Different Types Of Vulnerabilities Research Articles

The role of environmental gradients and microclimates in structuring communities and functional groups of lizards in a rainforest-savanna transition area.

Environmental heterogeneity poses a significant influence on the functional characteristics of species and communities at local scales. Environmental transition zones, such as at the savanna-forest borders, can act as regions of ecological tension when subjected to sharp variations in the microclimate. For ectothermic organisms, such as lizards, environmental temperatures directly influence physiological capabilities, and some species use different thermoregulation strategies that produce varied responses to local climatic conditions, which in turn affect species occurrence and community dynamics. In the context of global warming, these various strategies confer different types of vulnerability as well as risks of extinction. To assess the vulnerability of a species and understand the relationships between environmental variations, thermal tolerance of a species and community structure, lizard communities in forest-savanna transition areas of two national parks in the southwestern Amazon were sampled and their thermal functional traits were characterized. Then, we investigated how community structure and functional thermal variation were shaped by two environmental predictors (i.e., microclimates estimated locally and vegetation structure estimated from remote sensing). It was found that the community structure was more strongly predicted by the canopy surface reflectance values obtained via remote sensing than by microclimate variables. Environmental temperatures were not the most important factor affecting the occurrence of species, and the variations in ecothermal traits demonstrated a pattern within the taxonomic hierarchy at the family level. This pattern may indicate a tendency for evolutionary history to indirectly influence these functional features. Considering the estimates of the thermal tolerance range and warming tolerance, thermoconformer lizards are likely to be more vulnerable and at greater risk of extinction due to global warming than thermoregulators. The latter, more associated with open environments, seem to take advantage of their lower vulnerability and occur in both habitat types across the transition, potentially out-competing and further increasing the risk of extinction and vulnerability of forest-adapted thermoconformer lizards in these transitional areas.

A multi-type vulnerability detection framework with parallel perspective fusion and hierarchical feature enhancement

A core problem of vulnerability detection is to detect multi-type vulnerabilities simultaneously by characterizing vulnerabilities of high diversity and complexity in real program source code. Current methods mainly adjust and compromise multiple code representations such as code sequence and code graph based on composite graph. However, sequential features extracted by graph are hardly sufficient to model the contextual semantic associations of the token sequence. Meanwhile, structural features of the code graph extracted by models based on Euclidean Graph Neural Network are difficult to fit the tree-like calling relationships between code lines. These limitations make it difficult to detect diverse vulnerabilities. In addition, most of the existing models ignore the type of code statement, which is closely associated with some specific vulnerability types. In this paper, we propose a Parallelism Framework with Hierarchical feature Enhancement for Multi-type Vulnerability Detection (PFHE-MVD). PFHE-MVD models program code from three parallel perspectives, containing sequence, code graph, and Abstract Syntax Tree statistic. Hyperbolic Graph Convolutional Neural Network is integrated to model the top-down hierarchical calling structure in program code graph through hyperbolic space mapping. Besides, the statement type of code is embedded along with the code text to strengthen the identification ability for different types of vulnerabilities. Experimental results show that PFHE-MVD achieves new state-of-the-art results in multi-type vulnerability detection. PFHE-MVD captures tree-like hierarchical code structure feature and enhances the distinguishing ability for vulnerabilities by code statement type embedding.

Ambient vulnerability

In this paper we introduce the concept of ambient vulnerability. Ambience concerns the overlapping and shifting material forms that constitute a person’s surroundings – including (but not limited to) air quality, flow, temperature, humidity, noise and light – that contribute to their health, wellbeing and (dis)comfort. Building on a growing movement across a range of disciplines towards the study of socialmaterial relations, we suggest that ambience is an important approach for critically understanding the complex interconnections among nature, society, and technology in the production of lived ecologies. The vulnerability framing locates our expressly political understanding of ambience, reflecting and reinforcing social inequalities. Moreover, different types of vulnerability across the dimensions of the ambient environment are interdependent and accumulate, often intensifying one another. We delineate some of the key features of ambient vulnerability, specifically: cumulative impacts; permeability; unevenness; phenomenological differentiation; and multiple temporalities. The paper shows how ambient environments are shifting and complex, a turbulent milieu of contextual factors, but they are essential to our understanding of social and ecological vulnerability in the 21st century.

