2012 IEEE Sixth International Conference on Software Security and Reliability最新文献

A Control Flow Representation for Component-Based Software Reliability Analysis 一种基于组件的软件可靠性分析控制流表示方法

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.33

Atef Mohamed, Mohammad Zulkernine

{"title":"A Control Flow Representation for Component-Based Software Reliability Analysis","authors":"Atef Mohamed, Mohammad Zulkernine","doi":"10.1109/SERE.2012.33","DOIUrl":"https://doi.org/10.1109/SERE.2012.33","url":null,"abstract":"Current reliability analysis techniques encounter a prohibitive challenge with respect to the control flow representation of large software systems with intricate control flow structures. Some techniques use a component-based Control Flow Graph (CFG) structure which represents only inter-component control flow transitions. This CFG structure disregards the dependencies among multiple outward control flow transitions of a system component and does not provide any details about a component internal control flow structure. To overcome these problems, some techniques use statement-based or block-based CFGs. However, these CFG structures are remarkably complex and difficult to use for large software systems. In this paper, we propose a simple CFG structure called Connection Dependency Graph (CDG) that represents inter-component and intra-component control flow transitions and preserves the dependencies among them. We describe the CDG structure and explain how to derive it from a program source code. Our derivation exploits a number of architectural patterns to capture the control flow transitions and identify the execution paths among connections. We provide a case study to examine the effect of program size on the CDG, the statement-based, and the block-based CFGs by comparing them with respect to complexity using the PostgreSQL open source database system.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115257959","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Toward Systematic Construction of Timing Diagrams from UML/MARTE Behavioral Models for Time-Triggered Embedded Software 基于时间触发嵌入式软件UML/MARTE行为模型的时间图系统构建

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.24

Jinho Choi, Eunkyoung Jee, Doo-Hwan Bae

引用次数: 5

Countering Network-Centric Insider Threats through Self-Protective Autonomic Rule Generation 通过自我保护自治规则生成对抗以网络为中心的内部威胁

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.40

Faisal M. Sibai, D. Menascé

{"title":"Countering Network-Centric Insider Threats through Self-Protective Autonomic Rule Generation","authors":"Faisal M. Sibai, D. Menascé","doi":"10.1109/SERE.2012.40","DOIUrl":"https://doi.org/10.1109/SERE.2012.40","url":null,"abstract":"Insider threats are a growing problem in today's organizations. Detecting such attacks is especially challenging because most system owners and system administrators use networks to remotely manage the systems they are responsible for. In previous work, we introduced the Autonomic Violation Prevention System (AVPS) that has a scalable architecture to deal with such threats. This system uses low level human-specified and manually-entered rules to protect networked applications from disgruntled privileged users. However, rule-based systems are generally difficult to maintain when the number of rules is too large. This paper addresses this problem by allowing human beings to enter a smaller number of high-level rules that are automatically translated into one or more low-level rules based on an analysis of the incoming network traffic. The paper discusses how various high level rules (HLR) can detect new unwanted behaviors without any user intervention. Experiments conducted on three types of applications -- FTP, database, and Web -- show that the enhanced AVPS can detect known and unknown insider attacks through high level rules and process automation.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128401406","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Mining Executable Specifications of Web Applications from Selenium IDE Tests 从Selenium IDE测试中挖掘Web应用程序的可执行规范

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.39

Dianxiang Xu, Weifeng Xu, Bharath K. Bavikati, W. E. Wong

{"title":"Mining Executable Specifications of Web Applications from Selenium IDE Tests","authors":"Dianxiang Xu, Weifeng Xu, Bharath K. Bavikati, W. E. Wong","doi":"10.1109/SERE.2012.39","DOIUrl":"https://doi.org/10.1109/SERE.2012.39","url":null,"abstract":"A common practice for system testing of web-based applications is to perform the test cases through a web browser. These tests are often recorded and managed by a record and replay tool, such as Selenium IDE. Mining specifications from such tests can be very useful for understanding, verifying, and debugging the system under test. This paper presents an approach to mining a behavior specification from a Selenium IDE test suite such that (a) it captures the behavior of the tests at a high level of abstraction, (b) the behavior can be simulated, and (c) all the tests are completely reproducible from the specification. We first identify similar test actions through context-sensitive clustering so as to normalize the given Selenium IDE tests. Then, we mine patterns of test actions that represent meaningful functions and transform Selenium IDE tests into abstract tests, which are similar to the tests used in the existing model-mining techniques. From the abstract tests, we synthesize a high-level Petri net that captures both temporal constraints and data values. For evaluation purposes, we applied our approach to eight test suites of two real-world systems, Magento (an online shopping system being used by many live stores) and Amazon. Two of the test suites are for security testing, aiming at SQL injection and XSS vulnerabilities. The result shows that our approach is effective in producing abstract yet executable specifications and reducing the complexity of the models.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"59 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128745415","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

