SIS Framework for Risk Assessment Through Quantitative Analysis

Knowledge is the most important asset to a company. It is key to strategic innovation and alignment, and must be made sustainable. To keep knowledge sustainable, it must be safeguarded. However, knowledge management (KM) and knowledge systems are different than traditional information systems with different threats and operational requirements. Information security professionals recognize that risk assessment is the cornerstone to information security. We build on this perspective and propose that risk assessment techniques need to be applied to KM. We discuss risk assessment frameworks and build on a KM/knowledge system risk assessment framework with a KM/knowledge system specific threat assessment.

Analysis of the source code of video games is not an integrated part of the formal analysis. Rather, few scholars have investigated how an analysis of the source code can inform a hermeneutic reading of the game. In this paper I will present a reading of the source code of Passage (Rohrer, 2007), argue for why a traditional focus on authorial intention is unnecessary when investigating the symbolism and metaphors of a game, and illustrate how source code analysis can inform the formal analysis of the executed game. Finally, I shall discuss how the source code relates to the game as a ‘work’, and how it can be used for studies of symbolism and metaphors. Thus, I will conclude that it is indeed a valuable method for game studies, although further studies should expand on the textual relation between executed game and source code.

K-scope is a source code analysis tool with a graphical user interface for the performance tuning of Fortran programs. With K-scope, developers are able to visually understand the structures of their Fortran programs and estimate their performance. However, the original version of K-scope has two problems. First, it lacks the ability to integrate the results of source code analysis with performance profiling data. Second, it requires developers to install XcalableMP because K-scope utilizes the front-end of the XcalableMP compiler. However it is difficult to set up the XcalableMP environment because this requires installing and configuring several libraries and applications. A binary package of XcalableMP is only available for major Linux distributions, and developers thus have a hard time installing XcalableMP on other environments, e.g., Windows. In order to address these two problems, we extend K-scope with two mechanisms. The first visualizes performance profiling data and the second offloads the parsing of Fortran programs to a remote server. More specifically, the visualization mechanism enables users to readily identify performance bottlenecks in their programs by mapping performance profiling data to each line of the source code. With the offloading mechanism, developers no longer need to install XcalableMP. Instead, they can connect K-scope to a remote server on which XcalableMP is installed, and which generates the intermediate code used for analysis. For this purpose, we develop a tool named SSHconnect. To verify the effectiveness of our extended K-scope, we analyze the Nonhydrostatic Icosahedral Atmospheric Model (NICAM) code, an application for global climate simulation that consists of about 300,000 lines of Fortran code. We found that K-scope successfully identified performance bottlenecks in the NICAM code and translated the source code for several applications using its remote parsing mechanism.

Language analysis of scientific documents and analysis of source code have been done independently in the past. This work presents a network architecture and a self-supervised training approach to find alignments between published computer science research papers and their corresponding public source code by learning a representation of encodings from transformers, from which source code can be enriched with helpful information. We present our ideas, findings and plans for upcoming research.

Static code analysis is a very important stage in the development and implementation of software, and it needs to be used to obtain a better code. The most complicated in static analysis is the analysis of source code, and further analysis. Analysis of the source code can be done multiple times and expand the set of necessary grammar. The main goal was and remains to provide a solution to reduce the time needed for a global reassessment of static analysis at code level after a change.The main problem when using static code analysis is to build an abstract semantic graph, because each software solution is provided with a separate data warehouse. The proposed solution proposes to use as a database repository using graphs. Thus, the storage mechanisms of the created abstract semantic graph have been simplified, which in turn, in addition to increasing the clarity of the information we store, provides convenient ways to further work with the stored information.The developed solution can transform a rather large source repository into a graphic representation and maintain it later. It is found that the approach is suitable for carrying out code compliance checks and for performing static analysis tests on a graphic representation. This approach also uses advanced file-level detailing, accelerating static analysis. Based on my measurements, the frameworks are fast enough to help their users quickly change the repository of codes.This article confirms the thesis about the possibility of storing an abstract semantic graph in a graph database, and after refinement, if it contains sufficient transformations and requests for language processing, can become a complete transport for communication between various static analysis tools that usually perform one of two the functions of verification either for quality or for vulnerability, thereby making a unified creation of an abstract semantic graph.As an improvement it is necessary to consider the possibility of incremental analysis – the analysis of changes in the code, in order to minimize resource costs for a rather resource intensive operation of the structure of the abstract semantic graph.Manuscript received 09.06.2020

