Fortifying Codebases: Secure Code Generation and Vulnerability Assessment with LLMs

“Essential Security Practices for Fortifying Mobile Apps” is a definitive guide designed to empower developers, security professionals, and organizations with the knowledge and tools needed to secure mobile applications in an increasingly complex digital landscape. This comprehensive book covers every aspect of mobile app security, providing actionable insights and practical strategies to protect apps from the ever-evolving threat landscape. The book begins with an Introduction to Mobile App Security (Chapter 1), where readers are introduced to the critical importance of securing mobile apps. It discusses common security threats, the principles of security by design, and the unique challenges faced in mobile app development. The chapter also includes case studies of major security breaches, offering real-world context to the concepts discussed. In Secure Development Lifecycle (Chapter 2), the book emphasizes the importance of integrating security into the Software Development Lifecycle (SDLC). Topics such as threat modeling, secure coding practices, and penetration testing are explored in depth. This chapter also covers the role of continuous integration in maintaining security and the necessity of incident response planning and security training. Authentication and Authorization (Chapter 3) dives into the mechanisms that ensure only authorized users have access to mobile apps. It covers secure authentication methods, including multi-factor authentication and token-based authentication, as well as best practices for session management and password storage. The chapter provides guidelines to avoid common authentication flaws that could compromise app security. Data Protection and Privacy (Chapter 4) addresses the crucial aspects of encrypting data both at rest and in transit. It discusses secure data storage, privacy by design principles, and the handling of personally identifiable information (PII). Readers will learn about secure data deletion and compliance with data protection regulations, as well as the use of secure cryptographic libraries. Network Security (Chapter 5) explores the protocols and techniques needed to secure communication between mobile apps and their backend systems. The chapter covers the correct use of TLS/SSL, protecting against man-in-the-middle attacks, and securing backend APIs. It also discusses the importance of monitoring and logging network activity to detect and respond to potential threats. The book then moves on to Secure Coding Practices (Chapter 6), providing guidance on avoiding common coding vulnerabilities through input validation, error handling, and defensive programming techniques. It also covers secure code reviews and the best practices for using mobile platform APIs securely. Mobile Device Security (Chapter 7) shifts focus to the security of the devices on which mobile apps run. The chapter discusses mobile device threats, secure device configuration, and the use of mobile device management (MDM) solutions. It also addresses the security features of mobile devices, such as secure boot and remote wiping, which are essential for protecting against device theft or loss. In Secure Deployment and Distribution (Chapter 8), readers will learn about secure strategies for deploying and distributing mobile apps. Topics include code signing, protecting against repackaging and tampering, and securely distributing sensitive data. The chapter also covers handling updates and patches, ensuring that apps remain secure after deployment. Security Testing and Validation (Chapter 9) provides an in-depth look at the various types of security testing, including automated and manual testing techniques. It discusses penetration testing best practices, vulnerability assessment, and the integration of security testing into CI/CD pipelines. Regular security audits and addressing found vulnerabilities are also emphasized. Incident Response and Management (Chapter 10) guides readers in building an effective incident response team and creating a robust incident response plan. The chapter covers the steps for detecting, analyzing, containing, eradicating, and recovering from security incidents. Post-incident analysis and communication with stakeholders are also discussed, alongside legal and regulatory considerations. Finally, Future Trends in Mobile App Security (Chapter 11) explores the emerging threats and advancements in mobile security technologies. The chapter discusses the role of artificial intelligence in security, the integration of IoT with mobile devices, and the potential of blockchain in enhancing mobile security. It also highlights the importance of user education and awareness in safeguarding mobile applications in the future. “Essential Security Practices for Fortifying Mobile Apps” is an invaluable resource for anyone involved in the development, deployment, and management of mobile applications, offering a thorough understanding of the security challenges and the strategies needed to overcome them.

Context. Android is the largest mobile platform today, with thousands of apps published and updated in the Google Play store everyday. Maintenance is an important factor in Android apps lifecycle, as it allows developers to constantly improve their apps and better tailor them to their user base. Goal. In this paper we investigate the evolution of various maintainability issues along the lifetime of Android apps. Method. We designed and conducted an empirical study on 434 GitHub repositories containing open, real (i.e., published in the Google Play store), and actively maintained Android apps. We statically analyzed 9,945 weekly snapshots of all apps for identifying their maintainability issues over time. We also identified maintainability hotspots along the lifetime of Android apps according to how their density of maintainability issues evolves over time. More than 2,000 GitHub commits belonging to identified hotspots have been manually categorized to understand the context in which maintainability hotspots occur. Results. Our results shed light on (i) how often various types of maintainability issues occur over the lifetime of Android apps, (ii) the evolution trends of the density of maintainability issues in Android apps, and (iii) an in-depth characterization of development activities related to maintainability hotspots. Together, these results can help Android developers in (i) better planning code refactoring sessions, (ii) better planning their code review sessions (e.g., steering the assignment of code reviews), and (iii) taking special care of their code quality when performing tasks belonging to activities highly correlated with maintainability issues. We also support researchers by objectively characterizing the state of the practice about maintainability of Android apps. Conclusions. Independently from the type of development activity, maintainability issues grow until they stabilize, but are never fully resolved.

