检索结果-内蒙古大学图书馆

Efficient encryption of wavelet-based coded color images

PATTERN RECOGNITION 2005年第7期38卷 1111-1115页

作者： Martin, K Lukac, R Plataniotis, KN Univ Toronto Edward S Rogers Sr Dept ECE Multimedia Lab Toronto ON M5S 3G4 Canada

An efficient, secure color image coder incorporating Color-SPIHT (C-SPIHT) compression and partial encryption is presented. Confidentiality of the image data is achieved by encrypting only the significance bits of individual wavelet coefficients for K iterations of the C-SPIHT algorithm. By varying K, the level of confidentiality vs. processing overhead can be controlled. For K = 2, adequate security is achieved and an average of only 0.40% of bits needed encrypting for test images coded at 0.8 bpp. (c) 2005 Pattern Recognition Society. Published by Elsevier Ltd. All rights reserved.

关键词： image encryption partial encryption secure coding secure wavelet based coding secure SPIHT

来源：评论

学校读者我要写书评

暂无评论

Systematic Detection of State Variable Corruptions in Discrete Event System Specification Based Simulation

引用

IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS 2020年第7期E103D卷 1769-1772页

作者： Lee, Hae Young Kim, Jin Myoung Cheongju Univ Cheongju South Korea SKKU Seoul South Korea

In this letter, we propose a more secure modeling and simulation approach that can systematically detect state variable corruptions caused by buffer overflows in simulation models. Using our approach, developers may not consider secure coding practices related to the corruptions. We have implemented a prototype of the approach based on a modeling and simulation formalism and an open source simulator. Through optimization, the prototype could show better performance, compared to the original simulator, and detect state variable corruptions.

关键词： data corruption state variable corruption buffer overflow secure coding discrete event system specification

来源：评论

学校读者我要写书评

暂无评论

Security Assessment by Google Hacking Automation Tools for the Web Sites of Korea and the USA Universities

引用

INTERNATIONAL JOURNAL OF SECURITY AND ITS APPLICATIONS 2015年第5期9卷 163-173页

作者： Bae, Mi Young Lim, Hankyu Andong Natl Univ Dept Multimedia Engn Andong South Korea

As software exchanges data in the internet environment, it is always susceptible to the malicious attacks of hackers. Google Search enables individuals to randomly search servers with their preferred vulnerabilities using several search words. Using a sample of university homepages in Korea and the US, this paper investigates the security weakness of homepages by using SiteDigger that automatically searches the Googling, which is the most convenient way of collecting data, and examines the security weakness of homepages in Korea and the US. Based on the analyzed weakness, the researcher attempts to conduct future study that develops security diagnosis tool for webpage

关键词： secure coding Hacking tools University Website Personal information

来源：评论

学校读者我要写书评

暂无评论

Sifu-a cybersecurity awareness platform with challenge assessment and intelligent coach

引用

Cybersecurity 2018年第1期1卷 945-967页

作者： Tiago Espinha Gasiba Ulrike Lechner Maria Pinto-Albuquerque Siemens AG Corporate Technology Otto-Hahn-Rin 681379 MunichBavariaGermany Universitat der Bundeswehr München MunichGermany Instituto Universitario de Lisboa(ISCTE-IUL) ISTAR-IULLisbonPortugal

Software vulnerabilities,when actively exploited by malicious parties,can lead to catastrophic *** handling of software vulnerabilities is essential in the industrial context,particularly when the software is deployed in critical ***,several industrial standards mandate secure coding guidelines and industrial software developers’training,as software quality is a significant contributor to secure *** Challenges(CSC)form a method that combines serious game techniques with cybersecurity and secure coding guidelines to raise secure coding awareness of software developers in the *** cybersecurity awareness events have been used with success in industrial ***,until now,these coached events took place *** the present work,we briefly introduce cybersecurity challenges and propose a novel platform that allows these events to take place *** introduced cybersecurity awareness platform,which the authors call Sifu,performs automatic assessment of challenges in compliance to secure coding guidelines,and uses an artificial intelligence method to provide players with solution-guiding ***,due to its characteristics,the Sifu platform allows for remote(online)learning,in times of social *** CyberSecurity Challenges events based on the Sifu platform were evaluated during four online real-life CSC *** report on three surveys showing that the Sifu platform’s CSC events are adequate to raise industry software developers awareness on secure coding.

