发布求助
文献互助 智能选刊 最新文献

2016 IEEE Cybersecurity Development (SecDev)最新文献

筛选
英文 中文
Static Analysis Alert Audits: Lexicon & Rules 静态分析警报审计:词典和规则
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-04 DOI: 10.1109/SecDev.2016.018
David Svoboda, Lori Flynn, William Snavely
{"title":"Static Analysis Alert Audits: Lexicon & Rules","authors":"David Svoboda, Lori Flynn, William Snavely","doi":"10.1109/SecDev.2016.018","DOIUrl":"https://doi.org/10.1109/SecDev.2016.018","url":null,"abstract":"There is no widely-accepted lexicon or standard set of rules for auditing static analysis alerts in the software engineering community. Auditing rules and a lexicon should guide different auditors to make the same determination for an alert. Standard terms and processes are necessary so that initial determinations are correctly interpreted, which helps organizations reduce code flaws. They are also needed to improve the quality of audit data to benefit research on alert prioritization. This paper provides a suggested set of auditing rules and a lexicon, detailing rationales based on modern software engineering practices for each rule and each lexicon term. Some code examples are provided with the auditing rules. The authors' hope is that this suggested framework will motivate community discussion leading to agreed-upon standards.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126756649","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Avoiding Insecure C++ —How to Avoid Common C++ Security Vulnerabilities 避免不安全的c++ -如何避免常见的c++安全漏洞
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.022
A. Ballman, David Svoboda
{"title":"Avoiding Insecure C++ —How to Avoid Common C++ Security Vulnerabilities","authors":"A. Ballman, David Svoboda","doi":"10.1109/SecDev.2016.022","DOIUrl":"https://doi.org/10.1109/SecDev.2016.022","url":null,"abstract":"Introducing the SEI CERT C++ Coding Standard, a new, security-focused coding standard for the C++ programming language that focuses on the security of applications written with modern versions of C++.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127139224","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
The Seven Turrets of Babel: A Taxonomy of LangSec Errors and How to Expunge Them 巴别塔的七个塔楼:语言错误的分类和如何消除它们
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.019
Falcon Momot, S. Bratus, Sven M. Hallberg, M. Patterson
{"title":"The Seven Turrets of Babel: A Taxonomy of LangSec Errors and How to Expunge Them","authors":"Falcon Momot, S. Bratus, Sven M. Hallberg, M. Patterson","doi":"10.1109/SecDev.2016.019","DOIUrl":"https://doi.org/10.1109/SecDev.2016.019","url":null,"abstract":"Input-handling bugs share two common patterns: insufficient recognition, where input-checking logic is unfit to validate a program's assumptions about inputs, %leading to the code acting on invalid inputs, and parser differentials, wherein two or more components of a system fail to interpret input equivalently. We argue that these patterns are artifacts of avoidable weaknesses in the development process and explore these patterns both in general and via recent CVE instances. We break ground on defining the input-handling code weaknesses that should be actionable findings and propose a refactoring of existing CWEs to accommodate them. We propose a set of new CWEs to name such weaknesses that will help code auditors and penetration testers precisely express their findings of likely vulnerable code structures.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128181163","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 49
Automated Code Repair Based on Inferred Specifications 基于推断规范的自动代码修复
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.037
William Klieber, William Snavely
{"title":"Automated Code Repair Based on Inferred Specifications","authors":"William Klieber, William Snavely","doi":"10.1109/SecDev.2016.037","DOIUrl":"https://doi.org/10.1109/SecDev.2016.037","url":null,"abstract":"Techniques for automated code repair have the potential for greatly aiding in the development of secure and correct code. There are currently a few major difficulties confronting the development and deployment of tools for automated repair, we examine these and briefly explore possible solutions. To give a flavor of what automated repair might look like, we discuss in detail three types of proposed automated repair: (1) repairing inequality comparisons involving integer overflow to behave the same as if unlimited-bitwidth integers were used, (2) inserting memory bounds checks where needed, using dynamic analysis to infer tightest correct bounds, (3) inserting missing authorization checks in a client-server application based on an inferred access control policy.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134448311","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Maintaining Authorization Hook Placements Across Program Versions 维护跨程序版本的授权钩子位置
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.024
Nirupama Talele, D. Muthukumaran, F. Capobianco, T. Jaeger, Gang Tan
{"title":"Maintaining Authorization Hook Placements Across Program Versions","authors":"Nirupama Talele, D. Muthukumaran, F. Capobianco, T. Jaeger, Gang Tan","doi":"10.1109/SecDev.2016.024","DOIUrl":"https://doi.org/10.1109/SecDev.2016.024","url":null,"abstract":"We examine the problem of maintaining security code across program versions. There are now several cases where programmers manually retrofit their programs with security code, such as authorization mechanisms. However, programs evolve, so a challenge for programmers is to determine whether their security code remains correct across multiple versions of the program. The insight of this work is that programmers can use the constraints on the authorization policies that can be enforced in one version of the program to limit their effort in validating authorization hook placements in later versions. We develop a tool we call HEIMDAL to implement this insight, finding that a modest number of authorization constraints require review across several versions of the X window server program.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115530268","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Adopting Strict Content Security Policy for XSS Protection 采用严格的内容安全策略进行XSS防护
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.039
Lukas Weichselbaum, M. Spagnuolo, Artur Janc
