首页 > 最新文献

Int. J. Syst. Softw. Secur. Prot.最新文献

英文 中文
A Goal-Oriented Approach to Requirements Development and Quantitative Security Assurance 面向目标的需求开发和定量安全保证方法
Pub Date : 2021-01-01 DOI: 10.4018/IJSSSP.2021010103
Zhengshu Zhou, Qiang Zhi, Zilong Liang, Shuji Morisaki
When deciding and evaluating system security strategies, there is a trade-off relationship between security assuring effect and constraint condition, which has been revealed by many qualitative security assurance methods. However, the existing methods cannot be used to make quantitative analysis on security assurance and constraint conditions to support project managers and system engineers to decide system development strategies. Therefore, a quantitative method which can consider both security strategies and constraints is necessary. This paper proposes a semi-automatic, quantitative system security assurance approach for developing security requirement and security assurance cases by extending the traditional GSN (goal structuring notation). Next, two greedy algorithms for quantitative system security assurance are implemented and evaluated. In addition, a case study and an experiment are carried out to verify the effectiveness and efficiency of the proposed approach and the proposed algorithms.
在确定和评估系统安全策略时,安全保证效果与约束条件之间存在权衡关系,许多定性安全保证方法都揭示了这一点。然而,现有的方法无法对安全保证和约束条件进行定量分析,以支持项目经理和系统工程师制定系统开发策略。因此,需要一种既能考虑安全策略又能考虑约束的定量方法。本文通过对传统GSN(目标结构符号)的扩展,提出了一种半自动、定量的系统安全保障方法,用于开发安全需求和安全保障案例。其次,实现并评估了两种用于定量系统安全保证的贪心算法。最后,通过实例分析和实验验证了所提方法和算法的有效性和高效性。
{"title":"A Goal-Oriented Approach to Requirements Development and Quantitative Security Assurance","authors":"Zhengshu Zhou, Qiang Zhi, Zilong Liang, Shuji Morisaki","doi":"10.4018/IJSSSP.2021010103","DOIUrl":"https://doi.org/10.4018/IJSSSP.2021010103","url":null,"abstract":"When deciding and evaluating system security strategies, there is a trade-off relationship between security assuring effect and constraint condition, which has been revealed by many qualitative security assurance methods. However, the existing methods cannot be used to make quantitative analysis on security assurance and constraint conditions to support project managers and system engineers to decide system development strategies. Therefore, a quantitative method which can consider both security strategies and constraints is necessary. This paper proposes a semi-automatic, quantitative system security assurance approach for developing security requirement and security assurance cases by extending the traditional GSN (goal structuring notation). Next, two greedy algorithms for quantitative system security assurance are implemented and evaluated. In addition, a case study and an experiment are carried out to verify the effectiveness and efficiency of the proposed approach and the proposed algorithms.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"126 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122636055","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Graph Classification Using Back Propagation Learning Algorithms 使用反向传播学习算法的图分类
Pub Date : 2020-07-01 DOI: 10.4018/ijsssp.2020070101
Abhijit Bera, M. Ghose, D. Pal
Due to the propagation of graph data, there has been a sharp focus on developing effective methods for classifying the graph object. As most of the proposed graph classification techniques though effective are constrained by high computational overhead, there is a consistent effort to improve upon the existing classification algorithms in terms of higher accuracy and less computational time. In this paper, an attempt has been made to classify graphs by extracting various features and selecting the important features using feature selection algorithms. Since all the extracted graph-based features need not be equally important, only the most important features are selected by using back propagation learning algorithm. The results of the proposed study of feature-based approach using back propagation learning algorithm lead to higher classification accuracy with faster computational time in comparison to other graph kernels. It also appears to be more effective for large unlabeled graphs.
