: IEEE Access (2017-09-29)

The recent expansion of the Internet of Things (IoT) and the consequent explosion in the volume of data produced by smart devices have led to the outsourcing of data to designated data centers. However, to manage these huge data stores, centralized data centers, such as cloud storage cannot afford auspicious way. There are many challenges that must be addressed in the traditional network architecture due to the rapid growth in the diversity and number of devices connected to the internet, which is not designed to provide high availability, real-time data delivery, scalability, security, resilience, and low latency. To address these issues, this paper proposes a novel blockchain-based distributed cloud architecture with a software defined networking (SDN) enable controller fog nodes at the edge of the network to meet the required design principles. The proposed model is a distributed cloud architecture based on blockchain technology, which provides low-cost, secure, and on-demand access to the most competitive computing infrastructures in an IoT network. By creating a distributed cloud infrastructure, the proposed model enables cost-effective high-performance computing. Furthermore, to bring computing resources to the edge of the IoT network and allow low latency access to large amounts of data in a secure manner, we provide a secure distributed fog node architecture that uses SDN and blockchain techniques. Fog nodes are distributed fog computing entities that allow the deployment of fog services, and are formed by multiple computing resources at the edge of the IoT network. We evaluated the performance of our proposed architecture and compared it with the existing models using various performance measures. The results of our evaluation show that performance is improved by reducing the induced delay, reducing the response time, increasing throughput, and the ability to detect real-time attacks in the IoT network with low performance overheads.
A Review of Security Integration Technique in Agile Software Development
Authors: Raja Khaim, Saba Naz, Fakhar Abbas, Naila Iqbal, Memoona Hamayun
Published in: International Journal of Software Engineering & Applications (2016-05-30)

Agile software development has gained a lot of popularity in the software industry due to its iterative and incremental approach as well as user involvement. Agile has also been criticized due to lack of its ability to deliver secure software. In this paper, extensive literature has been performed, in order to highlight the existing security issues in agile software development. Majority of challenges reported in literature, occurred due to lack of involvement of security expert. Improving security of a software system without damaging the real essence of Agile can achieved with the continuous involvement of security engineer throughout development lifecycle with its defined role and responsibilities.
Software Defined Internet of Things Security: Properties, State of the Art, and Future Research
Authors: Pritish Mishra, Ananya Biswal, Sahil Garg, Rongxing Lu, Mayank Tiwary, Deepak Puthal
Published in: IEEE Wireless Communications (2020-06-01)

The Internet of Things (IoT) is an emerging technology whose popularity and use cases grow with every passing day. Although the domain of IoT has proven to be transformative, as the deployment size of the network increases, it becomes a huge challenge to secure such a large number of heterogeneous devices connected by a complex network having a variety of access protocols. Software defined networking (SDN), with its unique capabilities of decoupling control plane from data plane and maintaining a centralized programmable controller, has been gaining a lot of prominence in solving the security challenges faced by the IoT domain. This work first analyzes the security threats faced by the IoT domain and the inherent architectural flaws for these vulnerabilities. It then goes on to understand how solutions presented by the modified architecture of SDN-IoT can help to tackle these challenges. Lastly, the work draws a realistic image of bringing in SDN-IoT by showcasing the critical issues faced by this domain and the current efforts attempting to solve these issues. Thus, it serves as a good primer for researchers looking to delve into the topic for tackling prevalent challenges.
Software‐defined networking (SDN): a survey
Authors: Kamal Benzekki, Abdeslam El Fergougui, Abdelbaki El Belrhiti El Alaoui
Published in: Security and Communication Networks (2016-12-01)

Abstract With the advent of cloud computing, many new networking concepts have been introduced to simplify network management and bring innovation through network programmability. The emergence of the software‐defined networking (SDN) paradigm is one of these adopted concepts in the cloud model so as to eliminate the network infrastructure maintenance processes and guarantee easy management. In this fashion, SDN offers real‐time performance and responds to high availability requirements. However, this new emerging paradigm has been facing many technological hurdles; some of them are inherent, while others are inherited from existing adopted technologies. In this paper, our purpose is to shed light on SDN related issues and give insight into the challenges facing the future of this revolutionary network model, from both protocol and architecture perspectives. Additionally, we aim to present different existing solutions and mitigation techniques that address SDN scalability, elasticity, dependability, reliability, high availability, resiliency, security, and performance concerns. Copyright © 2017 John Wiley &amp; Sons, Ltd.
Software Supply-Chain Security: Issues and Countermeasures
Authors: Badis Hammi, Sherali Zeadally
Published in: Computer (2023-07-01)

Software application development involves various actors and organizations in what is called the software supply chain. We discuss how we can achieve strong resilience of the software supply chain to cyberthreats and then propose a holistic end-to-end security approach for the software supply chain.
Evaluation of Dynamic Analysis Tools for Software Security
Authors: Michael Lescisin, Qusay H. Mahmoud
Published in: International Journal of Systems and Software Security and Protection (2018-07-01)

This article discusses the development of secure software by means of dynamic analysis tools. A secure software-based system should have security checks and balances integrated throughout its entire development lifecycle, including its deployment phase. Therefore, this article covers both using software security tools for testing code in development as well as monitoring code in deployment to ensure that it is operating securely. The security issues discussed in this article will be split into two categories – memory safety issues and input validation issues. Memory safety issues concern problems of unauthorized memory access such as buffer overflows, stack overflows, use-after-free, double-free, memory leaks, etc. Although not strictly a memory safety issue, concurrency issues, such as data races, will be considered as memory safety issues in this article. Input validation issues concern problems where untrusted input is directly passed to handlers which are designed to handle both data and commands. Examples of this include path traversal, SQL injection, command injection, JavaScript/HTML injection, etc. As a result of this significant difference between these two types of security vulnerabilities, two sets of tools are evaluated with one set focusing on memory safety issues and the other on input validation issues. This article explores the benefits and limitations of current software dynamic analysis tools by evaluating them against both the authors test cases as well as the OWASP Benchmark for Security Automation and proposes solutions for implementing secure software applications.