Software Security Vulnerabilities Research Articles

Evaluation and Assessment of Software Security Risks and Vulnerabilities Within the Realm of Secure DevOps.

Security plays a vital role in successful software development and consistency, especially in a modern, fast-expanding world dominated by technologies. It guarantees that all privacy, integrity, and accessibility of information, coding, and services are protected. Achieving such requires a consistent consideration of security throughout all developmental stages of software. Although several methods for improving the quality of software have been created, there is still no clear method for effectively integrating security throughout each stage of the software developmental process. The inability to give adequate attention to security has been identified as the main cause of common flaws. Many forward-thinking businesses frequently employ a "patch and infiltrate” technique, taking security into consideration only after the execution of the task. Higher costs, project delays, neglect of verification and integration during the development life cycle of the project, reliance on external tools and parts, and ignorance among all factors contribute to the disregard of security during the SDLC. Nevertheless, Secure-DevOps is indispensable for the survival of companies in the Information and Communication Technology (ICT) landscape. Consequently, applying an effective approach that deals with security within every level of the SDLC is crucial. To bridge this gap, a comprehensive examination of effective techniques for developing secure software was presented, taking into account the financial and time constraints of a project. A framework for ensuring security built upon Secure-DevOps practices, which seamlessly integrates the best security measures into different stages of the SDLC, was identified. To validate this framework, a mathematical model has been employed. The study concludes that effectively incorporating Secure-DevOps practices throughout the Software developmental process, minimizes security risks and vulnerabilities.

FuSeBMC v4: Improving Code Coverage with Smart Seeds via BMC, Fuzzing and Static Analysis

Bounded model checking (BMC) and fuzzing techniques are among the most effective methods for detecting errors and security vulnerabilities in software. However, there are still shortcomings in detecting these errors due to the inability of existing methods to cover large areas in target code. We propose FuSeBMC v4, a test generator that synthesizes seeds with useful properties, that we refer to as smart seeds , to improve the performance of its hybrid fuzzer thereby achieving high C program coverage. FuSeBMC works by first analyzing and incrementally injecting goal labels into the given C program to guide BMC and Evolutionary Fuzzing engines. After that, the engines are employed for an initial period to produce the so–called smart seeds. Finally, the engines are run again, with these smart seeds as starting seeds, in an attempt to achieve maximum code coverage/find bugs. During seed generation and normal running, the Tracer subsystem aids coordination between the engines. This subsystem conducts additional coverage analysis and updates a shared memory with information on goals covered so far. Furthermore, the Tracer evaluates test-cases dynamically to convert cases into seeds for subsequent test fuzzing. Thus, the BMC engine can provide the seed that allows the fuzzing engine to bypass complex mathematical guards (e.g., input validation). As a result, we received three awards for participation in the fourth international competition in software testing (Test-Comp 2022), outperforming all state-of-the-art tools in every category, including the coverage category.

Multi-class vulnerability prediction using value flow and graph neural networks

In recent years, machine learning models have been increasingly used to detect security vulnerabilities in software, due to their ability to achieve high performance and lower false positive rates compared to traditional program analysis tools. However, these models often lack the capability to provide a clear explanation for why a program has been flagged as vulnerable, leaving developers with little reasoning to work with. We present a new method which not only identifies the presence of vulnerabilities in a program, but also the specific type of error, considering the whole program rather than just individual functions. Our approach utilizes graph neural networks that employ inter-procedural value flow graphs, and instruction embedding from the LLVM Intermediate Representation, to predict a class. By mapping these classes to the Common Weakness Enumeration list, we provide a clear indication of the security issue found, saving developers valuable time which would otherwise be spent analyzing a binary vulnerable/non-vulnerable label. To evaluate our method’s effectiveness, we used two datasets: one containing memory-related errors (out of bound array accesses), and the other a range of vulnerabilities from the Juliet Test Suite, including buffer and integer overflows, format strings, and invalid frees. Our model, implemented using PyTorch and the Gated Graph Sequence Neural Network from Torch-Geometric, achieved a precision of 96.35 and 91.59% on the two datasets, respectively. Compared to common static analysis tools, our method produced roughly half the number of false positives, while identifying approximately three times the number of vulnerable samples. Compared to recent machine learning systems, we achieve similar performance while offering the added benefit of differentiating between classes. Overall, our approach represents a meaningful improvement in software vulnerability detection, providing developers with valuable insights to better secure their code.

