Vulnerability Discovery Modelling With Vulnerability Severity

With the increasing amount of codes and their complexity, the manual method of exploiting vulnerabilities is no longer able to meet the actual needs of vulnerability discovery. Therefore, more researchers are conducting automated vulnerability discovery models and related algorithms. In the real attack and defense scenario, the vulnerability discovery researchers rarely obtain the source code of the target software. Therefore, the non-white box mode of the target system or software is particularly urgent and necessary in the vulnerability discovery model and algorithm. Aiming to solve the above problems, this paper proposes a model for gray-box vulnerability discovery GVDM, which uses the tracking of path coverage to infer the internal structure of the application. The samples with low-frequency path are preferably selected during the sample selection phase using simulated annealing and genetic algorithms. The experimental results on the LAVA-M dataset justify the better performance of the proposed GVDM model, which finds more vulnerabilities than other fuzzers with high accuracy.

Software vulnerabilities trend over time has been proposed by various researchers and academicians in recent years. But none of them have considered operational coverage function in vulnerability discovery modeling. In this research paper, we have proposed a generalized statistical model that determines the relationship between operational coverage function and the number of expected vulnerabilities. During the operational phase, possible vulnerable sites are covered and vulnerabilities present at a particular site are discovered with some probability. We have assumed that the proposed model follows the nonhomogeneous Poisson process properties; thus, different distributions are used to formulate the model. The numerical illustration shows that the proposed model performs better and has the good fitness to the Google Chrome data. The second focus of this research paper is to evaluate the total cost incurred by the developer after software release and to identify the optimal vulnerability disclosure time through multiobjective utility function. The proposed vulnerability discovery helps in optimization. The optimal time problem depends on the combined effect of cost, risk, and effort.

The recent rapid advancement in technology has affected the security of software products. The number of threats and cyber-attacks are intensifying both in number and in complexity. Therefore, software system requires protection against threats and vulnerabilities. When defects in the software have an effect on the security of the software system, then these defects are called vulnerabilities. It is essential for vendors to rigorously identify and remove vulnerabilities present in the system. This chapter aims to explain the vulnerability discovery and patching process mathematically. Patch is a security update released by software developers to eliminate vulnerabilities from the system. Quantitative measures are discussed in the present study to predict the vulnerability discovery growth function by incorporating various attributes, namely, software users, operational effort, and coverage functions. Joint optimization problem for optimal software and patch time-to-market are also discussed with an aim of minimizing the cost functions. Numerical examples are provided to validate the mathematical models and minimization problem using the actual vulnerability data sets. The results indicate that the discussed models can objectively determine the vulnerability discovery paradigm. Moreover, the optimization models will assist the management team in optimal decision making pertaining to release time of software and security patch in the market.

To report or not to report? Extending Protection Motivation Theory to Vulnerability Discovery and Disclosure

In many educational institutes, learning management systems are essential parts of delivering class materials not only for on-line courses but also on-campus classes. The primary purpose of learning management system is to provide proper virtual educational environments and convenient communicational channels between instructors and students letting them to overcome the barrier of time and space for the general schooling. In this paper, we are investigating the security vulnerabilities in such learning management systems. Especially, we are examining the vulnerability discovery process in the two popular learning management systems, Moodle and Blackboard, using datasets spanning a decade. We applied two vulnerability discovery models to examine the vulnerability discovery process quantitatively. The discovery models allow us to estimate the approximate number of vulnerabilities likely to be discovered in software systems in the future. It also helps policy makers when they need to decide which learning management systems will be adopted for their organizations when security is an extremely important factor. Result shows that the vulnerability discovery process in learning management systems could be predictable which could be utilized for IT risk assessment in organizations having the systems.

With the ever-growing use of the Internet in our daily lives, an increase of potentially sensitive data being shared and accessed online is observed. Web apps and browsers are the main tools used by Internet users, so being able to guarantee secure browsing is a key point. In this context, this paper explores key aspects of web security and privacy in two of the most widely used browsers worldwide - Google Chrome and Microsoft Edge, running in different operating systems - Windows and Linux. Whilst emulating a browsing routine of a common web user for navigating through heterogeneous services, the aim is to verify if the content being shared online is properly secure. For this purpose, a comparative analysis based on collected web-browsing traffic, protocols in use, cookies and related policies is carried out, being the main browsers’ vulnerabilities identified and discussed.

