Language Based Security

Application-level security is a key to defending against application-level attacks. Because these applications are typically specified and implemented in programming languages, this area is generally known as "language-based security". Research into language -based security focuses on a range of languages and approaches. The works cited here were presented between January and August of 2014.

• Almorsy, M.; Grundy, J., "SecDSVL: A Domain-Specific Visual Language to Support Enterprise Security Modelling," Software Engineering Conference (ASWEC), 2014 23rd Australian, pp.152, 161, 7-10 April 2014. doi: 10.1109/ASWEC.2014.18 Enterprise security management requires capturing different security and IT systems' details, analyzing and enforcing these security details, and improving employed security to meet new risks. Adopting structured models greatly helps in simplifying and organizing security specification and enforcement processes. However, existing security models are generally limited to specific security details and do not deliver a comprehensive security model. They also often do not have user-friendly notations, being complicated extensions of existing modeling languages (such as UML). In this paper, we introduce a comprehensive Security Domain Specific Visual Language (SecDSVL), which enables capturing of key security details to support enterprise systems security management process. We discuss our SecDSVL, tool support and the model-based enterprise security management approach it supports, give a usage example, and present evaluation experiments of SecDSVL.
  Keywords: business data processing; risk management; security of data; specification languages; visual languages; IT system details; SecDSVL; UML; enterprise security modelling; enterprise system security management process; model-based enterprise security management approach; modeling languages; security domain specific visual language; security models; security specification; security system details; Analytical models; Color; Passive optical networks; Security; Shape; Unified modeling language; Visualization; Domain Specific Visual Language; model-based security management; visual modelling tools (ID#:14-2951)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6824120&isnumber=6824087

• Hatzivasilis, G.; Papaefstathiou, I; Manifavas, C.; Papadakis, N., "A Reasoning System for Composition Verification and Security Validation," New Technologies, Mobility and Security (NTMS), 2014 6th International Conference on, pp.1,4, March 30 2014-April 2 2014. doi: 10.1109/NTMS.2014.6814001 The procedure to prove that a system-of-systems is composable and secure is a very difficult task. Formal methods are mathematically-based techniques used for the specification, development and verification of software and hardware systems. This paper presents a model-based framework for dynamic embedded system composition and security evaluation. Event Calculus is applied for modeling the security behavior of a dynamic system and calculating its security level with the progress in time. The framework includes two main functionalities: composition validation and derivation of security and performance metrics and properties. Starting from an initial system state and given a series of further composition events, the framework derives the final system state as well as its security and performance metrics and properties. We implement the proposed framework in an epistemic reasoner, the rule engine JESS with an extension of DECKT for the reasoning process and the JAVA programming language.
  Keywords: Java; embedded systems; formal specification; formal verification; reasoning about programs; security of data; software metrics; temporal logic; DECKT;J AVA programming language; composition validation; composition verification; dynamic embedded system composition; epistemic reasoner; event calculus; formal methods; model-based framework; performance metrics; reasoning system ;rule engine JESS; security evaluation; security validation; system specification; system-of-systems; Cognition; Computational modeling; Embedded systems; Measurement; Protocols; Security; Unified modeling language (ID#:14-2952)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6814001&isnumber=6813963

• Dooley, Rion; Stubbs, Joe; Basney, Jim, "The MyProxy Gateway," Science Gateways (IWSG), 2014 6th International Workshop on, pp.6,11, 3-5 June 2014. doi: 10.1109/IWSG.2014.8 In 2000, the original My Proxy server was released to provide a centralized way to securely store and delegate grid credentials. In 2009, the OAuth for My Proxy (OA4MP) server was released in response to security concerns expressed by resource providers and a strong trend of science gateways moving to the web. OA4MP provided a standards-based way for users to delegate X.509 credentials from My Proxy to science gateways without exposing user passwords to third-party services. This addressed both a security concern for service providers and a desire by gateway developers for a standards-based approaches to security. While OA4MP solved some problems, it introduced others. The My Proxy Gateway Service (MPG) is a Restful API to My Proxy that picks up where OA4MP left off by supporting OAuth2 credential renewal, attribute insertion, trust root management, language agnostic access patterns, and improved accounting. In this paper we first start by looking at related work and detailing the evolution of My Proxy up to the writing of this paper. Next we briefly describe OAuth2 and highlight the differences between it and OAuth1. After that we describe the MPG, its multiple configurations, and security considerations. We conclude with finishing remarks.
  Keywords: Authentication; Authorization; Browsers; Logic gates; Servers; Web services; REST; api; authentication; grid; myproxy; oauth; security; web service (ID#:14-2953)
  URL:http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6882061&isnumber=6882053

