2017 IEEE Cybersecurity Development (SecDev)最新文献_第2页

Layering Security at Global Control Points to Secure Unmodified Software 在全球控制点的分层安全保护未修改的软件

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI: 10.1109/SecDev.2017.20

Scott Ruoti, K. Seamons, D. Zappala

引用次数: 5

Hands-On Tutorial: Auditing Static Analysis Alerts Using a Lexicon & Rules 动手教程:使用词典和规则审计静态分析警报

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI: 10.1109/SecDev.2017.10

Lori Flynn, David Svoboda, William Snavely

{"title":"Hands-On Tutorial: Auditing Static Analysis Alerts Using a Lexicon & Rules","authors":"Lori Flynn, David Svoboda, William Snavely","doi":"10.1109/SecDev.2017.10","DOIUrl":"https://doi.org/10.1109/SecDev.2017.10","url":null,"abstract":"This hands-on tutorial teaches participants how to audit static analysis alerts, using an auditing lexicon and rules. There is no widely-accepted lexicon or standard set of rules for auditing static analysis alerts in the software engineering community. Auditing rules and a lexicon should guide different auditors to make the same determination for an alert. Standard terms and processes are necessary so that initial determinations are correctly interpreted, which helps organizations reduce code flaws. They are also needed to improve the quality of audit data to benefit research on alert prioritization. This tutorial teaches a suggested set of auditing rules and a lexicon, briefly detailing rationales based on modern software engineering practices for each rule and each lexicon term. The majority of time in the tutorial will be spent by participants working with provided small programs and associated static analysis alerts, examining them using the lexicon and rules to make a determination, separately and as a group. These hands-on activities will be interspersed with presenting the auditing rules, so participants immediately put what was taught into practice on relevant code and alerts. We hope that the auditing rules and lexicon taught will be immediately useful for participants to adopt (partially or in full) in their workplace, and that learning about them will motivate community discussion leading to agreed-upon standards","PeriodicalId":415145,"journal":{"name":"2017 IEEE Cybersecurity Development (SecDev)","volume":"119 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127502157","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Empirical Studies on the Security and Usability Impact of Immutability 不变性对安全性和可用性影响的实证研究

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI: 10.1109/SecDev.2017.21

Sam Weber, Michael J. Coblenz, B. Myers, Jonathan Aldrich, Joshua Sunshine

引用次数: 11

Something Is Better Than Everything: A Distributed Approach to Audit Log Anomaly Detection 有些东西比一切都好:分布式审计日志异常检测方法

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI: 10.1109/SecDev.2017.25

Isis Rose, Nicholas Felts, Alexander George, Emily Miller, M. Planck

{"title":"Something Is Better Than Everything: A Distributed Approach to Audit Log Anomaly Detection","authors":"Isis Rose, Nicholas Felts, Alexander George, Emily Miller, M. Planck","doi":"10.1109/SecDev.2017.25","DOIUrl":"https://doi.org/10.1109/SecDev.2017.25","url":null,"abstract":"Computing systems produce large amounts of system log information at a scale wildly disproportionate to the growth of computing and bandwidth resources. This growth outpaces the ability of human auditors and administrators to digest such quantities of data via manual analysis. This situation is only expected to worsen over time as more and more data become available due to expanded technological reach and instrumentation. We propose a framework based around process models for analyzing the log data in near-real-time, by taking advantage of distributed resources and then pushing results to a central location for correlation and contextualization instead of relying on the movement of the full volume of raw data. These results will have already been algorithmically determined to be relevant to adversarial process models before being aggregated. Under this distributed philosophy, the computational workload of audit log event detection is shared among end point sensors, and not needing to immediately centralize all raw data reduces overhead and allows the detection framework to scale with advances and expansions in network technology. By only sharing analytical results instead of underlying logs, meaningful information is prioritized, reducing both the burden on the system administrator and the real-time transfer cost of moving information to centralized storage. This is illustrated using a proof-of-concept deployment of a process modeling tool for insider threat detection.","PeriodicalId":415145,"journal":{"name":"2017 IEEE Cybersecurity Development (SecDev)","volume":"161 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127192802","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Automated Assessment Tools and the Software Assurance Marketplace (SWAMP) 自动评估工具和软件保证市场(SWAMP)

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI: 10.1109/SecDev.2017.11

J. Kupsch

引用次数: 0

Securing Dataverse with an Adapted Command Design Pattern 使用适应性命令设计模式保护Dataverse

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI: 10.1109/SECDEV.2017.22

G. Durand, Michael Bar-Sinai, M. Crosas

{"title":"Securing Dataverse with an Adapted Command Design Pattern","authors":"G. Durand, Michael Bar-Sinai, M. Crosas","doi":"10.1109/SECDEV.2017.22","DOIUrl":"https://doi.org/10.1109/SECDEV.2017.22","url":null,"abstract":"In order to bake security into application design, we introduce an adaptation to the Command pattern: command instances are tagged with the permissions required to perform them for each object they manipulate. Prior to executing a command instance issued by a given user, an execution engine validates the user has the required permissions over the objects the command is about to operate on. Stating the required permissions can often be declarative. In addition to the usual advantages offered by the command pattern (such as standardized operation handling), this adaptation creates a single checkpoint for validating permissions throughout the application. This, in turn, enhances application security and reduces code duplication, for example between the API and UI controllers. Disadvantages include the lack of framework support, and a learning curve for existing developers. We have used this design in implementing Dataverse, a widely-used institutional data repository developed at Harvard University, which has been in production use since May 2015. As this design differs significantly from common web application design, we also look at how the development team adapted to it, and at how using it affected our development process.","PeriodicalId":415145,"journal":{"name":"2017 IEEE Cybersecurity Development (SecDev)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127957663","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Software Solution for Hardware Vulnerabilities 硬件漏洞的软件解决方案

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI: 10.1109/SecDev.2017.18

Komail Dharsee, Ethan Johnson, J. Criswell

引用次数: 6

Evaluation of Software Vulnerabilities in Vehicle Electronic Control Units 车辆电子控制单元软件漏洞评估

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI: 10.1109/SecDev.2017.26

Jesse Edwards, Ameer Kashani, Gopalakrishnan Iyer

引用次数: 4