Security Testing Research Articles

Security Analysis of Web Open-Source Projects Based on Java and PHP

During website development, the selection of suitable computer language and reasonable use of relevant open-source projects is imperative. Although the two languages, PHP and Java, have been extensively investigated in this context, there are not many security test reports based on their open-source projects. In this article, we conducted separate security analyses on web-related open-source projects based on PHP and Java. To this end, different open-source frameworks and services are used to design websites used to test experimental attacks on 12 popular open-source filters available on GitHub, as well as investigate the use of Lightweight Directory Access Protocol (LDAP) in the Firefox browser environment. Using malicious payloads published by Open Web Application Security Project (OWASP) and others, Cross-site Scripting (XSS), Local File Inclusion (LFI), SQL injection, and LDAP injection are performed on the test targets. The experimental results reveal that although PHP-based open-source projects are more vulnerable to attacks than Java-based ones, there is significant room for improvement. Finally, a whitelist-based filtering scheme is proposed. This scheme filters the inline attributes of label elements so that the filter has an excellent detection rate of malicious payloads while having an excellent pass rate of benign payloads. Effective references and suggestions for web developers are also included to aid the selection of open-source web projects, and feasible solutions to improve filter performance are proposed.

Oyster-inspired carbon dots-functionalized silica and dialdehyde chitosan to fabricate a soy protein adhesive with high strength, mildew resistance, and long-term water resistance

Developing multifunctional adhesives with exceptional cold-pressing strength, water resistance, toughness, and mildew resistance remains challenging. Herein, inspired by oysters, a multifunctional organic-inorganic hybrid soybean meal (SM)-based adhesive was fabricated by incorporating amino-modified carbon dots functionalized silica nanoparticles (CDs@SiO2) and dialdehyde chitosan (DCS) into SM matrix. DCS effectively enhanced the interface interactions of organic-inorganic phases and the rigid nanofillers CDs@SiO2 uniformly dispersed in the SM matrix, which provided energy dissipation to improve the adhesive's toughness. Owing to the stiff skeleton structure and enhanced crosslinking density, the crosslinker-modified SM (MSM)/DCS/CDs@SiO2–2 wood adhesive exhibited outstanding cold-pressing strength (0.74 MPa), wet shear strength (1.36 MPa), and long-term water resistance (49 d). Additionally, the resultant adhesive showed superior antimildew and antibacterial properties benefiting from the introduction of DCS. Intriguingly, the fluorescent properties endowed by carbon dots further broadened the application of adhesives for realizing security testing. This study opens a new pathway for the synthesis of multifunctional biomass adhesives in industrial and household applications.

Research on university laboratory network security based on Cloud Computing

Abstract As information technology increasingly develops, cloud computing has become an emerging computer network technology, which brings great convenience to network life. In order to ensure network security while fully enjoying this convenience, this paper established the laboratory cloud platform and network topology using the single node deployment mode of Openstack, obtained the software system architecture by applying B/S three-tier architecture model for laboratory development, and finally constructed cloud computing system of the laboratory by integrating encryption technology, digital signature technology, fingerprint recognition technology and dynamic password technology. After functionality, security and performance tests of the laboratory cloud platform, the application effect indicates that, some functional modules of the platform are in line with the desired results, the operation success rate is up to 100%, a 64G server can assume the operation of about 22 virtual machines, the number of server receiving and processing reaches 33 per second, and the throughput climbs up to 980,000 bytes per second. Therefore, it is concluded that with the support of cloud computing, the laboratory basically meets the desired use demand, which can effectively intercept unauthorized operation instructions, and get good carrying capacity and load capacity while strengthening network security.