• Dong-Ah Lee; Eui-sub Kim; Junbeom Yoo; Jang-Soo Lee; Jong Gyun Choi, "FBDtoVerilog 2.0: An Automatic Translation of FBD into Verilog to Develop FPGA," Information Science and Applications (ICISA), 2014 International Conference on, pp.1,4, 6-9 May 2014. doi: 10.1109/ICISA.2014.6847402 The PLC (Programmable Logic Controller) is a digital computer which has been widely used for nuclear RPSs (Reactor Protection Systems). There is increasing concern that such RPSs are being threatened because of its complexity, maintenance cost, security problems, etc. Recently, nuclear industry is developing FPGA-based RPSs to provide diversity or to change the platform. Developing the new platform, however, is challenge for software engineers in nuclear domain because the two platform, PLC-based and FPGA-based, are too different to apply their knowledge. This paper proposes an automatic translation of FBD (Function Block Diagram: a programming language of PLC software) into HDL (Hardware Description Language). We implemented an automatic translation tool, 'FBDtoVerilog 2.0,' which helps software engineers design FPGA-based RPSs with their experience and knowledge. Case study using a prototype version of a real-world RPS in Korea shows 'FBDtoVerilog 2.0' translates FBD programs for PLC into HDL reasonably.
  Keywords: control engineering computing; field programmable gate arrays; fission reactors;hardware description languages; nuclear engineering computing;nuclear power stations; power engineering computing; programmable controllers; FBDtoVerilog 2.0;FPGA-based RPS;HDL; Korea; PLC; digital computer; function block diagram; hardware description language; maintenance cost; nuclear RPS; nuclear domain; programmable logic controller; reactor protection systems; security problems; software engineers; Field programmable gate arrays; Hardware design languages; Libraries; Power generation; Safety; Software; Wires (ID#:14-2954)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6847402&isnumber=6847317

• Zhongpai Gao; Guangtao Zhai; Xiongkuo Min, "Information Security Display System Based On Temporal Psychovisual Modulation," Circuits and Systems (ISCAS), 2014 IEEE International Symposium on, pp.449, 452, 1-5 June 2014. doi: 10.1109/ISCAS.2014.6865167 This paper introduces an information security display system using temporal psychovisual modulation (TPVM). TPVM was proposed as a new information display technology using the interplay of signal processing, optoelectronics and psychophysics. Since the human visual system cannot detect quick temporal changes above the flicker fusion frequency (about 60 Hz) and yet modern display technologies offer much higher refresh rates, there is a chance for a single display to simultaneously serve different contents to multiple observers. A TPVM display broadcasts a set of images called atom frames at a high speed, and those atom frames are then weighted by liquid crystal (LC) shutter based viewing devices that are synchronized with the display before entering the human visual system and fusing into the desired visual stimuli. And through different viewing devices, people can see different information. In this work, we develop a TPVM based information security display prototype. There are two kinds of viewers, those authorized viewers with the viewing devices who can see the secret information and those unauthorized viewers (bystanders) without the viewing devices who only see mask/disguise images. The prototype is built on a 120 Hz LCD screen with synchronized LC shutter glasses that were originally developed for stereoscopic display. The system is written in C++ language with SDKs of Nvidia 3D Vision, DirectX, CEGUI, MuPDF and etc. We also added human-computer interaction support of the system using Kinect. The information security display system developed in this work serves as a proof-of-concept of the TPVM paradigm, as well as a testbed for future research of TPVM technology.
  Keywords: computer displays; human computer interaction; image sensors; security of data; stereo image processing; C++ language; CEGUI; DirectX; Kinect; LC shutter based viewing devices; MuPDF; Nvidia 3D Vision; TPVM; flicker fusion frequency; frequency 60 Hz; human visual system ;human-computer interaction support; information display technology ;information security display system; liquid crystal shutter; optoelectronics; psychophysics; signal processing; stereoscopic display; temporal psychovisual modulation; Brightness; Electronic publishing; Games; Glass; Information security; Synchronization; Three-dimensional displays (ID#:14-2955)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6865167&isnumber=6865048

