2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)最新文献_第8页

On the Use of API Calls for Detecting Repackaged Malware Apps: Challenges and Ideas 关于使用API调用检测重新包装的恶意软件应用程序:挑战和想法

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/ISSREW.2019.00057

Kobra Khanmohammadi, R. Khoury, A. Hamou-Lhadj

引用次数: 0

Safe Compilation for Hidden Deterministic Hardware Aliasing 隐藏确定性硬件混叠的安全编译

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/ISSREW.2019.00105

Peter T. Breuer, Jonathan P. Bowen

引用次数: 2

A Configurable Software Aging Detection and Rejuvenation Agent for Android 一个可配置的Android软件老化检测和返老还老代理

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/ISSREW.2019.00078

Domenico Cotroneo, L. Simone, R. Natella, R. Pietrantuono, S. Russo

引用次数: 9

Go-Sanitizer: Bug-Oriented Assertion Generation for Golang Go-Sanitizer:面向bug的Golang断言生成

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/ISSREW.2019.00039

Cong Wang, Hao Sun, Yiwen Xu, Yu Jiang, Huafeng Zhang, M. Gu

{"title":"Go-Sanitizer: Bug-Oriented Assertion Generation for Golang","authors":"Cong Wang, Hao Sun, Yiwen Xu, Yu Jiang, Huafeng Zhang, M. Gu","doi":"10.1109/ISSREW.2019.00039","DOIUrl":"https://doi.org/10.1109/ISSREW.2019.00039","url":null,"abstract":"Go programming language (Golang) is widely used, and the security issue becomes increasingly important because of its extensive applications. Most existing validation techniques, such as fuzz testing and unit testing, mainly focus on crashes detection and coverage improvements. However, it is challenging for test engines to perceive common program bugs such as loss of precision and integer overflow. In this paper, we propose Go-Sanitizer, an effective bug-oriented assertion generator for Golang, which is able to achieve a better performance in finding program bugs. Firstly, we manually analyze the Common Weakness Enumeration (CWE) and summarize the applicabilities on Golang. Secondly, we design a generator to automatically insert several bug-oriented assertions to the proper locations of the target program. Finally, we can utilize the traditional validation techniques such as fuzz and unit testing to test the programs with inserted assertions, and Go-Sanitizer reports bugs via the failures of assertions. For evaluation, we apply Go-Sanitizer to Badger, a widely-used database software, and successfully discovers 12 previously unreported program bugs, which can not be detected by pure fuzzer such as Go-Fuzz or unit testing methods.","PeriodicalId":166239,"journal":{"name":"2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"47 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128384110","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

WoSAR 2019 Workshop Committees WoSAR 2019研讨会委员会

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/issrew.2019.00017

引用次数: 0

SHCoT: Secure (and Verified) Hybrid Chain of Trust to Protect from Malicious Software in LightWeight Devices SHCoT:安全(和验证)混合信任链，以防止轻量级设备中的恶意软件

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/ISSREW.2019.00107

Abderrahmane Sensaoui, O. Aktouf, D. Hély

引用次数: 1

GAUSS 2019 Workshop Committees GAUSS 2019研讨会委员会

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/issrew.2019.00014

引用次数: 0

Resilient Reactive Systems Based on Runtime Semantic Models 基于运行时语义模型的弹性反应系统

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/ISSREW.2019.00069

Ester Giallonardo, Francesco Poggi, D. Rossi, E. Zimeo

引用次数: 2

Automatic Performance Monitoring and Regression Testing During the Transition from Monolith to Microservices 从单体到微服务的自动性能监控和回归测试

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/ISSREW.2019.00067

Andrea Janes, B. Russo

{"title":"Automatic Performance Monitoring and Regression Testing During the Transition from Monolith to Microservices","authors":"Andrea Janes, B. Russo","doi":"10.1109/ISSREW.2019.00067","DOIUrl":"https://doi.org/10.1109/ISSREW.2019.00067","url":null,"abstract":"The transition from monolith to microservices poses several challenges, like how to redistribute the features of system over different microservices. During the transition, developers may also redesign or rethink system services significantly, which can have a strong impact on various quality aspects of the resulting system. Thus, the new system may be more or less performing depending on the ability of the developers to design microservices and the capability of the microservice architecture to represent the system. Overall, a transition to microservices may or may not end up with the same or a better performing system. One way to control the migration to microservices is to continuously monitor a system by continuously collecting performance data and feeding the resulting data analysis back in the transition process. In DevOps, such continuous feedback can be exploited to re-tune the development and deployment of system's builds. In this paper, we present PPTAM+, a tool to continuously assess the degradation of a system during a transition to microservices. In an in-production system, the tool can continuously monitor each microservice and provide indications of lost performance and overall degradation. The system is designed to be integrated in a DevOps process. The tool automates the whole process from collecting data for building the reference operational profile to streamline performance data and automatically adapt and regress performance tests on each build based the analysis' feedback obtained from tests of the previous build.","PeriodicalId":166239,"journal":{"name":"2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"47 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134245498","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15

Analyzing and Improving Customer-Side Cloud Security Certifiability 分析和改进客户端云安全可认证性

2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) Pub Date : 2019-10-01 DOI: 10.1109/ISSREW.2019.00088

Shujie Zhao, Yiqun Chen, Stefan Winter, N. Suri

{"title":"Analyzing and Improving Customer-Side Cloud Security Certifiability","authors":"Shujie Zhao, Yiqun Chen, Stefan Winter, N. Suri","doi":"10.1109/ISSREW.2019.00088","DOIUrl":"https://doi.org/10.1109/ISSREW.2019.00088","url":null,"abstract":"Cloud services have become popular as an effective form to outsource computational resources. While providing cost efficiency on the one side, this outsourcing also causes a certain loss of control over the computational resources, which makes security risks difficult to predict and manage. To address such concerns, security service level agreements (secSLAs) have been proposed as contracts between Cloud service providers (CSPs) and Cloud service customers (CSCs) that cover security properties of Cloud services. SecSLAs cover a variety of different security properties, ranging from the availability of encrypted communication channels for accessing Cloud resources to the timely detection and removal of vulnerabilities in the CSP's infrastructure. As previous work [1] has shown, and as is evident for the example of timely vulnerability removal, not all of these security properties can be assessed by the CSC, which limits their utility as a contract basis. In this paper we propose a new monitoring framework for Cloud services to support the monitoring and validation of security properties on the customer side that require infrastructure-internal knowledge. To obtain the security properties to be monitored by our framework, we have manually investigated 97 different quantifiable properties in 5 standards from both industry and academia. We identified only 21 measurable properties from those standards, out of which we implement measurements for 13 representative ones and evaluated our measurements on the OPENSTACK platform.","PeriodicalId":166239,"journal":{"name":"2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"129 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122978381","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0