由于图数据的传播,开发有效的图对象分类方法已成为人们关注的焦点。由于大多数提出的图分类技术虽然有效,但受到高计算开销的限制,因此人们一直在努力改进现有的分类算法,以提高准确率和减少计算时间。本文尝试通过特征选择算法提取各种特征并选择重要特征对图进行分类。由于提取的所有基于图的特征不需要同等重要,因此使用反向传播学习算法只选择最重要的特征。采用反向传播学习算法的基于特征的方法的研究结果与其他图核相比具有更高的分类精度和更快的计算时间。对于大型的未标记图形,它似乎也更有效。
{"title":"Graph Classification Using Back Propagation Learning Algorithms","authors":"Abhijit Bera, M. Ghose, D. Pal","doi":"10.4018/ijsssp.2020070101","DOIUrl":"https://doi.org/10.4018/ijsssp.2020070101","url":null,"abstract":"Due to the propagation of graph data, there has been a sharp focus on developing effective methods for classifying the graph object. As most of the proposed graph classification techniques though effective are constrained by high computational overhead, there is a consistent effort to improve upon the existing classification algorithms in terms of higher accuracy and less computational time. In this paper, an attempt has been made to classify graphs by extracting various features and selecting the important features using feature selection algorithms. Since all the extracted graph-based features need not be equally important, only the most important features are selected by using back propagation learning algorithm. The results of the proposed study of feature-based approach using back propagation learning algorithm lead to higher classification accuracy with faster computational time in comparison to other graph kernels. It also appears to be more effective for large unlabeled graphs.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115481107","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A Security Review of Event-Based Application Function and Service Component Architecture 基于事件的应用程序功能和服务组件体系结构的安全性综述
Pub Date : 2020-07-01 DOI: 10.4018/ijsssp.2020070104
Faisal Nabi, J. Yong, Xiaohui Tao
The term service component is derived from SCA (service component architecture) for event based distributed system design. Although service component pattern offers composite application development and support application reusability functionality. However, security in event based communication in components interaction model mostly discussed on upper layer in SCA while developing service oriented component application logic. This layer is called application business process logic layer, which produces the application's rendering logic, having being authenticated from ACL.The need for such a comprehensive security review is required in this field that could possibly elaborate the issues in composite application and Event based attack in service component architecture model. The paper achieves this target by analysing, reviewing the security issues, modelling techniques in service component application functionality, while application components, that produces, consume, and processing events.
术语“服务组件”源于用于基于事件的分布式系统设计的SCA(服务组件体系结构)。虽然服务组件模式提供了复合应用程序开发和支持应用程序可重用性的功能。然而,SCA在开发面向服务的组件应用逻辑时,主要在上层讨论组件交互模型中基于事件通信的安全性问题。此层称为应用程序业务流程逻辑层,它生成应用程序的呈现逻辑,并通过ACL进行身份验证。在这个领域中,需要进行这种全面的安全审查,这可能会详细说明复合应用程序和服务组件体系结构模型中基于事件的攻击中的问题。本文通过分析、回顾服务组件应用程序功能中的安全问题和建模技术,以及产生、消费和处理事件的应用程序组件,来实现这一目标。
{"title":"A Security Review of Event-Based Application Function and Service Component Architecture","authors":"Faisal Nabi, J. Yong, Xiaohui Tao","doi":"10.4018/ijsssp.2020070104","DOIUrl":"https://doi.org/10.4018/ijsssp.2020070104","url":null,"abstract":"The term service component is derived from SCA (service component architecture) for event based distributed system design. Although service component pattern offers composite application development and support application reusability functionality. However, security in event based communication in components interaction model mostly discussed on upper layer in SCA while developing service oriented component application logic. This layer is called application business process logic layer, which produces the application's rendering logic, having being authenticated from ACL.The need for such a comprehensive security review is required in this field that could possibly elaborate the issues in composite application and Event based attack in service component architecture model. The paper achieves this target by analysing, reviewing the security issues, modelling techniques in service component application functionality, while application components, that produces, consume, and processing events.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128775623","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Towards a Secure DevOps Approach for Cyber-Physical Systems: An Industrial Perspective 面向网络物理系统的安全开发运维方法:工业视角