• Buchler, M.; Hossen, K.; Mihancea, P.F.; Minea, M.; Groz, R.; Oriat, C., "Model Inference And Security Testing In The Spacios Project," Software Maintenance, Reengineering and Reverse Engineering (CSMR-WCRE), 2014 Software Evolution Week - IEEE Conference on, pp.411, 414, 3-6 Feb. 2014. doi: 10.1109/CSMR-WCRE.2014.6747207 The SPaCIoS project has as goal the validation and testing of security properties of services and web applications. It proposes a methodology and tool collection centered around models described in a dedicated specification language, supporting model inference, mutation-based testing, and model checking. The project has developed two approaches to reverse engineer models from implementations. One is based on remote interaction (typically through an HTTP connection) to observe the runtime behaviour and infer a model in black-box mode. The other is based on analysis of application code when available. This paper presents the reverse engineering parts of the project, along with an illustration of how vulnerabilities can be found with various SPaCIoS tool components on a typical security benchmark.
  Keywords: Web services; hypermedia; program diagnostics; program verification; reverse engineering; security of data; specification languages; transport protocols HTTP connection; SPaCIos project; Web applications; application code analysis; black-box mode; dedicated specification language; model checking; model inference; mutation-based testing; remote interaction; reverse engineering; runtime behaviour; security benchmark; security testing; tool collection; Abstracts; Analytical models; Concrete; Crawlers; Security; Semantics; Testing; Control Flow Inference; Data-Flow Inference; Reverse-Engineering; Security; Web Application (ID#:14-2956)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6747207&isnumber=6747152

• Lihong Guo; Jian Wang; Haitao Wu; He Du, "eXtensible Markup Language access Control Model With Filtering Privacy Based On Matrix Storage," Communications, IET , vol.8, no.11, pp.1919,1927, July 24 2014. doi: 10.1049/iet-com.2013.0570 With eXtensible Markup Language (XML) becoming a ubiquitous language for data storage and transmission in various domains, effectively safeguarding the XML document containing sensitive information is a critical issue. In this study, the authors propose a new access control model with filtering privacy. Based on the idea of separating the structure and content of the XML document, they provide a method to extract the main structure of the XML document and use matrix to save the structure information, at the same time, the start-end region encoding is used to combine the corresponding structure and content skillfully. These not only save the storage space but also efficiently speed up the search and make it convenient to find the relevant elements, especially the finding of the related content. In order to evaluate the security and efficiency of this model, the security analysis and simulation experiment verify its performance in this work.
  Keywords: XML; authorisation; data privacy; document handling; information filtering; storage management; ubiquitous computing; XML document content; XML document structure; access control model; data storage space; data transmission;eXtensible Markup Language; flltering privacy; matrix storage; security analysis; sensitive information; start-end region encoding; structure information; ubiquitous language (ID#:14-2957)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6855939&isnumber=6855933