Research on smart contract vulnerability detection method based on domain features of solidity contracts and attention mechanism

The smart contract, a self-executing program on the blockchain, is key to programmable finance. However, the rise of smart contract use has also led to an increase in vulnerabilities that attract illegal activity from hackers. Traditional manual approaches for vulnerability detection, relying on domain experts, have limitations such as low automation and weak generalization. In this paper, we propose a deep learning approach that leverages domain-specific features and an attention mechanism to accurately detect vulnerabilities in smart contracts. Our approach reduces the reliance on manual input and enhances generalization by continuously learning code patterns of vulnerabilities, specifically detecting various types of vulnerabilities such as reentrancy, integer overflow, forced Ether injection, unchecked return value, denial of service, access control, short address attack, tx.origin, call stack overflow, timestamp dependency, random number dependency, and transaction order dependency vulnerabilities. In order to extract semantic information, we present a semantic distillation approach for detecting smart contract vulnerabilities. This approach involves using a syntax parser, Slither, to segment the code into smaller slices and word embedding to create a matrix for model training and prediction. Our experiments indicate that the BILSTM model is the best deep learning model for smart contract vulnerability detection task. We looked at how domain features and self-attentiveness mechanisms affected the ability to identify 12 different kinds of smart contract vulnerabilities. Our results show that by including domain features, we significantly increased the F1 values for 8 different types of vulnerabilities, with improvements ranging from 7.35% to 48.58%. The methods suggested in this study demonstrate a significant improvement in F1 scores ranging from 4.18% to 38.70% when compared to conventional detection tools like Oyente, Mythril, Osiris, Slither, Smartcheck, and Securify. This study provides developers with a more effective method of detecting smart contract vulnerabilities, assisting in the prevention of potential financial losses. This research provides developers with a more effective means of detecting smart contract vulnerabilities, thereby helping to prevent potential financial losses.

Effectiveness of interventions to address different types of vulnerabilities in community-dwelling older adults: An umbrella review.

Frailty, social isolation, loneliness, and poverty may render older adults vulnerable to social or health stressors. It is imperative to identify effective interventions to address them especially in the context of COVID-19 pandemic. To identify effective community-based interventions to address frailty, social isolation, loneliness, and poverty among community-dwelling older adults. Umbrella review. We systematically searched PubMed, Ovid MEDLINE, Embase, Cochrane CENTRAL, EBM-Reviews, CINAHL via EBSCO, and APA PsycInfo via Ovid from January 2009 to December 2022. We included systematic reviews or quantitative reviews of non-pharmacologic interventions targeting community-dwelling older adults. Two review authors independently screened the titles and abstracts, performed data extraction and appraised the methodological quality of the reviews. We used a narrative synthesis approach to summarize and interpret the findings. We assessed the methodological quality of the studies using AMSTAR 2.0 tool. We identified 27 reviews incorporating 372 unique primary studies that met our inclusion criteria. Ten of the reviews included studies conducted in low-middle-income countries. Twelve reviews (46%, 12/26) included interventions that addressed frailty. Seventeen reviews (65%, 17/26) included interventions that addressed either social isolation or loneliness. Eighteen reviews included studies with single component interventions, while 23 reviews included studies with multi-component interventions. Interventions including protein supplementation combined with physical activity may improve outcomes including frailty status, grip strength, and body weight. Physical activity alone or in combination with diet may prevent frailty. Additionally, physical activity may improve social functioning and interventions using digital technologies may decrease social isolation and loneliness. We did not find any review of interventions addressing poverty among older adults. We also noted that few reviews addressed multiple vulnerabilities within the same study, specifically addressed vulnerability among ethnic and sexual minority groups, or examined interventions that engaged communities and adapted programs to local needs. Evidence from reviews support diets, physical activity, and digital technologies to improve frailty, social isolation or loneliness. However, interventions examined were primarily conducted under optimal conditions. There is a need for further interventions in community settings and conducted under real world settings in older adults living with multiple vulnerabilities.

