Security Scanning Research Articles

Security Scanning of AI/ML Models in the Software Development Life Cycle

Security Scanning of AI/ML Models in the Software Development Life Cycle

THE EUROPEAN UNION’S AVIATION SECURITY POLICY EVOLUTION AND ITS IMPLICATIONS TO INDONESIA

Advances in aviation transportation have increased threats to security, prompting the European Union (EU) to take decisive actions. This research examines the evolution of the EU’s aviation security laws and their implications for Indonesia. Using a normative legal research approach, the study finds that EU aviation security measures have been significantly influenced by external and internal factors. Key developments include the integration of aviation security post-9/11 with Regulation (EC) No. 2320/2002, its replacement by Regulation (EC) No. 300/2008, the near-ban on liquids after the 2006 Trans-Atlantis liquid bomb plot, the installation of security scanners following the 2009 underwear bomb plot, and the ACC3 system post-2010 Yemen incident that revoked Regulation (UE) No. 185/2010. Cyber threats are also a growing concern. This research is important as these EU measures impact Indonesia’s national aviation security standards.

Microservices Security Vulnerability Remediation approach using Veracode and Checkmarx

Abstract — As organizations increasingly adopt microservices architectures for building scalable and resilient applications, ensuring the security of these distributed systems becomes paramount. In this empirical study, we conduct a comprehensive comparative analysis to assess the efficacy of three leading security scanning tools, namely Veracode, Snyk, and Checkmarx, in identifying and remedying security vulnerabilities within microservices applications deployed on the AWS and Azure cloud platforms. The study aims to provide nuanced insights into the performance, usability, and integration capabilities of these tools, offering valuable guidance to organizations striving to fortify their microservices-based infrastructures. By meticulously evaluating scanning capabilities, vulnerability detection accuracy, remediation guidance comprehensiveness, CI/CD pipeline integration proficiency, and overall ease of use, our research sheds light on the relative strengths and weaknesses of each tool in the context of modern cloud-native application security. Through meticulously designed experiments utilizing realistic microservices application scenarios encompassing diverse vulnerability types, including injection attacks, authentication bypasses, and insecure configurations, we present a thorough examination of the tools' capabilities and limitations. The findings from our study contribute to the evolving discourse on microservices security, emphasizing the critical importance of selecting appropriate security scanning solutions tailored to the unique requirements and constraints of cloud-based microservices architectures. By leveraging the insights gleaned from our comparative analysis, organizations can make well-informed decisions regarding tool selection and deployment strategies, thereby bolstering the resilience of their microservices ecosystems against an ever-expanding threat landscape.

Automated detection and classification of concealed objects using infrared thermography and convolutional neural networks

This paper presents a study on the effectiveness of a convolutional neural network (CNN) in classifying infrared images for security scanning. Infrared thermography was explored as a non-invasive security scanner for stand-off and walk-through concealed object detection. Heat generated by human subjects radiates off the clothing surface, allowing detection by an infrared camera. However, infrared lacks in penetration capability compared to longer electromagnetic waves, leading to less obvious visuals on the clothing surface. ResNet-50 was used as the CNN model to automate the classification process of thermal images. The ImageNet database was used to pre-train the model, which was further fine-tuned using infrared images obtained from experiments. Four image pre-processing approaches were explored, i.e., raw infrared image, subject cropped region-of-interest (ROI) image, K-means, and Fuzzy-c clustered images. All these approaches were evaluated using the receiver operating characteristic curve on an internal holdout set, with an area-under-the-curve of 0.8923, 0.9256, 0.9485, and 0.9669 for the raw image, ROI cropped, K-means, and Fuzzy-c models, respectively. The CNN models trained using various image pre-processing approaches suggest that the prediction performance can be improved by the removal of non-decision relevant information and the visual highlighting of features.

