Interactive sensitive data exposure detection through static analysis

Achieving comprehensive code quality and ensuring software reliability are critical goals in modern software engineering. This paper delves into advanced strategies that encompass both technical and organizational practices, aiming to enhance code quality and boost software reliability. Key strategies include the implementation of rigorous code review processes, adoption of automated testing frameworks, and the utilization of static and dynamic code analysis tools. Firstly, rigorous code review processes are fundamental for maintaining high standards of code quality. By fostering a collaborative environment where peer reviews are routine, teams can catch potential issues early, ensure adherence to coding standards, and promote knowledge sharing. This practice not only improves code quality but also enhances team cohesion and expertise. Secondly, automated testing frameworks are indispensable in achieving comprehensive test coverage and reducing the incidence of bugs. Unit tests, integration tests, and end-to-end tests, when automated, provide continuous feedback and ensure that code changes do not introduce new defects. This continuous testing approach is crucial for maintaining software reliability, especially in agile and DevOps environments where rapid iterations are common. Furthermore, the integration of static and dynamic code analysis tools into the development pipeline offers additional layers of quality assurance. Static analysis tools inspect the codebase for potential vulnerabilities, code smells, and compliance with coding standards without executing the program. Dynamic analysis tools, on the other hand, evaluate the software during runtime to detect memory leaks, concurrency issues, and performance bottlenecks. Together, these tools provide a comprehensive assessment of the code’s health and reliability. Moreover, fostering a culture of continuous improvement and learning within the development team is essential. Regular training sessions, workshops, and knowledge-sharing activities help in keeping the team updated with the latest advancements in software engineering practices and tools. Encouraging a mindset of quality-first and reliability among developers ensures long-term benefits and sustainability. In conclusion, achieving comprehensive code quality and ensuring software reliability require a multifaceted approach that integrates rigorous code reviews, automated testing frameworks, and both static and dynamic analysis tools. Coupled with a strong culture of continuous learning and improvement, these strategies collectively contribute to the development of robust, reliable, and high-quality software systems. Keywords: Software Reliability, Code Quality, Advanced, Strategies, Comprehensive.

In this study, we present the uitHyDroid system, which allows the detection of sensitive data leakage via multi-applications using hybrid analysis. uitHyDroid uses static analysis to collect user interface elements that must interact to illuminate possible sensitive data flows. In addition, dynamic analysis is used to capture inter-application communications to link partial sensitive data flows from static analysis. This approach is faster than using only dynamic analysis. In this study, we use hooking technology to conduct dynamic analysis phase emulator modification. The experimental results show that the proposed system can detect most sensitive data leakages for both our dataset and real-world applications.

Ethereum smart contracts are computer programs that are deployed and executed on the Ethereum blockchain to enforce agreements among untrusting parties. Being the most prominent platform that supports smart contracts, Ethereum has been targeted by many attacks and plagued by security incidents. Consequently, many smart contract vulnerabilities have been discovered in the past decade. To detect and prevent such vulnerabilities, different security analysis tools, including static and dynamic analysis tools, have been created, but their performance decreases drastically when codes to be analyzed are constantly being rewritten. In this paper, we propose Eth2Vec, a machine-learning-based static analysis tool that detects smart contract vulnerabilities. Eth2Vec maintains its robustness against code rewrites; i.e., it can detect vulnerabilities even in rewritten codes. Other machine-learning-based static analysis tools require features, which analysts create manually, as inputs. In contrast, Eth2Vec uses a neural network for language processing to automatically learn the features of vulnerable contracts. In doing so, Eth2Vec can detect vulnerabilities in smart contracts by comparing the similarities between the codes of a target contract and those of the learned contracts. We performed experiments with existing open databases, such as Etherscan, and Eth2Vec was able to outperform a recent model based on support vector machine in terms of well-known metrics, i.e., precision, recall, and F1-score.

The rapid development of information technology makes business organizations face major challenges in managing and securing sensitive data. The development of information technology has changed data storage systems from local media to cloud computing, enabling data access and processing via the internet. Services like Google Drive and OneDrive offer security, accessibility, and data backup, but pose challenges for business organizations, especially in terms of security of sensitive data and operational costs that increase as users grow. This research aims to design a local cloud as a private cloud to improve data management and security in the organization. With a private cloud, companies can control data access more tightly, increase privacy, and enable employees to access applications and data from various locations more safely and efficiently. The results of this research are in the form of a private cloud based on a private server which was developed as a file server with access rights based on departments, across departments, projects or work groups. This system utilizes open-source technology and is equipped with an encrypted Virtual Private Network (VPN) to support remote work models (Work From Home, WFH) and work flexibility from anywhere (Work From Anywhere, WFA). With this solution, organizations can increase operational efficiency, reduce the risk of data leaks, optimize more affordable technology resources, and maintain full control of sensitive company data.

