检索结果-内蒙古大学图书馆

Resolving vulnerability identification errors using security requirements on business process models

Information Management and Computer Security 2013年第3期21卷 202-223页

作者： Taubenberger, Stefan Jürjens, Jan Yu, Yijun Nuseibeh, Bashar Computing Department Open University Milton Keynes United Kingdom Department of Computer Science Technical University Dortmund Dortmund Germany Fraunhofer Institute for Software Systems Engineering ISST Dortmund Germany Lero the Irish Software Engineering Research Centre Computing Department University of Limerick Limerick Ireland Open University Milton Keynes United Kingdom

Purpose - In any information security risk assessment, vulnerabilities are usually identified by information-gathering techniques. However, vulnerability identification errors - wrongly identified or unidentified vulnerabilities - can occur as uncertain data are used. Furthermore, businesses' security needs are not considered sufficiently. Hence, security functions may not protect business assets sufficiently and cost-effectively. This paper aims to resolve vulnerability errors by analysing the security requirements of information assets in business process models. Design/methodology/approach - Business process models have been selected for use, because there is a close relationship between business process objectives and risks. Security functions are evaluated in terms of the information flow of business processes regarding their security requirements. The claim that vulnerability errors can be resolved was validated by comparing the results of a current risk assessment approach with the proposed approach. The comparison is conducted both at three entities of an insurance company, as well as through a controlled experiment within a survey among security professionals. Findings - Vulnerability identification errors can be resolved by explicitly evaluating security requirements in the course of business;this is not considered in current assessment methods. Originality/value - It is shown that vulnerability identification errors occur in practice. With the explicit evaluation of security requirements, identification errors can be resolved. Risk assessment methods should consider the explicit evaluation of security requirements. Copyright © 2013 Emerald Group Publishing Limited. All rights reserved.

关键词： Risk assessment

来源：评论

学校读者我要写书评

暂无评论

DIV： Dynamic Integrity Validation Framework for Detecting Compromises on Virtual Machine Based Cloud Services in Real Time

引用

China Communications 2014年第8期11卷 15-27页

作者： WANG Chunlu LIU Chuanyi LIU Bin DONG Yingfei School of Computer Science Beijing University of Posts and Telecommunications Beijing 100876 P. R. China School of Software Engineering Beijing University of Posts and Telecommunications Beijing 100876 P. R. China Key Laboratory of Trustworthy Distributed Computing and Service (BUPT) Ministry of Education Beijing 100876 P. R. China Department of Electrical Engineering University of Hawaii Honolulu Hawaii U.S.

with the increasing popularity of cloud services,attacks on the cloud infrastructure also increase ***,how to monitor the integrity of cloud execution environments is still a difficult *** this paper,a real-time dynamic integrity validation(DIV) framework is proposed to monitor the integrity of virtual machine based execution environments in the *** can detect the integrity of the whole architecture stack from the cloud servers up to the VM OS by extending the current trusted chain into virtual machine's architecture *** introduces a trusted third party(TTP) to collect the integrity information and detect remotely the integrity violations on VMs periodically to avoid the heavy involvement of cloud tenants and unnecessary information leakage of the cloud *** evaluate the effectiveness and efficiency of DIV framework,a prototype on KVM/QEMU is implemented,and extensive analysis and experimental evaluation are *** results show that the DIV can efficiently validate the integrity of files and loaded programs in real-time,with minor performance overhead.

关键词： cloud security remote attestation trusted computing cloud trustworthiness

来源：评论

学校读者我要写书评

暂无评论

A secure elliptic curve based RFID ownership transfer scheme with controlled delegation

引用

Cryptology and Information Security Series 2013年 11卷 31-43页

作者： Cheng, Shu Varadharajan, Vijay Mu, Yi Susilo, Willy Department of Computing Faculty of Scicence Macquarie University Sydney Australia Centre for Computer and Information Security Research School of Computer Science and Software Engineering University of Wollongong Wollongong Australia

ISBN: (纸本)9781614993278

In practical applications, the owner of an RFID-tagged item canchange. In this paper, we propose a new RFID ownership transfer protocol using elliptic-curve cryptography. The paper first considers security and privacy requirements in the ownership transfer process. Then the paper provides a detailed description of our ownership transfer scheme outlining various protocol phases. Key features of the proposed scheme are that it allows controlled delegation and authorisation recovery, and the ownership transfer is achieved without a trusted third party. We describe a security analysis of the proposed scheme and demonstrate that it meets the desired security and privacy requirements. We also illustrate the performance results and show that our scheme is feasible for lightweight RFID tags. © 2013 The authors and IOS Press. All rights reserved.