A micro size terahertz wheel shaped antenna with non-defected ground structure

A micro dimension antenna with wheel-geometrical wide-band terahertz (THz) is suggested in this research. In the circular shaped patch, concentric circle shaped slots are incorporated to form a wheel shaped patch antenna. The suggested model is designed on a polymide substrate with dielectric constant of 4.3 and thickness of 20 µm. The suggested prototype antenna is very much compact in size of 210×160 µm2 . The designed antenna achieves a wideband operation from 8.692 THz to 9.772 THz. This prototype antenna’s maximum realized gain is 10.2 dBi at 9.0 THz. This high gain is important for wide range of wireless applications. The radiation pattern, radiation efficiency, reflection coefficient, surface current distribution and voltage standing wave ratio are examined through the simulation results. In future video rate imaging system, super fast close-range in-door wireless communication, biomedical picturing, homeland defence equipments, security scanning, explosive detection, and characterisation of materials in the THz level will be benefited from the suggested THz antenna.

Non-contact, portable, and stand-off infrared thermal imager for security scanning applications

In this article, we demonstrated the physical application of a portable infrared (IR) security scanning system for the non-contact and stand-off detection of target objects concealed underneath clothing. Such a system combines IR imaging and transfer learning with convolutional neural networks (CNNs) to enhance the detection of weak thermal signals and automate the classification of IR images. A mid-wavelength IR detector was used to record the real-time heat emitted from the clothing surface by human subjects. Concealed objects reduce the transmissivity of IR radiation from the body to the clothing surface, generally showing lower IR intensity compared to regions without objects. Due to limited resources for training data, the transfer learning approach was applied by fine-tuning a pre-trained CNN ResNet-50 model using the ImageNet database. Two image types were investigated here, i.e., raw thermal and Fuzzy-c clustered images. Receiver operating characteristic curves were built using a holdout set, showing an area-under-the-curve of 0.8934 and 0.9681 for the raw and Fuzzy-c clustered image models, respectively. The gradient-weighted class activation mapping visualization method was used to improve target identification, showing an accurate prediction of the object area. It was also found that complex clothing, such as those composed of materials of different transmissivity, could mislead the model in classification. The proposed IR-based detector has shown potential as a non-contact, stand-off security scanning system that can be deployed in diverse locations and ensure the safety of civilians.

Dead or alive: Discovering server HTTP endpoints in both reachable and dead client-side code

Discovering server HTTP endpoints – essentially, enumerating the server’s attack surface – is an important step of every black-box web security scanner. One of the main methods of doing that is inferring server endpoints from the client side, determining what HTTP requests can be sent from client to server. This is trivial for requests triggered by HTML markup elements, such as links and forms, but is much harder for requests sent by JavaScript. Existing approaches to determining requests sent from JavaScript are based on a technique known as dynamic crawling - automated interaction with user interface elements using a headless browser. Dynamic crawling fails when the code that sends a request is impossible or very difficult to trigger with interface interaction. We propose a different approach for finding HTTP requests sent by JS code, which uses static code analysis. While analyzing JavaScript statically is known to be hard and applying existing analyzers to real-world web pages usually does not work, we propose a new lightweight analysis algorithm that can work on pages of real websites and can discover server endpoints that dynamic crawlers cannot. Evaluation results show that augmenting a black-box scanner with the proposed static analysis may significantly improve server-side endpoint coverage.

DaISy: diffuser-aided sub-THz imaging system.

Sub-terahertz (Sub-THz) waves possess exceptional attributes, capable of penetrating non-metallic and non-polarized materials while ensuring bio-safety. However, their practicality in imaging is marred by the emergence of troublesome speckle artifacts, primarily due to diffraction effects caused by wavelengths comparable to object dimensions. In addressing this limitation, we present the Diffuser-aided sub-THz Imaging System (DaISy), which utilizes a diffuser and a focusing lens to convert coherent waves into incoherent counterparts. The cornerstone of our progress lies in a coherence theory-based theoretical framework, pivotal for designing and validating the THz diffuser, and systematically evaluating speckle phenomena. Our experimental results utilizing DaISy reveal substantial improvements in imaging quality and nearly diffraction-limited spatial resolution. Moreover, we demonstrate a tangible application of DaISy in the scenario of security scanning, highlighting the versatile potential of sub-THz waves in miscellaneous fields.