Static analyzers have become increasingly popular both as developer tools and as subjects of empirical studies. Whereas static analysis tools exist for disparate programming languages, the bulk of the empirical research has focused on the popular Java programming language. In this paper, we investigate to what extent some known results about using static analyzers for Java change when considering C#-another popular object-oriented language. To this end, we combine two replications of previous Java studies. First, we study which static analysis tools are most widely used among C# developers, and which warnings are more commonly reported by these tools on open-source C# projects. Second, we develop and empirically evaluate EagleRepair: a technique to automatically fix code in response to static analysis warnings; this is a replication of our previous work for Java [20]. Our replication indicates, among other things, that 1) static code analysis is fairly popular among C# developers too; 2) Re-Sharper is the most widely used static analyzer for C#; 3) several static analysis rules are commonly violated in both Java and C# projects; 4) automatically generating fixes to static code analysis warnings with good precision is feasible in C#. The EagleRepair tool developed for this research is available as open source.

This study aims to examine the role of Information Systems (SI) in improving the quality of audits of local government financial statements. Audit of local government financial statements is a critical process in evaluating public finances and ensuring the reliability of financial information and compliance with applicable regulations. In recent years, the use of SI has become an important factor in improving audit quality by strengthening the efficiency, effectiveness, and accuracy of the audit process. A review of the literature reveals that the use of SI in auditing local government financial statements provides significant benefits. First, automation of the audit process using SI replaces error-prone manual tasks, thereby increasing audit efficiency. Second, SI facilitates efficient data collection and analysis, allowing auditors to access more accurate and comprehensive financial information. Third, SI strengthens internal supervision through real-time monitoring of financial activities and early detection of risks or policy violations. Finally, SI also provides protection against the security and integrity of sensitive data in auditing practices. However, the use of SI in auditing local government financial statements is also faced with challenges. These challenges include limited resources, complexity of system integration, security of sensitive data, and the need for increased auditor competence in understanding and using SI effectively. Through this research, it is hoped that a deeper understanding of the role of SI in improving the quality of audits of local government financial statements can be obtained. The results of this study can provide practical guidance and recommendations for auditors and local governments in making optimal use of SI, as well as overcoming challenges that may arise. Thus, it is expected that the practice of auditing local government financial statements can be more effective, accurate, and transparent, as well as provide significant benefits in public financial management.

Static code analysis is widely used to support the development of high-quality software. It helps developers detect potential bugs and security vulnerabilities in a program's source code without executing it. While the potential benefits of static analysis tools are beyond question, their usability is often criticised and prevents software developers from using static analysis to its full potential. In the past decade, researchers have studied developer needs and contrasted them to available static analysis tool functionalities. In this paper, we summarize the main design challenges for building usable static analysis tools, and show that they revolve around the notion of explainability, which is a subarea of usability. We present existing analysis tools and current research in static analysis usability, and detail how they approach those challenges. This leads us to proposing potential lines of future work in explainability for static analysis, namely turning static analysis tools into assistants and teachers.

Android is currently the most popular smartphone operating system in use, with its success attributed to the large number of applications available from the Google Play Store. However, these contain issues relating to the storage of the user’s sensitive data, including contacts, location, and the phone’s unique identifier (IMEI). Use of these applications therefore risks exfiltration of this data, including unauthorized tracking of users’ behavior and violation of their privacy. Sensitive data leaks are currently detected with taint analysis approaches. This paper addresses these issues by proposing a new static taint analysis framework specifically for Android platforms, termed “B-Droid”. B-Droid is based on static taint analysis using a large set of sources and sinks techniques, side by side with the fuzz testing concept, in order to detect privacy leaks, whether malicious or unintentional by analyses the behavior of Applications Under Test (AUTs). This has the potential to offer improved precision in comparison to earlier approaches. To ensure the quality of our analysis, we undertook an evaluation testing a variety of Android applications installed on a mobile after filtering according to the relevant permissions. We found that B-Droid efficiently detected five of the most prevalent commercial spyware applications on the market, as well as issuing an immediate warning to the user, so that they can decide not to continue with the AUTs. This paper provides a detailed analysis of this method, along with its implementation and results.