Vulnerability Detection Using Two-Stage Deep Learning Models

Application security is an essential part of developing modern software, as lots of attacks depend on vulnerabilities in software. The number of attacks is increasing globally due to technological advancements. Companies must include security in every stage of developing, testing, and deploying their software in order to prevent data breaches. There are several methods to detect software vulnerability Non-AI-based such as Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST). However, these approaches have substantial false-positive and false-negative rates. On the other side, researchers have been interested in developing an AI-based vulnerability detection system employing deep learning models like BERT, BLSTM, etc. In this paper, we proposed a two-stage solution, two deep learning models were proposed for vulnerability detection in C/C++ source codes, the first stage is CNN which detects if the source code contains any vulnerability (binary classification model) and the second stage is CNN-LTSM that classifies this vulnerability into a class of 50 different types of vulnerabilities (multiclass classification model). Experiments were done on SySeVR dataset. Results show an accuracy of 99% for the first and 98% for the second stage.

VDoTR: Vulnerability detection based on tensor representation of comprehensive code graphs

Code vulnerability detection has long been a critical issue due to its potential threat to computer systems. It is imperative to detect source code vulnerabilities in software and remediate them to avoid cyber attacks. To automate detection and reduce labor costs, many deep learning-based methods have been proposed. However, these approaches have been found to be either ineffective in detecting multiple classes of vulnerabilities or limited by treating original source code as a natural language sequence without exploiting the structural information of code. In this paper, we propose VDoTR, a model that leverages a new tensor representation of comprehensive code graphs, including AST, CFG, DFG, and NCS, to detect multiple types of vulnerabilities. Firstly, a tensor structure is introduced to represent the structured information of code, which deeply captures code features. Secondly, a new Circle Gated Graph Neural Network (CircleGGNN) is designed based on tensor for hidden state embedding of nodes. CircleGGNN can perform heterogeneous graph information fusion more directly and effectively. Lastly, a 1-D convolution-based output layer is applied to hidden embedding features for classification. The experimental results demonstrate that the detection performance of VDoTR is superior to other approaches with higher accuracy, precision, recall, and F1-measure on multiple datasets for vulnerability detection. Moreover, we illustrate which code graph contributes the most to the performance of VDoTR and which code graph is more sensitive to represent vulnerability features for different types of vulnerabilities through ablation experiments.

Systematic Review of Common Web-Application Vulnerabilities

Organizations are increasingly worried about web application vulnerabilities because they can be used by cybercriminals to access private data without authorization. In this review, we examine the current state of the vulnerabilities in the web application layer. We begin by discussing the different types of vulnerabilities that can affect web applications, including cross-site scripting (XSS), brute force, SQL injection, and cross-site request forgery (CSRF) attacks. And then for each vulnerability, we discuss the various approaches that have been developed to detect and prevent these vulnerabilities. Finally, we discuss the challenges and limitations of current approaches and suggest directions for future research. Key Words: web application, vulnerabilities, cyber-security, SQL injection, XSS, CSRF.

