Security Code Research Articles

Emergency solutions in the field of social security caused by the COVID-19 pandemic in selected countries that are parties of the European Code of Social Security

Objective: The aim of the study is to present extraordinary solutions in the field of social security, adopted by states - parties to the European Code of Social Security (EKZS) in the event of the COVID-19 pandemic, as well as their verification in relation to the represented model of social policy and ETUC standards Materials and methods: To achieve the aim of the work, research methods based on inductive reasoning were used, related to the research of the literature on the subject, reports of countries on the implementation of the European Code of Social Security for the period from July 1, 2019 to June 30, 2020, as well as searching internet resources. Based on the information contained in the analyzed sources, secondary research was carried out, including an in-depth analysis of activities undertaken in Sweden, Great Britain and Belgium. Spain and Estonia in relation to four main areas of support, i.e., health care system, job protection and financial relief for employers, support for small and medium-sized enterprises and social transfers.Results: The generally accepted policies and strategies of countries in the fight against the COVID-19 pandemic were consistent with the represented model of social policy. However, in many cases, specific, detailed actions by states deviated from this model. In terms of sickness, unemployment and old age benefits, the states introduced higher standards than those set by the Code. On the other hand, the regulations were not properly applied to medical care, as delays in planned procedures and operations for patients with other diseases were noted due to the treatment of people infected with COVID-19.

AI and Blockchain-based source code vulnerability detection and prevention system for multiparty software development

With the growing demand for application software, there is a race among industries to develop software as quickly as possible. However, maintaining pace and ensuring bug-free software has become increasingly challenging in a work-from-home arrangement as software developers are not under constant supervision. It increases the possibility of buggy products, and traditional testing techniques fail to provide optimal performance. We propose an Artificial Intelligence (AI) and blockchain-based novel decentralized software testing system. The proposed system aims to detect and prevent vulnerable code by synergizing deep learning capabilities and smart-contract-powered blockchain. The vulnerability detection is performed automatically without relying on manually written rules. We propose a non-vulnerability score range map to classify the source code. Furthermore, we integrate an InterPlanetary File System (IPFS) to ensure efficient storage over the blockchain. We conduct a testbed-based experiment to demonstrate the effectiveness of AI and blockchain integration for secure code development and testing.

Teaching by Practice: Shaping Secure Coding Mentalities through Cybersecurity CTFs

The use of the Capture the Flag (CTF)-style competitions has grown popular in a variety of environments as a method to improve or reinforce cybersecurity techniques. However, while these competitions have shown promise in student engagement, enjoyment, and the teaching of essential workforce cybersecurity concepts, many of these CTF challenges have largely focused on cybersecurity as a general topic. Further, most in-school CTF challenges are designed with technical institutes in mind, prepping only experienced or upper-level students in cybersecurity studies for real-world challenges. Our paper aims to focus on the setting of a liberal arts institute, emphasizing secure coding as the focus of CTF-engaged learning for beginner to upper-level undergraduate students. We propose a survey system to evaluate the secure coding mentality of our students before and after taking these challenges, as well as an easily-hosted, low-resource CTF platform that students can access either in or outside of the classroom. We have found this system to be moderately effective at framing and improving the secure coding mentalities of our students.

Trustworthiness models to categorize and prioritize code for security improvement

The exploitation of software security vulnerabilities can have severe consequences. Thus, it is crucial to devise new processes, techniques, and tools to support teams in the development of secure code from the early stages of the software development process, while potentially reducing costs and shortening the time to market. In this paper, we propose an approach that uses security evidences (e.g., software metrics, bad smells) to feed a set of trustworthiness models, which allow characterizing code from a security perspective. In practice, the goal is to identify the code units that are more prone to be vulnerable (i.e., are less trustworthy from a security perspective), thus helping developers to improve their code. A clustering-based approach is used to categorize the code units based on the combination of the scores provided by several trustworthiness models and taking into account the criticality of the code. To instantiate our proposal, we use a dataset of software metrics (e.g., CountLine, Cyclomatic Complexity, Coupling Between Objects) for files and functions of the Linux Kernel and Mozilla Firefox projects, and a set of machine learning algorithms (i.e., Random Forest, Decision Tree, SVM Linear, SVM Radial, and Xboost) to build the trustworthiness models. Results show that code that is more prone to be vulnerable can be effectively distinguished, thus demonstrating the applicability and usefulness of the proposed approach in diverse scenarios.