Third-party security apps are an integral part of the Android app ecosystem. Many users install them as an extra layer of protection for their devices. By installing security apps, the smartphone users place a significant amount of trust on them allowing access to many smartphone resources that contain personal information such as the storage, text messages, email, and browser history. As such, it is essential to understand the mobile security apps ecosystem. In this paper, we present the first empirical study of Android security apps. We analyse 100 Android security apps from multiple aspects and offer insights to their operations and behaviours. Our results show that 20% of the security apps resell the data they collect to third parties; in some cases, even without the user consent. Also, we show that around 50% of the security apps fail to identify known malware.

The Android Application Programming Interface provides the necessary building blocks for app developers to harness the functionalities of the Android devices, including for interacting with services and accessing hardware. This API thus evolves rapidly to meet new requirements for security, performance and advanced features, creating a race for developers to update apps. Unfortunately, given the extent of the API and the lack of automated alerts on important changes, Android apps are suffered from API-related compatibility issues. These issues can manifest themselves as runtime crashes creating a poor user experience. We propose in this paper an automated approach named CiD for systematically modelling the lifecycle of the Android APIs and analysing app bytecode to flag usages that can lead to potential compatibility issues. We demonstrate the usefulness of CiD by helping developers repair their apps, and we validate that our tool outperforms the state-of-the-art on benchmark apps that take into account several challenges for automatic detection.

Mission-critical services (MCX) comprise a standardized suite of capabilities including Mission-Critical Push-to-Talk (MCPTT), MCVideo, and MCData, designed to meet stringent requirements for availability, reliability, latency, security, and Quality of Service (QoS). These services are essential for public safety, emergency response, and other critical infrastructure domains, where communication performance directly affects operational effectiveness. Integration into 4G and 5G mobile networks, supported by targeted standardization efforts, has extended broadband capabilities to mission-critical environments. 5G networks provide the technical foundations for MCX through ultra-low latency (below 1 ms), high availability (99.999%), broadband throughput over 100 Mbps per user, deterministic QoS via network slicing, massive device connectivity (over one million devices per square kilometer), and seamless Non-Terrestrial Network (NTN) integration. Technical enablers such as Proximity Services (ProSe), network slicing, and Ultra-Reliable Low-Latency Communications (URLLC) are fundamental to delivering these capabilities. This paper reviews MCX architectures, service frameworks, and protocols, relating MCPTT, MCData, and MCVideo to the key performance requirements defined in ITU-T M.2377-2. It also examines the frozen features of 3GPP Release 19, including enhancements to MC services, NTN integration, Reduced Capability device support, sub-meter positioning, extended network slicing for Public Protection and Disaster Relief (PPDR), and strengthened security mechanisms. Finally, the study addresses challenges such as standard maturity, interoperability, and deterministic QoS, identifying research priorities toward 6G readiness. By consolidating advances from standards bodies, research initiatives, and deployments, this work serves as a technical reference for scalable, secure, and standards-compliant MCX solutions in current and future networks.

Secure software engineering has emerged in recent decades by encouraging the idea of software security has to be an integral part of all the phases of the software development lifecycle. As a result, each phase of the lifecycle is associated with security-specific best practices such as threat modeling and static code analysis. It was observed that various artifacts (i.e., security requirements, architectural flaws, bug reports, security test cases) generated as a result of security best practices tend to be segregated. This creates a significant barrier to resolve the security issues at the implementation phase since most of them are originated in the design phase. In order to address this issue, this paper presents a knowledge-modeling based approach to semantically infer the associations between architectural level security flaws and code-level security bugs, which is manually tedious. Threat modeling and static analysis are used to identify security flaws and security bugs, respectively. The case study based experimental results revealed that the architectural level security flaws have a significant impact on originating security bugs in the code level. Besides, the evaluation results confirmed the scalability of the proposed approach to large-scale industrial software products.

