Software Security Research Articles

Enhancing cybersecurity through script development using machine and deep learning for advanced threat mitigation

This scholarly paper explores the utilization of Machine Learning (ML) and Deep Learning (DL) methodologies to enhance the cybersecurity aspects of script development. Given the increasing panorama of threats in contemporary software creation, cybersecurity has ascended to a critical realm of concern. Traditional security measures frequently prove inadequate in countering complex breaches. However, ML and DL present promising solutions by facilitating automated and intelligent scrutiny of security-centric tasks. In this investigation, we leverage the Fashion MNIST dataset, deploying a Convolutional Neural Network (CNN) model to underscore the efficacy of ML and DL in elevating cybersecurity. The trajectory of script development encompasses stages like data preprocessing, model training, and assessment through metrics such as accuracy and loss. Our empirical findings convincingly demonstrate that the proposed methodology yields significant enhancements in cybersecurity benchmarks, thereby validating the potential of ML and DL techniques in reinforcing software security. Furthermore, we explore practical implications and delineate the application of ML/DL integration within real software development scenarios. Through the adept amalgamation of ML and DL techniques in script development, developers can augment the robustness of their software systems against various cybersecurity threats. This paper enriches the growing body of cybersecurity research while providing invaluable insights to practitioners striving to bolster their software resilience against the ever-evolving landscape of security challenges.

Improving the User-friendliness and Ease of Use of Network Security Software through Visual Communication Design

Improving the User-friendliness and Ease of Use of Network Security Software through Visual Communication Design

Source Code Vulnerability Detection Based on Joint Graph and Multimodal Feature Fusion

Code vulnerability detection is a crucial approach to ensuring software security, aiming to automatically identify potential security vulnerabilities in source code. However, existing static vulnerability detection methods often face challenges such as feature loss and an insufficient expressive power when extracting program features. To address these issues, in this paper, we propose a source code vulnerability detection method based on joint graph and multimodal feature fusion. Innovatively, we construct a joint graph that integrates multiple program dependencies and semantic edges to achieve more comprehensive feature extraction. Additionally, by combining Graph Attention Networks (GATs) with the Transformer architecture, both structural and sequential features of code snippets are captured, further enhancing the model’s expressive capabilities. Finally, we introduce pre-fusion and post-fusion strategies to fully integrate multimodal features, thereby improving the accuracy and performance of vulnerability detection. Experimental results on the SARD dataset demonstrate the method’s excellent performance in detecting various types of vulnerabilities, achieving an F1 score of 85.20% and an accuracy of 86.50%. On the Real-Vul real-world dataset, the method achieves an F1 score of 73.9% and an accuracy of 86.50%. The detection results exhibit remarkable stability, ensuring a reliable and consistent performance. Overall, the proposed method surpasses the performance of existing mainstream detection approaches.

Novelty Not Found: Exploring Input Shadowing in Fuzzing through Adaptive Fuzzer Restarts

Greybox fuzzing enhances software security through unprecedented effectiveness in automated fault detection. Its success lies in the coverage feedback extracted from the system under test, guiding the fuzzer to explore different program parts. The most prominent way to use this feedback is novelty search , where the fuzzer keeps only new inputs exercising a new program edge. However, this approach—by design—ignores input shadowing , in which interesting inputs are discarded if they do not contribute to new coverage. This limits the accepted input space and may overlook bugs that shadowed inputs could trigger with mutations. In this work, we present a comprehensive analysis of input shadowing and demonstrate that multiple fuzzing runs of the same target exhibit a different basic block hit frequency distribution despite overlapping code coverage. We propose fuzzer restarts to effectively redistribute basic block hit frequencies and show that this increases the overall achieved coverage on 15 evaluated targets on average by \(9.5\%\) and up to \(25.0\%\) . Furthermore, restarts help to find more bugs and trigger them more reliably. Overall, our results highlight the importance of considering input shadowing in the fuzzers’ design and the potential benefits of a restart-based strategy to enhance the performance of complex fuzzing methods.