Cost polarization by dequantizing for JPEG steganography

In this article, we study a recently proposed method for improving empirical security of steganography in JPEG images in which the sender starts with an additive embedding scheme with symmetrical costs of ± 1 changes and then decreases the cost of one of these changes based on an image obtained by applying a deblocking (JPEG dequantization) algorithm to the cover JPEG. This approach provides rather significant gains in security at negligible embedding complexity overhead for a wide range of quality factors and across various embedding schemes. Challenging the original explanation of the inventors of this idea, which is based on interpreting the dequantized image as an estimate of the precover (uncompressed) image, we provide alternative arguments. The key observation and the main reason why this approach works is how the polarizations of individual DCT coefficients work together. By using a MiPOD model of content complexity of the uncompressed cover image, we show that the cost polarization technique decreases the chances of “bad” combinations of embedding changes that would likely be introduced by the original scheme with symmetric costs. This statement is quantified by computing the likelihood of the stego image w.r.t. the multivariate Gaussian precover distribution in DCT domain. Furthermore, it is shown that the cost polarization decreases spatial discontinuities between blocks (blockiness) in the stego image and enforces desirable correlations of embedding changes across blocks. To further prove the point, it is shown that in a source that adheres to the precover model, a simple Wiener filter can serve equally well as a deep-learning based deblocker

Constructing Immunized Stego-Image for Secure Steganography via Artificial Immune System

Adaptive image steganography is the process of embedding secret messages into undetectable regions of a cover image through the design of a distortion function by a steganographer. Since the state-of-the-art steganalyzers are mainly based on image residual analysis, it is reasonable to modify stego image for withstanding steganalysis by reducing or eliminating the image residual distance between cover and stego image. However, simply modifying stego images may lead to message extraction failure and the introduction of additional detectable artifacts. In this paper, we propose a novel secure steganography strategy by constructing immunized stego-image via an artificial immune system, called ISteg, which ensures the accurate extraction of hidden data while enhancing the security against steganalyzers. Inspired by the biological immune system, we use an artificial immune system (AIS) to build ISteg. Specifically, ISteg generates the immunized stego-image by automatically modifying the stego to maximize the affinity of the antibody. The affinity is developed to evaluate antibody quality according to the Euclidean distance between the residual co-occurrence matrix features of the cover image and the modified stego image. In this manner, the so-called immunized stego-image is generated. Extensive experimental results demonstrate that the proposed ISteg strategy can effectively improve the security performance of existing steganography.

Paillier Cryptography Based Message Authentication Code for IoMT Security

Health care visualization through Internet of Things (IoT) over wireless sensor network (WSN) becomes a current research attention due to medical sensor evolution of devices. The digital technology-based communication system is widely used in all application. Internet of medical thing (IoMT) assisted healthcare application ensures the continuous health monitoring of a patient and provides the early awareness of the one who is suffered without human participation. These smart medical devices may consume with limited resources and also the data generated by these devices are large in size. These IoMT based applications suffer from the issues such as security, anonymity, privacy, and interoperability. To overcome these issues, data aggregation methods are the solution that can concatenate the data generated by the sensors and forward it into the base station through fog node with efficient encryption and decryption. This article proposed a well-organized data aggregation and secured transmission approach. The data generated by the sensor are collected and compressed. Aggregator nodes (AN) received the compressed data and concatenate it. The concatenated and encrypted data is forward to fog node using the enhanced Paillier cryptography-based encryption with Message Authentication code (MAC). Fog node extracts the forwarded data from AN using Fog message extractor method (FME) with decryption. The proposed system ensures data integrity, security and also protects from security threats. This proposed model is simulated in Network Simulator 2.35 and the evaluated simulation results proves that the aggregation with MAC code will ensures the security, privacy and also reduces the communication cost. Fog node usages in between Aggregator and base station, will reduce the cloud server/base station computational overhead and storage cost. The proposed ideology is compared with existing data aggregation schemes in terms of computational cost, storage cost, communication cost and energy cost. Cost of communication takes 18.7 ms which is much lesser than existing schemes.