This paper is a continuation of our previous work on solving source code authorship identification problems. The analysis of heterogeneous source code is a relevant issue for copyright protection in commercial software development. This is related to the specificity of development processes and the usage of collaborative development tools (version control systems). As a result, there are source codes written according to different programming standards by a team of programmers with different skill levels. Another application field is information security—in particular, identifying the author of computer viruses. We apply our technique based on a hybrid of Inception-v1 and Bidirectional Gated Recurrent Units architectures on heterogeneous source codes and consider the most common commercial development complex cases that negatively affect the authorship identification process. The paper is devoted to the possibilities and limitations of the author’s technique in various complex cases. For situations where a programmer was proficient in two programming languages, the average accuracy was 87%; for proficiency in three or more—76%. For the artificially generated source code case, the average accuracy was 81.5%. Finally, the average accuracy for source codes generated from commits was 84%. The comparison with state-of-the-art approaches showed that the proposed method has no full-functionality analogs covering actual practical cases.

Security has been always treated as an add-on feature in the software development lifecycle, and addressed by security professionals using firewalls, proxies, intrusion prevention systems, antivirus and platform security. Software is at the root of all common computer security problems, and hence hackers don't create security holes, but rather exploit them. Security holes in software applications are the result of bad design and implementation of software systems and applications. To address this problem, several initiatives for integrating security in the software development lifecycle have been proposed, along with tools to support a security-centric software development lifecycle. This paper introduces a framework for evaluating security static analysis tools such as source code analyzers, and offers evaluation of non-commercial static analysis tools such as Yasca, CAT.NET, and FindBugs. In order to evaluate the effectiveness of such tools, common software weaknesses are defined based on CWE/SANS Top 25, OWASP Top Ten and NIST source code weaknesses. The evaluation methodology is based on the NIST Software Assurance Metrics And Tool Evaluation (SAMATE). Results show that security static analysis tools are, to some extent, effective in detecting security holes in source code; source code analyzers are able to detect more weaknesses than bytecode and binary code scanners; and while tools can assist the development team in security code review activities, they are not enough to uncover all common weaknesses in software. The new test cases developed for this research have been contributed to the NIST Software Assurance Reference Dataset (samate.nist.gov/SARD).

Source code quality is undoubtedly very important, yet usually forgotten aspect of software development process. This study shows different approaches to analysis of student codes, mainly in Java. By comparing different widely-used tools and our solution, we are able to get precise results from such an analysis, and thus to improve the code quality. The analysis results can also be used to determine knowledge and skills of novice programmers (students). Analysis of source codes may be as simple as counting the occurrences of language constructs or as complex as design pattern detection. Different approaches and solutions, i.e. measurements of language construct occurrences, copy-pasted code and design pattern detection, or source code quality, are discussed and subjected to evaluation by being executing on source codes of students as novice programmers.

In computer science education, the analysis of source code with errors is of interest as programming errors may give a hint to misconceptions. The analysis of misconceptions can help teachers to improve their exercises and lessons.The semantic analysis of texts or video sequences could lead to different, subjective interpretation. This problem also effects source code errors, which could contain semantic errors.In different projects, we were confronted with a lot of incorrect source codes, which were written by students of universities and secondary schools. A first analysis of these errors led to a categorization of errors regarding missing competencies.To avoid mainly subjective interpretation of source code errors a standardized method for categorizing errors, which could also be applied by a practitioner, has to be developed and justified. Categorizing texts or source code errors is a matter of semantics, because text or code elements have to be interpreted. Thus, a qualitative content analysis is most suitable. In this paper we explain the difference between errors and misconceptions and present our adaption of the qualitative content analysis of Mayring to source code errors.

In this paper we discuss a new application of Semantic Web and Artificial Intelligence in software analysis research. We show on a concrete example - clone detection for object-oriented source code that transitivity closure computation can provide added value to the clone detection community. Our novel approach models the domain of discourse knowledge as a mixture of source code patterns and inheritance trees represented as Directed Acyclic Graphs. Our approach promotes the use of Semantic Web and inference engines in source code analysis. More specifically we take advantage of the Semantic Web and its support for knowledge modeling and transitive closure computation to detect semantic source code clones not detected by traditional detection tools.

