Publications

NCSU Lablet Publications

The ‘as code’ activities: development anti-patterns for infrastructure as code
Abstract: Context:

The 'as code' suffix in infrastructure as code (IaC) refers to applying software engineering activities, such as version control, to maintain IaC scripts. Without the application of these activities, defects that can have serious consequences may be introduced in IaC scripts. A systematic... more
Gang of Eight: A Defect Taxonomy for Infrastructure as Code Scripts
Abstract: Defects in infrastructure as code (IaC) scripts can have serious
consequences, for example, creating large-scale system outages. A
taxonomy of IaC defects can be useful for understanding the nature
of defects, and identifying activities needed to fix and prevent
defects in IaC scripts. The goal... more
A Cybersecurity Dataset Derived from the National Collegiate Penetration Testing Competition
Abstract: more
Risk-based attack surface approximation: how much data is enough?
Abstract: Proactive security reviews and test efforts are a necessary component of the software development lifecycle. Resource limitations often preclude reviewing the entire code base. Making informed decisions on what code to review can improve a team's ability to find and remove vulnerabilities. Risk-... more
Software Security Education at Scale
Abstract: Massively Open Online Courses (MOOCs) provide a unique opportunity to reach out to students who would not normally be reached by alleviating the need to be physically present in the classroom. However, teaching software security coursework outside of a classroom setting can be challenging. What are... more
Reusing Stack Traces: Automated Attack Surface Approximation
Abstract: Security requirements around software systems have become more stringent as society becomes more interconnected via the Internet. New ways of prioritizing security efforts are needed so security professionals can use their time effectively to find security vulnerabilities or prevent them from... more
Which Factors Influence Practitioners' Usage of Build Automation Tools?
Abstract: Even though build automation tools help to reduce errors and rapid releases of software changes, use of build automation tools is not widespread amongst software practitioners. Software practitioners perceive build automation tools as complex, which can hinder the adoption of these tools. How well... more
Predicting Android Application Security and Privacy Risk with Static Code Metrics
Abstract: Android applications pose security and privacy risks for end-users. These risks are often quantified by performing dynamic analysis and permission analysis of the Android applications after release. Prediction of security and privacy risks associated with Android applications at early stages of... more
On the Tradeoff Between Privacy and Utility in Collaborative Intrusion Detection Systems-A Game Theoretical Approach
Abstract: Intrusion Detection Systems (IDSs) are crucial security mechanisms widely deployed for critical network protection. However, conventional IDSs become incompetent due to the rapid growth in network size and the sophistication of large scale attacks. To mitigate this problem, Collaborative IDSs (... more
Characterizing Scientific Reporting in Security Literature: An Analysis of ACM CCS and IEEE S&P Papers
Abstract: Scientific advancement is fueled by solid fundamental research, followed by replication, meta-analysis, and theory building. To support such advancement, researchers and government agencies have been working towards a "science of security". As in other sciences, security science requires high-... more

more ►