API Security Testing: The Challenges of Security Testing for Restful APIs

API Security Testing: The Challenges of Security Testing for Restful APIs

Harbinger: A Toolkit for Vulnerability Testing of IoT Devices and Web Clients

Abstract: The need for efficient tools to identify and mitigate vulnerabilities has never been more critical due to the complexity and proliferation of online applications and embedded systems. We introduce a Python toolkit in this study that combines a variety of security testing and analysis methodologies, allowing users to locate and fix web application vulnerabilities and examine firmware files. Our toolkit offers aggregated reports summarizing the outcomes of firmware analysis and web application vulnerability testing, in addition to being adaptable and user-friendly so customers may change and add features to meet their unique needs. We provide the findings from testing and analysis carried out on a variety of online apps and firmware files, as well as the design and implementation of our tools. The integration of additional security testing tools, compatibility for other file formats, and the introduction of machine learning-based analysis are just a few of the future directions we could take our toolset. This Python toolkit makes a significant addition to the realm of cybersecurity by offering customers a strong and adaptable solution for web application vulnerability testing and firmware analysis.

A novel chaos-based permutation for image encryption

Image encryption is an essential method for ensuring confidentiality during transmission on open channels. Digital images have a high correlation with large redundant data, requiring alternative spatial handling during encryption. Digital chaos offers shared properties of randomness and sensitivity that can provide secure image encryption. The security and performance of chaotic image ciphers depend on the underlying digital chaotic map. Therefore, classical chaotic maps must improve security while maintaining implementation time. The main objective of this paper is to propose a new image encryption algorithm based on an enhanced chaotic map that offers high security and low time consumption. A new perturbed logistic chaotic map based on hybridizing backward and forward perturbation methods is introduced, which exhibits better chaotic features than other existing chaotic systems such as a large chaotic range, higher sensitivity, and randomness. Based on this, a new image encryption algorithm is proposed, employing a novel permutation operation and two substitution operations to achieve superior encryption speed and efficiency. The novel permutation operation based on a chaotic data sequence utilizes all chaotic states to generate 8-bit numbers. Each index of the resulting 8-bit number is compiled into one block. The plain image is then scanned in accordance with the randomized indices of each block. The two substitution operations involve an XORing operation for each pixel and a hashing process for each block. The newly proposed encryption algorithm can effectively encrypt images of varying sizes and types, transforming them into indecipherable cipher images that successfully pass through rigorous security tests, including differential attack analysis with a score of 28/28 and local Shannon entropy with a score of 25/28. The experimental findings showcase the superior performance of the proposed cipher over existing chaotic image ciphers, creating a cipher image that resembles noise and has the ability to resist a diverse range of cyber-attacks.

Analysis of vulnerabilities and security problems of web applications

The article provides a comprehensive analysis of vulnerabilities, methods, tools and problems faced by web application security testing. The analysis of scientific research in the field of web application security testing revealed a significant interest of scientists in finding effective ways to minimize site security risks and vulnerabilities. It was found out that the list of the most common web application vulnerabilities includes: broken access control, cryptographic failures, misconfiguration of security, SQL and other injections, insecure design, identification and authentication errors, etc. Specific features of the security vulnerabilities of web applications are highlighted. The problems faced by automated tools for web security testing are separately considered, namely the development of automated tools for web security testing, the use of RIA (Rich Internet Application) web applications, and the use of insecure cryptographic storage. Web application security risks can be associated with the design phase, the development phase, the deployment phase, and the maintenance phase. It is security testing that is used to identify these risks of the web application, to investigate the vulnerabilities and weak points of the web application. The conducted analysis of security vulnerabilities, methods and problems of testing web applications revealed the presence of different approaches to protect software products. A combination of manual and automated web application security testing techniques is advisable, starting with automated security testing and complementing it with manual penetration testing. A comprehensive approach should integrate testing into all stages of the software development life cycle. Such approach helps to use the most appropriate and effective available methods for the current phase of software product development.

A Lightweight Cryptographic Algorithm Based on DNA Computing for IoT Devices

Internet of Things (IoT) applications are used in almost every part of our life, so it is important to protect the sensitive data and information that is transmitted over wireless networks such as images and documents. The IoT devices have limited computational resources; they are called limited devices due to their limited processors and memory size. Traditional encryption methods require a lot of computing power; therefore, it is difficult to implement traditional cryptographic algorithm on IoT processor. Finally, a new, lightweight encryption method based on the DNA sequence is proposed to suit the IoT devices in a way to make an easy and secure the communications among the IoT devices. DNA sequences are very random, so we have used it to make a strong secret key that is hard for attackers to break. The proposed method has an advantage in terms of efficiency and strength. Experiments and security tests show that the proposed encryption system not only has a good encryption effect and can withstand known attacks, but it is also fast enough for real-world use. The DNA key is used to encrypt files using two simple and reliable methods such as substitution and transposition procedures that meet IoT computational requirements. In addition, when compared with other encryption algorithms, the experimental results shows that the key size, encryption time, and distortion preparation are all superior.