关键词： Cybersecurity Awareness Training Artificial intelligence Serious games secure coding Static application security testing Capture-the-flag Software development in industry

来源：评论

学校读者我要写书评

暂无评论

SACH: A Tool for Assisting secure Android Application Development

SACH: A Tool for Assisting Secure Android Application Develo...

引用

IEEE SoutheastCon Conference

作者： Abernathy, Aakiel Yuan, Xiaohong Hill, Edward Xu, Jinsheng Bryant, Kelvin Williams, Kenneth North Carolina Agr & Tech State Univ Dept Comp Sci Greensboro NC 27401 USA

ISBN: (纸本)9781538615393

To mitigate the risk of attacks to mobile applications, it is important for mobile application developers to develop secure mobile applications. There have been tools that statically analyze the mobile applications to determine whether there are data leakage or access control vulnerabilities The Software Engineering Institute at Carnegie Melon University published CERT Java secure coding rules applicable to developing android applications. This paper describes SACH (secure Android coding Helper) - a tool we implemented to help developers identify security vulnerabilities in Android application. The tool analyzes Android application source code to detect violations of CERT Java secure coding rules. This tool will help Android developers to write Android code that comply with CERT Java secure coding rules. It can also be used in the classroom to teach students about Android secure coding.

关键词： Android application development secure coding CERT Java secure coding rules

来源：评论

学校读者我要写书评

暂无评论

Raising Security Awareness of Cloud Deployments using Infrastructure as Code through CyberSecurity Challenges 21

Raising Security Awareness of Cloud Deployments using Infras...

引用

16th International Conference on Availability, Reliability and Security (ARES)

作者： Gasiba, Tiago Espinha Andrei-Cristian, Iosif Lechner, Ulrike Pinto-Albuquerque, Maria Siemens AG T RDA CST SEL DE Munich Germany Tech Univ Munich Munich Germany Univ Bundeswehr Munchen Neubiberg Germany Inst Univ Lisboa ISCTE IUL ISTAR Lisbon Portugal

ISBN: (纸本)9781450390514

Improper deployment of software can have serious consequences, ranging from simple downtime to permanent data loss and data breaches. Infrastructure as Code tools serve to streamline delivery by promising consistency and speed, by abstracting away from the underlying actions. However, this simplicity may distract from architectural or configuration faults, potentially compromising the secure development lifecycle. One way to address this issue involves awareness training. Sifu is a platform that provides education on security through serious games, developed in the industry, for the industry. The presented work extends the Sifu platform with challenges addressing Terraform-aided cloud deployment on Amazon Web Services. This paper proposes an evaluation pipeline behind the challenges, and provides details of the vulnerability detection and feedback mechanisms, as well as a novel technique for detecting undesired differences between a given architecture and a target result. Furthermore, this paper quantifies the challenges' perceived usefulness and impact, by evaluating the challenges among a total of twelve participants. Our preliminary results show that the challenges are suitable for education and the industry, with potential usage in internal training. A key finding is that, although the participants understand the importance of secure coding, their answers indicate that universities leave them unprepared in this area. Finally, our results are compared with related industry works, to extract and provide good practices and advice for practitioners.

关键词： secure coding DevSecOps Awareness Training Serious Games CyberSecurity Challenges Infrastructure as Code

来源：评论

学校读者我要写书评

暂无评论

A Pilot Study on secure Code Generation with ChatGPT forWeb Applications 24

A Pilot Study on Secure Code Generation with ChatGPT forWeb ...

引用

Annual ACM Southeast Conference (ACMSE)

作者： Jamdade, Mahesh Liu, Yi Univ Massachusetts Dartmouth Dartmouth MA 02747 USA

ISBN: (纸本)9798400702372

Conversational Large Language Models (LLMs), such as ChatGPT, have demonstrated their potent capabilities in natural language processing tasks. This paper presents a pilot study that uses ChatGPT for generating web application code with a specific emphasis on mitigating four prevalent web application vulnerability types: SQL Injection, Cross Site Scripting, Carriage Return Line Feed Injection, and Exposure of Sensitive Information. The paper uses a case study to illustrate how the vulnerabilities in the code are mitigated with the prompts and the subsequent refinements. The study's findings summarize the security concerns in the code generated by ChatGPT, and the paper proposes a prompt pattern designed to help mitigating the potential vulnerabilities.

