Security Testing Research Articles

An efficient security testing mechanism for Android Apps based on malware analysis and optimized XGBoost

An efficient security testing mechanism for Android Apps based on malware analysis and optimized XGBoost

Retracted: Software Security Testing through Coverage in Deep Neural Networks

Retracted: Software Security Testing through Coverage in Deep Neural Networks

Research on dimension reduction for visualization of simplified security region of integrated energy system considering renewable energy access

This paper proposes the research on dimension reduction for visualization of simplified security region of integrated energy system considering renewable energy access. Reason: Integrated energy system is conducive to achieving low-carbon transition and efficient utilization of energy. As the penetration of renewable energy increases, the security of integrated energy system faces severe challenges. It holds significance for comprehensively studying N-1 security test method in the operation scenario of integrated energy system, the impact of renewable energy on the IES security region model, and the optimal selection for observation variables. Methods: Firstly, a model for interval security region of integrated energy system is constructed, according to the N-1 safety constraints of energy hub key equipment and pipeline. The imbalance between energy demand and supply caused by the renewable energy uncertainty is defined as a special N-1 fault. Then, an engineering simplification approach for interval security region model is proposed, in order to quantify the security boundary, security distance, and interval total supply capability. On the basis, a dimension reduction observation method based on observation variable optimization is proposed, the selection of observation variables help to expand the volume of area unaffected by renewable energy uncertainty. Results: To the existed problem in current research, an example is presented to verify the effectiveness of proposed method, which brings forward N-1 security test method in the operation scenario of integrated energy system, analyzes the impact of renewable energy on the security region model, and realizes the optimal selection for observation variables of simplified security region. Conclusions: Interval security region of integrated energy system can intuitively estimate the security status of operating points and observe the security boundaries. The simplified model can satisfy the needs of calculating precision. Optimal selection of observation variables is necessary, and the volume of area unaffected by renewable energy uncertainty can be effectively increased.

Методологические подходы к обеспечению безопасности программных продуктов

Testing is considered as a separate and independent life cycle stage of any secure software development. However, the testing is present at another stages, such as development stage or the technical support stage after software release. This paper describes the domestic and foreign experience in security testing which is considered both at specific life cycle stage of secure software development and as a whole. Each method has its own benefits and drawbacks. The experience of researchers will be useful in own methodology for software security testing.

Exploiting Substitution Box for Cryptanalyzing Image Encryption Schemes With DNA Coding and Nonlinear Dynamics

In recent years, a number of image encryption schemes based on DNA coding and nonlinear dynamics have been proposed. Generally, these DNA-based schemes first encode plaintext images into DNA sequences and then encrypt them with pseudorandom elements produced by chaotic systems or other nonlinear dynamics. Although ciphertexts can pass some security tests, many image encryption schemes are being shown to have intrinsic flaws and that they cannot guarantee a high level of security. In this paper, we cryptanalyze a family of image encryption schemes for which the encryption kernel is DNA coding or its variant. The complex DNA operation can be simplified as a substitution box (S-box). The whole cryptosystem's security level is thus significantly decreased and is vulnerable to the chosen-plaintext attack. Applications of this concept to break five ciphers are theoretically presented and experimentally verified. In addition, some suggestions for resisting similar attacks are also given in this paper.

Comprehensive Empirical Study of Python JWT Libraries

JSON Web Token (JWT) is a simple, compact way to share claims in a space-constrained environment. JWT is part of the interoperable JSON-based identity suite. Many libraries that provide JWT-based authentication and authorization exist. While the JWT standard is secure, some implementations still need to be made. This research paper delves into a comprehensive analysis of the prominent Python libraries utilized for JWT authentication. By meticulously examining these libraries, we aim to provide an in-depth understanding of their features and capabilities. Our investigation encompasses an enumeration of the distinct signing algorithms that are supported by each of these JWT Python libraries.To ensure the robustness and security of these libraries, we employ a multifaceted approach that utilizes various statistical application Security Testing (SAST) tools. These tools play a pivotal role in our assessment by not only evaluating the adherence of the codebase to the PEP8 standard but also by meticulously scanning for common security vulnerabilities and bugs that could potentially compromise the integrity of the authentication process.Our research goes beyond mere identification; we meticulously analyze each warning generated by the SAST tools, emphasizing those warnings that hold the most tremendous significance regarding potential security risks. Furthermore, our investigation extends to gauging the popularity and adoption of each library. To achieve this, we leverage GitHub statistics and harness the power of the Sourcegraph code search utility. By delving into these metrics, we gain a comprehensive view of the community’s engagement, usage trends, and overall traction of each library. In summary, this paper thoroughly explores the landscape of JWT authentication in Python, encompassing library evaluation, security assessment, warning analysis, and popularity metrics.