The Security of Autonomous Vehicle Software and its National Security Implications

The rapid proliferation of autonomous vehicles (AVs) presents a transformative technological leap with significant implications for safety, efficiency, and societal well-being. However, this advancement introduces a complex web of security vulnerabilities posing substantial risks to national security. This analysis explores the multifaceted security challenges inherent in AV software, examining their cascading effects on critical infrastructure, economic stability, and national defense. The core argument is that AV software vulnerabilities represent a significant and underappreciated national security threat. This threat manifests in several key ways. First, the interconnectedness of AVs—relying on communication networks (5G, V2X), mapping data, and real-time information sharing—creates a large attack surface. Cyberattacks can cause cascading failures, disrupting transportation networks and impacting supply chains. Second, the economic consequences of large-scale attacks are potentially devastating, encompassing vehicle recalls, repairs, insurance claims, and lost productivity leading to economic instability and national security concerns. Third, the integration of AV technology into military applications amplifies these risks. Autonomous military systems inherit and may amplify the vulnerabilities present in civilian AVs, jeopardizing national defense capabilities. Geopolitical implications are significant; state-sponsored attacks and the potential for cyber warfare demand international cooperation in establishing cybersecurity norms and standards. Furthermore, the potential for AV misuse in terrorism or criminal activities, alongside data privacy concerns, increases the urgency of addressing these security challenges. Connected AVs collect vast amounts of data, presenting significant privacy risks and potential for exploitation. The analysis details various software vulnerabilities, including susceptibility to adversarial attacks on sensor systems (cameras, LiDAR, radar), vulnerabilities in machine-learning-based decision-making algorithms (adversarial examples, model poisoning, algorithmic bias), weaknesses in V2X communication protocols, risks associated with OTA updates, and supply chain security challenges. Hardware vulnerabilities further expand the attack surface. Mitigating these risks necessitates a multi-pronged approach: robust cybersecurity regulations and standards, investment in research and development of more resilient systems, and strong international cooperation. Implementing secure software development lifecycle practices, enhanced hardware security, transparent supply chains via SBOMs, and comprehensive incident response plans are crucial. Continuous research, development, and collaboration are essential for ensuring AVs' secure and responsible deployment, preventing significant consequences for national security and global stability.

Threat Modeling in Web Application Security: A Forward-thinking to Secure Software Development

Threat Modeling in Web Application Security: A Forward-thinking to Secure Software Development

Energy Implications of Mitigating Side-Channel Attacks on Branch Prediction

Spectre variants 1 and 2 pose grave security threats to dynamic branch predictors in modern CPUs. While extensive research has focused on mitigating these attacks, little attention has been given to their energy and power implications. This study presents an empirical analysis of how compiler-based Spectre mitigation techniques influence energy consumption. We collect fine-grained energy readings from an HPC-class CPU via embedded sensors, allowing us to quantify the trade-offs between security and power efficiency. By utilizing a standard suite of microbenchmarks, we evaluate the impact of Spectre mitigations across three widely used compilers, comparing them to a no-mitigation baseline. The results show that energy consumption varies significantly depending on the compiler and workload characteristics. Loop unrolling influences power consumption by altering branch distribution, while speculative execution, when unrestricted, plays a role in conserving energy. Since Spectre mitigations inherently limit speculative execution, they should be applied selectively to vulnerable code patterns to optimize both security and power efficiency. Unlike previous studies that primarily focus on security effectiveness, this work uniquely evaluates the energy costs associated with Spectre mitigations at the compiler level, offering insights for power-efficient security strategies. Our findings underscore the importance of tailoring mitigation techniques to application needs, balancing performance, energy consumption, and security. The study provides practical recommendations for compiler developers to build more secure and energy-efficient software.

SAluMC: Thwarting Side-Channel Attacks via Random Number Injection in RISC-V.

As processor performance advances, the cache has become an essential component of computer architecture. Moreover, the rapid digital transformation of daily life has resulted in electronic devices storing greater amounts of sensitive information. Thus, device users are becoming more concerned about the security of their personal information, so improving processor performance is no longer the sole priority. Hardware vulnerabilities are generally more difficult to detect and address compared to software viruses and related threats. A common technique for exploiting hardware vulnerabilities is through side-channel attacks. They can bypass software security to extract personal information directly from hardware components like the cache or registers. This paper introduces a novel architecture for the arithmetic logic unit (ALU) and associated memory controller (MC) based on the RISC-V microarchitecture to mitigate side-channel attacks. The proposed approach employs hardware-generated random numbers and has minimal design costs, negligible impact on the original system structure, seamless integration, and easy modification of internal components. Results are presented that show it is effective against side-channel attacks.