Pub Date : 2020-07-01 DOI: 10.4018/ijsssp.2020070103
P. Abrahamsson, Goetz Botterweck, Hadi Ghanbari, M. Jaatun, Petri Kettunen, T. Mikkonen, Anila Mjeda, Jürgen Münch, A. Duc, B. Russo, Xiaofeng Wang
With the expansion of cyber-physical systems (CPSs) across critical and regulated industries, systems must be continuously updated to remain resilient. At the same time, they should be extremely secure and safe to operate and use. The DevOps approach caters to business demands of more speed and smartness in production, but it is extremely challenging to implement DevOps due to the complexity of critical CPSs and requirements from regulatory authorities. In this study, expert opinions from 33 European companies expose the gap in the current state of practice on DevOps-oriented continuous development and maintenance. The study contributes to research and practice by identifying a set of needs. Subsequently, the authors propose a novel approach called Secure DevOps and provide several avenues for further research and development in this area. The study shows that, because security is a cross-cutting property in complex CPSs, its proficient management requires system-wide competencies and capabilities across the CPSs development and operation.
随着网络物理系统(cps)在关键和受监管行业的扩展,系统必须不断更新以保持弹性。同时,他们应该是非常安全的和安全的操作和使用。DevOps方法迎合了业务对生产中更快和更智能的需求,但由于关键cps的复杂性和监管机构的要求,实现DevOps极具挑战性。在本研究中,来自33家欧洲公司的专家意见揭示了目前在面向devops的持续开发和维护的实践状态中的差距。该研究通过确定一系列需求,有助于研究和实践。随后,作者提出了一种称为安全DevOps的新方法,并为该领域的进一步研究和开发提供了几种途径。研究表明,由于安全在复杂的cps中是一个横切的属性,其熟练的管理需要整个cps开发和操作的系统范围的能力和能力。
{"title":"Towards a Secure DevOps Approach for Cyber-Physical Systems: An Industrial Perspective","authors":"P. Abrahamsson, Goetz Botterweck, Hadi Ghanbari, M. Jaatun, Petri Kettunen, T. Mikkonen, Anila Mjeda, Jürgen Münch, A. Duc, B. Russo, Xiaofeng Wang","doi":"10.4018/ijsssp.2020070103","DOIUrl":"https://doi.org/10.4018/ijsssp.2020070103","url":null,"abstract":"With the expansion of cyber-physical systems (CPSs) across critical and regulated industries, systems must be continuously updated to remain resilient. At the same time, they should be extremely secure and safe to operate and use. The DevOps approach caters to business demands of more speed and smartness in production, but it is extremely challenging to implement DevOps due to the complexity of critical CPSs and requirements from regulatory authorities. In this study, expert opinions from 33 European companies expose the gap in the current state of practice on DevOps-oriented continuous development and maintenance. The study contributes to research and practice by identifying a set of needs. Subsequently, the authors propose a novel approach called Secure DevOps and provide several avenues for further research and development in this area. The study shows that, because security is a cross-cutting property in complex CPSs, its proficient management requires system-wide competencies and capabilities across the CPSs development and operation.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"106 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115366814","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Handling Minority Class Problem in Threats Detection Based on Heterogeneous Ensemble Learning Approach 基于异构集成学习方法处理威胁检测中的少数类问题
Pub Date : 2020-07-01 DOI: 10.4018/ijsssp.2020070102
H. Eke, Andrei V. Petrovski, Hatem Ahriz
Multiclass problems, such as detecting multi-steps behaviour of advanced persistent threats (APTs), have been a major global challenge due to their capability to navigates around defenses and to evade detection for a prolonged period. Targeted APT attacks present an increasing concern for both cyber security and business continuity. Detecting the rare attack is a classification problem with data imbalance. This paper explores the applications of data resampling techniques together with heterogeneous ensemble approach for dealing with data imbalance caused by unevenly distributed data elements among classes with the focus on capturing the rare attack. It has been shown that the suggested algorithms provide not only detection capability but can also classify malicious data traffic corresponding to rare APT attacks.