Survey on Web Security Scanner: The State of Features and Vulnerability Checks

The development has been lacked in categorization of web security scanning. The testers use binge-tool-scanning (running security scanning one after the other) where issue of availability and accessibility of proper tools arises. In this study, the issue of automation by running multiple scans to evaluate vulnerabilities, effectively judging, saving the precious time and addressing the accurate results. There been many overlaps between the scanning tools which makes this problem more challenging. This executes multitude of web security scanning tools, does other custom added checks and prints the result spontaneously. In an era dominated by digital connectivity and online interactions, the security of web applications stands at stage of critical concern

Synthesis of Al quantum dots on porous silicon as an effective radiation detector using extended gate technique

In this study, porous silicon (PS) and aluminum (Al) doped porous silicon were synthesized through an electrochemical method, utilizing carefully selected parameters. The etching procedure was calibrated with a 4:1 HF/ethanol ratio, maintaining a current of 20 mA for 20 min, and incorporating 0.05 g of doping powder. Comprehensive structural analysis using FESEM-EDX revealed the incorporation of Al into the porous silicon matrix. Subsequently, the samples were covered with a finger mask, which facilitated the creation of an interdigitated electrode using a sputtering deposition method. The I–V characteristics of the samples were systematically studied, showing an increase in bias voltage at the source correlated with the measured current. Remarkably, upon X-ray exposure, pulses were successfully measured, highlighting the potential of these materials for radiation detection. These pulses were evaluated under various X-ray irradiation parameters using a sample detector. The study successfully identified the optimal parameters for PS and Al-PS as (90 V, 100 mA, 1 s) and (100 V, 10 mA, 0.5 s), respectively. This research underscores the potential applications of these materials in advanced electronic devices and sensors. The unique properties of synthesized porous silicon, particularly when doped with aluminum, could be beneficial in areas such as photovoltaics, biosensors, and photonics. Additionally, the material's efficiency in detecting X-ray radiation suggests its suitability for medical imaging, security scanning, and radiation monitoring systems. Based on the I–V characteristic studies, these materials may be well-suited for use in electronic components requiring precise control of electrical properties. Overall, this study not only enhances our understanding of porous silicon and aluminum-doped porous silicon but also opens up new avenues for their application in a wide range of sensing technologies.

Dynamic X-ray imaging with screen-printed perovskite CMOS array.

High performance X-ray detector with ultra-high spatial and temporal resolution are crucial for biomedical imaging. This study reports a dynamic direct-conversion CMOS X-ray detector assembled with screen-printed CsPbBr3, whose mobility-lifetime product is 5.2 × 10-4 cm2 V-1 and X-ray sensitivity is 1.6 × 104 µC Gyair-1 cm-2. Samples larger than 5 cm[Formula: see text]10 cm can be rapidly imaged by scanning this detector at a speed of 300 frames per second along the vertical and horizontal directions. In comparison to traditional indirect-conversion CMOS X-ray detector, this perovskite CMOS detector offers high spatial resolution (5.0 lp mm-1) X-ray radiographic imaging capability at low radiation dose (260 nGy). Moreover, 3D tomographic images of a biological specimen are also successfully reconstructed. These results highlight the perovskite CMOS detector's potential in high-resolution, large-area, low-dose dynamic biomedical X-ray and CT imaging, as well as in non-destructive X-ray testing and security scanning.

Terahertz MIMO antenna array for future generation of wireless applications

Abstract The paper proposes a high gain, low ECC, and high isolation THz MIMO antenna array for future generation wireless applications to accommodate a growing population of mobile users. A THz MIMO antenna array is designed with dimensions of 1200 × 2200 × 191.29 µm3. It employs the array of double-slit complementary split-ring resonators (D-CSRRs) on the bottom layer to improve the gain, return loss, and isolation. The gain of the proposed antenna array is 11.3 dBi with 66.45 % radiating efficiency at 0.65 THz. The −10 dB impedance bandwidth lies from 0.62–0.66 THz. The parameters of the MIMO antenna are evaluated such as isolation, envelope correlation coefficient (ECC), diversity gain (DG), and channel capacity loss. The ECC and DG value observed are 2.84 × 10−6 and 9.98 dB, respectively, at 0.65 THz. The channel capacity loss and isolation of the proposed MIMO antenna array are below 0.4 bps/Hz and (|S 21| > 25 dB), respectively, in the complete operating band. The suggested THz MIMO antenna array can be utilised for THz high-speed wireless communication, video-rate imaging systems, sensing, the medical field for cancer imaging, security scanning, and the detection of illicit goods.