A Novel Seed Generation Approach for Vulnerability Mining Based on Generative Adversarial Networks and Attention Mechanisms

Coverage-guided fuzzing has been widely applied in software error and security vulnerability detection. The fuzzing technique based on AFL (American Fuzzy Loop) is a common coverage-guided fuzzing method. The code coverage during AFL fuzzing is highly dependent on the quality of the initial seeds. If the selected seeds’ quality is poor, the AFL may not be able to detect program paths in a targeted manner, resulting in wasted time and computational resources. To solve the problems that the seed selection strategy in traditional AFL fuzzing cannot quickly and effectively generate high-quality seed sets and the mutated test cases cannot reach deeper paths and trigger security vulnerabilities, this paper proposes an attention mechanism-based generative adversarial network (GAN) seed generation approach for vulnerability mining, which can learn the characteristics and distribution of high-quality test samples during the testing process and generate high-quality seeds for fuzzing. The proposed method improves the GAN by introducing fully connected neural networks to balance the competitive adversarial process between discriminators and generators and incorporating attention mechanisms, greatly improving the quality of generated seeds. Our experimental results show that the seeds generated by the proposed method have significant improvements in coverage, triggering unique crashes and other indicators and improving the efficiency of AFL fuzzing.

Exploitation and prevention of Python prototype chain pollution

As more and more enterprises and organizations migrate their business infrastructure to the internet, the significance of software security vulnerabilities becomes increasingly prominent. Python, as a flexible and efficient programming language, plays a crucial role in web application development. Consequently, research on its security is imperative. In recent years, researchers have explored Python prototype chain pollution vulnerabilities. This paper aims to further investigate the exploitation of prototype chain pollution in Python and provide an explanation of pollution prevention. The paper will introduce the working principles of the prototype chain, attack scenarios, and analyze the exploitation of prototype chain pollution in Python using experimental samples. Finally, the article will propose two possible defense measures to assist developers in better mitigating potential development risks and safeguarding cyberspace security.

Modeling the Process of Evaluation of Information Security Risks and its Methodology by the Application of Computer Systems

The main aim of the article is to study modeling the process of evaluation of information security risks by the application of computer systems. Thus, information security risk assessment and analysis of existing methods of information security risk assessment had been also studied in the article. The term "risk of information security" (IS) applies to the damage that can attack the information technology systems. IS risk is a wide range of potential threats, especially includes data violations, control measures, financial costs, reputation damage, etc. cover issues such as. IS risks include the failure of hardware and software, human errors, spams, viruses and harmful attacks, as well as natural disasters such as fires, cyclones or floods. Security risk assessment determines, assesses and implements key security controls in applications. It also focuses on prevention of software security defects and vulnerabilities. Information security risk is the potential probability of using vulnerabilities of an asset or group of assets as a specific threat to damage the organization.

CPL-Net: A Malware Detection Network Based on Parallel CNN and LSTM Feature Fusion

Malware is a significant threat to the field of cyber security. There is a wide variety of malware, which can be programmed to threaten computer security by exploiting various networks, operating systems, software and physical security vulnerabilities. So, detecting malware has become a significant part of maintaining network security. In this paper, data enhancement techniques are used in the data preprocessing stage, then a novel detection mode—CPL-Net employing malware texture image—is proposed. The model consists of a feature extraction component, a feature fusion component and a classification component, the core of which is based on the parallel fusion of spatio-temporal features by Convolutional Neural Networks (CNN) and Long Short-Term Memory networks (LSTM). Through experiments, it has been proven that CPL-Net can achieve an accuracy of 98.7% and an F1 score of 98.6% for malware. The model uses a novel feature fusion approach and achieves a comprehensive and precise malware detection.

Enhancing Security and Sustainability of e-Learning Software Systems: A Comprehensive Vulnerability Analysis and Recommendations for Stakeholders

The onset of the COVID-19 pandemic prompted educational institutions to swiftly integrate e-learning software systems, including learning management systems (LMSs), as essential tools for online education. This study aims to probe the inherent security vulnerabilities of three widely utilized e-learning platforms, namely, Moodle, Chamilo, and Ilias, spanning the pre-pandemic, pandemic, and post-pandemic periods. The rapid adoption of these platforms during the pandemic revolutionized online education but also unveiled security risks. This paper delves into these security vulnerabilities, offering insights before, during, and after the pandemic. Through an analysis of existing patches and security measures, areas for improvement are identified. Furthermore, the paper considers emerging cybersecurity technologies and trends, providing comprehensive recommendations to enhance system resilience against evolving cyber threats. The results obtained here can provide educational institutions with a guide for action to enable effective mitigation of e-learning software security vulnerabilities and ensure the continued security and sustainability of online education systems.