The past decade has witnessed an explosive increase in the scale, intensity and sophistication of cyber attacks. While software vendors have significantly increased their efforts on security, they are almost always playing catch up. As a result, security-conscious organizations and individuals have come to expect their system administrators to deploy an array of tools and techniques to stay a step ahead of the hackers. While developer-oriented security tools rely mainly on static analysis, runtime analysis and policy enforcement are the mechanisms of choice in administrator-oriented tools. Runtime techniques offer increased automation and precision over static analysis, thus addressing the needs of administrators who don't have the time or resources needed to acquire extensive knowledge about the internals of a software system. In this talk, I will begin by summarizing some of the significant advances that have been achieved in the past few years in the context of software vulnerability mitigation, including buffer overflow defenses, and more recently, the impressive results that have been achieved using dynamic information-flow analysis for blocking the most popular exploits today, including SQL and command injection and cross-site scripting. I will then proceed to describe dynamic analysis and enforcement techniques aimed at another high-profile security problem faced today, namely, malware defense. Our initial target in this regard has been on dynamic analysis techniques for extracting high-level models of program behavior. These models could be used in a variety of applications such as intrusion detection, vulnerability analysis and security policy verification. More recently, interesting advances have been made in the context of security policy development, where a combination of static and dynamic analysis techniques have been developed to synthesize low-level, enforceable policies that achieve a high-level goal such as protecting system integrity. Finally, I will conclude the talk with a discussion of some research opportunities and challenges in software security.

The article analyzes approaches to software development that allow creating complex container applications with a microservice architecture based on automation tools and flexible development methods. The development of cloud technologies, the global strategy of containerization, the modernization of the application architecture, and the increase in security requirements have led to a change in the application development methodology. The study aims to determine approaches to increase the speed of development, security and quality of software code of containerized applications by implementing security principles and automation tools at all stages of the life cycle. Features and development prospects of microservice applications deployed in a container environment are considered. The advantages of the container infrastructure are defined: mobility, scalability, an additional level of microservice security. Containers provide an isolated environment for running a microservices, this reduces the risk of security vulnerabilities and simplifies interaction between microservices. The article identifies the security problems of microservice applications and the main vulnerabilities associated with the use of containers. It is determined that DevSecOps methodology allows implementing modern practice of continuous integration, continuous delivery, continuous application deployment and integration of security tools at all life cycle stages. DevSecOps describes development processes, deployment and operation processes using Security as Code and Infrastructure as Code practices. The research describes the model for developing and deploying microservice applications with containerization, defines the security domains, and the security controls for DevSecOps development pipeline. Based on this model, the main security control tools that must be used at all development and deployment pipeline stages are defined. The article proves that the considered technique regulates the implementation of given security procedures at all stages of the pipeline, allows to reduce development time and improve code quality for container applications with a microservices architecture.

Chapter 3 - Static Analysis

Over the years, as the software systems grew in complexity and connectivity, the risk of getting a vulnerability embedded in a piece of code has also significantly grown.Secure code review-a contemporary practice in software development-becomes the first and last line in defense of the cyberworld.Traditional code reviewing methods, which are attacked by way of static and dynamic analyses, have been useful but limited due to scaling issues, the false positives they cannot avoid, and the inability to adapt to changing threat landscapes.The review herein aims to elucidate the transformation of secure code review with AI-powered enhancement of both static and dynamic analysis techniques.AIpowered models, chiefly those of ML and NLP genres, have been contributing toward discovering vulnerabilities accurately, minimizing false-positive cases, and interpreting codes into further insights about behaviors.Inasmuch as the melding of AI with static tools such as CodeQL, SonarQube, and Semgrep and with dynamic tools such as AI-guided fuzzers turns the tide from reactive to proactive security, this paper focuses on the scientometric study of AI-assisted code review methods, tools, and research and attempts to answer issues of volume scarcity and integration.

With the continuous growth in the usage of Android apps, ensuring their security has become critically important. An increasing number of malicious apps adopt anti-analysis techniques to evade security measures. Although some research has started to consider anti-runtime analysis (ARA), it is unfortunate that they have not systematically examined ARA techniques. Furthermore, the rapid evolution of ARA technology exacerbates the issue, leading to increasingly inaccurate analysis results. To effectively analyze Android apps, understanding their adopted ARA techniques is necessary. However, no systematic investigation has been conducted thus far. <p xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">In this paper, we conduct the first systematic study of the ARA implementations in a wide range of 117,270 Android apps (including both malicious and benign ones) collected between 2016 and 2023. Additionally, we propose a specific investigation tool named <small>ARAP</small> to assist this study by leveraging both static and dynamic analysis. According to the evaluation results, <small>ARAP</small> not only effectively identifies the ARA implementations in Android apps but also reveals many important findings. For instance, almost all apps have implemented at least one category of ARA technology (99.6% for benign apps and 97.0% for malicious apps).