Development of Ward Visitor Management System in the COVID-19 Epidemic.

The purpose of this study was to design, develop, and deploy a visitor management system (VMS) to effectively manage visitors during COVID-19. The VMS was designed using the User-Centered Design (UCD) methodology. The iterative process of UCD includes 3 interviews and 5 usability tests and cognitive walkthrough cycles. This system comprised six parts: the WEB server provides visit scheduling service; the database server stores visit data and provides visit data services; the mobile application server provides security checks and scanning services; the electronic medical record (EMR) server provides ward data service; the Internet application gateway provides health code data service and exchanges health code data with the Sichuan Tianfu Health Code platform, and the service bus enables the centralized exchange and integration of visit data. The visit management system optimizes the workflow of ward visitors, improves staff productivity, and reduces the risk of infection transmission.

Development of prototype backscatter X-ray security scanner for luggage inspection

In the Republic of Korea, for the purpose of security screening at ports and airports, the present system for inspecting small cargo/luggage relies on transmission X-ray imaging, with which discernment of organic and powder-form materials in images is difficult. Backscatter X-ray imaging techniques, contrastingly, are sensitive to organic materials (i.e., low-Z elements) due to a higher probability of Compton scattering relative to other photon interactions. Such techniques, therefore, have the potential to be used in security screening systems for the detection of organic compounds such as drugs and explosives. In the present study, a prototype backscatter X-ray security scanner for luggage screening was developed, and its performance was evaluated at various tube voltages. It was found that the isolation contrast, which indicates the minimum discernible thickness of a plastic panel when the background material of the image is steel, was approximately 1 mm at the tube voltage of 120 kVp. Moreover, amorphously shaped contraband articles randomly hidden inside the luggage were clearly visible at tube voltages ranging from 80 to 160 kVp. The developed backscatter X-ray security scanner is expected to provide improved detection efficiency for thin objects and/or illicit organic materials compared to a transmission-based X-ray imaging system.

Experimental validation of Monte Carlo simulation model for X-ray security scanner

Transmission X-ray security scanners are deployed to detect smuggling of contraband articles, including weapons, narcotics, and explosives, for the purposes of homeland security. Current X-ray scanners use a fixed tube voltage (i.e., 160 kV); hence, they have a limitation in detecting thinly coated and/or low-density objects. To overcome this limitation, we are developing an X-ray scanner that applies variable tube voltage according to the physical/chemical properties of the object being inspected. To this end, in our previous study, Monte Carlo simulations with Geant4 (GEometry ANd Tracking4) and MCNP (Monte Carlo N Particle) were performed to optimize the design of the X-ray scanner for variable tube voltages. The MCNP was used to simulate the radiation generator for the X-ray source term, and the Geant4 was used to optimize the design of the dual-energy detector and to obtain the detector counts. In the present study, we experimentally validated the reliability of the Monte Carlo simulation model for the X-ray scanner. An 241Am source and a radiation generator were employed in this validation. For the 241Am source, the dual-energy detector signal was measured at a distance of 1 cm from the detector. In the case of the radiation generator, the source-to-object distance and the source-to-detector distance were 70 cm and 120 cm, respectively, as used in a typical X-ray security scanner. The tube voltage and the current were 140 kV and 10 mA, respectively. To obtain the X-ray images, the object was scanned while moving at a speed of 0.2 m/s on a conveyor system. The X-ray source term used in the simulation was obtained by monoenergetic-electron-beam bombardment onto the target. 4-D simulations were performed for the moving object. To validate the simulation model, we compared the simulated and measured image profiles, as well as the pixel counts of the dual-energy detector. The percent differences between the simulated and measured pixel counts and the image profiles were all within 5%. Thus, we concluded that our simulation model for the X-ray scanner can be considered to be reliable.

