发布求助
文献互助 智能选刊 最新文献

2009 ICSE Workshop on Software Engineering for Secure Systems最新文献

筛选
英文 中文
Generating formal specifications for security-critical applications - A model-driven approach 为安全关键型应用程序生成正式规范——一种模型驱动的方法
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068461
Nina Moebius, K. Stenzel, W. Reif
{"title":"Generating formal specifications for security-critical applications - A model-driven approach","authors":"Nina Moebius, K. Stenzel, W. Reif","doi":"10.1109/IWSESS.2009.5068461","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068461","url":null,"abstract":"The SecureMDD approach aims to generate both, a formal specification for verification and executable code, from UML diagrams. The UML models define the static as well as dynamic components of the system under development. This model-driven approach is focused on security-critical applications that are based on cryptographic protocols, esp. Java Card applications. In this paper we describe the generation of the formal specification from the UML model which is then used as input for our interactive verification system KIV. The formal specification is based on abstract state machines and algebraic specifications. It allows to formulate and to prove application-specific security properties.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"91 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128608852","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 25
SWAP: Mitigating XSS attacks using a reverse proxy SWAP:使用反向代理减轻XSS攻击
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068456
Peter Würzinger, Christian Platzer, Christian Ludl, E. Kirda, Christopher Krügel
{"title":"SWAP: Mitigating XSS attacks using a reverse proxy","authors":"Peter Würzinger, Christian Platzer, Christian Ludl, E. Kirda, Christopher Krügel","doi":"10.1109/IWSESS.2009.5068456","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068456","url":null,"abstract":"Due to the increasing amount of Web sites offering features to contribute rich content, and the frequent failure of Web developers to properly sanitize user input, cross-site scripting prevails as the most significant security threat to Web applications. Using cross-site scripting techniques, miscreants can hijack Web sessions, and craft credible phishing sites. Previous work towards protecting against cross-site scripting attacks suffers from various drawbacks, such as practical infeasibility of deployment due to the need for client-side modifications, inability to reliably detect all injected scripts, and complex, error-prone parameterization. In this paper, we introduce SWAP (Secure Web Application Proxy), a server-side solution for detecting and preventing cross-site scripting attacks. SWAP comprises a reverse proxy that intercepts all HTML responses, as well as a modified Web browser which is utilized to detect script content. SWAP can be deployed transparently for the client, and requires only a simple automated transformation of the originalWeb application. Using SWAP, we were able to correctly detect exploits on several authentic vulnerabilities in popular Web applications.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"520 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116261784","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 119
Metamodel for privacy policies within SOA SOA中隐私策略的元模型
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068457
D. Allison, H. ElYamany, Miriam A. M. Capretz
{"title":"Metamodel for privacy policies within SOA","authors":"D. Allison, H. ElYamany, Miriam A. M. Capretz","doi":"10.1109/IWSESS.2009.5068457","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068457","url":null,"abstract":"As service-oriented architecture (SOA) continues to grow as a viable approach to systems development, so too does the number of services available. The strength of services in an SOA environment to provide interoperability comes at the cost of reduced privacy, as more interactions between autonomous services require more information to be exchanged. In this paper we define a metamodel for privacy policy creation and comparison based on fair information practices introduced around the world to protect the privacy of individuals. We develop criteria for the comparison of the elements that compose the policies, creating hierarchical relationships between those elements that could not otherwise be directly compared. An example of two policies being compared is presented to demonstrate how this comparison can be done. We believe this definition of how to create and compare privacy policies forms a strong foundation from which a comprehensive solution to SOA privacy can be built.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124012619","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 25
RUP-based process model for security requirements engineering in value-added service development 增值业务开发中安全需求工程的基于rup的过程模型
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068459
H. Belani, Z. Car, A. Caric
{"title":"RUP-based process model for security requirements engineering in value-added service development","authors":"H. Belani, Z. Car, A. Caric","doi":"10.1109/IWSESS.2009.5068459","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068459","url":null,"abstract":"Due to the spreading of SMS services and appearing of new business models, value-added SMS services have been introduced. According to the research results about wide distribution of security incidents on ICT systems worldwide, in spite of known security solutions, there is a necessity for organizational approach to implement security. This paper presents research and development efforts in building process model SecuRUP for security requirements engineering conformed to RUP framework. The model consists of processes, artifacts, activities and according roles for successful elicitation, analysis and specification of recognized security requirements and is validated on presented case study. The model validation results have shown significant process improvement, especially on roles and activities identification in SecuRUP elaboration process, but only further case studies in industry can be best indicators for usefulness of such models.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123654785","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Reusable security use cases for mobile grid environments 移动网格环境的可重用安全用例
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068452
D. Rosado, E. Fernández-Medina, Javier López
{"title":"Reusable security use cases for mobile grid environments","authors":"D. Rosado, E. Fernández-Medina, Javier López","doi":"10.1109/IWSESS.2009.5068452","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068452","url":null,"abstract":"Due to the growing complexity of software development, developing software through systematic processes is becoming more and more important. Likewise, it is important that the development process used integrates security aspects from the first stages at the same level as other functional and non-functional requirements. In the last years, GRID technology has shown to be the most important one and it allows us to build very complex information systems with different and remarkable features (interoperability between multiple security domains, cross-domain authentication and authorization, dynamic, heterogeneous and limited mobile devices, etc). Traditionally, systems based on GRID Computing have not been developed through adequate methodologies and have not taken into account security requirements throughout their development, only offering security technical solutions at the implementation stages. This paper shows part of a development methodology that we are elaborating for the construction of information systems based on Grid Computing highly dependent on mobile devices where security plays a very important role. Specifically, in this paper, we will present the analysis phase, managed by reusable use cases through which we can define the requirements and needs of these systems obtaining an analysis model that can be used as input to the following phase of the methodology, the design phase of mobile Grid systems.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130587883","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