多类问题,如检测高级持续威胁(apt)的多步骤行为,由于它们能够绕过防御并长时间逃避检测,一直是全球面临的主要挑战。有针对性的APT攻击给网络安全和业务连续性带来了越来越多的担忧。检测罕见攻击是一个数据不平衡的分类问题。本文探讨了数据重采样技术与异构集成方法在处理类间数据元素分布不均匀导致的数据不平衡中的应用,重点关注捕获罕见攻击。研究表明,所提出的算法不仅提供检测能力,而且可以对罕见的APT攻击对应的恶意数据流量进行分类。
{"title":"Handling Minority Class Problem in Threats Detection Based on Heterogeneous Ensemble Learning Approach","authors":"H. Eke, Andrei V. Petrovski, Hatem Ahriz","doi":"10.4018/ijsssp.2020070102","DOIUrl":"https://doi.org/10.4018/ijsssp.2020070102","url":null,"abstract":"Multiclass problems, such as detecting multi-steps behaviour of advanced persistent threats (APTs), have been a major global challenge due to their capability to navigates around defenses and to evade detection for a prolonged period. Targeted APT attacks present an increasing concern for both cyber security and business continuity. Detecting the rare attack is a classification problem with data imbalance. This paper explores the applications of data resampling techniques together with heterogeneous ensemble approach for dealing with data imbalance caused by unevenly distributed data elements among classes with the focus on capturing the rare attack. It has been shown that the suggested algorithms provide not only detection capability but can also classify malicious data traffic corresponding to rare APT attacks.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"85 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124657941","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Towards a Conceptual Framework for Security Requirements Work in Agile Software Development 面向敏捷软件开发中安全需求工作的概念框架
Pub Date : 2020-01-01 DOI: 10.4018/ijsssp.2020010103
Inger Anne Tøndel, M. Jaatun
Security requirement work plays a key role in achieving cost-effective and adequate security in a software development project. Knowledge about software companies' experiences of security requirement work is important in order to bridge the observed gap between software security practices and security risks in many projects today. Particularly, such knowledge can help researchers improve on available practices and recommendations. This article uses the results of published empirical studies on security requirement work to create a conceptual framework that shows key concepts related to work context, this work itself and the effects of this work. The resulting framework points to the following research challenges: 1) Identifying and understanding factors important for the effect of security requirements work; 2) Understanding what is the importance of the chosen requirements approach itself, and; 3) Properly taking into account contextual factors, especially factors related to individuals and interactions, in planning and analysis of empirical studies on security requirements work.