The role of metrology in the cyber-security of embedded devices

The cyber-security of an embedded device is a crucial issue especially in the Internet of Things (IoT) paradigm, since the physical accessibility to the smart transducers eases an attacker to eavesdrop the exchanged messages. In this manuscript, the role of metrology in improving the characterization and security testing of embedded devices is discussed in terms of vulnerability testing and robustness evaluation. The presented methods ensure an accurate assessment of the device’s security by relying on statistical analysis and design of experiments. A particular focus is given on power analysis by means of a scatter attack. In this context, the metrological approach contributes to guaranteeing the confidentiality and integrity of the data exchanged by IoT transducers.

Vulnerability Detection Using Two-Stage Deep Learning Models

Application security is an essential part of developing modern software, as lots of attacks depend on vulnerabilities in software. The number of attacks is increasing globally due to technological advancements. Companies must include security in every stage of developing, testing, and deploying their software in order to prevent data breaches. There are several methods to detect software vulnerability Non-AI-based such as Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST). However, these approaches have substantial false-positive and false-negative rates. On the other side, researchers have been interested in developing an AI-based vulnerability detection system employing deep learning models like BERT, BLSTM, etc. In this paper, we proposed a two-stage solution, two deep learning models were proposed for vulnerability detection in C/C++ source codes, the first stage is CNN which detects if the source code contains any vulnerability (binary classification model) and the second stage is CNN-LTSM that classifies this vulnerability into a class of 50 different types of vulnerabilities (multiclass classification model). Experiments were done on SySeVR dataset. Results show an accuracy of 99% for the first and 98% for the second stage.

Security Aspect in Software Testing Perspective: A Systematic Literature Review

Background: Software testing and software security have become one of the most important parts of an application. Many studies have explored each of these topics but there is a gap wherein the relation of software security and software testing in general has not been explored. Objective: This study aims to conduct a systematic literature review to capture the current state-of-the-art in software testing related to security. Methods: The search strategy obtains relevant papers from IEEE Xplore and ScienceDirect. The results of the search are filtered by applying inclusion and exclusion criteria. Results: The search results identified 50 papers. After applying the inclusion/exclusion criteria, we identified 15 primary studies that discuss software security and software testing. We found approaches, aspects, references, and domains that are used in software security and software testing. Conclusion: We found certain approach, aspect, references, and domain are used more often in software security testing Keywords: Software security, Software testing, Security testing approach, Security threats, Systematic literature review

Endophytic, extremophilic and entomophilic fungi strains biodegrade anthracene showing potential for bioremediation.

Anthropogenic activities have been increasing Polycyclic Aromatic Hydrocarbons (PAHs) release, promoting an urgent need for decontamination methods. Therefore, anthracene biodegradation by endophytic, extremophilic, and entomophilic fungi was studied. Moreover, asalting-out extraction methodology with the renewable solvent ethanol and the innocuous salt K2HPO4was employed. Nine of the ten employed strains biodegraded anthracene in liquid medium (19-56% biodegradation) after 14days at 30°C, 130rpm, and 100 mg L-1. The most efficient strain Didymellaceae sp. LaBioMMi 155, an entomophilicstrain, was employed for optimized biodegradation, aiming at a better understanding of how factors like pollutant initial concentration, pH, and temperature affected this process. Biodegradation reached 90 ± 11% at 22°C, pH 9.0, and 50 mg L-1. Futhermore, 8 different PAHs were biodegraded and metabolites were identified. Then, experiments with anthracene in soil ex situ were performed and bioaugmentation with Didymellaceae sp. LaBioMMi 155 presented better results than natural attenuation by the native microbiome and biostimulation by the addition of liquid nutrient medium into soil. Therefore, an expanded knowledge about PAHs biodegradation processes was achieved with emphasis to the action of Didymellaceae sp. LaBioMMi 155, which can be further employed for in situ biodegradation (after strain security test), or for enzyme identification and isolation aiming at oxygenases with optimal activity under alkaline conditions.