Enhanced security in federated learning by integrating homomorphic encryption for privacy-protected, collaborative model training

A significant novel approach in distributed ML, Federated Learning (FL), enables multiple parties to work simultaneously on developing models while securing the confidentiality of their unique datasets. There are issues regarding privacy with FL, particularly for models that are being trained, because private information can be accessed from shared gradients or updates to the model. This investigation proposes SecureHE-Fed, a novel system that improves FL’s defense against attacks on privacy through the use of Homomorphic Encryption (HE) and Zero-Knowledge Proofs (ZKP). Before data from clients becomes involved in the learning procedure, SecureHE-Fed encrypts it. The following lets us determine encrypted messages without revealing the data as it is. As an additional security test, ZKP is employed to verify if modifications to models are valid without sharing the true nature of the information. By evaluating SecureHE-Fed with different FL techniques, researchers demonstrate that it enhances confidentiality while maintaining the precision of the model. The results of this work obtained validate SecureHE-Fed as a secure and scalable FL approach, and we recommend its use in applications where user confidentiality is essential.

Enhancing Home Security with IoT Devices: A Vulnerability Analysis Using the IoT Security Test

In order to carefully evaluate the susceptibility of common IoT devices found in smart homes, this research made use of the IoT Security Test framework. The findings showed a significant average drop in vulnerability ratings of 45% after evaluation, clearly indicating that improving IoT device security is feasible. The research classifies vulnerabilities found, highlighting the prevalence of Firmware Problems, Weak Passwords, and Network Vulnerabilities. Moreover, it examines the efficacy of remedial initiatives. These discoveries play a crucial role in enhancing the security of Internet of Things devices, providing a strong barrier for the protection of homeowners and the privacy of their data, especially in the constantly linked world of smart homes.

Design A Novel Image Encryption Algorithm Based on A PRNG with High Performance

This paper proposes a novel two-dimensional logistic map (2D-LM). Relative to the classical 2D logistic modulation map (2D-LMM), it has larger chaotic range and better chaos performance. In comparison with some 2D chaos maps, the proposed new 2D-LM also has unique advantages in the complexity of sequence. To further study its application, the novel image encryption algorithm is designed based on the proposed 2D-LM. The security tests show the higher anti-decryption ability of the design algorithm. Finally, we develop a FPGA test platform to realize the Pseudo-Random Number Generator (PRNG) based on the proposed 2D-LM. The experiment results show the feasibility of its industrial applications.

Using NFTs for Product Management, Digital Certification, Trading, and Delivery in the Healthcare Supply Chain

The COVID-19 pandemic caused disruption in the healthcare market, which resulted in shortages of essential healthcare products. The pandemic exacerbated the problems that already existed in the healthcare supply chain, such as poor data availability, transparency, and accessibility. Such problems necessitate the introduction of a solution that is capable of managing products, maintaining ownership, facilitating trading, and delivering products in a traceable, auditable, and trustworthy manner. In this article, we propose a nonfungible-token-based solution for the management of healthcare products, where the ownership of a product is maintained by using digital certification, the trade and delivery of healthcare products is facilitated by a smart contract, and disputes are settled by an arbitrator while keeping all related information on-chain for auditing purposes. We utilize the Interplanetary File System to store the metadata of healthcare products to avoid storing large-sized data on the blockchain. We present system diagrams and algorithms along with the implementation details. We conduct security testing to demonstrate that our solution is resilient and secure against common vulnerabilities and exploits. We compare our solution with the existing solutions to show its distinctive features and novelty. The smart contracts code is made publicly available on GitHub.

AIM: Automated Input Set Minimization for Metamorphic Security Testing

AIM: Automated Input Set Minimization for Metamorphic Security Testing

Automated Web Security Testing Guide Mapping to Accelerate Process on Penetration Testing

Usage of website is increasing due to its ease of access. An increase in website users should be accompanied by an increase in website security to prevent unwanted things, such as data breach. Penetration testing is used to reduce risk due to security factors. OWASP has Web Security Testing Guide (WSTG) with 12 test types. Not all tests can be tested, but there are patterns that can be used as a reference whether the test is possible or not. This pattern can be used to automate test mapping for each endpoint. Thus, penetration tester does not need to do it manually.

Optimizing Semantic Segmentation for Enhanced Football Analytics: A Pixel-level Approach

Semantic Segmentation, a pivotal technique in image analysis, is adeptly leveraged in this research to bolster sports analytics, with a concentrated focus on football. A comprehensive pipeline is unveiled for an in-depth analysis of a select portion of the IAUFD 100k dataset, encompassing 2030 manually annotated football images. The methodology entails a thorough evaluation and comparison of diverse semantic segmentation models, supplemented by the integration of advanced pre-processing strategies and optimal training techniques. Such a holistic approach culminates in a marked enhancement in model performance, as evidenced by a significant uptick in the mean Intersection over Union (mIoU). This research offers granular, object-oriented insights that substantially augment player tracking, action recognition, and event detection in football. The conclusive remarks of the study highlight prospective avenues for further research, emphasizing the potential incorporation of Explainable AI and advanced Metamorphic and Security Testing to fortify sports analytics.