在软件开发项目中,安全性需求工作在实现成本效益和充分的安全性方面起着关键作用。了解软件公司在安全需求工作方面的经验是很重要的,这是为了弥合当今许多项目中软件安全实践与安全风险之间的差距。特别是,这些知识可以帮助研究人员改进现有的实践和建议。本文使用发表的关于安全需求工作的实证研究的结果来创建一个概念性框架,该框架显示了与工作环境、工作本身和工作效果相关的关键概念。由此产生的框架指出了以下研究挑战:1)识别和理解对安全需求工作的影响重要的因素;2)理解所选择的需求方法本身的重要性;3)在安全需求工作的实证研究规划和分析中,适当考虑情境因素,特别是与个体和交互相关的因素。
{"title":"Towards a Conceptual Framework for Security Requirements Work in Agile Software Development","authors":"Inger Anne Tøndel, M. Jaatun","doi":"10.4018/ijsssp.2020010103","DOIUrl":"https://doi.org/10.4018/ijsssp.2020010103","url":null,"abstract":"Security requirement work plays a key role in achieving cost-effective and adequate security in a software development project. Knowledge about software companies' experiences of security requirement work is important in order to bridge the observed gap between software security practices and security risks in many projects today. Particularly, such knowledge can help researchers improve on available practices and recommendations. This article uses the results of published empirical studies on security requirement work to create a conceptual framework that shows key concepts related to work context, this work itself and the effects of this work. The resulting framework points to the following research challenges: 1) Identifying and understanding factors important for the effect of security requirements work; 2) Understanding what is the importance of the chosen requirements approach itself, and; 3) Properly taking into account contextual factors, especially factors related to individuals and interactions, in planning and analysis of empirical studies on security requirements work.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131379877","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Factors in Information Assurance Professionals' Intentions to Adhere to Information Security Policies 信息保障专业人员坚持信息安全政策意图的因素
Pub Date : 2020-01-01 DOI: 10.4018/ijsssp.2020010102
S. Muller, Mary L. Lind
Information security policies (ISPs) serve to clarify and formalize organizational information security practices and reduce data risks, but research shows that ISP noncompliance remains a prominent concern for both scholars and practitioners. This study utilized the unified theory of acceptance and use of technology 2 (UTAUT2) to explore factors that predict information assurance professionals' behavioral intentions to comply with ISPs. The research question addressed: To what extent do performance expectancy, effort expectancy, social influence, facilitating conditions, hedonic motivation, price value, and habit predict information assurance professionals' behavioral intention to comply with information security policies in organizations? A nonexperimental, cross-sectional research design using structural equation modeling (PLS-SEM) addressed the research question with information assurance professionals in government agencies where habit emerged as the important component of ISP compliance with hedonic factors having a negative impact.
信息安全政策(ISP)用于澄清和形式化组织信息安全实践并降低数据风险,但研究表明,ISP不合规仍然是学者和从业者关注的突出问题。本研究利用技术接受和使用的统一理论(UTAUT2)来探讨预测信息保障专业人员遵守isp的行为意图的因素。研究的问题是:绩效预期、努力预期、社会影响、促进条件、享乐动机、价格价值和习惯在多大程度上预测了信息保障专业人员在组织中遵守信息安全政策的行为意图?利用结构方程模型(PLS-SEM)对政府机构的信息保障专业人员进行了一项非实验的横断面研究设计,其中习惯成为ISP遵守的重要组成部分,享乐因素具有负面影响。
{"title":"Factors in Information Assurance Professionals' Intentions to Adhere to Information Security Policies","authors":"S. Muller, Mary L. Lind","doi":"10.4018/ijsssp.2020010102","DOIUrl":"https://doi.org/10.4018/ijsssp.2020010102","url":null,"abstract":"Information security policies (ISPs) serve to clarify and formalize organizational information security practices and reduce data risks, but research shows that ISP noncompliance remains a prominent concern for both scholars and practitioners. This study utilized the unified theory of acceptance and use of technology 2 (UTAUT2) to explore factors that predict information assurance professionals' behavioral intentions to comply with ISPs. The research question addressed: To what extent do performance expectancy, effort expectancy, social influence, facilitating conditions, hedonic motivation, price value, and habit predict information assurance professionals' behavioral intention to comply with information security policies in organizations? A nonexperimental, cross-sectional research design using structural equation modeling (PLS-SEM) addressed the research question with information assurance professionals in government agencies where habit emerged as the important component of ISP compliance with hedonic factors having a negative impact.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122498902","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Analysing Information Security Risk Ontologies 分析信息安全风险本体
Pub Date : 2020-01-01 DOI: 10.4018/ijsssp.2020010101
Ines Meriah, Latifa Ben Arfa Rabai
This research work presents existing security ontologies and identifies relevant security ontology requirements in information systems. Moreover, it proposes a new classification of security ontologies in which, two main families, namely ontologies-based security standards and ontologies-based security risk assessment, are defined. For each family, a set of related research works is selected and a thorough description of their security ontologies is presented. The purpose of this analysis is to identify security ontology requirements as well as ontological characteristics for each study in order to help a security decision maker to select an ontology based off of their security risks and requirements as well as their needed security models and standards. By selecting the appropriate ontology, security stakeholders support security compliance and risk assessment in an enterprise.
