2022 IEEE 29th Annual Software Technology Conference (STC)最新文献

Experience-Based Guidelines for Effective Planning & Management of Software Integration & Test Activities in the Agile/DevSecOps Environment 在敏捷/DevSecOps环境中有效规划和管理软件集成和测试活动的基于经验的指南

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/stc55697.2022.00028

Emily Arseneault, D. Boudreau, Jarred Lien, Gregory Young

{"title":"Experience-Based Guidelines for Effective Planning & Management of Software Integration & Test Activities in the Agile/DevSecOps Environment","authors":"Emily Arseneault, D. Boudreau, Jarred Lien, Gregory Young","doi":"10.1109/stc55697.2022.00028","DOIUrl":"https://doi.org/10.1109/stc55697.2022.00028","url":null,"abstract":"Agile teams need to be ready to fail and try again. The Integration and Test (I&S) team is integral to this process because they provide the benchmarks against which DevSecOps development teams measure their work products. The integration process for Agile features must be flexible enough to handle changing schedules and requirements, while continuing to drive the program teams toward the ultimate goal of a successful program sell-off activity. Throughout the life of the contract the I&T team must continually integrate new features; work with the hardware & software teams to ensure product quality is preserved; and regression test the system at each software build release to ensure product stability. As the defense industry continues maturing its applications of the Agile and Devsecops philosophies, this family of I&T activities must be defined, managed, and executed within these frameworks.This presentation discusses in detail the integration of new features activity in I&T. Provided are practical. proven, experience-based guidelines for planning and managing this effort in the Agile framework. These guidelines derive from the successful integration of new capabilities into an unclassified foreign system, on a program employing DevSecOps. Information presented in this lecture is recommended to individuals interested in, or tasked with, this responsibility.","PeriodicalId":170123,"journal":{"name":"2022 IEEE 29th Annual Software Technology Conference (STC)","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133430049","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Implementing a Communication Network between Bases Station applied for Group of Drones 无人机群基站间通信网络的实现

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/STC55697.2022.00025

Julio Opolski Netto, Robison Cris Brito, F. Favarim, Luis Felipe Priester, E. Todt

引用次数: 0

Automated Extraction of Software Names from Vulnerability Reports using LSTM and Expert System 利用LSTM和专家系统从漏洞报告中自动提取软件名称

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/STC55697.2022.00024

Igor Khokhlov, A. Okutan, Ryan Bryla, Steven Simmons, Mehdi Mirakhorli

{"title":"Automated Extraction of Software Names from Vulnerability Reports using LSTM and Expert System","authors":"Igor Khokhlov, A. Okutan, Ryan Bryla, Steven Simmons, Mehdi Mirakhorli","doi":"10.1109/STC55697.2022.00024","DOIUrl":"https://doi.org/10.1109/STC55697.2022.00024","url":null,"abstract":"Software vulnerabilities are closely monitored by the security community to timely address the security and privacy issues in software systems. Before a vulnerability is published by vulnerability management systems, it needs to be characterized to highlight its unique attributes, including affected software products and versions, to help security professionals prioritize their patches. Associating product names and versions with disclosed vulnerabilities may require a labor-intensive process that may delay their publication and fix, and thereby give attackers more time to exploit them. This work proposes a machine learning method to extract software product names and versions from unstructured CVE descriptions automatically. It uses Word2Vec and Char2Vec models to create context-aware features from CVE descriptions and uses these features to train a Named Entity Recognition (NER) model using bidirectional Long short-term memory (LSTM) networks. Based on the attributes of the product names and versions in previously published CVE descriptions, we created a set of Expert System (ES) rules to refine the predictions of the NER model and improve the performance of the developed method. Experiment results on real-life CVE examples indicate that using the trained NER model and the set of ES rules, software names and versions in unstructured CVE descriptions could be identified with F-Measure values above 0.95.","PeriodicalId":170123,"journal":{"name":"2022 IEEE 29th Annual Software Technology Conference (STC)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126380968","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Continuous Documentation: Automating Document Preparation with your DevSecOps Pipeline 连续文档:使用DevSecOps管道自动化文档准备

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/STC55697.2022.00029

Bill Andel

引用次数: 1

Zero Trust Validation: from Practice to Theory : An empirical research project to improve Zero Trust implementations 零信任验证:从实践到理论:改进零信任实施的实证研究项目

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/STC55697.2022.00021

Y. Bobbert, J. Scheerder

{"title":"Zero Trust Validation: from Practice to Theory : An empirical research project to improve Zero Trust implementations","authors":"Y. Bobbert, J. Scheerder","doi":"10.1109/STC55697.2022.00021","DOIUrl":"https://doi.org/10.1109/STC55697.2022.00021","url":null,"abstract":"How can high-level directives concerning risk, cybersecurity and compliance be operationalized in the central nervous system of any organization above a certain complexity? How can the effectiveness of technological solutions for security be proven and measured, and how can this technology be aligned with the governance and financial goals at the board level? These are the essential questions for any CEO, CIO or CISO that is concerned with the wellbeing of the firm. The concept of Zero Trust (ZT) approaches information and cybersecurity from the perspective of the asset to be protected, and from the value that asset represents. Zero Trust has been around for quite some time. Most professionals associate Zero Trust with a particular architectural approach to cybersecurity, involving concepts such as segments, resources that are accessed in a secure manner and the maxim “always verify never trust”. This paper describes the current state of the art in Zero Trust usage. We investigate the limitations of current approaches and how these are addressed in the form of Critical Success Factors in the Zero Trust Framework developed by ON2IT ‘Zero Trust Innovators’ (1). Furthermore, this paper describes the design and engineering of a Zero Trust artefact that addresses the problems at hand (2), according to Design Science Research (DSR). The last part of this paper outlines the setup of an empirical validation trough practitioner oriented research, in order to gain a broader acceptance and implementation of Zero Trust strategies (3). The final result is a proposed framework and associated technology which, via Zero Trust principles, addresses multiple layers of the organization to grasp and align cybersecurity risks and understand the readiness and fitness of the organization and its measures to counter cybersecurity risks.","PeriodicalId":170123,"journal":{"name":"2022 IEEE 29th Annual Software Technology Conference (STC)","volume":"58 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128583183","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Neural Model for Generating Method Names from Combined Contexts 从组合上下文生成方法名的神经模型