• Woodruff, J.; Watson, R.N.M.; Chisnall, D.; Moore, S.W.; Anderson, J.; Davis, B.; Laurie, B.; Neumann, P.G.; Norton, R.; Roe, M., "The CHERI Capability Model: Revisiting RISC In An Age Of Risk," Computer Architecture (ISCA), 2014 ACM/IEEE 41st International Symposium on, pp.457,468, 14-18 June 2014. doi: 10.1109/ISCA.2014.6853201 Motivated by contemporary security challenges, we reevaluate and refine capability-based addressing for the RISC era. We present CHERI, a hybrid capability model that extends the 64-bit MIPS ISA with byte-granularity memory protection. We demonstrate that CHERI enables language memory model enforcement and fault isolation in hardware rather than software, and that the CHERI mechanisms are easily adopted by existing programs for efficient in-program memory safety. In contrast to past capability models, CHERI complements, rather than replaces, the ubiquitous page-based protection mechanism, providing a migration path towards deconflating data-structure protection and OS memory management. Furthermore, CHERI adheres to a strict RISC philosophy: it maintains a load-store architecture and requires only single-cycle instructions, and supplies protection primitives to the compiler, language runtime, and operating system. We demonstrate a mature FPGA implementation that runs the FreeBSD operating system with a full range of software and an open-source application suite compiled with an extended LLVM to use CHERI memory protection. A limit study compares published memory safety mechanisms in terms of instruction count and memory overheads. The study illustrates that CHERI is performance-competitive even while providing assurance and greater flexibility with simpler hardware.
  Keywords: field programmable gate arrays; operating systems (computers);reduced instruction set computing; security of data; CHERI hybrid capability model; CHERI memory protection; FPGA implementation; FreeBSD operating system; MIPS ISA; OS memory management; RISC era; byte-granularity memory protection; capability hardware enhanced RISC instruction; compiler; data-structure protection; fault isolation; field programmable gate array; in-program memory safety; instruction count; instruction set architecture ;language memory model enforcement; language runtime; load-store architecture; memory overhead; open-source application suite; reduces instruction set computing; single-cycle instructions; ubiquitous page-based protection mechanism; Abstracts; Coprocessors; Ground penetrating radar; Registers; Safety (ID#:14-2958)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6853201&isnumber=6853187

• Pura, M.L.; Buchs, D., "Model Checking ARAN Ad Hoc Secure Routing Protocol With Algebraic Petri Nets," Communications (COMM), 2014 10th International Conference on, pp.1,4, 29-31 May 2014. doi: 10.1109/ICComm.2014.6866692 Modeling and verifying the security protocols for ad hoc networks is a very complex task, because this type of networks is very complex. In this paper we present a new approach: the use of algebraic Petri nets as implemented by AlPiNA tool to model ad hoc networks and to verify some of the security properties of ARAN ad hoc secure routing protocol. The results we have obtained are in concordance with the other research on this protocol, and thus they validate the use of this methodology. Our approach has several advantages. An increase of performance was obtained, in the sense that we managed to verify the protocol for larger topologies than it was previous reported. The specification language of algebraic Petri nets is more expressive than the languages use by other tools, and it is more suited for model based code generation.
  Keywords: Petri nets; ad hoc networks; routing protocols; telecommunication security; ARAN ad hoc secure routing protocol; AlPiNA tool; ad hoc networks; algebraic Petri nets; security protocols; Ad hoc networks; Object oriented modeling; Routing; Routing protocols; Security; Topology; ARAN; AlPiNA; ad hoc networks; algebraic Petri nets; model checking (ID#:14-2959)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6866692&isnumber=6866648