Improving perimeter security with security-oriented program transformations 通过面向安全的程序转换改进外围安全性
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068460
M. Hafiz, Ralph E. Johnson
{"title":"Improving perimeter security with security-oriented program transformations","authors":"M. Hafiz, Ralph E. Johnson","doi":"10.1109/IWSESS.2009.5068460","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068460","url":null,"abstract":"A security-oriented program transformation maps programs to security-augmented programs, i.e. it introduces a protection mechanism to make programs more secure. Our previous work defined security-oriented program transformations [6], introduced a catalog of transformations [8], and showed how program transformations could be applied to systematically eradicate various types of data injection attacks [9]. This paper shows how security-oriented program transformations could be used to improve the security of a system's perimeter by introducing authentication, authorization and input validation components. The program transformation examples in this paper are JAVA specific, but the transformations could be implemented to use other authentication and authorization frameworks.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131104270","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 14
A hybrid analysis framework for detecting web application vulnerabilities 用于检测web应用程序漏洞的混合分析框架
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068455
Mattia Monga, Roberto Paleari, Emanuele Passerini
{"title":"A hybrid analysis framework for detecting web application vulnerabilities","authors":"Mattia Monga, Roberto Paleari, Emanuele Passerini","doi":"10.1109/IWSESS.2009.5068455","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068455","url":null,"abstract":"Increasingly, web applications handle sensitive data and interface with critical back-end components, but are often written by poorly experienced programmers with low security skills. The majority of vulnerabilities that affect web applications can be ascribed to the lack of proper validation of user's input, before it is used as argument of an output function. Several program analysis techniques were proposed to automatically spot these vulnerabilities. One particularly effective is dynamic taint analysis. Unfortunately, this approach introduces a significant run-time penalty.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130240277","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 36
Intrusion detection using signatures extracted from execution profiles 使用从执行配置文件中提取的签名进行入侵检测
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068454
Marwa El-Ghali, Wes Masri
{"title":"Intrusion detection using signatures extracted from execution profiles","authors":"Marwa El-Ghali, Wes Masri","doi":"10.1109/IWSESS.2009.5068454","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068454","url":null,"abstract":"An application based intrusion detection system is a security mechanism designed to detect malicious behavior that could compromise the security of a software application. Our aim is to develop such a system that operates on signatures extracted from execution profiles. These signatures are not descriptions of exploits, but instead are descriptions of the program conditions that lead to the exploitation of software vulnerabilities, i.e., they depend on the structure of the vulnerabilities themselves.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114693441","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
MUTEC: Mutation-based testing of Cross Site Scripting MUTEC:基于突变的跨站脚本测试
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-19 DOI: 10.1109/IWSESS.2009.5068458
H. Shahriar, Mohammad Zulkernine
{"title":"MUTEC: Mutation-based testing of Cross Site Scripting","authors":"H. Shahriar, Mohammad Zulkernine","doi":"10.1109/IWSESS.2009.5068458","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068458","url":null,"abstract":"Cross Site Scripting (XSS) is one of the worst vulnerabilities that allow malicious attacks such as cookie thefts and web page defacements. Testing an implementation against XSS vulnerabilities (XSSVs) can avoid these consequences. Obtaining an adequate test data set is essential for testing of XSSVs. An adequate test data set contains effective test cases that can reveal XSSVs. Unfortunately, traditional testing techniques for XSSVs do not address the issue of adequate testing. In this work, we apply the idea of mutation-based testing technique to generate adequate test data sets for testing XSSVs. Our work addresses XSSVs related to web-applications that use PHP and JavaScript code to generate dynamic HTML contents. We propose 11 mutation operators to force the generation of adequate test data set. A prototype mutation-based testing tool named MUTEC is developed to generate mutants automatically. The proposed operators are validated by using five open source applications having XSSVs. The results indicate that the proposed operators are effective for testing XSSVs.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128296345","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 64
Resolving least privilege violations in software architectures 解决软件架构中最少的特权冲突
2009 ICSE Workshop on Software Engineering for Secure Systems Pub Date : 2009-05-01 DOI: 10.1109/IWSESS.2009.5068453
Koen Buyens, Bart De Win, W. Joosen
{"title":"Resolving least privilege violations in software architectures","authors":"Koen Buyens, Bart De Win, W. Joosen","doi":"10.1109/IWSESS.2009.5068453","DOIUrl":"https://doi.org/10.1109/IWSESS.2009.5068453","url":null,"abstract":"Supporting a security principle, such as least privilege, in a software architecture is difficult. Systematic rules are lacking, no guidance explains how to apply the principle in practice. As a result, security principles are often neglected. This lowers the overall security level of the software system and the cost of fixing such problems later on in the development cycle is high. We propose an improvement in supporting least privilege in software architectures. We have identified architectural transformations that reduce violations to the principle of least privilege. These transformations have been implemented. We have applied the solution on a case study.","PeriodicalId":238909,"journal":{"name":"2009 ICSE Workshop on Software Engineering for Secure Systems","volume":"64 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121704071","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 16
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整，为了账户安全，请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们：info@booksci.cn Book学术提供免费学术资源搜索服务，方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号：604180095
Book学术官方微信
小红书