DEVELOPMENT OF SECURE CONTAINERIZED APPLICATIONS WITH A MICROSERVICES ARCHITECTURE

The article analyzes approaches to software development that allow creating complex container applications with a microservice architecture based on automation tools and flexible development methods. The development of cloud technologies, the global strategy of containerization, the modernization of the application architecture, and the increase in security requirements have led to a change in the application development methodology. The study aims to determine approaches to increase the speed of development, security and quality of software code of containerized applications by implementing security principles and automation tools at all stages of the life cycle. Features and development prospects of microservice applications deployed in a container environment are considered. The advantages of the container infrastructure are defined: mobility, scalability, an additional level of microservice security. Containers provide an isolated environment for running a microservices, this reduces the risk of security vulnerabilities and simplifies interaction between microservices. The article identifies the security problems of microservice applications and the main vulnerabilities associated with the use of containers. It is determined that DevSecOps methodology allows implementing modern practice of continuous integration, continuous delivery, continuous application deployment and integration of security tools at all life cycle stages. DevSecOps describes development processes, deployment and operation processes using Security as Code and Infrastructure as Code practices. The research describes the model for developing and deploying microservice applications with containerization, defines the security domains, and the security controls for DevSecOps development pipeline. Based on this model, the main security control tools that must be used at all development and deployment pipeline stages are defined. The article proves that the considered technique regulates the implementation of given security procedures at all stages of the pipeline, allows to reduce development time and improve code quality for container applications with a microservices architecture.

Rust's Memory Safety Model: An Evaluation of Its Effectiveness in Preventing Common Vulnerabilities

Ensuring safe program operation is crucial for systems programming, and memory safety is a significant aspect of this. This paper assesses the memory safety strategies used in Rust and C++ programming languages. Rust is a modern language that has become popular due to its focus on safety, performance, and concurrency, whereas C++ is known for its efficiency and low-level program- ming capabilities. The analysis compares and contrasts the memory safety features of both languages, including Rust's ownership and borrowing model and C++’s manual memory management techniques. Additionally, the study examines the development tools available for both languages and compares ease of use and productivity. The analysis shows that Rust has several memory safety advantages over C++. Rust's ownership and borrowing model enables safe memory management without requiring manual intervention. By enforcing strict rules for memory usage, the compiler in Rust prevents typical memory-related errors like null and dangling pointers. However, in contrast to Rust, C++ provides more low-level hardware control but needs manual memory management, exposing it to memory errors such as buffer overflows and memory leaks. Moreover, Rust's memory safety features simplify the development of secure and dependable code, especially for applications with crucial security requirements. In con- trast, C++ demands significant memory management expertise to avoid memory-related errors. In conclusion, Rust offers several memory safety benefits over C++, making it a superior choice for applications with critical safety needs. However, the selection of language ultimately depends on the specific project requirements and the development team's experience and preferences.