The empirical analysis of multi-objective hyperparameter optimization in software vulnerability prediction

The security of software has always been a vital concern for software developers. Infringements on software systems can result in significant losses in terms of time and confidential data. Software vulnerabilities are considered to be the gateway for attackers to harm information systems. Hence, it is crucial to build effective software vulnerability prediction models. Machine learning algorithms produce high-performance prediction models but the performance of these models is affected by the hyperparameter settings of machine learning methods and imbalanced datasets. The current study aims to find out the effect of single- and multi-objective hyperparameter optimization on software vulnerability prediction models. The paper has proposed an experimental methodology that considers both optimizations and uses eight machine learning methods on PHP open-source public datasets (Drupal, Moodle, and PHPMyAdmin). The experimental results show that after applying multi-objective hyperparameter optimization, the highest AUC achieved is 0.9774 and the F1-Score attained is 0.9222, which is better than the benchmark studies. Random Forest has performed satisfactorily for all three datasets. The comparative analysis of single and multi-objective HPO is performed using post hoc Tukey’s HSD test. Furthermore, the effectiveness of the resampling technique ‘SMOTE’ is observed.

A Secure and Efficient Software Random Number Generator Applicable to Internet of Things

A Secure and Efficient Software Random Number Generator Applicable to Internet of Things

Enhancing Security in Software Design Patterns and Antipatterns: A Framework for LLM-Based Detection

The detection of security vulnerabilities in software design patterns and antipatterns is crucial for maintaining robust and maintainable systems, particularly in dynamic Continuous Integration/Continuous Deployment (CI/CD) environments. Traditional static analysis tools, while effective for identifying isolated issues, often lack contextual awareness, leading to missed vulnerabilities and high rates of false positives. This paper introduces a novel framework leveraging Large Language Models (LLMs) to detect and mitigate security risks in design patterns and antipatterns. By analyzing relationships and behavioral dynamics in code, LLMs provide a nuanced, context-aware approach to identifying issues such as unauthorized state changes, insecure communication, and improper data handling. The proposed framework integrates key security heuristics—such as the principles of least privilege and input validation—to enhance LLM performance. An evaluation of the framework demonstrates its potential to outperform traditional tools in terms of accuracy and efficiency, enabling the proactive detection and remediation of vulnerabilities in real time. This study contributes to the field of software engineering by offering an innovative methodology for securing software systems using LLMs, promoting both academic research and practical application in industry settings.

Toward Enhancing Privacy Preservation of a Federated Learning CNN Intrusion Detection System in IoT: Method and Empirical Study

Enormous risks and hidden dangers of information security exist in the applications of Internet of Things (IoT) technologies. To secure IoT software systems, software engineers have to deploy advanced security software such as Intrusion Detection Systems (IDS) that are able to keep track of how the IoT devices behave within the network and detect any malicious activity that may be occurring. Considering that IoT devices generate large amounts of data, Artificial Intelligence (AI) is often regarded as the best method for implementing IDS, thanks to AI’s high capability in processing large amounts of IoT data. To tackle these security concerns, specifically the ones tied to the privacy of data used in IoT systems, the software implementation of a Federated Learning (FL) method is often used to improve both privacy preservation (PP) and scalability in IoT networks. In this article, we present an FL IDS that leverages a 1-Dimensional Convolutional Neural Network (CNN) for efficient and accurate intrusion detection in IoT networks. To address the critical issue of PP in FL, we incorporate three techniques: Differential Privacy, Diffie–Hellman Key Exchange, and Homomorphic Encryption. To evaluate the effectiveness of our solution, we conduct experiments on seven publicly available IoT datasets: TON-IoT, IoT-23, BoT-IoT, CIC IoT 2023, CIC IoMT 2024, RT-IoT 2022, and EdgeIIoT. Our CNN-based approach achieves outstanding performance with an average accuracy, precision, recall, and F1-score of 97.31%, 95.59%, 92.43%, and 92.69%, respectively, across these datasets. These results demonstrate the effectiveness of our approach in accurately identifying and detecting intrusions in IoT networks. Furthermore, our experiments reveal that implementing all three PP techniques only incurs a minimal increase in computation time, with a 10% overhead compared to our solution without any PP mechanisms. This finding highlights the feasibility and efficiency of our solution in maintaining privacy while achieving high performance. Finally, we show the effectiveness of our solution through a comparison study with other recent IDS trained and tested on the same datasets we use.

Secure software development: leveraging application call graphs to detect security vulnerabilities.