THE EFFECT OF FOOD ACQUISITION OUTSIDE EXPENDITURES ON THE FOOD SECURITY OF CASSAVA (Manihot utilissima) FARMER HOUSE- HOLDS IN WONOGIRI REGENCY

As the standard of living increases, the orientation of food consumption shifts from fulfilling intake to fulfilling nutrition. The acquisition of sustenance by means other than farming and government aid can enhance nutritional satisfaction, increasing energy consumption as a measure of food security. This study aimed to assess the impact of food acquisition outside expenditure on the food security of cassava farmer households in Wonogiri Regency. The research was conducted in July 2022. The method of analysis was descriptive quantitative with purposive location determination. A representative sample of 80 households was chosen by applying the proportionate allocation formula. Data were collected using 2 x 24-hour Food Recall. The data analysis in this study focused on three key variables: income, the proportion of food spending, and the Wilcoxon test of energy consumption and food security among farmer households. These variables were examined before and after food acquisition from external sources. The results showed that the average monthly income of farmers was Rp4,985,487.00. The proportion of food expenditure amounted to 33.36 percent. Wilcoxon test showed a significant difference in energy consumption before and after food acquisition outside expenditure. The food security classification of cassava farmer households before the acquisition of food outside expenditure showed that 21.25 percent were classified as food secure, 15 percent were classified as food susceptible, 52.5 percent as food insecure, and 11.25 percent as severely food insecure. After the additional food outside expenditure, the food security classification increased, with 45 percent classified as food secure, 23.75 percent as food susceptible, 25 percent as food insecure, and 6.25 percent as severely food insecure. This finding demonstrates that food utilization from farming and the Non-Cash Food Assistance (Bantuan et al./BPNT) program positively impacts the food security conditions of cassava farmer households in Wonogiri Regency.

Securing Smart Agriculture: Proposed Hybrid Meta-Model and Certificate-based Cyber Security Approaches

The Internet of Things is a decentralized network of physically connected devices that communicate with other systems and devices over the internet. As the number of IoT-based devices continues to grow at an exponential rate, this technology has the potential to improve nearly every aspect of daily life, from smart networks and transportation to home automation and agriculture. However, the absence of adequate security measures on all levels of the IoT poses a significant security risk, with the potential for cyber-attacks and data theft. While scholars have suggested various security measures, there are still gaps that need to be addressed. In this study, we analyzed previous research and proposed metamodels for security, IoT, and machine learning. We then proposed a new IoT-based smart agriculture model with integrated security measures to mitigate cyber- attacks and increase agricultural output. Our model takes into account the unique features of the smart farming domain and offers a framework for securing IoT devices in this specific application area. Moreover, in order to mitigate a range of cyber security attacks across various layers of IoT, we introduced two certificate-based schemes named CBHA and SCKA for smart agriculture. A comparative analysis of their security with existing literature demonstrates their superior robustness against diverse attacks. Additionally, security testing utilizing scyther affirms the resilience and security of both CBHA and SCKA, establishing them as viable options for ensuring security in smart agriculture

Comprehensive Exploration of Web Application Security Testing with Burp Suite Tools

This research paper investigates the pivotal role of Burp Suite tools in web application security testing, aligned with the foundational principles of secure coding practices outlined by the Open Web Application Security Project (OWASP). The paper provides an in-depth overview of Burp Suite tools, emphasizing their features and the significance of web application vulnerability scanning in enforcing robust security practices. The exploration includes a detailed examination of Burp Repeater and Burp Intruder, with a practical demonstration of a Burp Suite cluster bomb attack. This research contributes to advancing the understanding and application of Burp Suite tools for effective web application security testing within the framework of OWASP secure coding practices.

User Acceptance Testing through Blackbox Evaluation for Corn Distribution Information System

Corn Distribution Information System in Bandar Lampung has witnessed a significant surge in interest, highlighting the importance of ensuring system reliability and functionality. This research endeavors to investigate and enhance these aspects through the application of the black box testing approach, focusing on the user-centric perspective of User Acceptance Testing (UAT). Black box testing, a methodology emphasizing system functionality without delving into internal structures, is complemented by UAT to provide comprehensive evaluation. In executing 27 study cases to evaluate the system, 22 patients demonstrated proper functionality, while 5 issues were identified. Notably, 4 issues pertained to the unavailability of the export function to CSV, and 1 patient encountered difficulties with road letter generation facilities. The discussion elucidates that UAT through Black Box proves to be a valuable approach, effectively bridging the methodological gap of traditional black box and providing insightful input from end users. Furthermore, this methodology successfully identified 5 focal points that can serve as development suggestions for the company's system, previously undiscovered. In conclusion, the study underscores the efficiency of integrating UAT with black box in enhancing Corn Distribution Information System's dependability and functionality. Identified issues shed light on areas for improvement, emphasizing the need for ongoing research in system testing methodologies. Future studies are recommended to explore the integration of UAT with white box testing, iterative testing for bug identification, and comprehensive security testing within the system network. This approach ensures a holistic evaluation, addressing potential limitations and contributing to the continuous refinement of the information system.