Hardware/software security co-verification and vulnerability detection: An information flow perspective

Security vulnerabilities provide attackers unauthorized access to critical resources and effective attack surfaces to compromise a system. Security verification is an emerging technique for detecting and locating such threats. However, existing security verification methods are typically restricted within the hardware or software boundary and incapable of meeting cross-layer verification requirements due to the differences in design semantics and the lack of a security model that fits both hardware and software. We attempt to address such a limitation from the perspective of information flow analysis and propose a hardware/software security co-verification method, which can check information flow security properties on fine-grained hardware information flow models. The proposed method can pinpoint security vulnerabilities by capturing information flow security property violations under clues of malicious information flows. Our information flow security model and properties are described using standard hardware design and verification languages, which allows our method to be seamlessly integrated with electronics design automation flows. Experimental results using RISC-V hardware/software designs show that the proposed method detects software, hardware and system-level security vulnerabilities, effectively.

Security Management on Arduino-Based Electronic Devices

Arduino has emerged as a very popular electronic board because of its low-cost, open hardware approach and flexibility with a huge potential for prototyping, small product runs, Internet of Things, makers or educational electronic projects, among others. However, there is a literature gap concerning wide analysis on different versions and types of Arduino boards, which include software, hardware and communication vulnerabilities analysis. This work analyzes the software, hardware and communication vulnerabilities that can be found in different versions of Arduino boards (entry level, enhanced features, Internet of Things-oriented, non-official and with Operating System). The results of the analysis show that, in most cases, Arduino boards present hardware and software limitations and security vulnerabilities, probably due to their low-cost requirement design. Some examples are: an easy-to-override firmware, lack of power protection or non-encrypted board communications in the case of Arduino Yun. Also Arduino does not check bad use of memory stack, so bad memory operations may end up easily on memory corruption and unexpected behavior. All these limitations and vulnerabilities may lead to security breaches on the deployed environment. Therefore, any security management policy must take these weaknesses into account.

Design and Development of Artificial Intelligence Knowledge Processing System for Optimizing Security of Software System

Software security vulnerabilities are significant for the software development industry. Exploration is conducted for software development industry landscape, software development eco-system landscape, and software system customer landscape. The focus is to explore the data sources that can provide the software development team with insights to act upon the security vulnerabilities proactively. Across these modules of software landscape, customer landscape, and industry landscape, data sources are leveraged using artificial intelligence approaches to identify the security insights. The focus is also on building a smart knowledge management system that integrates the information processed across modules into a central system. This central intelligence system can be further leveraged to manage software development activities proactively. In this exploration, machine learning and deep learning approaches are devised to model the data and learn from across the modules. Architecture for all the modules and their integration is also proposed. Work helps to envision a smart system for Artificial Intelligence-based knowledge management for managing software security vulnerabilities.

SSDTutor: A feedback-driven intelligent tutoring system for secure software development

Application Programming Interfaces (APIs) in cryptography typically impose concealed usage constraints. The violations of these usage constraints can lead to software crashes or security vulnerabilities. Several professional tools can detect these constraints (API misuses) in cryptography; however, in the educational programs, the focus has been less on helping students implement an application without cryptographic API misuses that are caused by either a lack of cryptographic knowledge or programming mistakes. To address the problem, we present an intelligent tutoring approach SSDTutor for educating Secure Software Development. Our tutoring approach helps students or developers repair cryptographic API misuse defects by leveraging an automated program repair technique based on the usage patterns of cryptographic APIs. We studied the best practices of cryptographic implementations and encoded eight cryptographic API usage patterns. For quality feedback, we leverage a clone detection technique to recommend related feedback for helping students understand why their programs are incorrect, rather than blindly accepting repairs. We evaluated SSDTutor on 456 open source subject projects implemented with cryptographic APIs. SSDTutor successfully detected 1,553 out of 1,573 misuse defects with 98.9% accuracy and repaired 1,551 out of 1,573 misuse defects with 99.3% accuracy. In a user study involving 22 students, the participants reported that interactive SSDTutor's feedback recommendation could be valuable for novice students to learn about the correct usages of cryptography APIs.