• Karande, AM.; Kalbande, D.R., "Web Service Selection Based On Qos Using Tmodel Working On Feed Forward Network," Issues and Challenges in Intelligent Computing Techniques (ICICT), 2014 International Conference on, pp.29,33, 7-8 Feb. 2014. doi: 10.1109/ICICICT.2014.6781247 This paper address the selection of web services using tmodel of SOA which is designed using feed forward network. This construction will be done using XML language. Ontology provides a terminology about concepts and their relationships within a domain along with the activities taking place in that domain, and the theories, elementary principles governing that domain. Using supervised learning method of feed forward neural network, ontologies of different domain can be matched. Feed forward neural network can be used for pattern matching with back propagation techniques. Pattern defined here will be quality parameter. This quality parameter can be selected using tModel structure of UDDI. Web service Provider present in UDDI can differentiate services using Quality categorization by labeling the qualities i.e. performance, security. This differentiation be done using QoS ontology for service Identification. The registered service descriptions by the service provider contain the semantic profile and QoS parameters. ANN matching model consists of training phase and matching phase based on ontology domain.
  Keywords: Web services; XML; backpropagation; feedforward neural nets; ontologies (artificial intelligence); pattern matching; quality of service; QoS; QoS ontology;S OA tmodel; UDDI tModel structure; Web service provider; Web service selection; XML language; backpropagation technique; feedforward neural network; pattern matching; quality categorization; service identification supervised learning method; Artificial neural networks; Feeds; Neurons; Ontologies; Quality of service; Reliability; Service-oriented architecture; QoS; feedforward neural network; service: oriented architecture; tModel; web service repository builder (ID#:14-2960)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6781247&isnumber=6781240

• Buinevich, M.; Izrailov, K., "Method and utility for recovering code algorithms of telecommunication devices for vulnerability search," Advanced Communication Technology (ICACT), 2014 16th International Conference on, pp.172,176, 16-19 Feb. 2014. doi: 10.1109/ICACT.2014.6778943 The article describes a method for searching vulnerabilities in machine code based on the analysis of its algorithmized representation obtained with the help of an utility being a part of the method. Vulnerability search falls within the field of telecommunication devices. Phase-by-phase description of the method is discussed, as well as the software architecture of the utility and their limitations in terms of application and preliminary effectiveness estimate results. A forecast is given as to developing the method and the utility in the near future.
  Keywords: assembly language; binary codes; reverse engineering; security of data; algorithmized representation; code recovery algorithm; machine code; phase-by-phase description; software architecture; telecommunication devices; vulnerability search; Algorithm design and analysis; Assembly; Communications technology; Educational institutions; Information security; Software; Software algorithms; binary codes; information security; program language extension; reverse engineering and decompilation; telecommunications (ID#:14-2961)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6778943&isnumber=6778899

• Lau, R.Y.K.; Yunqing Xia; Yunming Ye, "A Probabilistic Generative Model for Mining Cybercriminal Networks from Online Social Media," Computational Intelligence Magazine, IEEE, vol.9, no.1, pp.31,43, Feb. 2014. doi: 10.1109/MCI.2013.2291689 There has been a rapid growth in the number of cybercrimes that cause tremendous financial loss to organizations. Recent studies reveal that cybercriminals tend to collaborate or even transact cyber-attack tools via the "dark markets" established in online social media. Accordingly, it presents unprecedented opportunities for researchers to tap into these underground cybercriminal communities to develop better insights about collaborative cybercrime activities so as to combat the ever increasing number of cybercrimes. The main contribution of this paper is the development of a novel weakly supervised cybercriminal network mining method to facilitate cybercrime forensics. In particular, the proposed method is underpinned by a probabilistic generative model enhanced by a novel context-sensitive Gibbs sampling algorithm. Evaluated based on two social media corpora, our experimental results reveal that the proposed method significantly outperforms the Latent Dirichlet Allocation (LDA) based method and the Support Vector Machine (SVM) based method by 5.23% and 16.62% in terms of Area Under the ROC Curve (AUC), respectively. It also achieves comparable performance as the state-of-the-art Partially Labeled Dirichlet Allocation (PLDA) method. To the best of our knowledge, this is the first successful research of applying a probabilistic generative model to mine cybercriminal networks from online social media.
  Keywords: data mining; digital forensics; sampling methods; social networking (online);AUC;PLDA method; area under the ROC curve; collaborative cybercrime activities; context-sensitive Gibbs sampling algorithm; cyber-attack tools; cybercrime forensics; dark markets; online social media; partially labeled Dirichlet allocation method; probabilistic generative model; social media corpora; supervised cybercriminal network mining method; underground cybercriminal communities; Computer crime; Computer security; Data mining; Hackers; Natural language processing; Network security; Probabilstic logic; Social network services (ID#:14-2962)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6710252&isnumber=6710231

