Measuring, analyzing and predicting security vulnerabilities in software systems

2007 ◽  
Vol 26 (3) ◽  
pp. 219-228 ◽  
Author(s):  
O.H. Alhazmi ◽  
Y.K. Malaiya ◽  
I. Ray
Keyword(s):  
Software Systems ◽  
Security Vulnerabilities

Creating and Applying Security Goal Indicator Trees in an Industrial Environment

2014 ◽  
pp. 999-1013
Author(s):  
Alessandra Bagnato ◽  
Fabio Raiteri ◽  
Christian Jung ◽  
Frank Elberzhager
Keyword(s):  
Software Development ◽  
Software Systems ◽  
Full Potential ◽  
Security Vulnerabilities ◽  
Industrial Project ◽  
Project Environment ◽  
Development Tools ◽  
Development Lifecycle ◽  
Software Development Lifecycle

Security inspections are increasingly important for bringing security-relevant aspects into software systems, particularly during the early stages of development. Nowadays, such inspections often do not focus specifically on security. With regard to security, the well-known and approved benefits of inspections are not exploited to their full potential. This book chapter focuses on the Security Goal Indicator Tree application for eliminating existing shortcomings, the training that led to their creation in an industrial project environment, their usage, and their reuse by a team in industry. SGITs are a new approach for modeling and checking security-relevant aspects throughout the entire software development lifecycle. This book chapter describes the modeling of such security goal based trees as part of requirements engineering using the GOAT tool dedicated plug-in and the retrieval of these models during the various phases of the software development lifecycle in a project by means of Software Vulnerability Repository Services (SVRS) created in the European project SHIELDS (SHIELDS - Detecting known security vulnerabilities from within design and development tools).

scholarly journals Intrusion Detection in IoT based Smart Networks using Fuzzy Brain Storm Optimization Technique

2019 ◽  
Vol 8 (6) ◽  
pp. 3066-3071
Keyword(s):  
Embedded Systems ◽  
Optimization Technique ◽  
Security And Privacy ◽  
Smart Devices ◽  
Software Systems ◽  
Security Risks ◽  
Security Vulnerabilities ◽  
Brain Storm Optimization ◽  
Fuzzy C Means Clustering ◽  
The Internet Of Things

The Internet of Things (IoT) is characterized as an approach where objects are outfitted with sensors, processors, and actuators which include design of hardware board and development, protocols, web APIs, and software systems, which combined to make an associated architecture of embedded systems. This connected environment enables technologies to get associated with different networks, platforms, and devices, making a web of communication which is reforming the manner in which we communicate with the world digitally. These connected embedded systems are changing behaviour and interactions with our environment, networks, and homes, and also with our own bodies in terms of smart devices. Security and privacy are the most significant consideration in the field of real-world communication and mainly on IoTs. With the evolution of IoT the network layer security in the IoT has drawn greater focus. The security vulnerabilities in the IoT system could make security risks based on any application. Therefore there is an essential requirement for IDS for the IoT based systems for avoiding security attacks based on security vulnerabilities. This paper proposed a fuzzy c-means clustering with brain storm optimization algorithm (FBSO) for IDS based on IoT system. The NSL-KDD dataset is utilized to evaluate and simulate the proposed algorithm. The results demonstrate that the proposed technique efficiently recognize intrusion attacks and decrease the network difficulties

scholarly journals Data-Flow Analysis Heuristic for Vulnerability Detection on Configurable Systems

2020 ◽  
Author(s):  
Gleyberson Andrade ◽  
Elder Cirilo ◽  
Vinicius Durelli ◽  
Bruno Cafeo ◽  
Eiji Adachi
Keyword(s):  
Data Flow ◽  
Small Sample Size ◽  
Flow Analysis ◽  
Small Sample ◽  
Software Systems ◽  
Vulnerability Detection ◽  
Security Vulnerabilities ◽  
Data Flow Analysis ◽  
Configurable Software ◽  
Multiple Configurations