The inconsistency in software development standards frequently leads to vulnerabilities that can jeopardize an application's cryptographic integrity. This situation can result in incomplete or flawed encryption processes. Vulnerabilities may manifest as missing, bypassed, or improperly executed encryption functions or the absence of critical cryptographic mechanisms, which eventually weaken security goals. This article introduces a thorough method for detecting vulnerabilities using dynamic and static analysis, focusing on a cryptographic function dominance tree. This strategy systematically minimizes the likelihood of integrity breaches in cryptographic applications. A layered and modular model is developed to maintain integrity by mapping the entire flow of cryptographic function calls across various components. The cryptographic function call graph and dominance tree are extracted and subsequently analyzed using an integrated dynamic and static technique. The extracted information undergoes strict evaluation against the anticipated function call sequence in the relevant cryptographic module to identify and localize potential security issues. Experimental findings demonstrate that the proposed method considerably enhances the accuracy and comprehensiveness of vulnerability detection in cryptographic applications, improving implementation security and resilience against misuse vulnerabilities.

Come for syntax, stay for speed, write secure code: an empirical study of security weaknesses in Julia programs

ContextPractitioners prefer to achieve performance without sacrificing productivity when developing scientific software. The Julia programming language is designed to develop performant computer programs without sacrificing productivity by providing a syntax that is scripting in nature. According to the Julia programming language website, the common projects are data science, machine learning, scientific domains, and parallel computing. While Julia has yielded benefits with respect to productivity, programs written in Julia can include security weaknesses, which can hamper the security of Julia-based scientific software. A systematic derivation of security weaknesses can facilitate secure development of Julia programs—an area that remains under-explored.ObjectiveThe goal of this paper is to help practitioners securely develop Julia programs by conducting an empirical study of security weaknesses found in Julia programs.MethodWe apply qualitative analysis on 4,592 Julia programs used in 126 open-source Julia projects to identify security weakness categories. Next, we construct a static analysis tool called Julia Static Analysis Tool (JSAT) that automatically identifies security weaknesses in Julia programs. We apply JSAT to automatically identify security weaknesses in 558 open-source Julia projects consisting of 25,008 Julia programs.ResultsWe identify 7 security weakness categories, which include the usage of hard-coded password and unsafe invocation. From our empirical study we identify 23,839 security weaknesses. On average, we observe 24.9% Julia source code files to include at least one of the 7 security weakness categories.ConclusionBased on our research findings, we recommend rigorous inspection efforts during code reviews. We also recommend further development and application of security static analysis tools so that security weaknesses in Julia programs can be detected before execution.

STRATEGIES LEVERAGING AI IN DEVSECOPS FOR CLOUD ENVIRONMENTS

This paper aims to review how AI can be implemented in DevSecOps for cloud environments for the improvement of security across the SDLC. Authenticated automation, predictive analytics, and detecting threats are significant in realizing the cloud-native applications’ complexity and speed. Some of the focused strategies are AI in Security Testing, AI Powered Vulnerability Management, and AI in Compliance with regular and deeper security checks against the latest threats that might threaten the system. Subsequent trends reveal factors that define the utilization of AI in threat intelligence as well as prediction for secure software development in the future. The paper presents continuity of security as an important aspect of cloud application development with the emphasis on AI’s contributions to it. Keywords - Security Testing, AI, DevSecOps, DevOps, Cloud Environments

Augmented Cyber-physical Model for Real-time Smart-grid Co-simulation

Due to crucial importance of the electricity in almost every aspect of our life, power systems and their components continue to receive considerable attention, and important efforts are invested for development or improvement in the direction of smooth transition to full smart grid solutions. Even if operation and control of power system are well-known, new control solutions require careful and detailed investigations due to challenges emerged from high complexity, security or even the current operating conditions in high penetration of renewable energy sources or consummers with significant loads. In this context, the paper introduces a new concept and solution of augmented cyberphysical model to allow testing and simulation of the supervision, monitoring and control solutions in a mixed physical and virtual environment, facilitating complex investigation starting from common process level to complex interdependencies arise from communication infrastructure inherent failures to contingent issues such as software related or security attacks. The concept, architecture and an implementation on a real-time hardware-in-the-loop based platform are revealed and shown as an open and affordable research and development solution.