A Comprehensive Study of Digital Image Steganographic Techniques

Steganography surpasses other mechanisms of securing data from potential threats. The modern digital arena calls for robust information hiding techniques and, thus, it has always been a flash point for researchers and academicians. Nowadays, transmission is susceptible to numerous hacks while sharing secret information through typical correspondence channel. Accordingly, everybody needs the classification, respectability, and realness of his or her privileged information. Particularly, different techniques are used to take on these security issues like advanced declaration, computerized mark, and cryptography. Nevertheless, these strategies alone cannot be negotiated. Steganography is a revolution where current information compression, data hypothesis, spread range, and cryptography advancements are integrated to meet the requirements for protection of data over the Internet. This study investigates and critically analyses various existing cover steganography techniques and identifies the valuable region that everyone can be benefited. Moreover, we present a comprehensive overview of the fundamental concepts with in the domain of the steganographic methods and steganalysis. These systems have been depicted in numerous areas of the steganography such as spatial space, transform domain, and adaptive space. Moreover, each space has its particular traits. A few regularly involved techniques for improving the steganographic security and upgrading steganalysis capacity are elaborated, summed up; and conceivable examination patterns are talked about. We also systematically separate different methodologies in our review and show their pros and cons, qualities, challenges and significance.

Automatic Detection of Java Cryptographic API Misuses: Are We There Yet?

The Java platform provides various cryptographic APIs to facilitate secure coding. However, correctly using these APIs is challenging for developers who lack cybersecurity training. Prior work shows that many developers misused APIs and consequently introduced vulnerabilities into their software. To eliminate such vulnerabilities, people created tools to detect and/or fix cryptographic API misuses. However, it is still unknown (1) how current tools are designed to detect cryptographic API misuses, (2) how effectively the tools work to locate API misuses, and (3) how developers perceive the usefulness of tools’ outputs. For this paper, we conducted an empirical study to investigate the research questions mentioned above. Specifically, we first conducted a literature survey on existing tools and compared their approach design from different angles. Then we applied six of the tools to three popularly used benchmarks to measure tools’ effectiveness of API-misuse detection. Next, we applied the tools to 200 Apache projects and sent 57 vulnerability reports to developers for their feedback. Our study revealed interesting phenomena. For instance, none of the six tools was found universally better than the others; however, CogniCrypt, CogniGuard, and Xanitizer outperformed SonarQube. More developers rejected tools’ reports than those who accepted reports (30 versus 9) due to their concerns on tools’ capabilities, the correctness of suggested fixes, and the exploitability of reported issues. This study reveals a significant gap between the state-of-the-art tools and developers’ expectations; it sheds light on future research in vulnerability detection.

Security During Transmission Of Data Using Web Steganography

The enormous improvements in communications and related technologies, such as the Internet of Things (IoT) and its web-based and mobile applications, have changed our way of life. We are also noticing a trend in which internet-connected electronic devices are using technology more frequently and providing customers with services of a higher standard. However, there are several complications and issues that arise when sending and receiving information via the internet. The security, privacy, and preservation of sent information are the most critical of them all. The security of information has grown to be a significant problem with the expansion of data transfer across computer networks. There are numerous ways to safeguard data and prevent unwanted users from accessing it. Steganography and cryptography are two different data hiding and protection techniques. Steganography conceals communications within some other digital media. On the other side, cryptography obscures the message's content and makes it challenging for readers to decipher. To safeguard data, steganography can be combined with cryptographic methods. Combining steganography and cryptography for hidden data transmission is the best suggested method for protecting data transferred over the internet. A data carrier that is an image can be used for the transmission. With regard to capacity, security, and robustness for secure data transmission over an open channel, this combinational methodology will be sufficient. The purpose of this paper is to explain the steganographic security measures used to protect data while it is being transmitted across a network. Key words: Security, Transmission, Data, Web Steganography

Correlation Between GitHub Stars and Code Vulnerabilities

In the software industry, open-source repositories are widely utilized to speed up software development. GitHub is a big source of open-source repositories and offers users to star the code repository. Stars are used in GitHub to represent appreciation and popularity. Studies have revealed that repositories may be of lower quality and may have vulnerabilities that hackers may exploit. It is not known whether the popularity of the GitHub repositories in terms of stars confirms the security and invulnerability of the program code. This paper analyzed the correlation between stars of GitHub’s code repositories and the vulnerabilities in their code by using static code analyzer. The study examined the vulnerabilities in ten popular C++ source repositories on GitHub and discovered 3487 vulnerabilities in the dataset, which were split into four categories based on severity. There was not a single repository in the dataset that was free of flaws. On the detected vulnerabilities, a Kruskal-Wallis H test reveals a significant difference between the different code repositories of the dataset. The Spearman's rank correlation coefficient test found no correlation between repositories’ stars and the frequency of vulnerabilities, implying that the popularity of code repositories on GitHub in terms of high star ratings does not imply their security integrity. Overall, the findings suggest that code repositories should be thoroughly evaluated before being used in software development. The novelty of this paper resides in the development of new knowledge as well as the study pattern that may be used to other investigations.