Configurable software systems offer a variety of benefits such as supporting easy configuration of custom behaviours for distinctive needs. However, it is known that the presence of configuration options in source code complicates maintenance tasks and requires additional effort from developers when adding or editing code statements. They need to consider multiple configurations when executing tests or performing static analysis to detect vulnerabilities. Therefore, vulnerabilities have been widely reported in configurable software systems. Unfortunately, the effectiveness of vulnerability detection depends on how the multiple configurations (i.e., samples sets) are selected. In this paper, we tackle the challenge of generating more adequate system configuration samples by taking into account the intrinsic characteristics of security vulnerabilities. We propose a new sampling heuristic based on data-flow analysis for recommending the subset of configurations that should be analyzed individually. Our results show that we can achieve high vulnerability-detection effectiveness with a small sample size.

scholarly journals Software Systems Security Vulnerabilities Management by Exploring the Capabilities of Language Models Using NLP

2021 ◽  
Vol 2021 ◽  
pp. 1-19
Author(s):  
Raghavendra Rao Althar ◽  
Debabrata Samanta ◽  
Manjit Kaur ◽  
Abeer Ali Alnuaim ◽  
Nouf Aljaffan ◽  
...  
Keyword(s):  
Software Development ◽  
Data Science ◽  
Software Security ◽  
Language Modeling ◽  
Language Models ◽  
Software Systems ◽  
Software System ◽  
Security Vulnerabilities ◽  
Systems Security ◽  
Secure Software

Security of the software system is a prime focus area for software development teams. This paper explores some data science methods to build a knowledge management system that can assist the software development team to ensure a secure software system is being developed. Various approaches in this context are explored using data of insurance domain-based software development. These approaches will facilitate an easy understanding of the practical challenges associated with actual-world implementation. This paper also discusses the capabilities of language modeling and its role in the knowledge system. The source code is modeled to build a deep software security analysis model. The proposed model can help software engineers build secure software by assessing the software security during software development time. Extensive experiments show that the proposed models can efficiently explore the software language modeling capabilities to classify software systems’ security vulnerabilities.

Creating and Applying Security Goal Indicator Trees in an Industrial Environment

2012 ◽  
pp. 266-280
Author(s):  
Alessandra Bagnato ◽  
Fabio Raiteri ◽  
Christian Jung ◽  
Frank Elberzhager
Keyword(s):  
Software Development ◽  
Software Systems ◽  
Full Potential ◽  
Software Vulnerability ◽  
Security Vulnerabilities ◽  
Industrial Project ◽  
Project Environment ◽  
Development Lifecycle ◽  
Software Development Lifecycle

Security inspections are increasingly important for bringing security-relevant aspects into software systems, particularly during the early stages of development. Nowadays, such inspections often do not focus specifically on security. With regard to security, the well-known and approved benefits of inspections are not exploited to their full potential. This book chapter focuses on the Security Goal Indicator Tree application for eliminating existing shortcomings, the training that led to their creation in an industrial project environment, their usage, and their reuse by a team in industry. SGITs are a new approach for modeling and checking security-relevant aspects throughout the entire software development lifecycle. This book chapter describes the modeling of such security goal based trees as part of requirements engineering using the GOAT tool dedicated plug-in and the retrieval of these models during the various phases of the software development lifecycle in a project by means of Software Vulnerability Repository Services (SHIELDS, Software Vulnerability Repository Services) created in the European project SHIELDS (SHIELDS, SHIELDS - Detecting known security vulnerabilities from within design and development tools).

A survey of static analysis methods for identifying security vulnerabilities in software systems

2007 ◽  
Vol 46 (2) ◽  
pp. 265-288 ◽  
Author(s):  
M. Pistoia ◽  
S. Chandra ◽  
S. J. Fink ◽  
E. Yahav
Keyword(s):  
Static Analysis ◽  
Software Systems ◽  
Security Vulnerabilities ◽  
Analysis Methods
Sign in / Sign up

Export Citation Format

Share Document