RECONFIGURABLE GRAPHENE-BASED MULTI-INPUT-MULTI-OUTPUT ANTENNA FOR SIXTH GENERATION AND BIOMEDICAL APPLICATION

In this paper, a small MIMO antenna with a semi-hexagonal form is developed for use in terahertz applications. The suggested antenna consists of four radiating components printed on a Silicon Dioxide substrate that is 90 ×90 with a thickness of 10 µm. The radiating components have been positioned in an orthogonal orientation to produce excellent isolation and miniaturization of the MIMO system. The suggested MIMO antenna works for all the (0.1-10)THz bands with different values of chemical potential with wide impedance bandwidth (S11 ≤ -10dB) in the frequency range of 2.4 to more than 10 THz, With a co-reflection coefficient less than -20 dB over the whole operating band, with a return loss -50 dB. The MIMO antenna has a maximum gain of 8.4 dBi and a steady diversity performance across all the working bands. According to the high-performance characteristics, the suggested graphene MIMO antenna design can be used for many applications in the THz band, including 6G high-speed wireless communication systems, security scanning, biomedical applications, IoT (Internet of Things), and sensing.

ADOPSI DEVSECOPS UNTUK MENDUKUNG METODE AGILE MENGGUNAKAN TRIVY SEBAGAI SECURITY SCANNER DOCKER IMAGE DAN DOCKERFILE

Compliance with personal data protection laws requires electronic system operators to pay more attention to security in applications. Security testing which is usually done at the end of the SDLC makes Agile principles incompatible with advantages that prioritize acceleration, adaptability and responsiveness to change. DevSecOps implementation using Trivy will insert a security scanner process for applications that are deployed in containerized form. The continuous process of security scanning integrated in CI/CD will increase the awareness of developers in terms of application security, so that developers will more quickly fix these problems and avoid security problems at the end of the SDLC.

Delivering Next Generation Security Scanners

HOW EDGE PROCESSING IS ENABLING NEXT-GENERATION MILLIMETRE WAVE SCANNERS

Deep Learning-Based Symptomizing Cyber Threats Using Adaptive 5G Shared Slice Security Approaches

In fifth Generation (5G) networks, protection from internal attacks, external breaches, violation of confidentiality, and misuse of network vulnerabilities is a challenging task. Various approaches, especially deep-learning (DL) prototypes, have been adopted in order to counter such challenges. For 5G network defense, DL module are recommended here in order to symptomize suspicious NetFlow data. This module behaves as a virtual network function (VNF) and is placed along a 5G network. The DL module as a cyber threat-symptomizing (CTS) unit acts as a virtual security scanner along the 5G network data analytic function (NWDAF) to monitor the network data. When the data were found to be suspicious, causing network bottlenecks and let-downs of end-user services, they were labeled as “Anomalous”. For the best proactive and adaptive cyber defense system (PACDS), a logically organized modular approach has been followed to design the DL security module. In the application context, improvements have been made to input features dimension and computational complexity reduction with better response times and accuracy in outlier detection. Moreover, key performance indicators (KPIs) have been proposed for security module placement to secure interslice and intraslice communication channels from any internal or external attacks, also suggesting an adaptive defense mechanism and indicating its placement on a 5G network. Among the chosen DL models, the CNN model behaves as a stable model during behavior analysis in the results. The model classifies botnet-labeled data with 99.74% accuracy and higher precision.

A Voltage-Tuned Terahertz Absorber Based on MoS2/Graphene Nanoribbon Structure.

Terahertz frequency has promising applications in communication, security scanning, medical imaging, and industry. THz absorbers are one of the required components for future THz applications. However, nowadays, obtaining a high absorption, simple structure, and ultrathin absorber is a challenge. In this work, we present a thin THz absorber that can be easily tuned through the whole THz range (0.1-10 THz) by applying a low gate voltage (<1 V). The structure is based on cheap and abundant materials (MoS2/graphene). Nanoribbons of MoS2/graphene heterostructure are laid over a SiO2 substrate with an applied vertical gate voltage. The computational model shows that we can achieve an absorptance of approximately 50% of the incident light. The absorptance frequency can be tuned through varying the structure and the substrate dimensions, where the nanoribbon width can be varied approximately from 90 nm to 300 nm, while still covering the whole THz range. The structure performance is not affected by high temperatures (500 K and above), so it is thermally stable. The proposed structure represents a low-voltage, easily tunable, low-cost, and small-size THz absorber that can be used in imaging and detection. It is an alternative to expensive THz metamaterial-based absorbers.