Automatic Simplification of Obfuscated JavaScript Code: A Semantics-Based Approach 自动简化混淆JavaScript代码:基于语义的方法

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.13

Gen Lu, S. Debray

引用次数: 40

A Study of Using Two-Parameter Generalized Pareto Model to Analyze the Fault Distribution of Open Source Software 用双参数广义Pareto模型分析开源软件故障分布的研究

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.21

C. Kuo, Chin-Yu Huang, Shao-Pu Luan

引用次数: 6

Accelerating Taint-Based Concolic Testing by Pruning Pointer Overtaint 利用剪枝指针覆盖加速基于污点的圆锥检测

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.31

Yun-Min Cheng, Bing-Han Li, S. Shieh

{"title":"Accelerating Taint-Based Concolic Testing by Pruning Pointer Overtaint","authors":"Yun-Min Cheng, Bing-Han Li, S. Shieh","doi":"10.1109/SERE.2012.31","DOIUrl":"https://doi.org/10.1109/SERE.2012.31","url":null,"abstract":"Taint-based Concolic testing is a software testing technique, which combines dynamic taint analysis, symbolic testing and concrete execution. Concolic testing is faster than symbolic testing while maintaining the same precision. Taint-based concolic testing uses dynamic taint analysis to help identify instructions related to inputs, and at the same time reduce the total number of constraints. Although taint-based concolic testing can be faster than concolic testing, issues regarding the taint propagation of pointers must be addressed. Decision on whether to taint the read-from-memory data referenced by a tainted address may cause either pointer under taint or over taint. The inappropriate taint will cause the result of insufficient or redundant constraints. Consequently, the insufficient constraint will lead to inaccurate test results and make the test target exploitable. On the other hand, the redundant constraint significantly slows down the test due to the fact that the constraint solving time depends on the constraint size. In this paper, we propose a new tainting approach which can prune pointer over taint without causing pointer under taint to depress the size of the path constraints. While exploring the target program exhaustively and detecting potential vulnerabilities, the proposed tainting approach can substantially accelerate taint-based concolic testing.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"47 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115360203","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Secure Fine-Grained Access Control Mechanism for Networked Storage Systems 面向网络存储系统的安全细粒度访问控制机制

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.35

Hsiao-Ying Lin, J. Kubiatowicz, Wen-Guey Tzeng

引用次数: 3

Using Weighted Attributes to Improve Cluster Test Selection 利用加权属性改进聚类测试选择

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.18

Yabin Wang, Zhenyu Chen, Yang Feng, B. Luo, Yijie Yang

引用次数: 7

Extending the Reliability of Wireless Sensor Networks through Informed Periodic Redeployment 通过知情周期性重新部署扩展无线传感器网络的可靠性

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.29

Luiz A. F. Laranjeira, G. Rodrigues

{"title":"Extending the Reliability of Wireless Sensor Networks through Informed Periodic Redeployment","authors":"Luiz A. F. Laranjeira, G. Rodrigues","doi":"10.1109/SERE.2012.29","DOIUrl":"https://doi.org/10.1109/SERE.2012.29","url":null,"abstract":"This paper investigates the reliability of wireless sensor networks, deployed over a square area, in regards to two aspects: network connectivity and node failures. Analyzing the phenomenon known as the border effects on the connectivity of such networks, we derive exact expressions for the expected effective connectivity degree of border nodes. We show that the relative average number of neighbors for nodes in the borders is independent of the node transmission range and of the overall network node density. Assuming a network composed of N uniformly distributed nodes over a square area of side L, our simulation experiments demonstrate that the connectivity of the overall network is dominated by the average node degree in the corner borders of the square network area. Using this result, and considering sensor node failure rates, we derive analytical expressions for the mean time to disconnect (MTTD) and the mean number of sensors remaining (MNSR) upon disconnection for a given network. For precise reliability estimates we also calculate the sensor redeployment period ΔT and the number of sensors per redeployment ΔN, that should be effected in order to keep the network continuously connected with probability higher than 99%. We then run additional simulations for a network subject to sensors failures to obtain experimental MTTD and MNSR values which we found to be very close to the analytically derived ones. These experiments also ratified that periodic sensor redeployments characterized by the pair (ΔN, ΔT), resulting from our analysis, can continuously extend the reliability of wireless sensor networks.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129204201","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11