Development of computer application system and database testing based on data encryption technology

Abstract In this paper, we use the MapReduce programming framework for the development of a computer application system and design the vision module, control module and transaction module of the system based on MVC architecture. Focusing on the encryption design of the database, the data stored in the database is chunked through the Map function, and all the chunking results are aggregated based on the Reduce function, and synchronized encryption of the database is combined with the Paillier homomorphic encryption algorithm. On this basis, the system environment is configured, and the application system developed in this paper is tested, focusing on exploring the stability of the database. The test results show that the decryption output time is 21s when the Paillier encryption algorithm is 200, and the first set of database peak is 76% of the server load, which is within the tolerable range. Security test on the database: the results show that the probability of an attack on all ports with a database security factor less than 6 is around 0.3. There is no significant difference, and the database test is good.

ICVTest: A Practical Black-Box Penetration Testing Framework for Evaluating Cybersecurity of Intelligent Connected Vehicles

Intelligent connected vehicles (ICVs) are equipped with extensive electronic control units which offer convenience but also pose significant cybersecurity risks. Penetration testing, recommended in ISO/SAE 21434 “Road vehicles—Cybersecurity engineering”, is an effective approach to identify cybersecurity vulnerabilities in ICVs. However, there is limited research on vehicle penetration testing from a black-box perspective due to the complex architecture of ICVs. Additionally, no penetration testing framework has been proposed to guide security testers on conducting penetration testing for the whole vehicle. The lack of framework guidance results in the inexperienced security testers being uncertain about the processes to follow for conducting penetration testing. Moreover, the inexperienced security testers are unsure about which tests to perform in order to systematically evaluate the vehicle’s cybersecurity. To enhance the penetration testing efficiency of ICVs, this paper presents a black-box penetration testing framework, ICVTest. ICVTest proposes a standardized penetration testing process to facilitate step-by-step completion of the penetration testing, thereby addressing the issue of inexperienced testers lacking guidance on how to initiate work when confronted with ICV. Also, ICVTest includes 10 sets of test cases covering hardware and software security tests. Testers can select appropriate test cases based on the specific cybersecurity threats faced by the target object, thereby reducing the complexity of penetration testing tasks. Furthermore, we have developed a vehicle cybersecurity testing platform for ICVTest that seamlessly integrates various testing tools. The platform enables even novice testers to conduct vehicle black-box penetration testing in accordance with the given guidance which addresses the current industry’s challenge of an overwhelming number of testing tasks coupled with a shortage of skilled professionals. For the first time, we propose a comprehensive black-box penetration testing framework and implement the framework in the form of a cybersecurity testing platform. We apply ICVTest to evaluate an electric vehicle manufactured in 2021 for assessing the framework’s availability. With the aid of ICVTest, even testers with limited experience in automotive penetration can effectively evaluate the security risks of ICVs. In our experiments, numerous cybersecurity vulnerabilities were identified involving in-vehicle sensors, remote vehicle control systems, and in-vehicle controller area network (CAN) bus.

Smart-Contract-Based Agricultural Service Platform for Drone Plant Protection Operation Optimization

The platform-based agricultural service is receiving popularity in small-scale farming and shows significant advantages in gathering dispersed service requests and matching supply and demand. However, it also generates new challenges including service traceability, denial and fraud, information security and privacy issues. Blockchain is an emerging technology that provides a secure and trusted environment to track and manage the service process. In this study, we propose a blockchain-based service platform for efficient agricultural service operations with the support of Internet of Things technology. Following the smart platform, we use the drone plant protection service as an example and develop a new execution procedure for smart contract-based agricultural services. In the proposed procedure, we focus on integrating optimization methods to deal with multiple service requests as well as potential disruption events and establishing detailed interactions among service plans, smart contracts, and physical services. Moreover, we formulate the drone plant protection issue using a mixedinteger linear programming model to obtain the optimal service plan and develop a recovery model to deal with potential disruptions of new order arrival. Finally, we design detailed smart contract terms for drone plant protection services. Results of numerical experiments demonstrate the effectiveness of the developed optimization model in obtaining the optimal service plan before and after disruptions. Also, we verify the applicability and security of the smart contract on the Ethereum platform based on a three-phase functional test and a comprehensive security test.