检索结果-内蒙古大学图书馆

13th International Symposium on Foundations and Practice of Security (FPS)

作者： Courant, Judicael Orange Cyberdefense Lyon France

ISBN: (纸本)9783030708818;9783030708801

SQL queries, when written by unskilled or hurried developers for web applications, are prone to SQL injections. We propose an alternative approach for querying SQL databases that does not suffer from this flaw. Our approach is based on abstract syntax trees, lets developers build dynamic queries easily, and is easier to set up than an ORM tool. We provide a proof-of-concept in Java, but our approach can be extended to other languages.

关键词： SQL injection SQLi prevention Dynamic queries Code generation Abstract syntax trees Language-based security secure coding Software security

来源：评论

学校读者我要写书评

暂无评论

Minimizing Cognitive Overload in Cybersecurity Learning Materials: An Experimental Study Using Eye-Tracking 14th

Minimizing Cognitive Overload in Cybersecurity Learning Mate...

引用

14th IFIP WG 11.8 World Conference on Information Security Education (WISE)

作者： Bernard, Leon Raina, Sagar Taylor, Blair Kaza, Siddharth Towson Univ Dept Comp & Informat Sci Baltimore MD 21252 USA Mt St Mary Coll Div Maths & Informat Technol Newburgh NY USA

ISBN: (纸本)9783030808655;9783030808648

Cybersecurity education is critical in addressing the global cyber crisis. However, cybersecurity is inherently complex and teaching cyber can lead to cognitive overload among students. Cognitive load includes: 1) intrinsic load (IL-due to inherent difficulty of the topic), 2) extraneous (EL- due to presentation of material), and 3) germane (GL- due to extra effort put in for learning). The challenge is to minimize IL and EL and maximize GL. We propose a model to develop cybersecurity learning materials that incorporate both the Bloom's taxonomy cognitive framework and the design principles of content segmentation and interactivity. We conducted a randomized control/treatment group study to test the proposed model by measuring cognitive load using two eye-tracking metrics (fixation duration and pupil size) between two cybersecurity learning modalities - 1) segmented and interactive modules, and 2) traditional-without segmentation and interactivity (control). Nineteen computer science majors in a large comprehensive university participated in the study and completed a learning module focused on integer overflow in a popular programming language. Results indicate that students in the treatment group had significantly less IL (p < 0.05), EL (p < 0.05), and GL (p < 0.05) as compared to the control group. The results are promising, and we plan to further the work by focusing on increasing the GL. This has interesting potential in designing learning materials in cybersecurity and other computing areas.

关键词： Bloom's taxonomy Cognitive overload Cybersecurity Eye tracking Pupillometry secure coding Curriculum

来源：评论

学校读者我要写书评

暂无评论

Systematic Detection of State Variable Corruptions in Discrete Event System Specification Based Simulation

引用

IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS 2020年第7期E103D卷 1769-1772页

作者： Lee, Hae Young Kim, Jin Myoung Cheongju Univ Cheongju South Korea SKKU Seoul South Korea

In this letter, we propose a more secure modeling and simulation approach that can systematically detect state variable corruptions caused by buffer overflows in simulation models. Using our approach, developers may not consider secure coding practices related to the corruptions. We have implemented a prototype of the approach based on a modeling and simulation formalism and an open source simulator. Through optimization, the prototype could show better performance, compared to the original simulator, and detect state variable corruptions.

关键词： data corruption state variable corruption buffer overflow secure coding discrete event system specification

来源：评论

学校读者我要写书评

暂无评论

Code Obfuscation Technique for Enhancing Software Protection Against Reverse Engineering 2nd

Code Obfuscation Technique for Enhancing Software Protection...

引用

2nd International Conference of Artificial Intelligence, Medical Engineering, Education (AIMEE)

作者： Gnatyuk, Sergiy Kinzeryavyy, Vasyl Stepanenko, Iryna Gorbatyuk, Yana Gizun, Andrii Kotelianets, Vitalii Natl Aviat Univ Kiev Ukraine

ISBN: (纸本)9783030120825;9783030120818

Software reliability is an actual problem caused with absence of software protection techniques, especially absence of software code protection from reverse engineering. Computer piracy and illegal software usage makes big damage for state economy. The development of new approaches and modification of existed obfuscation technologies is actual task directed to growing efficiency of secure coding and protection against reverse engineering. In this paper, authors present the obfuscation method for software protection, which ensures protection from reverse engineering. The method is based on a new sequence of obfuscation transformations. Also software tool StiK was developed, and based on the submitted sequence of operations, pseudocode for protection method was created. Experimental study was conducted according to the presented technique. Experimental results show the efficiency and generality of the proposed method (StiK obfuscator is 10% faster as well as 1.37 times more protected than analogues). Consequently, the developed technique can be used to prevent or at least hamper interpretation, decoding, analysis, or reverse engineering of software.

关键词： Information security Software code protection Obfuscation technique Obfuscation Obfuscation transformations secure coding Obfuscation algorithm

来源：评论

学校读者我要写书评

暂无评论

Designing a Serious Game: Teaching Developers to Embed Privacy into Software Systems 35

Designing a Serious Game: Teaching Developers to Embed Priva...

