International journal of secure software engineering最新文献_第5页

Information Theoretic XSS Attack Detection in Web Applications Web应用程序中的信息论XSS攻击检测

International journal of secure software engineering Pub Date : 2014-07-01 DOI: 10.4018/IJSSE.2014070101

H. Shahriar, Sarah North, Wei-Chuen Chen, Edward Mawangi

{"title":"Information Theoretic XSS Attack Detection in Web Applications","authors":"H. Shahriar, Sarah North, Wei-Chuen Chen, Edward Mawangi","doi":"10.4018/IJSSE.2014070101","DOIUrl":"https://doi.org/10.4018/IJSSE.2014070101","url":null,"abstract":"Cross-Site Scripting (XSS) has been ranked among the top three vulnerabilities over the last few years. XSS vulnerability allows an attacker to inject arbitrary JavaScript code that can be executed in the victim's browser to cause unwanted behaviors and security breaches. Despite the presence of many mitigation approaches, the discovery of XSS is still widespread among today's web applications. As a result, there is a need to improve existing solutions and to develop novel attack detection techniques. This paper proposes a proxy-level XSS attack detection approach based on a popular information-theoretic measure known as Kullback-Leibler Divergence (KLD). Legitimate JavaScript code present in an application should remain similar or very close to the JavaScript code present in a rendered web page. A deviation between the two can be an indication of an XSS attack. This paper applies a back-off smoothing technique to effectively detect the presence of malicious JavaScript code in response pages. The proposed approach has been applied for a number of open-source PHP web applications containing XSS vulnerabilities. The initial results show that the approach can effectively detect XSS attacks and suffer from low false positive rate through proper choice of threshold values of KLD. Further, the performance overhead has been found to be negligible.","PeriodicalId":89158,"journal":{"name":"International journal of secure software engineering","volume":"13 1","pages":"1-15"},"PeriodicalIF":0.0,"publicationDate":"2014-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"82280266","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Meta-Modeling Based Secure Software Development Processes 基于元建模的安全软件开发过程

International journal of secure software engineering Pub Date : 2014-07-01 DOI: 10.4018/IJSSE.2014070104

Mehrez Essafi, H. Ghézala

引用次数: 13

Secure Software Development Assimilation: Effects of External Pressures and Roles of Internal Factors 安全软件开发同化:外部压力的影响和内部因素的作用

International journal of secure software engineering Pub Date : 2014-07-01 DOI: 10.4018/ijsse.2014070103

Mingqiu Song, Donghao Chen, E. Mkoba

引用次数: 4

Design Churn as Predictor of Vulnerabilities? 设计流失是漏洞的预测因子?

International journal of secure software engineering Pub Date : 2014-07-01 DOI: 10.4018/ijsse.2014070102

A. Hovsepyan, R. Scandariato, Maximilian Steff, W. Joosen

引用次数: 8

Threat Analysis in Goal-Oriented Security Requirements Modelling 面向目标的安全需求建模中的威胁分析

International journal of secure software engineering Pub Date : 2014-04-01 DOI: 10.4018/IJSSE.2014040101

P. H. Meland, E. Paja, Erlend Andreas Gjære, S. Paul, F. Dalpiaz, P. Giorgini

{"title":"Threat Analysis in Goal-Oriented Security Requirements Modelling","authors":"P. H. Meland, E. Paja, Erlend Andreas Gjære, S. Paul, F. Dalpiaz, P. Giorgini","doi":"10.4018/IJSSE.2014040101","DOIUrl":"https://doi.org/10.4018/IJSSE.2014040101","url":null,"abstract":"Goal and threat modelling are important activities of security requirements engineering: goals express why a system is needed, while threats motivate the need for security. Unfortunately, existing approaches mostly consider goals and threats separately, and thus neglect the mutual influence between them. In this paper, the authors address this deficiency by proposing an approach that extends goal modelling with threat modelling and analysis. The authors show that this effort is not trivial and a trade-off between visual expressiveness, usability and usefulness has to be considered. Specifically, the authors integrate threat modelling with the socio-technical security modelling language (STS-ml), introduce automated analysis techniques that propagate threats in the combined models, and present tool support that enables reuse of threats facilitated by a threat repository. The authors illustrate their approach on a case study from the Air Traffic Management (ATM) domain, from which they extract some practical challenges. The authors conclude that threats provide a useful foundation and justification for the security requirements that the authors derive from goal modelling, but this should not be considered as a replacement to risk assessment. The usage of goals and threats early in the development process allows raising awareness of high-level security issues that occur regardless of the chosen technology and organizational processes.","PeriodicalId":89158,"journal":{"name":"International journal of secure software engineering","volume":"56 1","pages":"1-19"},"PeriodicalIF":0.0,"publicationDate":"2014-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"88518927","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 21

A Structured Method for Security Requirements Elicitation concerning the Cloud Computing Domain 一种结构化的云计算领域安全需求提取方法

International journal of secure software engineering Pub Date : 2014-04-01 DOI: 10.4018/IJSSE.2014040102