本研究提出了现有的安全本体,并确定了信息系统中相关的安全本体需求。提出了一种新的安全本体分类方法,定义了基于本体的安全标准和基于本体的安全风险评估两大类。对于每个家庭,选择了一组相关的研究工作,并对其安全本体进行了全面的描述。此分析的目的是确定每个研究的安全本体论需求和本体论特征,以帮助安全决策者根据其安全风险和需求以及所需的安全模型和标准选择本体。通过选择适当的本体,安全涉众支持企业中的安全遵从性和风险评估。
{"title":"Analysing Information Security Risk Ontologies","authors":"Ines Meriah, Latifa Ben Arfa Rabai","doi":"10.4018/ijsssp.2020010101","DOIUrl":"https://doi.org/10.4018/ijsssp.2020010101","url":null,"abstract":"This research work presents existing security ontologies and identifies relevant security ontology requirements in information systems. Moreover, it proposes a new classification of security ontologies in which, two main families, namely ontologies-based security standards and ontologies-based security risk assessment, are defined. For each family, a set of related research works is selected and a thorough description of their security ontologies is presented. The purpose of this analysis is to identify security ontology requirements as well as ontological characteristics for each study in order to help a security decision maker to select an ontology based off of their security risks and requirements as well as their needed security models and standards. By selecting the appropriate ontology, security stakeholders support security compliance and risk assessment in an enterprise.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128425395","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
TLS Certificates of the Tor Network and Their Distinctive Features Tor网络的TLS证书及其特点
Pub Date : 2019-07-01 DOI: 10.4018/ijsssp.2019070102
V. Lapshichyov
This article presents the results of an experimental study of the properties of SSL/TLS certificates of an anonymous Tor network, based on which it is concluded that there are several features that differ from other SSL/TLS certificates. At present, in the scientific literature and in the documentation of U.S. National Security Agency, and the U.K. Government Communications Headquarters devoted to the identification of Tor network traffic, two signs of SSL/TLS certificates are indicated - the name of the certificate subject, as well as the port of the certificate transmission and network connection. The results of an experimental study allow the authors to state with a high degree of probability that Tor network certificates can be identified in the data stream between the client and server of the specified network by their size, which is between 400 and 600 bytes. The list of features of the Tor network certificates is intended to develop software or add-ons to existing ones, which is used to block access of Internet users to Darknet resources or to limit the use of the Tor anonymous network service. Based on data on the distinguishing features of Tor network certificates, an algorithm is proposed for blocking access to the Internet for users of the Tor Bundle.