Metamorphic Testing for Web System Security

Security testing aims at verifying that the software meets its security properties. In modern Web systems, however, this often entails the verification of the outputs generated when exercising the system with a very large set of inputs. Full automation is thus required to lower costs and increase the effectiveness of security testing. Unfortunately, to achieve such automation, in addition to strategies for automatically deriving test inputs, we need to address the oracle problem, which refers to the challenge, given an input for a system, of distinguishing correct from incorrect behavior (e.g., the response to be received after a specific HTTP GET request). In this paper, we propose Metamorphic Security Testing for Web-interactions ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MST-wi</i> ), a metamorphic testing approach that integrates test input generation strategies inspired by mutational fuzzing and alleviates the oracle problem in security testing. It enables engineers to specify metamorphic relations (MRs) that capture many security properties of Web systems. To facilitate the specification of such MRs, we provide a domain-specific language accompanied by an Eclipse editor. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MST-wi</i> automatically collects the input data and transforms the MRs into executable Java code to automatically perform security testing. It automatically tests Web systems to detect vulnerabilities based on the relations and collected data. We provide a catalog of 76 system-agnostic MRs to automate security testing in Web systems. It covers 39% of the OWASP security testing activities not automated by state-of-the-art techniques; further, our MRs can automatically discover 102 different types of vulnerabilities, which correspond to 45% of the vulnerabilities due to violations of security design principles according to the MITRE CWE database. We also define guidelines that enable test engineers to improve the testability of the system under test with respect to our approach. We evaluated <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MST-wi</i> effectiveness and scalability with two well-known Web systems (i.e., Jenkins and Joomla). It automatically detected 85% of their vulnerabilities and showed a high specificity (99.81% of the generated inputs do not lead to a false positive); our findings include a new security vulnerability detected in Jenkins. Finally, our results demonstrate that the approach scale, thus enabling automated security testing overnight.

A Framework for Modeling and Detecting Security Vulnerabilities in Human-Machine Pair Programming

&lt;p&gt;To detect and mitigate security vulnerabilities early in the coding phase is an important strategy for secure software development. Existing solutions typically focus on finding certain vulnerabilities in certain computer systems without giving a systematic way of handling different types of vulnerabilities. In this paper, we present a framework for systematically modeling and detecting potential security vulnerabilities during the construction of programs using a particular programming paradigm known as Human-Machine Pair Programming. The framework provides designers with a general way of modeling a class of attacks in detail, and shows how programmers can discover and fix a vulnerability in a timely manner. Specifically, our framework advocates three primary steps: (1) generating an attack tree to model a given security threat, (2) constructing vulnerability-matching patterns based on the result of the attack tree analysis, and (3) detecting corresponding vulnerabilities based on the patterns during the program construction. We also present a case study to demonstrate how it works in practice.&lt;/p&gt; &lt;p&gt;&amp;nbsp;&lt;/p&gt;

Expanding Social Protection Coverage with Humanitarian Aid: Lessons on Targeting and Transfer Values from Ethiopia

While social protection programmes have multiplied over the last two decades across sub-Saharan Africa, these coexist alongside humanitarian assistance in many places, calling for better integration of assistance delivered through the two channels. Progress on this front is hampered by limited evidence of whether and how these historically siloed sectors can work together. Using quantitative and qualitative data from districts covered by Ethiopia’s Productive Safety Net Programme (PSNP) and where humanitarian food assistance (HFA) was delivered, we assess differences in targeting and transfer values. We find that the PSNP and HFA were targeted to households with different characteristics. PSNP transfers did, on average, reach those households that were chronically food insecure. HFA, while delivered through the PSNP systems, was targeted to households that were acutely vulnerable. These are promising findings as they suggest that social protection systems are able to effectively deliver a continuum of support in response to different types of vulnerability and risk. On transfer values, we find that the value of PSNP transfers is greater than those for HFA. One reason for this may be due to the social pressure on local officials to distribute support more widely across a drought-affected population when faced with acute needs.

Exploring the Drivers of Vulnerability Among Disadvantaged Internal Migrants in Riverbank Erosion Prone Areas in North-West Bangladesh

Bangladesh frequently suffers from acute riverbank erosions and, as a result, every year a large number of people internally migrate to new places mainly in search of livelihoods. While very few studies focus on the multifaceted nature of vulnerability experienced from riverbank erosions, the present study examines to what extent different drivers of vulnerability affect socio-economically disadvantaged internal migrants living in riverbank erosion-prone areas in Bangladesh. Empirical evidence from two north-western riverbank erosion-prone districts in Bangladesh demonstrates that the disadvantaged internal migrants and their household members were exposed to a range of vulnerabilities connected to economic, institutional, infrastructural, environmental, and social drivers. It is contended that evidently there are different types of vulnerability some of which are perceived to be more severe than others in the study areas. This study, therefore, suggests extending some specific support programmes including income generation schemes, access to institutional credit for the landless, improved inexpensive means of transportation, and improved communication. This article also proposes improving rural infrastructure including irrigation facilities, inexpensive transportation means for agricultural inputs or other farming materials, reasonable prices for daily necessities, and improved health care benefits.