关键词： secure coding web application vulnerabilities generative AI ChatGPT

来源：评论

学校读者我要写书评

暂无评论

Rethinking Answer Set Programming Templates 26th

Rethinking Answer Set Programming Templates

引用

26th International Symposium on Practical Aspects of Declarative Languages (PADL)

作者： Alviano, Mario Ianni, Giovambattista Pacenza, Francesco Zangari, Jessica Univ Calabria DEMACS Via Bucci 30-B I-87036 Arcavacata Di Rende CS Italy

ISBN: (纸本)9783031520372;9783031520389

In imperative programming, the Domain-Driven Design methodology helps in coping with the complexity of software development by materializing in code the invariants of a domain of interest. Code is cleaner and more secure because any implicit assumption is removed in favor of invariants, thus enabling a fail fast mindset and the immediate reporting of unexpected conditions. This article introduces a notion of template for Answer Set Programming that, in addition to the don't repeat yourself principle, enforces locality of some predicates by means of a simple naming convention. Local predicates are mapped to the usual global namespace adopted bymainstream engines, using universally unique identifiers to avoid name clashes. This way, local predicates can be used to enforce invariants on the expected outcome of a template in a possibly empty context of application, independently by other rules that can be added to such a context. Template applications transpiled this way can be processed by mainstream engines and safely shared with other knowledge designers, even when they have zero knowledge of templates.

关键词： Answer Set Programming secure coding clean code Domain-Driven Design Test-Driven Development

来源：评论

学校读者我要写书评

暂无评论

Software Reengineering Based Security Teaching

Software Reengineering Based Security Teaching

引用

3rd International Multi-Conference on Engineering and Technological Innovation

作者： Chung, Sam Endicott-Popovsky, Barbara Univ Washington Inst Technol Comp & Software Syst Tacoma WA 98402 USA Univ Washington Ctr Informat Assurance & Cyber Secur Seattle WA 98195 USA

ISBN: (纸本)9781936338115

The problem of developing secure code is well known to high-tech sector companies. Some, like Microsoft, have found it necessary to establish ongoing security training for their developers to make up for the absence of college-level, secure coding curriculum. This research takes a unique, software reengineering-based, thread approach. Curriculum modules are built around a concept such as input data validation, encapsulation, errors, etc. A software engineering case study is developed for each module that will produce code the traditional way, without regard to security, then re-engineer the code to transform it to include security concepts. Going through the cases in this manner, will give attending faculty, not only specific labs they can implement in their own courses, but also an understanding of how to transform their own existing assignments to incorporate secure coding practices.

关键词： secure coding 4+1 Views 5W1H Based Re-Documnetation Technique Reverse Software Engineering Forward Software Engineering

来源：评论

学校读者我要写书评

暂无评论

Scalable and Reusable Attack Aware Software

Scalable and Reusable Attack Aware Software

引用

ASE International Conference on BioMedical Computing (BioMedCom)

作者： Kim, William Moon, Cheolmin Sky Chung, Sam Escrig, Teresa Endicott-Popovsky, Barbara Univ Washington Tacoma Inst Technol Tacoma WA 98402 USA Univ Washington Ctr Informat Assurance & Cybersecur Seattle WA 98105 USA

ISBN: (纸本)9780769549385;9781467354950

Developing and maintaining security software systems can be cost-prohibitive for all but the largest organizations. New requirements of hardware and software quickly outdate current security systems. Modern software architecture technology, such as Spring Framework, and the new deployment paradigm of cloud computing infrastructure services can help with the challenge of maintaining software security systems. Spring Framework allows for better reusability of our code to adapt to different input vulnerabilities and cloud computing helps to deploy quickly and easily. The application of software architectural patterns and cloud computing to the development of attack aware software improves reusability and scalability.

关键词： Attack Aware Web Application Security Security Software secure coding secure Software Design Cloud Computing

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：