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/STC55697.2022.00009

Zane Varner, Çerağ Oğuztüzün, Feng Long

引用次数: 0

Model-Agnostic Scoring Methods for Artificial Intelligence Assurance 人工智能保障的模型不可知评分方法

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/STC55697.2022.00011

Md. Nazmul Kabir Sikder, Feras A. Batarseh, Pei Wang, Nitish Gorentala

{"title":"Model-Agnostic Scoring Methods for Artificial Intelligence Assurance","authors":"Md. Nazmul Kabir Sikder, Feras A. Batarseh, Pei Wang, Nitish Gorentala","doi":"10.1109/STC55697.2022.00011","DOIUrl":"https://doi.org/10.1109/STC55697.2022.00011","url":null,"abstract":"State of the art Artificial Intelligence Assurance (AIA) methods validate AI systems based on predefined goals and standards, are applied within a given domain, and are designed for a specific AI algorithm. Existing works do not provide information on assuring subjective AI goals such as fairness and trustworthiness. Other assurance goals are frequently required in an intelligent deployment, including explainability, safety, and security. Accordingly, issues such as value loading, generalization, context, and scalability arise; however, achieving multiple assurance goals without major trade-offs is generally deemed an unattainable task. In this manuscript, we present two AIA pipelines that are model-agnostic, independent of the domain (such as: healthcare, energy, banking), and provide scores for AIA goals including explainability, safety, and security. The two pipelines: Adversarial Logging Scoring Pipeline (ALSP) and Requirements Feedback Scoring Pipeline (RFSP) are scalable and tested with multiple use cases, such as a water distribution network and a telecommunications network, to illustrate their benefits. ALSP optimizes models using a game theory approach and it also logs and scores the actions of an AI model to detect adversarial inputs, and assures the datasets used for training. RFSP identifies the best hyper-parameters using a Bayesian approach and provides assurance scores for subjective goals such as ethical AI using user inputs and statistical assurance measures. Each pipeline has three algorithms that enforce the final assurance scores and other outcomes. Unlike ALSP (which is a parallel process), RFSP is user-driven and its actions are sequential. Data are collected for experimentation; the results of both pipelines are presented and contrasted.","PeriodicalId":170123,"journal":{"name":"2022 IEEE 29th Annual Software Technology Conference (STC)","volume":"140 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116432962","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Introduction to AI Assurance for Policy Makers 政策制定者人工智能保障导论

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/stc55697.2022.00016

Luke Biersmith, P. Laplante

引用次数: 0

The Generation of Software Security Scoring Systems Leveraging Human Expert Opinion 利用人类专家意见的软件安全评分系统的生成

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/STC55697.2022.00023

P. Mell

{"title":"The Generation of Software Security Scoring Systems Leveraging Human Expert Opinion","authors":"P. Mell","doi":"10.1109/STC55697.2022.00023","DOIUrl":"https://doi.org/10.1109/STC55697.2022.00023","url":null,"abstract":"While the existence of many security elements in software can be measured (e.g., vulnerabilities, security controls, or privacy controls), it is challenging to measure their relative security impact. In the physical world we can often measure the impact of individual elements to a system. However, in cyber security we often lack ground truth (i.e., the ability to directly measure significance). In this work we propose to solve this by leveraging human expert opinion to provide ground truth. Experts are iteratively asked to compare pairs of security elements to determine their relative significance. On the back end our knowledge encoding tool performs a form of binary insertion sort on a set of security elements using each expert as an oracle for the element comparisons. The tool not only sorts the elements (note that equality may be permitted), but it also records the strength or degree of each relationship. The output is a directed acyclic ‘constraint’ graph that provides a total ordering among the sets of equivalent elements. Multiple constraint graphs are then unified together to form a single graph that is used to generate a scoring or prioritization system.For our empirical study, we apply this domain-agnostic measurement approach to generate scoring/prioritization systems in the areas of vulnerability scoring, privacy control prioritization, and cyber security control evaluation.","PeriodicalId":170123,"journal":{"name":"2022 IEEE 29th Annual Software Technology Conference (STC)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125665712","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Analyzing Failures in Artificial Intelligent Learning Systems (FAILS) 分析人工智能学习系统中的故障(FAILS)

2022 IEEE 29th Annual Software Technology Conference (STC) Pub Date : 2022-10-01 DOI: 10.1109/STC55697.2022.00010

Francis Durso, M. Raunak, Rick Kuhn, R. Kacker

引用次数: 1