Security and Privacy Threats for Bluetooth Low Energy in IoT and Wearable Devices: A Comprehensive Survey

Bluetooth Low Energy (BLE) has become the de facto communication protocol for the Internet of Things (IoT) and smart wearable devices for its ultra-low energy consumption, ease of development, good enough network coverage, and data transfer speed. Due to the simplified design of this protocol, there have been lots of security and privacy vulnerabilities. As billions of health care, personal fitness wearable, smart lock, industrial automation devices adopt this technology for communication, its vulnerabilities should be dealt with high priority. Some segregated works on BLE were performed focusing on various vulnerabilities, such as the insecure implementation of encryption, device authentication, user privacy, etc. However, there has been no comprehensive survey on the security vulnerabilities of this protocol. In this survey paper, we present a comprehensive taxonomy for the security and privacy issues of BLE. We present possible attack scenarios for different types of vulnerabilities, classify them according to their severity, and list possible mitigation techniques. We also provide case studies regarding how different vulnerabilities can be exploited in real BLE devices.

The varying impacts of COVID-19 and its related measures in the UK: A year in review.

We examine how the earnings, time use, and subjective wellbeing of different social groups changed at different stages/waves of the pandemic in the United Kingdom (UK). We analyze longitudinal data from the latest UK Household Longitudinal Survey (UKHLS) COVID study and the earlier waves of the UKHLS to investigate within-individual changes in labor income, paid work time, housework time, childcare time, and distress level during the three lockdown periods and the easing period between them (from April 2020 to late March 2021). We find that as the pandemic developed, COVID-19 and its related lockdown measures in the UK had unequal and varying impacts on people's income, time use, and subjective well-being based on their gender, ethnicity, and educational level. In conclusion, the extent of the impacts of COVID-19 and COVID-induced measures as well as the speed at which these impacts developed, varied across social groups with different types of vulnerabilities.

DeepWukong

Static bug detection has shown its effectiveness in detecting well-defined memory errors, e.g., memory leaks, buffer overflows, and null dereference. However, modern software systems have a wide variety of vulnerabilities. These vulnerabilities are extremely complicated with sophisticated programming logic, and these bugs are often caused by different bad programming practices, challenging existing bug detection solutions. It is hard and labor-intensive to develop precise and efficient static analysis solutions for different types of vulnerabilities, particularly for those that may not have a clear specification as the traditional well-defined vulnerabilities. This article presents D eep W ukong , a new deep-learning-based embedding approach to static detection of software vulnerabilities for C/C++ programs. Our approach makes a new attempt by leveraging advanced recent graph neural networks to embed code fragments in a compact and low-dimensional representation, producing a new code representation that preserves high-level programming logic (in the form of control- and data-flows) together with the natural language information of a program. Our evaluation studies the top 10 most common C/C++ vulnerabilities during the past 3 years. We have conducted our experiments using 105,428 real-world programs by comparing our approach with four well-known traditional static vulnerability detectors and three state-of-the-art deep-learning-based approaches. The experimental results demonstrate the effectiveness of our research and have shed light on the promising direction of combining program analysis with deep learning techniques to address the general static code analysis challenges.