Evaluating Performance of Circular Staplers Using Comparative Test Methods for Evidence-Based Surgery.

Circular stapler anastomosis is a common surgical procedure. Despite technological advancements, anastomotic leak remains a postoperative concern. Assessment of new technologies is impeded by variations in test methods and analysis, precluding outcome reproducibility and direct comparisons of results across studies. The development of robust and reproducible preclinical test methods is critical to accelerating stapling technology advancements. Leak pressure, staple line perfusion and security, and device removal force were quantified for triple-row (Tri-staple EEA, TriEEA) and double-row staplers (Echelon Circular Powered, ECP). Leak and perfusion testing were performed in vivo. Device removal force and staple line security testing were performed with synthetic medium using an Instron. Data were analyzed using unpaired student's t-test or Kruskal-Wallis test, with statistical significance defined as P < .05. Leak pressure was 73% higher in TriEEA vs ECP (P = .016). TriEEA staple line failure force was lower than ECP at 40 and 50mmHg (P = .001 and P = .023, respectively). Perfusion to the staple line was higher (148%) for TriEEA than for ECP (P = .003) and the force required to remove the device from its stapled anastomosis was 78% lower for TriEEA than for ECP (P < .001). This report addresses a primary limitation in stapling research by presenting novel methodologies which enhance clinical relevance and provide sufficient detail for reproduction by independent investigators. These methods are applied to a comparison between triple-row and double-row staplers to demonstrate utility of new test methods in assessing key technology design features.

An Analysis of Adversary-Centric Security Testing within Information and Operational Technology Environments

Assurance techniques such as adversary-centric security testing are an essential part of the risk assessment process for improving risk mitigation and response capabilities against cyber attacks. While the use of these techniques, including vulnerability assessments, penetration tests, and red team engagements, is well established within Information Technology (IT) environments, there are challenges to conducting these within Operational Technology (OT) environments, often due to the critical nature of the OT system. In this article, we provide an analysis of the technical differences between IT and OT from an asset management perspective. This analysis provides a base for identifying how these differences affect the phases of adversary-centric security tests within industrial environments. We then evaluate these findings by using adversary-centric security testing techniques on an industrial control system testbed. Results from this work demonstrate that while legacy OT is highly susceptible to disruption during adversary-centric security testing, modern OT that uses better hardware and more optimised software is significantly more resilient to tools and techniques used for security testing. Clear requirements can, therefore, be identified for ensuring appropriate adversary-centric security testing within OT environments by quantifying the risks that the tools and techniques used during such engagements present to the operational process.

Dissecting American Fuzzy Lop: A FuzzBench Evaluation

AFL is one of the most used and extended fuzzers, adopted by industry and academic researchers alike. Although the community agrees on AFL’s effectiveness at discovering new vulnerabilities and its outstanding usability, many of its internal design choices remain untested to date. Security practitioners often clone the project “as-is” and use it as a starting point to develop new techniques, usually taking everything under the hood for granted. Instead, we believe that a careful analysis of the different parameters could help modern fuzzers improve their performance and explain how each choice can affect the outcome of security testing, either negatively or positively. The goal of this work is to provide a comprehensive understanding of the internal mechanisms of AFL by performing experiments and by comparing different metrics used to evaluate fuzzers. This can help to show the effectiveness of some techniques and to clarify which aspects are instead outdated. To perform our study, we performed nine unique experiments that we carried out on the popular Fuzzbench platform. Each test focuses on a different aspect of AFL, ranging from its mutation approach to the feedback encoding scheme and its scheduling methodologies. Our findings show that each design choice affects different factors of AFL. Some of these are positively correlated with the number of detected bugs or the coverage of the target application, whereas other features are related to usability and reliability. Most important, we believe that the outcome of our experiments indicates which parts of AFL we should preserve in the design of modern fuzzers.

