2020 International Conference on Software Security and Assurance (ICSSA)最新文献_第2页

An Internet of Things (IoT) Security Assessment for Households 家庭物联网(IoT)安全评估

2020 International Conference on Software Security and Assurance (ICSSA) Pub Date : 2020-10-01 DOI: 10.1109/ICSSA51305.2020.00017

William Aiken, J. Ryoo, S. Rizvi

引用次数: 0

Continuous Security through Integration Testing in an Electronic Health Records System 通过电子健康记录系统集成测试实现持续安全

2020 International Conference on Software Security and Assurance (ICSSA) Pub Date : 2020-10-01 DOI: 10.1109/ICSSA51305.2020.00012

S. Purkayastha, Shreya Goyal, Tyler Phillips, Huanmei Wu, Brandon Haakenson, X. Zou

{"title":"Continuous Security through Integration Testing in an Electronic Health Records System","authors":"S. Purkayastha, Shreya Goyal, Tyler Phillips, Huanmei Wu, Brandon Haakenson, X. Zou","doi":"10.1109/ICSSA51305.2020.00012","DOIUrl":"https://doi.org/10.1109/ICSSA51305.2020.00012","url":null,"abstract":"The estimated average cost of a healthcare data breach in 2019 was $6.45 million, which is the highest among all industries. Yet, security remains an afterthought in many digital health applications. Formal methods for testing for bugs are commonplace in software development through the use of unit testing, integration testing, system testing, and acceptance testing. More so, in modern software engineering, continuous integration is a well-known concept to run automated tests soon after any code change, when the system builds and notifies the development team of the test results. In this paper, we describe the use of a popular Python unit testing framework to implement a formal method of security testing. Common Vulnerability Scoring System (CVSS) is used to calculate metrics that represent the state of security of a deployed system. We developed a series of Pytest Behavioral Driven Development (BDD) scripts to test the Authentication and Availability of a widely used Electronic Health Records System called OpenMRS. The advantage of using the BDD approach is that testing scripts, called Gherkin files, can be read, and understood by the developers as well as the non-developer stakeholders. The use of Gherkin serves two purposes: firstly, it serves as the project’s documentation, and secondly, it automates the tests. The use of the CVSS score between 0 to 10 becomes an objective metric to compare every code change, thus achieving continuous security. We plan to expand BDD scripts to attacks like Denial of Service, Session Hijacking, SQL Injection, and other privilege escalation attacks.","PeriodicalId":346706,"journal":{"name":"2020 International Conference on Software Security and Assurance (ICSSA)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128047266","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

VM based Malware Security Protection on Android Platform Android平台基于虚拟机的恶意软件安全防护

2020 International Conference on Software Security and Assurance (ICSSA) Pub Date : 2020-10-01 DOI: 10.1109/ICSSA51305.2020.00014

Anthony Avella, Syed Rizvi, Andrew Gibson, Marcus Ryan, Ryan P. Strimple, Ian Menovich

{"title":"VM based Malware Security Protection on Android Platform","authors":"Anthony Avella, Syed Rizvi, Andrew Gibson, Marcus Ryan, Ryan P. Strimple, Ian Menovich","doi":"10.1109/ICSSA51305.2020.00014","DOIUrl":"https://doi.org/10.1109/ICSSA51305.2020.00014","url":null,"abstract":"This paper looks at the different ways in which Android phones can be attacked by android malware, and the different developments in malware protection and detection. The fight against mobile malware is an important one as most people today own cell phones and store valuable personal information on their phones. There are many ways in which a phone can be attacked by malware, and therefore there are many different methods to detect and defend against these attacks. Some experts suggest a decentralized data approach, while others suggest anti-malware hardware is the solution. There are many different Anti-malware hardware devices that all work in different ways and detect malware at different levels. However, there are no full-proof malware detection schemes. It is alarming that there is no common solution to protecting against malware and no way to completely detect malware every time. In this research, we focus on Android malware, specifically malware found on apps from the Google Play Store. One of the ways one would solve this problem is by using virtual machines and compiling malware detection programs on them. To support our VM based malware detection scheme, we develop an algorithm to provide implementation-level details. The practicality of our proposed scheme is shown using multiple case studies.","PeriodicalId":346706,"journal":{"name":"2020 International Conference on Software Security and Assurance (ICSSA)","volume":"118 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134379444","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Blockchain-based Service Performance Evaluation Method Using Native Cloud Environment 基于区块链的原生云环境下的服务性能评估方法

2020 International Conference on Software Security and Assurance (ICSSA) Pub Date : 2020-10-01 DOI: 10.1109/ICSSA51305.2020.00016

TaeYoung Kim, Hyung-Jong Kim

引用次数: 1

Compiling and Analyzing Open Source Malware for Research Purposes 编译和分析开源恶意软件的研究目的

2020 International Conference on Software Security and Assurance (ICSSA) Pub Date : 2020-10-01 DOI: 10.1109/ICSSA51305.2020.00013

Daniel Judt, Patrick Kochberger, Peter Kieseberg, S. Schrittwieser

引用次数: 0