There exists a large body of work on the specification and detection of anti-patterns in the source code of software systems. However, there are very few studies on the origins of the occurrences of anti-patterns in the source code: do the very design of the systems lead to the occurrences of anti-patterns or are anti-patterns introduced during implementation? Knowing when anti-patterns are introduced could help software designers and developers improve the quality of the source code, for example by eliminating fault-prone anti-patterns early during the design of the systems, even before their implementation. Therefore, we detect occurrences of anti-patterns in design models and in the source code of some systems, trace these occurrences between design and implementation, and study their relation and impact on the source code. First, we analyze both the UML design models and the source code of 10 open-source systems and show that antipatterns exist in design models. We observe that, on average, 37% of the classes in the design models that belong to anti-patterns also exist in the source code and also play roles in the same anti-patterns. Second, we investigate two open-source systems to assess the impact of the anti-patterns in their design models on the source code in terms of changes and faults. We show that classes that have anti-patterns in the design models have more changes and faults in the source code. Our results suggest that the design of the systems lead to anti-patterns and that the antipatterns impact negatively the change-and fault-proneness of the classes in the source code. Thus, designers should be wary of anti-patterns in their design models and could benefit from tools that detect and trace these anti-patterns into the source code.

We studied source code analysis techniques to predict statically how real programs work and use memory. If we can recognize problems of memory usage in the source code, we are able to prevent them and improve security in the software development phase. The problem detection techniques which are already existed can detect whether the program includes weak code such as Common Vulnerabilities and Exposures, Common Weakness Enumeration. However, these methods are not useful for finding problems in programs that do not include OpenSource. because they use hash value or pattern of weak code contained in OpenSource. Therefore, we propose a static prediction technique for dynamic memory usage with source code analysis without using techniques such as similarity detection. Also, we present how to calculate the values used for static prediction from the source code.

EDSA (expert data flow and static analysis tool) which uses static analysis of source code to help gain an understanding of existing code, is described. This may be for the purpose of tracking down a bug or to determine in advance whether an intended change will have any undesirable side effects. In either case, the phase of the development life cycle that is most likely to benefit from a tool like EDSA is the maintenance phase. EDSA provides three kinds of facilities. It helps to browse through code, following either the control flow or data flow, rather than the order in which the code happens to be written. It displays code with unimportant source lines eluded, so that the user can get a more global view of the program. Finally, it provides search management to make it easier to examine all possibilities when browsing. The mechanism used to create and display various views of programs is described and the approach to the user interface is discussed. The state of the current implementation is described. >

The rapid developments in science and technology have led to the availability of improved techniques in the construction industry. However, even as the technology has progressed, the hazards and risks associated with the construction sites have still persisted. Amongst the various risk assessment tools available for the purpose of risk assessment, the Decision matrix risk assessment (DMRA) technique is a widely used approach for the purpose of Occupational Health and Safety (OSH) assessment. The risk factor value was evaluated by the use of two hazard parameters namely the likelihood of hazard and the severity associated with the hazard. To deal with the shortcomings of a crisp risk factor value calculation and to address the inconsistency in decision making of DMRA technique, this paper presents a framework for risk assessment of activities in the construction site using fuzzy set theory, fuzzy logic approximation and composition. The parameters associated with risk likelihood and severities were analyzed and were given as linguistic variables. This proposed model was applied for evaluating and assessing the risk factor values of the activities in the construction site in Chennai Metropolitan Area and also throws light on the advantages of the fuzzy-DMRA methodology when compared to a standard DMRA technique

Whether the developed software system completed all functions in the software design specification and consistent with the design algorithm is an important work in software testing. Analysis of the source code artificial and verify whether the software system is to meet the requirements of the design specification is laborious job. Testers need to have rich experience in programming and strong ability of algorithm analysis. This paper proposes a method to verify consistency of software implementation and design based on function call path. The method can be summarized as analyze the calling relationship of functions from design specifications and source code, extraction function calling path, generation function cluster model. In documents aspect, the function calling relationship can be got by manual analysis of the design specification, then the designed function cluster model can be generated automatically. We can get function calling relationship, function features by static analysis of source code and the specific implementations of function with those features. Finally, compare the two function cluster model to verify that the consistency of software implementation and design. The experimental results showed that this method can obtain the system function structure and algorithm features accurately, make effective judgment of the consistency of the design specification and the software implementation, provides a new way to verify the consistency of software implementation and design.