Enterprise Package Management: A Framework for Secure Development and Team Collaboration

This article presents a comprehensive analysis of software supply chain security in modern development environments, focusing on package management and security practices. It examines the critical challenges organizations face in managing open-source dependencies, where the majority of application code comes from external sources. The article explores essential security measures including package source mapping, multi-factor authentication requirements, vulnerability notifications, and central package management systems. Through detailed analysis of recent security trends, including the significant increase in security advisories and package downloads, the article demonstrates the growing importance of supply chain security. It presents practical solutions for vulnerability management, dependency tracking, and secure package source configuration while incorporating emerging technologies such as OIDC, build provenance, and automated vulnerability remediation. The article emphasizes the critical role of proactive security measures and best practices in maintaining secure software development environments, particularly in enterprise settings where package management security directly impacts organizational risk and operational efficiency.

Exploring the Integration of Blockchain and Distributed DevOps for Secure, Transparent, and Traceable Software Development

Exploring the Integration of Blockchain and Distributed DevOps for Secure, Transparent, and Traceable Software Development

GPT-Based Automated Induction: Vulnerability Detection in Medical Software.

Integrating Natural Language Processing (NLP) with Generative Pre-trained Transformer (GPT) models plays a pivotal role in enhancing the accuracy and efficiency of healthcare software, which is essential for patient safety and providing high-quality care. The precision of healthcare software is fundamental to protecting the well-being of the patient. In addition, it can ensure the delivery of superior care, maintain the integrity of healthcare systems, and promote trust and cost-effectiveness. It is necessary to emphasize the importance of software reliability in its development and deployment. Symbolic execution serves as a vital technology in automated vulnerability detection. However, symbolic execution often faces problems such as path explosion, which seriously affects efficiency. Although there have been several studies to reduce the number of computational paths in symbolic execution, this problem remains a major obstacle. Therefore, more efficient solutions are urgently needed to ensure the software security. This paper proposes a large-scale language model(LLM) induction method mitigating path explosion applied to symbolic execution engines. In contrast to traditional symbolic execution engines, which often result in timeout or out-of-memory detection, our approach achieves the task of detecting vulnerabilities in seconds. Furthermore, our proposal improves the scalability of symbolic execution, allowing more extensive and complex programs to be analyzed without significant increases in computational resources or time. This scalability is crucial to tackling modern software systems and improving the efficiency and effectiveness of automated defect verification in healthcare software.

A Fuzzy‐AHP Decision‐Making Framework for Optimizing Software Maintenance and Deployment in Information Security Systems

ABSTRACTInformation System Security (ISS) is the primary economic lever for the global economy. It is the cornerstone for value generation, and its absence undeniably affects technology, people, and finances. The emergence of the worldwide information society has introduced fresh economic and legal challenges attributed to the surge in Internet utilization and advancements in the digital economy. Ensuring the security of advancements within information systems has emerged as a primary concern in propelling the evolution of information processes within the software development industry. This study aims to develop and propose a Fuzzy Analytic Hierarchy Process (Fuzzy‐AHP) framework to enhance decision‐making for software maintenance and deployment in ISS. This framework aims to provide a systematic, flexible method for evaluating and prioritizing multiple conflicting criteria under conditions of uncertainty. The study initially adopts an empirical survey to identify software security maintenance and deployment risks and their practices for ISS organizations. Then adopts the Fuzzy‐AHP method to handle the imprecision of expert judgments and organizes decision‐making into a hierarchical structure. The framework is applied to evaluate key criteria related to software maintenance and deployment, including security risks, system performance, operational costs, and compliance requirements. Data from 50 ISS experts were collected and used to validate the framework. The paper identifies 52 security risks in maintenance and deployment (SRMD) processes in ISS and also identified 139 best practices for ensuring security, including regular updates, patch management, and adherence to industry‐standard security protocols. The Fuzzy‐AHP framework effectively structured the decision‐making process by prioritizing criteria and sub‐criteria. The results demonstrated that the framework helps mitigate the subjective biases in expert judgment and provides a more balanced assessment of maintenance and deployment strategies. Prioritizing security risks and compliance emerged as key factors in the decision‐making process. The proposed Fuzzy‐AHP framework provides an innovative and adaptable solution for optimizing ISS organizations' software maintenance and deployment decisions. It addresses the complexity and uncertainty involved in such decisions, offering a transparent and structured approach that improves the accuracy and reliability of outcomes. Future research should focus on empirical validation of the framework in real‐world case studies and expand its application to other industries with similar decision‐making needs.