Coding standard violations, defect patterns and non-conformance to best practices are abundant in checked-in source code. This often leads to unmaintainable code and potential bugs in later stages of software life cycle. It is important to detect and correct these issues early in the development cycle, when it is less expensive to fix. Even though static analysis techniques such as tool-assisted code review are effective in addressing this problem, there is significant amount of human effort involved in identifying the source code issues and fixing it. Review Bot is a tool designed to reduce the human effort and improve the quality in code reviews by generating automatic reviews using static analysis output. In this paper, we propose an extension to Review Bot- addition of a component called Fix-it for the auto-correction of various source code issues using Abstract Syntax Tree (AST) transformations. Fix-it uses built-in fixes to automatically fix various issues reported by the auto-reviewer component in Review Bot, thereby reducing the human effort to greater extent. Fix-it is designed to be highly extensible-users can add support for the detection of new defect patterns using XPath or XQuery and provide fixes for it based on AST transformations written in a high-level programming language. It allows the user to treat the AST as a DOM tree and run XQuery UPDATE expressions to perform AST transformations as part of a fix. Fix-it also includes a designer application which enables Review Bot administrators to design new defect patterns and fixes. The developer feedback on a stand-alone prototype indicates the possibility of significant human effort reduction in code reviews using Fix-it.

Companies develop their software in versions and iterations. Ensuring the security of each additional version using code review is costly and time consuming. This paper investigates automated tracing of the impacts of code changes on the security of a given software. To this end, we use call graphs to model the software code, and security assurance cases to model the security requirements of the software. Then we relate assurance case elements to code through the entry point methods of the software, creating a map of monitored security functions. This mapping allows to evaluate the security requirements that are affected by code changes. The approach is implemented in a set of tools and evaluated using three open-source ERP/E-commerce software applications. The limited evaluation showed that the approach is effective in identifying the impacts of code changes on the security of the software. The approach promises to considerably reduce the security assessment time of the subsequent releases and iterations of software, keeping the initial security state throughout the software lifetime.

It is essential to ensure the data security of data analytical frameworks as any security vulnerability existing in the system can lead to a data loss or data breach. This vulnerability may occur due to attacks from live attackers as well as automated bots. However inside attacks are also becoming more frequent because of incorrectly implemented security requirements and access control policies. Thus, it is important to understand security goals and formulate security requirements and access control policies accordingly. Therefore, it is equally important to identify the existing security vulnerabilities of a given software system. To find the available vulnerabilities against any system, it is mandatory to conduct vulnerability assessments as scheduled tasks in a regular manner. Thus, an easily deployable, easily maintainable, accurate vulnerability assessment testbed or a model is helpful as facilitated by Linux containers. Nowadays Linux containers (LXCs) which have operating system level virtualization, are very popular over virtual machines (VMs) which have hypervisor or kernel level virtualization in high performance computing (HPC) due to reasons, such as high portability, high performance, efficiency and high security (Chae et al in Clust Comput 22:1765-1775, 2019. https://doi.org/10.1007/s10586-017-1511-2 ). Hence, LXCs can make an efficient and scalable vulnerability assessment testbed or a model by using already developed analyzing tools such as OpenVas, Dagda, PortSpider, MongoAudit, NMap, Metasploit Framework, Nessus, OWASP Zed Attack Proxy, and OpenSCAP, to assure the required security level of a given system very easily. To verify the overall security of any given software system, this paper first introduces a virtual, portable and easily deployable vulnerability assessment general testbed within the Linux container network. Next, the paper presents, how to conduct experiments using this testbed on a MongoDB database implemented in Singularity Linux containers to find the available vulnerabilities in 1. MongoDB application itself, 2. Images accompanied by containers, 3. Host, and 4. Network by integrating seven tools: OpenVas, Dagda, PortSpider, MongoAudit, NMap, Metasploit Framework, and Nessus to the container-based testbed. Finally, it discusses how to use generated results to improve the security level of the given system.

Cryptomining malware (also referred to as cryptojacking) has changed the cyber threat landscape. Such malware exploits the victim’s CPU or GPU resources with the aim of generating cryptocurrency. In this paper, we study the potential of using deep learning techniques to detect cryptomining malware by utilizing both static and dynamic analysis approaches. To facilitate dynamic analysis, we establish an environment to capture the system call events of 1500 Portable Executable (PE) samples of the cryptomining malware. We also demonstrate how one can perform static analysis of PE files’ opcode sequences. In our study, we evaluate the performance of using Long Short-Term Memory (LSTM), Attention-based LSTM (ATT-LSTM), and Convolutional Neural Networks (CNN) on our sequential data (opcodes and system call invocations) for classification by a Softmax function. We achieve an accuracy rate of 95% in the static analysis and an accuracy rate of 99% in the dynamic analysis.