Dynamic analysis tools, such as those that detect data-races, verify memory safety, and identify information flow, have become a vital part of testing and debugging complex software systems. While these tools are powerful, their slow speed often limits how effectively they can be deployed in practice. Hybrid analysis speeds up these tools by using static analysis to decrease the work performed during dynamic analysis. In this paper we argue that current hybrid analysis is needlessly hampered by an incorrect assumption that preserving the soundness of dynamic analysis requires an underlying sound static analysis. We observe that, even with unsound static analysis, it is possible to achieve sound dynamic analysis for the executions which fall within the set of states statically considered. This leads us to a new approach, called optimistic hybrid analysis. We first profile a small set of executions and generate a set of likely invariants that hold true during most, but not necessarily all, executions. Next, we apply a much more precise, but unsound, static analysis that assumes these invariants hold true. Finally, we run the resulting dynamic analysis speculatively while verifying whether the assumed invariants hold true during that particular execution; if not, the program is reexecuted with a traditional hybrid analysis. Optimistic hybrid analysis is as precise and sound as traditional dynamic analysis, but is typically much faster because (1) unsound static analysis can speed up dynamic analysis much more than sound static analysis can and (2) verifications rarely fail. We apply optimistic hybrid analysis to race detection and program slicing and achieve 1.8x over a state-of-the-art race detector (FastTrack) optimized with traditional hybrid analysis and 8.3x over a hybrid backward slicer (Giri).

The Android operating system dominates the smartphone market. Thus, to service the market, the number of Android applications has risen dramatically. These applications are processing a great amount of sensitive data, which could result in various concerns including data leakage and privacy violations. For example, applications may misuse the sensitive data stored on Android devices and violate the privacy of the user. Therefore, it is essential to maintain user privacy and protect sensitive data from leakage. Static data flow analysis approaches are used for analyzing Android applications to uncover security and privacy issues. However, these approaches frequently generate false alarms, given the different challenges created by Android applications, such as inter-component communication (ICC), reflection, and implicit flow. This work presents the DroidRista approach for conducting static data flow analysis on Android applications to detect sensitive data leakage. DroidRista analyzes ICC, reflection, and implicit flow in Android applications. To evaluate the performance of DroidRista, it was tested on three data sets. The results demonstrate improved performance in terms of detecting data leakage compared to existing static data flow analysis approaches.

Optimal allocation of Var source involves optimal location and determination of the size of the Var source. The purpose is to find the right tradeoff between the investment cost of the new Var source and the benefits in system operation derived from the presence of the additional reactive compensators. Traditionally, the locations for placing new Var sources were either simply estimated or directly assumed. This paper categorizes the literature relevant to optimal allocation of shunt dynamic Var source SVC and STATCOM, based on the voltage stability analysis tools used. Those tools include static voltage stability analysis ones such as P-V and V-Q curve analysis, continuation power flow (CPF), optimization methods (OPF), modal analysis, saddle-node bifurcation analysis, and dynamic voltage stability analysis ones such as Hopf bifurcation analysis and time-domain simulation. Static voltage stability analysis techniques are also used in dynamic Var planning. At the end of the paper, the advantages of static and dynamic voltage stability analysis tools are summarized. (7 pages)

With the improvement of the computing power and storage capacity of vehicular equipment, as well as the growing privacy concerns over sharing sensitive raw data, federated learning can be a promising solution for realizing distributed vehicular crowdsourcing services. The global learning model can be used as crowdsourcing tasks and assigned to vehicles that utilize their local training models. In such a distributed scenario, it is essential to ensure the completion of high-quality training tasks and the security of sensitive data. We propose a vehicular crowdsourcing blockchain to achieve secure reputation management of vehicles in a distributed manner, providing a safe and trusted solution for vehicle crowdsourcing services. We design a worker selection scheme, which combines the reputation of workers with the amount of data as an indicator of worker reliability. We further propose an effective incentive machine to enable more workers with high reputations to participate in crowdsourcing tasks and to contribute higher quality local data. Simulation results show that the worker selection scheme improves the matching rate by 10% and significantly improves the total utility. The proposed scheme is deployed on the IBM Hyperledger Fabric platform to observe its real-world running time and overall performance.

Several agencies, institutions and organizations publish the sensitive data for the public to achieve better research result.Privacy preserving and security in data publishing are the major challenge.Thus the focus of this paper is to ensure privacy and security of sensitive data by slicing algorithm. The slicing algorithm partition the data into vertical and horizontal columns. The attributes and tuples in the slicing algorithm is clustered based on their similarity. In vertical partitioning, the attributes are grouped by Modified Fully Self Adaptive Resonance Neural Networks (MFSARNN). The cluster formation has been improved by Genetic Algorithm based feature selection. In the horizontal partition, the tuple sare grouped by Metaheuristic Fireflies Algorithm with Minkowsi Distance Measure (MFAMD). In this way the proposed system overcomes the privacy threats such as Identity disclosure, Attribute disclosure and Membership disclosure. The experimental result with respect to mean square error, clustering rate is used to analyse the privacy of the system.

A decentralized framework for device authentication and data security in the next generation internet of medical things

The paper describes the architecture and implementation of the dynamic analysis tools that are part of theDOBERTSEE environment. DOBERTSEE is a low-cost, flexible software engineering environment which enables different development processes and methods to be supported by integrating different tools. An XML-based language is used as a basis for integration. The current version of the environment supports the HRT-HOOD method and Ravenscar Ada, and includes an extensive set of static and dynamic analysis tools.