Trustworthiness models to categorize and prioritize code for security improvement

The exploitation of software security vulnerabilities can have severe consequences. Thus, it is crucial to devise new processes, techniques, and tools to support teams in the development of secure code from the early stages of the software development process, while potentially reducing costs and shortening the time to market. In this paper, we propose an approach that uses security evidences (e.g., software metrics, bad smells) to feed a set of trustworthiness models, which allow characterizing code from a security perspective. In practice, the goal is to identify the code units that are more prone to be vulnerable (i.e., are less trustworthy from a security perspective), thus helping developers to improve their code. A clustering-based approach is used to categorize the code units based on the combination of the scores provided by several trustworthiness models and taking into account the criticality of the code. To instantiate our proposal, we use a dataset of software metrics (e.g., CountLine, Cyclomatic Complexity, Coupling Between Objects) for files and functions of the Linux Kernel and Mozilla Firefox projects, and a set of machine learning algorithms (i.e., Random Forest, Decision Tree, SVM Linear, SVM Radial, and Xboost) to build the trustworthiness models. Results show that code that is more prone to be vulnerable can be effectively distinguished, thus demonstrating the applicability and usefulness of the proposed approach in diverse scenarios.

Bug, Fault, Error, or Weakness: Demystifying Software Security Vulnerabilities

In this work, we define the notions of software bug, weakness, and vulnerability in the context of cybersecurity and elucidate their causal relations.

Yazılım Güvenlik Açıklarının Evrişimsel Sinir Ağları (CNN) ile Sınıflandırılması

Kötü niyetli saldırılara karşı yazılım sisteminin doğru şekilde çalışmaya devam etmesini sağlayacak teknik uygulamalar yazılım güvenliği kapsamındadır. Yazılımda bulunan ve saldırıya uğrama riskine sebep olacak zayıflıklar ve kusurlar yazılım güvenlik açığı olarak tanımlanır. Yazılım güvenlik açıkları, bir yazılımın gizliliğini, bütünlüğünü, kullanılabilirliğini, erişilebilirliğini tehlikeye atarak ciddi zararlara sebep olabilir. Yazılım güvenlik açıkları erken aşamada tespit edilip, etkin şekilde yönetilirse sistemin saldırıya uğrama ve hasar görme riski azaltılabilir. Yazılım güvenlik açıklarını otomatik yönetmek için son yıllarda yapay zekâ tabanlı yöntemler kullanılmaya başlanmıştır. Bu çalışmada, güvenlik açıklarının kategorilerinin belirlenerek yönetilmesine fayda sağlamak için derin öğrenmeye dayalı otomatik sınıflandırma yöntemi önerilmiştir. Geliştirilen yöntem, derin sinir ağ modellerinden biri olan evrişimli sinir ağı (ESA) modeli üzerine inşa edilmiştir. Önerilen yöntemin başarımını test etmek için ABD Ulusal Güvenlik Açığı Veri tabanı (NVD) kullanılmıştır. Çalışmada kullanılan ESA modelinin yazılım güvenlik açıklarının otomatik sınıflandırılmasında etkili olduğu gözlemlenmiştir.

A flexible Compilation-as-a-Service and Remote-Programming-as-a-Service platform for IoT devices

The Internet-of-Things (IoT) presents itself as an emerging technology, which is able to interconnect a massive number of heterogeneous smart objects. Several complex data-driven applications, such as smart cities applications, home automation, health monitoring, etc., have been realized through the existence of these ubiquitous networks of smart objects. The ability to remotely update the devices forming an IoT network is of paramount importance, as it enables adding new functionality in their firmware, either for resolving software bugs and security vulnerabilities or for application re-purposing, without the need to physically access them. In this work, we present a flexible Compilation-as-a-Service and Remote-Programming-as-a-Service platform that jointly offers cloud-based compilation and Firmware-Over-The-Air (FOTA) update functionalities for deployed IoT devices, in a reliable and secure manner. Our system is capable of easily supporting various embedded operating systems and heterogeneous hardware platforms. We describe the system architecture and elaborate on the implementation details of all system components. In addition, we perform an extensive performance evaluation of a Proof-of-Concept (PoC) deployment of our system and discuss results in terms of system response, scalability and resource utilization.

Automatically Detect Software Security Vulnerabilities Based on Natural Language Processing Techniques and Machine Learning Algorithms

Nowadays, software vulnerabilities pose a serious problem, because cyber-attackers often find ways to attack a system by exploiting software vulnerabilities. Detecting software vulnerabilities can be done using two main methods: i) signature-based detection, i.e. methods based on a list of known security vulnerabilities as a basis for contrasting and comparing; ii) behavior analysis-based detection using classification algorithms, i.e., methods based on analyzing the software code. In order to improve the ability to accurately detect software security vulnerabilities, this study proposes a new approach based on a technique of analyzing and standardizing software code and the random forest (RF) classification algorithm. The novelty and advantages of our proposed method are that to determine abnormal behavior of functions in the software, instead of trying to define behaviors of functions, this study uses the Word2vec natural language processing model to normalize and extract features of functions. Finally, to detect security vulnerabilities in the functions, this study proposes to use a popular and effective supervised machine learning algorithm.