引用

35th IEEE/ACM International Conference on Automated Software Engineering (ASE)

作者： Arachchilage, Nalin Asanka Gamagedara Hameed, Mumtaz Abdul La Trobe Univ Bundoora Vic Australia Technovat Consulting & Amp Training PVT Male Maldives

ISBN: (纸本)9781450381284

Software applications continue to challenge user privacy when users interact with them. Privacy practices (e.g. Data Minimisation (DM), Privacy by Design (PbD) or General Data Protection Regulation (GDPR)) and related "privacy engineering" methodologies exist and provide clear instructions for developers to implement privacy into software systems they develop that preserve user privacy. However, those practices and methodologies are not yet a common practice in the software development community. There has been no previous research focused on developing "educational" interventions such as serious games to enhance software developers' coding behaviour. Therefore, this research proposes a game design framework as an educational tool for software developers to improve (secure) coding behaviour, so they can develop privacy-preserving software applications that people can use. The elements of the proposed framework were incorporated into a gaming application scenario that enhances the software developers' coding behaviour through their motivation. The proposed work not only enables the development of privacy-preserving software systems but also helping the software development community to put privacy guidelines and engineering methodologies into practice.

关键词： secure coding DevSecOps Privacy-preserving Systems Usable Security and Privacy

来源：评论

学校读者我要写书评

暂无评论

A Study on the Evaluation System through Software Weakness Analysis 11

A Study on the Evaluation System through Software Weakness A...

引用

Joint 11th International Conference on Soft Computing and Intelligent Systems and 21st International Symposium on Advanced Intelligent Systems (SCIS-ISIS)

作者： Kim, Kyung-won Chang, Seokmin Park, Kyubin Son, Yunsik Dongguk Univ Dept Comp Sci & Engn Seoul South Korea

ISBN: (纸本)9781728197326

Recently, Due to the rapid development of IT technology the software in the social infrastructure is increasing. However, cyber attacks that exploit software vulnerabilities are also increasing. This paper designed and proposed the evaluation system considering in various programming languages and environments for cyber security. In addition, the effectiveness of research was proved by analyzing the results of selecting and evaluating weaknesses.

关键词： Weakness Vulnerability Evaluation System secure coding

来源：评论

学校读者我要写书评

暂无评论

Extracting Cryptographic Keys *** Applications

引用

Semiconductor Science and Information Devices 2021年第2期3卷 1-11页

作者： Shaun Mc Brearty william Farrelly Kevin Curran Institute of Technology SligoIreland Letterkenny Institute of Technology LetterkennyIreland Ulster University DerryUnited Kingdom

In the absence of specialized encryption hardware,cryptographic operationsmust be performed in main *** such,it is common place for cybercriminals to examine the content of main memory with a view to retrievinghigh-value data in plaintext form and/or the associated decryption *** paper,the author presents a number of simple methods for identifyingand extracting crypfographic keys from memory dumps of softwareapplications that utilize the *** Framework,as well as source-code level countermeasures to protect against *** the EXE file ofan application and a basic knowledge of the cryptographic libraries utilizedin the NET Framework,the author shows how to create a memory dumpof a running application and how to extract cryptographic keys from sameusing WinDBG-without any prior knowledgel of the cryptographic *** the proof-of-concept application utilized as part of thispaper uses an implementation of the DES cipher,it should be noted that thesteps shown can be utilized against all three generations of symmetric andasymmetric ciphers supported within the NET Framework.

关键词： Cryptography Cryptanalysis Memory dump analysis Memory hygiene Key finding attack secure coding .NET framework

来源：评论

学校读者我要写书评

暂无评论

Designing a serious game: teaching developers to embed privacy into software systems 20

Designing a serious game: teaching developers to embed priva...

引用

Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering

作者： Nalin Asanka Gamagedara Arachchilage Mumtaz Abdul Hameed La Trobe University Australia Technovation Consulting & Training PVT

ISBN: (纸本)9781450381284

关键词： privacy-preserving systems usable security and privacy secure coding DevSecOps

来源：评论

学校读者我要写书评

暂无评论

Is the OWASP Top 10 List Comprehensive Enough for Writing secure Code? 2020

Is the OWASP Top 10 List Comprehensive Enough for Writing Se...

引用

Proceedings of the 2020 International Conference on Big Data in Management

作者： Parth Sane Rochester Institute of Technology

ISBN: (纸本)9781450375061

The OWASP Top 10 is a list that is published by the Open Web Application Security Project (OWASP). The general purpose is to serve as a watchlist for bugs to avoid while writing code. This paper compares how many of those weakness as described in the top ten list are actually reported in vulnerabilities listed in the National Vulnerability Database (NVD). That way it makes it possible to empirically show whether the OWASP Top 10 list is comprehensive enough or not, for code weaknesses that have been found in the past decade.

关键词： secure coding vulnerabilities OWASP analysis

来源：评论

学校读者我要写书评

暂无评论

Hello world!: code responsibly: why cyber is a game changer for computer science education 20

Hello world!: code responsibly: why cyber is a game changer ...

引用

Proceedings of the 9th Computer Science Education Research Conference

作者： Blair Taylor Towson University

ISBN: (纸本)9781450388726

Cybersecurity continues to be a global crisis. The ever-growing need for cyber talent has challenged universities to build and expand cybersecurity programs, despite an acute shortage of cybersecurity *** every challenge comes opportunity. Can cybersecurity draw more students to computer science? Given the appropriate resources, can teaching cyber create opportunities for computer science educators to engage students and increase diversity? To address the cyber crisis, all university programs should offer an introduction to cyber course, all programming classes should teach responsible coding, and we should integrate security across the curriculum.

关键词： secure coding computer science education cybersecurity

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：