{"title":"Adopting Strict Content Security Policy for XSS Protection","authors":"Lukas Weichselbaum, M. Spagnuolo, Artur Janc","doi":"10.1109/SecDev.2016.039","DOIUrl":"https://doi.org/10.1109/SecDev.2016.039","url":null,"abstract":"Content Security Policy is a mechanism designed to prevent the exploitation of XSS -- the most common high-risk web application flaw. CSP restricts which scripts can be executed by allowing developers to define valid script sources; an attacker with a content-injection flaw should not be able to force the browser to execute arbitrary malicious scripts. Currently, CSP is commonly used in conjunction with domain-based script whitelist, where the existence of a single unsafe endpoint in the script whitelist effectively removes the value of the policy as a protection against XSS ( some examples ).","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126960710","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Software Security Investment: The Right Amount of a Good Thing 软件安全投资:适量的好东西
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.020
Chad Heitzenrater, A. Simpson
{"title":"Software Security Investment: The Right Amount of a Good Thing","authors":"Chad Heitzenrater, A. Simpson","doi":"10.1109/SecDev.2016.020","DOIUrl":"https://doi.org/10.1109/SecDev.2016.020","url":null,"abstract":"Despite an ever-increasing amount of money and attention devoted to cybersecurity, we continue to see wide-ranging cybersecurity failures. As security practitioners examine new approaches to combat this trend, a growing community has coalesced around secure software development, or 'SWSec', as a best practice. While this movement has highlighted the role engineering process plays in combating the underlying source of vulnerabilities, it has yet to enjoy wide adoption. Anecdotal evidence points to an inability to demonstrate the return on investment (ROI) as a rationale behind this reluctance, and current information security investment models have failed to account for such expenditures. We seek to build upon such models to reflect SWSec investments, with a view to demonstrating the ROI enjoyed by SWSec practice. We summarise our current research toward these ends and identify the research required to fully reflect SWSec alongside current security investments.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126367050","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Applying the Opacified Computation Model to Enforce Information Flow Policies in IoT Applications 应用不透明计算模型实施物联网应用中的信息流策略
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.031
Amir Rahmati, Earlence Fernandes, A. Prakash
{"title":"Applying the Opacified Computation Model to Enforce Information Flow Policies in IoT Applications","authors":"Amir Rahmati, Earlence Fernandes, A. Prakash","doi":"10.1109/SecDev.2016.031","DOIUrl":"https://doi.org/10.1109/SecDev.2016.031","url":null,"abstract":"Enforcing flow-control is an important, albeit difficult to achieve security goal in practical applications. In this paper, we consider the problem of flow-control in IoT applications and present an approach to enforce information flow policies on them. We describe a model called Opacified Computation and its implementation, FlowFence, and show how to port an existing IoT application (without flow policy enforcement) to one that uses FlowFence to guarantee protection against data leakage. Finally, we report on performance overhead and discuss directions for future work.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114370597","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Code Randomization: Haven’t We Solved This Problem Yet? 代码随机化:我们还没有解决这个问题吗?
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.036
Stephen Crane, Andrei Homescu, Per Larsen
{"title":"Code Randomization: Haven’t We Solved This Problem Yet?","authors":"Stephen Crane, Andrei Homescu, Per Larsen","doi":"10.1109/SecDev.2016.036","DOIUrl":"https://doi.org/10.1109/SecDev.2016.036","url":null,"abstract":"Two decades since the idea of using software diversity for security was put forward, ASLR is the only technique to see widespread deployment. This is puzzling since academic security researchers have published scores of papers claiming to advance the state of the art in the area of code randomization. Unfortunately, these improved diversity techniques are generally less deployable than integrity-based techniques, such as control-flow integrity, due to their limited compatibility with existing optimization, development, and distribution practices. This paper contributes yet another diversity technique called pagerando. Rather than trading off practicality for security, we first and foremost aim for deployability and interoperability. Most code randomization techniques interfere with memory sharing and deduplication optimization across processes and virtual machines, ours does not. We randomize at the granularity of individual code pages but never rewrite page contents. This also avoids incompatibilities with code integrity mechanisms that only allow signed code to be mapped into memory and prevent any subsequent changes. On Android, pagerando fully adheres to the default SELinux policies. All practical mitigations must interoperate with unprotected legacy code, our implementation transparently interoperates with unmodified applications and libraries. To support our claims of practicality, we demonstrate that our technique can be integrated into and protect all shared libraries shipped with stock Android 6.0. We also consider hardening of non-shared libraries and executables and other concerns that must be addressed to put software diversity defenses on par with integrity-based mitigations such as CFI.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"317 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"113996192","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 23
Secure Coding for Real-Time Embedded Systems: Cert Run-Time Profile for Ada 实时嵌入式系统的安全编码:Ada的证书运行时配置文件
2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.026
Mable Benjamin
{"title":"Secure Coding for Real-Time Embedded Systems: Cert Run-Time Profile for Ada","authors":"Mable Benjamin","doi":"10.1109/SecDev.2016.026","DOIUrl":"https://doi.org/10.1109/SecDev.2016.026","url":null,"abstract":"Safety and security in software coding is becoming increasingly important in mission-critical systems due to various emerging threats and to avoid potential disastrous consequences. These issues can be significantly reduced by software designs and implementations that adequately protect systems. This abstract describes coding methodologies in the Ada 95/2005 programming language for complex embedded software running on Real-Time Operating Systems (RTOS) for military applications.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128929691","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
下一页 尾页
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整，为了账户安全，请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们：info@booksci.cn Book学术提供免费学术资源搜索服务，方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号：604180095
Book学术官方微信
小红书