Proximal Instance Aggregator networks for explainable security vulnerability detection

Security vulnerabilities in software are the root cause of cyberattacks. Considering that these defects have huge associated costs, they should be proactively detected and resolved before shipping the software. Data-driven approaches like Artificial Intelligence (AI) are vastly explored for automatic vulnerability detection, given their potential to leverage large-scale vulnerability data feeds and learn from these scenarios. This work introduces a novel Proximal Instance Aggregator (PIA) neural network for accurately capturing insecure C code patterns from Abstract Syntax Tree (AST). It is built upon the concept of Multiple Instance Learning (MIL), which treats the AST representation of the code as a ‘bag’ of tree path ‘instances’. The security vulnerability can manifest in one or multiple such AST path instances. The PIA model dynamically learns a set of abstract concepts to describe the patterns associated with the AST paths. Specifically, the vulnerable nature of an AST path is characterized by its proximity to these concepts. The model also employs the attention mechanism to generate deep representations. By drawing cross-correlation of features between the path instances, the self-attention robustly weighs the relevance of each AST path towards vulnerability classification. The MIL utilizes these deep feature sets to construct the concept space. Thus, even without explicit supervision for localizing the line of defect, the AI automatically learns AST instance classification in a weakly supervised manner. Since AST-level prediction is formed as an aggregation of instance classifications, the AI is inherently explainable. The model outperforms state-of-the-art methods by a fair margin. It achieves 95.63% detection accuracy and 95.65% F1-score on the benchmarked NIST SARD, NVD datasets for a range of vulnerabilities.

Software security patch management - A systematic literature review of challenges, approaches, tools and practices

Software security patch management purports to support the process of patching known software security vulnerabilities. Patching security vulnerabilities in large and complex systems is a hugely challenging process that involves multiple stakeholders making several interdependent technological and socio-technical decisions. Given the increasing recognition of the importance of software security patch management, it is important and timely to systematically review and synthesise the relevant literature on this topic. This paper aims at systematically reviewing the state of the art of software security patch management to identify the socio-technical challenges in this regard, reported solutions (i.e., approaches, tools, and practices), the rigour of the evaluation and the industrial relevance of the reported solutions, and to identify the gaps for future research. We conducted a systematic literature review of 72 studies published from 2002 to March 2020, with extended coverage until September 2020 through forward snowballing. We identify 14 socio-technical challenges in software security patch management, 18 solution approaches, tools and practices mapped onto the software security patch management process. We provide a mapping between the solutions and challenges to enable a reader to obtain a holistic overview of the gap areas. The findings also reveal that only 20.8% of the reported solutions have been rigorously evaluated in industrial settings. Our results reveal that 50% of the common challenges have not been directly addressed in the solutions and that most of them (38.9%) address the challenges in one phase of the process, namely vulnerability scanning, assessment and prioritisation. Based on the results that highlight the important concerns in software security patch management and the lack of solutions, we recommend a list of future research directions. This study also provides useful insights about different opportunities for practitioners to adopt new solutions and understand the variations of their practical utility.

CAVP: A context-aware vulnerability prioritization model

With the growing number of vulnerabilities while attacks are becoming more advanced, known software security vulnerabilities need to be managed more efficiently with prioritization and contextualization. The current industry standard approach towards vulnerability management at a large scale is limited for two reasons. First, it does not automatically capture the temporal characteristics of the Common Vulnerability Exposures (CVEs) (i.e., how CVEs change over time). Second, it requires manual labor to prioritize identified vulnerabilities. To address these limitations, this research designs a context-aware vulnerability prioritization (CAVP) model to calculate temporal-enabled vulnerability scores of CVEs and prioritize these vulnerabilities visually. The CAVP model includes an enhanced Context-Aware Vulnerability Scoring System (CAVSS) that automatically derives temporal metric values of CVEs through a set of expert-validated heuristic rules. The CAVP model is the first attempt to provide a step-by-step process of vulnerability prioritization that can be integrated within the risk management workflow of an organization. The implementation of the CAVP model in two organizations validates its usefulness.