Seamless Security on Mobile Devices Textual Password Quantification Model Based Usability Evaluation of Secure Rotary Entry Pad Authentication

Mobile devices are vulnerable to shoulder surfing and smudge attacks, which should occur when a user enters a PIN for authentication purposes. This attack can be avoided by implementing a rotary entry pad mechanism. Despite this, several studies have found that using a rotary entry pad reduces user usability. This study uses a Design Research Methodology approach. It will implement a rotary entry pad authentication in the Android operating system as an authentication method to protect the device against Shoulder Surfing Attacks and Smudge Attacks. Furthermore, it combined JSON Web Token (JWT) to secure the authentication process from the client to the server. At the end of implementation, it compared with other studies in terms of usability and evaluated it using the TQ-Model, which showed that the usability aspect has improved. Regarding security, we conducted a shoulder surfing attack simulation to assess the efficacy of guessing PINs. The results showed that only a limited number of attempts were successful, with two out of five samples failing to guess any numbers and only one sample successfully guessing six 10-digit PIN combinations out of 10 to the power of 10. The security test results show that shoulder surfing attacks are more difficult to perform after implementing the rotary entry pad. The evaluation showed that the JSpinpad performed better, with seven parameters showing improvement, one parameter showing a decline, and ten parameters remaining unchanged.

Business-layer client-side racer: dynamic security testing of the web application against client-side race condition in the business layer

Business-layer client-side racer: dynamic security testing of the web application against client-side race condition in the business layer

Multi-semantic feature fusion attention network for binary code similarity detection

Binary code similarity detection (BCSD) plays a big role in the process of binary application security test. It can be applied in several fields, such as software plagiarism detection, malware analysis, vulnerability detection. Most research is based on recurrent neural networks, which is difficult to get the overall or long-distance semantic information of functions. Besides, exiting works simply extract high-level semantic features, lacking in-depth investigations on the potential mechanisms for fusing low-level and high-level semantic features. In this paper we propose a multi-semantic feature fusion attention network (MFFA-Net) for BCSD. MFFA-Net contains two critical modules: semantic feature fusion (SFF) and attention feature fusion (AFF). The SFF module concatenates multiple semantic features to represent the semantics of the function, which helps to obtain the overall semantic information of the function. The AFF module is designed to find useful information from various features, which assigns an attention matrix to research the relationship between features. In order to evaluate the proposed method, we made extensive experiments on two datasets. MFFA-Net can achieve a high degree of AUC at 99.6% and 98.3% respectively on the two datasets. The experimental results show that MFFA-Net has better performance for BCSD.

Evolving Tangent Hyperbolic memristor based 6D chaotic model with fractional order derivative: Analysis and applications

The nonlinear dynamics of fractional order systems and memristor based circuits have attracted an escalating attention in recent years. This paper reports on a novel six dimensional nonlinear dynamical system with a tangent hyperbolic memristor circuit and amalgamated image encryption. The dynamical system is analyzed using standard tools, including phase portraits, equilibrium points, Eigenvalues, Routh–Hurwitz stability criterion, Lyapunov exponents and bifurcation diagrams. The analysis suggests that the developed system is chaotic in nature and has exciting new 2D and 3D trajectories that have not been reported before. The chaotic system is numerically solved for different values of the fractional order q, and the results of equilibrium points and Lyapunov exponents are mentioned in tables. Fractional order circuits are designed for q=1 and q=0.99 utilizing the approximation fractional order technique of the transfer function. The developed circuit is generalized in a way that the circuit can work for both the integer and non-integer fractional order values by just introducing the fractional block to make it work for q=0.99, and removing it with a conventional integrator capacitor to work for q=1. The circuit simulation and numerical results were compared, and signifying that they were both in good agreement with each other. Lastly, the random number generated from the chaotic system is utilized to scramble the image via the scheme of Amalgamated Image Encryption. The scrambled image was tested using different image security test algorithms to support the idea that the chaotic system and image can together form an advantageous key.

Security Test of Active Directory Domain Services

Security Test of Active Directory Domain Services