• Bannour, B.; Escobedo, J.; Gaston, C.; Le Gall, P.; Pedroza, G., "Designing Sequence Diagram Models for Robustness to Attacks," Software Testing, Verification and Validation Workshops (ICSTW), 2014 IEEE Seventh International Conference on, pp.26,33, March 31 2014-April 4 2014. doi: 10.1109/ICSTW.2014.50 The omnipresence of complex distributed component-based systems offers numerous opportunities for malicious parties, especially thanks to the numerous communication mechanisms brought into play. This is particularly true for Smart Grids systems in which electricity networks and information technology are coupled to provide smarter and more efficient energy production-to-consumption chain. Indeed, Smart Grids are clearly security sensitive since a lot of components usually operate outside of the trusted company's border. In this paper, we propose a model-based methodology targeting the diagnostic of attacks with respect to some trusted components. The methodology combines UML sequence diagrams (SD) and formal symbolic techniques in order to model and analyze systems and threats from early design stages. We introduce a criterion that allows us to qualify or not a SD as robust with respect to an attack, also modeled as a SD. The criterion is defined by comparing traces as they are perceived by trusted components. We illustrate our approach with a UML sequence diagram issued from a Smart Grid case study.
  Keywords: Unified Modeling Language; diagrams; security of data; smart power grids; UML sequence diagrams; attack diagnostics ;complex distributed component-based systems; energy production-to-consumption chain; formal symbolic techniques; malicious parties; model-based methodology; security sensitivity; sequence diagram model design; smart grid systems; trusted components; Electricity; Registers; Security; Semantics; Smart grids; Unified modeling language; Robustness to attacks; attack diagnosis; model analysis; security watchdog testing; sequence diagrams; smart grids; symbolic execution} (ID#:14-2963)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6825635&isnumber=6825623

• Kishore, K.R.; Mallesh, M.; Jyostna, G.; Eswari, P.R.L.; Sarma, S.S., "Browser JS Guard: Detects and Defends Against Malicious Javascript Injection Based Drive By Download Attacks," Applications of Digital Information and Web Technologies (ICADIWT), 2014 Fifth International Conference on the, pp.92,100, 17-19 Feb. 2014. doi: 10.1109/ICADIWT.2014.6814705 In the recent times, most of the systems connected to Internet are getting infected with the malware and some of these systems are becoming zombies for the attacker. When user knowingly or unknowingly visits a malware website, his system gets infected. Attackers do this by exploiting the vulnerabilities in the web browser and acquire control over the underlying operating system. Once attacker compromises the users web browser, he can instruct the browser to visit the attackers website by using number of redirections. During the process, users web browser downloads the malware without the intervention of the user. Once the malware is downloaded, it would be placed in the file system and responds as per the instructions of the attacker. These types of attacks are known as Drive by Download attacks. Now-a-days, Drive by Download is the major channel for delivering the Malware. In this paper, Browser JS Guard an extension to the browser is presented for detecting and defending against Drive by Download attacks via HTML tags and JavaScript.
  Keywords: Java; Web sites; authoring languages; invasive software; online front-ends; operating systems (computers); security of data; HTML tags ;Internet; browser JS guard; download attacks; drive by download attacks; file system; malicious JavaScript injection; malware Web site; operating system; user Web browser; Browsers; HTML; Malware; Monitoring; Web pages; Web servers; DOM Change Methods; Drive by Download Attacks; HTML tags ;JavaScript Functions; Malware; Web Browser; Web Browser Extensions (ID#:14-2964)
  URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6814705&isnumber=6814661

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.