Identifying vulnerability in police custody: Making sense of information provided to custody officers

Vulnerable individuals frequently come into contact with the criminal justice system with those with mental health disorders over-represented in custody. Therefore, it is crucial to identify vulnerability in order to ensure the appropriate safeguards can be put in place. Research has documented that this is problematic and can be influenced by a number of factors. The current study, therefore, aimed to understand how custody officers in England and Wales made sense of different types of information presented to them, the impact that it had on their initial disposal option and whether there was a difference in police force area. Six case scenario vignettes containing different types of vulnerability were developed and disseminated. A total of 237 custody officers from 25 police forces participated. Results highlighted that custody officers were more likely to obtain a mental health assessment in all case scenarios, except if the individual displayed comprehension difficulties – custody officers would instead seek to implement the services of an Appropriate Adult. In addition, differences between police force areas were observed. Police forces in the North of England were the least likely to obtain the assistance of an Appropriate Adult when presented with a vulnerable suspect compared to other police force areas. This suggests fundamental differences in the disposal options preferred between police force areas and has implications for the treatment of vulnerable individuals in police custody.

Migrant Rights, Agency, and Vulnerability: Navigating Contradictions in the Eurasian Region

AbstractMigrants are often presented in simplified terms that focus on the threats they experience or pose to the host society. This produces an image of migrants who have no agency and are victims of their circumstances or who respond to their circumstances by turning to crime and illegality. In this special issue, we reframe migration by highlighting how migrants leverage the various vulnerabilities they encounter, turning them into agency and self-sufficiency. We explore different types of vulnerability and agency for migrants in the Eurasian region, which often originate from the same sources, including structural factors, state and governance practices, social networks, and gender roles. Through interactions with a variety of state and nonstate actors, migrants have the ability to make choices that reduce uncertainty and risk in their migration environment and on returning home. These choices coexist with vulnerability and a lack of formal rights but do not replace them, creating complex and contingent relationships between precarity and agency.

The impact factors on the performance of machine learning-based vulnerability detection: A comparative study

Machine learning-based Vulnerability detection is an active research topic in software security. Different traditional machine learning-based and deep learning-based vulnerability detection methods have been proposed. To our best knowledge, we are the first to identify four impact factors and conduct a comparative study to investigate the performance influence of these factors. In particular, the quality of datasets, classification models and vectorization methods can directly affect the detection performance, in contrast function/variable name replacement can affect the features of vulnerability detection and indirectly affect the performance. We collect three different vulnerability code datasets from two various sources (i.e., NVD and SARD). These datasets can correspond to different types of vulnerabilities. Moreover, we extract and analyze the features of vulnerability code datasets to explain some experimental results. Our findings based on the experimental results can be summarized as follows: (1) Deep learning models can achieve better performance than traditional machine learning models. Of all the models, BLSTM can achieve the best performance. (2) CountVectorizer can significantly improve the performance of traditional machine learning models. (3) Features generated by the random forest algorithm include system-related functions, syntax keywords, and user-defined names. Different vulnerability types and code sources will generate different features. (4) Datasets with user-defined variable and function name replacement will decrease the performance of vulnerability detection. (5) As the proportion of code from SARD increases, the performance of vulnerability detection will increase.

Private humanitarian responses to disaster vulnerabilities: The Chernobyl children from Belarus in Italy

This article aims to understand how children’s vulnerabilities function in humanitarian aid programmes. Different types of vulnerabilities that emerged as a result of and in response to the consequences of the Chernobyl nuclear disaster (1986) during recuperation of the affected children from Belarus in their Italian host families are examined. It is shown that while the initiation of aid was based on directly disaster-related vulnerabilities (radiation-related vulnerabilities), the outcomes of this aid were influenced by indirectly disaster-related vulnerabilities (social vulnerabilities).

Classification of Logical Vulnerability Based on Group Attacking Method

Abstract New advancement in the field of e-commerce software technology has also brought many benefits, at the same time developing process always face different sort of problems from design phase to implement phase. Software faults and defects increases the issues of reliability and security, that’s reason why a solution of this problem is required to fortify these issues. The paper addresses the problem associated with lack of clear component-based web application related classification of logical vulnerabilities through identifying Attack Group Method by categorizing two different types of vulnerabilities in component-based web applications. A new classification scheme of logical group attack method is proposed and developed by using a Posteriori Empirically methodology.