Cost Efficient Automobile Security Using Face Recognition and GSM Module

Face detection is one of the most important modern computer vision topics. The importance of face recognition (FR) is increasing in our society for identification purposes. In this paper, we practically demonstrated the authenticity of an automatic security system for automobiles using face recognition technology. Our proposed system is not only a facial recognition system, but also supports authentication via a GSM module for remote monitoring and permission/control by a specific remote security code. The system was implemented and tested using a Raspberry Pi 3 board, Python and OpenCV to program the different modules for face recognition. The implementation results confirm the applicability of the proposed system as it offers the advantages of robustness, high accuracy, reliability and security at the lowest cost. This paper defines a combination of fail-safe algorithms for the GPS/GSM module in addition to face recognition algorithms, which are more suitable in dynamic environments where high uncertainties are expected and require high accuracy and reasonable speed. In future, we aim to develop an intelligent smart home application to meet the upcoming needs.

Reseed Skipping of Linear Congruential Generator for Multi-level Image Steganography Security of Financial Data

Reseed Skipping of Linear Congruential Generator for Multi-level Image Steganography Security of Financial Data

The Role of the Digital Transformation in the Fight against Crime at Sea

Crime control at the sea involves public activities to create a modern security system in seaports, at the territorial sea and the adjacent zone throughout the sea corridors, as well as in the open sea on sea routes with intensive shipping.Aim. Impact assessment of digital transformation on maritime crime control.Tasks. Firstly, to characterize the impact of digital technologies on the nature of pirate attacks and other maritime offenses, which are actual threats to the maritime infrastructure. Secondly, to analyze the impact of modern measures to combat maritime crime on the economy of seaports, shipping companies and other maritime business entities. Thirdly, to demonstrate the role of the seaport administration and private military companies in the fight against offenses at sea.Methods. The study is carried out by formal legal and comparative legal methodology using a review-analytical approach.Results. Data analysis shows that the administrations of seaports are interested in optimizing security costs by creating a convenient digital management system for the coastal infrastructure. Security systems and logistics solutions depend on the effectiveness of digital technologies implemented in the interests of ensuring the safety of navigation. The Convention for the Safety of Human Life at Sea (SOLAS-74/88), supplemented by the International Ship and Port Facility Security Code (ISPS) in 2004, provides for a universal maritime security system, however, the implementation of these standards in a number of regions of the World Ocean is not enough to neutralize coastal criminal threats.Conclusion. In the context of digitalization, measures to combat crime at sea lead to significant costs, as they require complex technological infrastructure on ships and in ports. The norms of the law of the sea aimed at combating piracy and smuggling should be implemented at the national level, taking into account the socio-economic features of the maritime infrastructure development. Since negative economic trends entail an increase in criminal activity, the economic interests of commercial shipping entities should not be sacrificed in the fight against piracy and smuggling.

Legal fundamentals of the social policy in Ukraine: influence of European integration