关键词： Radio frequency identification (RFID)

来源：评论

学校读者我要写书评

暂无评论

Automated Coverage-Driven Test Data Generation Using Dynamic Symbolic Execution

Automated Coverage-Driven Test Data Generation Using Dynamic...

引用

International Conference on Secure System Integration and Reliability Improvement, SSIRI

作者： Ting Su Geguang Pu Bin Fang Jifeng He Jun Yan Siyuan Jiang Jianjun Zhao Shanghai Key Laboratory of Trustworthy Computing East China Normal University Shanghai China State Key Laboratory of Computer Science Chinese Academy of Sciences Beijing China Department of Computer Science and Engineering University of Notre Dame USA School of Software Shanghai Jiao Tong University Shanghai China

Recently code transformations or tailored fitness functions are adopted to achieve coverage (structural or logical criterion) driven testing to ensure software reliability. However, some internal threats like negative impacts on underlying search strategies or local maximum exist. So we propose a dynamic symbolic execution (DSE) based framework combined with a path filtering algorithm and a new heuristic path search strategy, i.e., predictive path search, to achieve faster coverage-driven testing with lower testing cost. The empirical experiments (three open source projects and two industrial projects) show that our approach is effective and efficient. For the open source projects w.r.t branch coverage, our approach in average reduces 25.5% generated test cases and 36.3% solved constraints than the traditional DSE-based approach without path filtering. And the presented heuristic strategy, on the same testing budget, improves the branch coverage by 26.4% and 35.4% than some novel search strategies adopted in KLEE and CREST.

关键词： Testing Search problems Heuristic algorithms Educational institutions Electronic mail Prediction algorithms Engines

来源：评论

学校读者我要写书评

暂无评论

Energy-aware multipath routing for data aggregation in wireless sensor networks

Energy-aware multipath routing for data aggregation in wirel...

引用

International Conference on Parallel and Distributed Systems (ICPADS)

作者： Yingyuan Xiao Xinrong Zhao Hongya Wang Ching-Hsien Hsu Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology Tianjin University of Technology Tianjin P.R. China School of Computer Science and Technology Donghua University Shanghai P.R. China Department of Computer Science and Information Engineering Chung Hua University Hsinchu Taiwan R.O.C

ISBN: (纸本)9781479976164

Data aggregation in wireless sensor networks is widely used to collect data in an energy efficient manner to eliminate redundant data transmission so that prolong the network lifetime. To meet the data aggregation needs in wireless sensor networks, this paper proposes a novel multi-path routing algorithm, called EAD, to process in-network data aggregation. For each sensor on the routing paths, EAD evaluates its neighbors based on the residual energy, deviation angle and distance, and selects the k neighbors with the minimal evaluation costs as its forwarding nodes in order to balance energy consumption of the wireless sensor network on the premise of ensuring the reliability and performance. Simulation results show that EAD can effectively prolong network lifetime, reduce latency and ensure the reliability by adjusting the weight of each influencing factor.

关键词： Monitoring Batteries Erbium Aggregates Standards

来源：评论

学校读者我要写书评

暂无评论

Teaching black-box testing to high school students 13

Teaching black-box testing to high school students

引用

8th Workshop in Primary and Secondary computing Education, WiPSCE 2013

作者： Sarkar, Amitrajit Bell, Tim Department of Computing Christchurch Polytechnic Institute of Technology Christchurch New Zealand Computer Science and Software Engineering University of Canterbury Christchurch New Zealand

ISBN: (纸本)9781450324557

This paper focuses on pedagogy for teaching acceptance testing to high school students in the context of the new New Zealand computer science standards. A review of resources that are currently available for teaching acceptance testing to high school students shows a major gap. In order to bridge that gap we have identified and evaluated resources that can be used to teach the concept to school students, have designed and evaluated an interactive tool to teach acceptance testing, and described a student project for the relevant New Zealand achievement standard.

关键词： Acceptance tests

来源：评论

学校读者我要写书评

暂无评论

A generic algebraic model for the analysis of cryptographic-key assignment schemes

A generic algebraic model for the analysis of cryptographic-...