Kristian Beckers, Isabelle Côté, Ludger Goeke, Selim Güler, M. Heisel

{"title":"A Structured Method for Security Requirements Elicitation concerning the Cloud Computing Domain","authors":"Kristian Beckers, Isabelle Côté, Ludger Goeke, Selim Güler, M. Heisel","doi":"10.4018/IJSSE.2014040102","DOIUrl":"https://doi.org/10.4018/IJSSE.2014040102","url":null,"abstract":"Cloud computing systems offer an attractive alternative to traditional IT-systems, because of economic benefits that arise from the cloud's scalable and flexible IT-resources. The benefits are of particular interest for SME's. The reason is that using Cloud Resources allows an SME to focus on its core business rather than on IT-resources. However, numerous concerns about the security of cloud computing services exist. Potential cloud customers have to be confident that the cloud services they acquire are secure for them to use. Therefore, they have to have a clear set of security requirements covering their security needs. Eliciting these requirements is a difficult task, because of the amount of stakeholders and technical components to consider in a cloud environment. Therefore, the authors propose a structured, pattern-based method supporting eliciting security requirements and selecting security measures. The method guides potential cloud customers to model the application of their business case in a cloud computing context using a pattern-based approach. Thus, a potential cloud customer can instantiate our so-called Cloud System Analysis Pattern. Then, the information of the instantiated pattern can be used to fill-out our textual security requirements patterns and individual defined security requirement patterns, as well. The presented method is tool-supported. Our tool supports the instantiation of the cloud system analysis pattern and automatically transfers the information from the instance to the security requirements patterns. In addition, they have validation conditions that check e.g., if a security requirement refers to at least one element in the cloud. The authors illustrate their method using an online-banking system as running example.","PeriodicalId":89158,"journal":{"name":"International journal of secure software engineering","volume":"21 1","pages":"20-43"},"PeriodicalIF":0.0,"publicationDate":"2014-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"85929491","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 18

An Invariant-Based Approach for Detecting Attacks Against Data in Web Applications 基于不变量的Web应用数据攻击检测方法

International journal of secure software engineering Pub Date : 2014-01-01 DOI: 10.4018/IJSSE.2014010102

R. Ludinard, Eric Totel, F. Tronel, V. Nicomette, M. Kaâniche, E. Alata, R. Akrout, Yann Bachy

引用次数: 8

Validation of a Trust Approach in Multi-Organization Environments 多组织环境下信任方法的验证

International journal of secure software engineering Pub Date : 2014-01-01 DOI: 10.4018/ijsse.2014010101

Khalifa Toumi, A. Cavalli, César Andrés

引用次数: 3

Remote E-Voting Using the Smart Card Web Server 使用智能卡Web服务器进行远程电子投票

International journal of secure software engineering Pub Date : 2014-01-01 DOI: 10.4018/ijsse.2014010103

Sheila Cobourne, Lazaros Kyrillidis, K. Mayes, K. Markantonakis

引用次数: 7

Performance Evaluation of SHA-2 Standard vs. SHA-3 Finalists on Two Freescale Platforms 两种飞思卡尔平台上SHA-2标准与SHA-3最终入选者的性能评估

International journal of secure software engineering Pub Date : 2013-10-01 DOI: 10.4018/ijsse.2013100101

Pal-Stefan Murvay, B. Groza

{"title":"Performance Evaluation of SHA-2 Standard vs. SHA-3 Finalists on Two Freescale Platforms","authors":"Pal-Stefan Murvay, B. Groza","doi":"10.4018/ijsse.2013100101","DOIUrl":"https://doi.org/10.4018/ijsse.2013100101","url":null,"abstract":"Embedded devices are ubiquitously involved in a large variety of security applications which heavily rely on the computation of hash functions. Roughly, two alternatives for speeding up computations co-exist in these resource constrained devices: parallel processing and hardware acceleration. Needles to say, multi-core devices are clearly the next step in embedded systems due to clear technological limitations on single processor frequency. Hardware accelerators are long known to be a cheaper approach for costly cryptographic functions. The authors analysis is focused on the five SHA-3 finalists which are also contrasted to the previous SHA-2 standard and to the widespread MD5. On the hardware side, the authors deploy their implementations on two platforms from Freescale: a S12X core equipped with an XGATE coprocessor and a Kinetis K60 core equipped with a crypto co-processor. These platforms differ significantly in terms of computational power, the first is based on a 16-bit Freescale proprietary architecture while the former relies on a more recent 32-bit Cortex core. The authors' experimental results show mixed performances between the old standard and the new candidates. Some of the new candidates clearly outperform the old standard in terms of both computational speed and memory requirements while others do not. Bottom line, on the 16 bit platform BLAKE and Grostl are the top performers while on the 32-bit platform Keccak, Blake and Skein give the best results.","PeriodicalId":89158,"journal":{"name":"International journal of secure software engineering","volume":"29 1","pages":"1-24"},"PeriodicalIF":0.0,"publicationDate":"2013-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"85330357","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3