Purpose. The aim of this research is to highlight the influence of European integration on the optimization of the legal fundamentals of social policy in Ukraine. Methodology. The research is based on the comparative legal method used for comparison of EU social law with the social law of Ukraine. The method of dialectic enables to establish contradictions in the legal norms that regulate the social system of Ukraine and determine its social policy. The systemic and functional method was used to study the system of regulation of the sphere of social relations in Ukraine, systems of social policy measures as well as functional interrelationships between them. The method of generalization was used for the systematization and interpretation of the results obtained during the study. Results. The research showed that the main ways of improving social policy in Ukraine and legal regulation in the social sphere include: ratification of the European Social Charter and its implementation plan in Ukraine; creation of a coherent strategy in the field of provision of social services; the accession of Ukraine to the European Code of Social Security; partial reform of the legal regulation of labor and employment of the population; improvement of legal regulation and social policy in the field of social protection, labor and employment of internally displaced persons from temporarily occupied territories of Ukraine. Scientific novelty. During the research, it was established that on the way to the EU, Ukraine has faced the following problems with its social policy and law: problems with the Ukrainian legislation on social security; problems with regulating the labor market, employment and poverty reduction; problems with improvement of the legislation on labor protection; problems with stimulating entrepreneurship as the basis for ensuring social standards and employment of the population; problems with adaptation of socially vulnerable groups of the population. Practical significance. The results of the research can be used in international law.

Toward a readiness model for secure software coding

AbstractThe heart of the application's secure operation is its software code. If the code contains flaws, the entire program might be hacked. The issue with software vulnerabilities is that they reveal coding flaws that hackers could exploit. The prevention of cybersecurity issues begins with the program code itself. When writing software code, a software developer must consider expressing the application's architecture and design requirements, keeping the code streamlined and efficient, and ensuring the code is safe. Secure code helps save the system from various cyber‐attacks by eliminating the weaknesses that many hacks rely on. To assist the software organization in Secure Software Coding (SSC), this article proposes a readiness model for SSC, namely SSCRM. The proposed model has five levels; SSC challenges and best practices (BP) are mapped at each level. The proposed model will help the organizations better understand SSC challenges and BPs and provide a roadmap for developing secure software code. The proposed model was evaluated using three case studies. The findings demonstrate that the proposed approach helps determine an organization's SSC level.

Towards secured image steganography based on content-adaptive adversarial perturbation

In this paper, a content-adaptive adversarial steganography is proposed to improve steganography security by adaptively adding perturbations to cover images while considering image contents with rich texture, where perturbations are generated using adversarial example generation methods like the fast gradient sign method. In this approach, a hybrid texture descriptor is initially created to describe texture regions by using better local binary patterns based on multi-grained gradient information and the noise residual feature to describe texture regions. The input image is then divided into different sections using local semantics using a segmentation approach called simple linear iterative clustering. Finally, using the hybrid texture descriptor and segmentation results, a weighted mask is created, which may be used to determine the best spots for applying adversarial perturbations of various weights to generate more secure adversarial cover images. Extensive experiments are carried out to compare the suggested method to existing state-of-the-art methods in order to prove its superiority. The experiments were conducted on BOSSbase ver. 1.01, which contains 10,000 grayscale 512*512 images. The images were cropped into four non-overlapping 256*256 images using ‘imcrop’ function in MATLAB R2018b. Consequently, a cropped BOSSbase dataset was constructed that contains 40,000 samples. Besides, we also evaluate the performance on another image dataset, namely BOWS2. Experiments show that the proposed model can increase image steganography security while causing less observable traces.

Shifted LT Code Security Scheme for Partial Information Encryption.

The existing physical layer security technology based on fountain codes needs to ensure that the legal channel is superior to the eavesdropping channel; when the quality of the legal channel and the eavesdropping channel are close, the information security cannot be guaranteed. Aiming at this problem, this paper proposes a shifted Luby transform (SLT) code security scheme for partial information encryption, which is mainly divided into two stages, partial information encryption transfer and degree distribution adjustment. The main idea is that the source randomly extracts part of the information symbols, and performs XOR encryption with the random sequence containing the main channel noise sent by the legitimate receiver. Afterward, the degree distribution is adjusted using the number of transfer information symbols received by the legitimate receiver to improve the average degree of the encoded codewords. Since the eavesdropper can only obtain fewer information symbols in the initial stage, it is difficult to decode the generated coded symbols after the degree distribution adjustment, thereby ensuring the safe transmission of information. The experimental results show that, compared with other LT anti-eavesdropping schemes, even if the legitimate channel is not dominant, the proposed scheme still has better security performance and less decoding overhead.