本文介绍了对匿名Tor网络的SSL/TLS证书属性的实验研究结果,在此基础上得出了与其他SSL/TLS证书不同的几个特征。目前,在科学文献中以及美国国家安全局和英国政府通信总部专门用于识别Tor网络流量的文件中,SSL/TLS证书有两个标志——证书主体的名称,以及证书传输和网络连接的端口。实验研究的结果使作者有很高的概率表明,Tor网络证书可以在指定网络的客户端和服务器之间的数据流中通过其大小来识别,其大小在400到600字节之间。Tor网络证书的功能列表旨在开发现有软件或附加组件,用于阻止互联网用户访问暗网资源或限制Tor匿名网络服务的使用。基于Tor网络证书的特征,提出了一种阻止Tor Bundle用户访问Internet的算法。
{"title":"TLS Certificates of the Tor Network and Their Distinctive Features","authors":"V. Lapshichyov","doi":"10.4018/ijsssp.2019070102","DOIUrl":"https://doi.org/10.4018/ijsssp.2019070102","url":null,"abstract":"This article presents the results of an experimental study of the properties of SSL/TLS certificates of an anonymous Tor network, based on which it is concluded that there are several features that differ from other SSL/TLS certificates. At present, in the scientific literature and in the documentation of U.S. National Security Agency, and the U.K. Government Communications Headquarters devoted to the identification of Tor network traffic, two signs of SSL/TLS certificates are indicated - the name of the certificate subject, as well as the port of the certificate transmission and network connection. The results of an experimental study allow the authors to state with a high degree of probability that Tor network certificates can be identified in the data stream between the client and server of the specified network by their size, which is between 400 and 600 bytes. The list of features of the Tor network certificates is intended to develop software or add-ons to existing ones, which is used to block access of Internet users to Darknet resources or to limit the use of the Tor anonymous network service. Based on data on the distinguishing features of Tor network certificates, an algorithm is proposed for blocking access to the Internet for users of the Tor Bundle.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115500429","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Towards a UMLsec-Based Proctored Examination Model 基于umlsec的监考模型研究
Pub Date : 2019-07-01 DOI: 10.4018/ijsssp.2019070103
I. Fadahunsi, O. Arogundade, A. Sodiya, B. Olajuwon
Electronic examination systems are becoming increasingly complex and intensive to develop with the introduction of virtual invigilator in proctored examinations. In order to address this complexity issue, there is evident need to have a global model that is extensible. Modeling software systems enables developers to better understand the system they are building and offers opportunities for simplification and reuse. This article presents an extension to UMLsec, by introducing three (3) new stereotypes which were added to the UMLsec Profile for a Proctored e-Exam model. The model was validated and converted to a platform specific model using the Java stereotype available on Papyrus. This enabled the model generate Java classes which can be used for the implementation of a secure proctored e-exam system. The model allows developers with little or no knowledge in security to use the model to build proctored e-exam systems and to incorporate all known security requirements. The model can also be extended to accommodate new security solutions for e-exam systems as they are discovered.
随着虚拟监考系统的引入,电子考试系统正变得越来越复杂和密集。为了解决这个复杂性问题,显然需要一个可扩展的全局模型。软件系统建模使开发人员能够更好地理解他们正在构建的系统,并为简化和重用提供了机会。本文通过介绍三(3)个新的原型,展示了UMLsec的扩展,这些原型被添加到用于监考电子考试模型的UMLsec概要文件中。使用Papyrus上可用的Java原型验证了模型并将其转换为特定于平台的模型。这使模型能够生成可用于实现安全监考电子考试系统的Java类。该模型允许对安全性知之甚少或一无所知的开发人员使用该模型来构建监考电子考试系统,并纳入所有已知的安全需求。该模型还可以扩展,以适应新发现的电子考试系统的安全解决方案。
{"title":"Towards a UMLsec-Based Proctored Examination Model","authors":"I. Fadahunsi, O. Arogundade, A. Sodiya, B. Olajuwon","doi":"10.4018/ijsssp.2019070103","DOIUrl":"https://doi.org/10.4018/ijsssp.2019070103","url":null,"abstract":"Electronic examination systems are becoming increasingly complex and intensive to develop with the introduction of virtual invigilator in proctored examinations. In order to address this complexity issue, there is evident need to have a global model that is extensible. Modeling software systems enables developers to better understand the system they are building and offers opportunities for simplification and reuse. This article presents an extension to UMLsec, by introducing three (3) new stereotypes which were added to the UMLsec Profile for a Proctored e-Exam model. The model was validated and converted to a platform specific model using the Java stereotype available on Papyrus. This enabled the model generate Java classes which can be used for the implementation of a secure proctored e-exam system. The model allows developers with little or no knowledge in security to use the model to build proctored e-exam systems and to incorporate all known security requirements. The model can also be extended to accommodate new security solutions for e-exam systems as they are discovered.","PeriodicalId":135841,"journal":{"name":"Int. J. Syst. Softw. Secur. Prot.","volume":"68 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123958669","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
Int. J. Syst. Softw. Secur. Prot.
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1