引用

5th International Symposium on Foundations and Practice of Security, FPS 2012

作者： Sabri, Khair Eddin Khedri, Ridha Department of Computer Science King Abdulla II School for Information Technology University of Jordan Jordan Department of Computing and Software Faculty of Engineering McMaster University Canada

ISBN: (纸本)9783642371189

One of the means to implement information flow policies is by using a cryptographic approach commonly referred to as key assignment schemes. In this approach, information is made publicly available to users but in an encrypted form. Then, keys are assigned to users such that each key reveals a specified part of the information. Usually the distribution of keys follows a predefined scheme that specifies the ability of users to reveal information. In this paper, we present an algebraic approach based on idempotent commutative semirings to define, specify, and analyse key assignment schemes. Then, we illustrate its usage on two key assignment schemes selected from the literature. Also, we propose amendments to the studied schemes to extend their scopes. The proposed generic algebraic approach enables the verification of security properties at an abstract level in systems that use key assignment schemes. The verification takes into consideration the algebraic properties of schemes, and the considered relationships among the assigned keys. Then, it enables the verification of the secrecy properties of the system through algebraic calculations. All the calculations can be automated using a theorem prover such as Prover9. © 2013 Springer-Verlag.

关键词： Algebra

来源：评论

学校读者我要写书评

暂无评论

An evaluation framework for software crowdsourcing

引用

Frontiers of Computer science 2013年第5期7卷 694-709页

作者： Wenjun WU Wei-Tek TSAI Wei LI State Key Laboratory of Software Development Environment Beihang University Beijing 100191 China School of Computing Informatics and Decision Systems Engineering Arizona State University Tempe AZ85281 USA Department of Computer Science and Technology INLIST Tsinghua University Beijing 100084 China

Recently software crowdsourcing has become an emerging area of software engineering. Few papers have pre- sented a systematic analysis on the practices of software crowdsourcing. This paper first presents an evaluation frame- work to evaluate software crowdsourcing projects with re- spect to software quality, costs, diversity of solutions, and competition nature in crowdsourcing. Specifically, competi- tions are evaluated by the min-max relationship from game theory among participants where one party tries to minimize an objective function while the other party tries to maximize the same objective function. The paper then defines a game theory model to analyze the primary factors in these min- max competition rules that affect the nature of participation as well as the software quality. Finally, using the proposed eval- uation framework, this paper illustrates two crowdsourcing processes, Harvard-TopCoder and AppStori. The framework demonstrates the sharp contrasts between both crowdsourc- ing processes as participants will have drastic behaviors in engaging these two projects.

关键词： crowdsourcing software engineering competi-tion rules game theory

来源：评论

学校读者我要写书评

暂无评论

Relations among privacy notions for signcryption and key invisible "sign-then-encrypt"

Relations among privacy notions for signcryption and key inv...

引用

18th Australasian Conference on Information Security and Privacy, ACISP 2013

作者： Wang, Yang Manulis, Mark Au, Man Ho Susilo, Willy Centre for Computer and Information Security Research School of Computer Science and Software Engineering University of Wollongong Australia Department of Computing University of Surrey United Kingdom

ISBN: (纸本)9783642390586

Signcryption simultaneously offers authentication through unforgeability and confidentiality through indistinguishability against chosen ciphertext attacks by combining the functionality of digital signatures and public-key encryption into a single operation. Libert and Quisquater (PKC 2004) extended this set of basic requirements with the notions of ciphertext anonymity (or key privacy) and key invisibility to protect the identities of signcryption users and were able to prove that key invisibility implies ciphertext anonymity by imposing certain conditions on the underlying signcryption scheme. This paper revisits the relationship amongst privacy notions for signcryption. We prove that key invisibility implies ciphertext anonymity without any additional restrictions. More surprisingly, we prove that key invisibility also implies indistinguishability against chosen ciphertext attacks. This places key invisibility on the top of privacy hierarchy for public-key signcryption schemes. On the constructive side, we show that general "sign-then- encrypt" approach offers key invisibility if the underlying encryption scheme satisfies two existing security notions, indistinguishable against adaptive chosen ciphertext attacks and indistinguishability of keys against adaptive chosen ciphertext attacks. By this method we obtain the first key invisible signcryption construction in the standard model. © 2013 Springer-Verlag.

关键词： Authentication

来源：评论

学校读者我要写书评

暂无评论

Query generation for semantic datasets 13

Query generation for semantic datasets

引用

7th International Conference on Knowledge Capture: "Knowledge Capture in the Age of Massive Web Data", K-CAP 2013

作者： Pan, Jeff Z. Ren, Yuan Wu, Honghan Zhu, Man Department of Computing Science University of Aberdeen United Kingdom College of Computer and Software Nanjing University of Information and Technology China School of Computer Science and Engineering Southeast University China

ISBN: (纸本)9781450321020

Due to the increasing volume of and interconnections between semantic datasets, it becomes a challenging task for novice users to know what are included in a dataset, how they can make use of them, and particularly, what queries should be asked. In this paper we analyse several types of candidate insightful queries and propose a framework to generate such queries and identify their relations. To verify our approach, we implemented our framework and evaluated its performance with benchmark and real world datasets. Copyright 2013 ACM.

关键词： Semantics

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：