The worldwide Web has dramatically evolved in recent years. Web pages are dynamic, expressed by programs written in common programming languages given rise to sophisticated Web applications. Thus, Web browsers are almost operating systems, having to interpret/compile such programs and execute them. Although JavaScript is widely used to express dynamic Web pages, it has several shortcomings and performance inefficiencies. To overcome such limitations, major IT powerhouses are developing a new portable and size/load efficient language: WebAssembly.In this paper, we conduct the first systematic study on the energy and run-time performance of WebAssembly and JavaScript on the Web. We used micro-benchmarks and also real applications in order to have more realistic results. Preliminary results show that WebAssembly, while still in its infancy, is starting to already outperform JavaScript, with much more room to grow. A statistical analysis indicates that WebAssembly produces significant performance differences compared to JavaScript. However, these differences differ between micro-benchmarks and real-world benchmarks. Our results also show that WebAssembly improved energy efficiency by 30%, on average, and showed how different WebAssembly behaviour is among three popular Web Browsers: Google Chrome, Microsoft Edge, and Mozilla Firefox. Our findings indicate that WebAssembly is faster than JavaScript and even more energy-efficient. Additionally, our benchmarking framework is also available to allow further research and replication.

The Data Collection System for Prospective Citizens and Residents (Trainers) in the Setia Hati Brotherhood in the Pekanbaru Branch still uses a manual system. Where paper becomes a means in data collection and data information sources. The rapid development of technology in the current era of globalization that can facilitate all respects, including data collection of information that can make data collection more effective and efficient. PSHT Pekanbaru Branch corrects the problem in this data collection to make data collection faster because the system has not been computerized. The data collection in the PSHT Pekanbaru Branch requires a new system so that the system can be improved. As for the system carried out by the writer who discusses structured development systems using the waterfall method, as well as analysis and design tools using the Unified Modeling Language (UML). As for the implementation, some software is published using the framework framework , the code editor uses Atom, the PHP package uses XAMPP version 3.2.4 (PHP 7.3.9, Apache web server 2.4.7 and MySQL database version 5.0.12) and which the last web browser using Google Chrome

Devices connect to a wireless local area network (WLAN) with Wi-Fi communication (see Chapter 7 (Wireless local area network)). A router connected to an Internet Service Provider (ISP), through a telephone line using DSL (Digital Subscriber Line) technology, provides access to the Internet (see Figure 8-1). The Internet is formed by interconnected computer networks using the Internet Protocol suite, consisting of the Transmission Control Protocol and the Internet Protocol (TCP/IP), to globally link devices. The World Wide Web (WWW) identifies information resources by URLs (Uniform Resource Locators). The client or web browser, such as Google Chrome or Mozilla Firefox, sends an HTTP (HyperText Transfer Protocol) request to the server device hosting the resource to retrieve information at the web address defined by the URL. The server responds to the client HTTP request, and the client displays the requested web page information on the Android tablet or mobile phone. The client must request web page information from the server, as the server cannot impose updates on the client. The exception is WebSocket, as discussed in Chapter 9.

Along with the development of current technology that has been very sophisticated and rapidly happening in this world, namely in a company, agency, even the world of education as well. At PT Sintech Berkah Abadi has an obligation to give permission to employees who submit. At this time, the management of employee exit permits is still running manually and has not been centralized computerized. Therefore, it requires papers in each process and is less efficient and it is difficult to control permit approval by employees if the HRD and the Chair are outside the office. The method used to develop an information system is to apply the analytical method using SWOT analysis, as well as data collection methods, there are three stages that must be done in collecting data, namely, Observation, Interview, and determining Literature Review (Literature Study) with the journal. The design method is done using the Unified Modeling Language (UML), Notepad ++, XAMPP and the web browser used to open the web that has been designed, Google Chrome. With the licensing system in and out of employees at PT Sintech Berkah Abadi can make it easier for employees to permit and more efficient in its use because they do not have to wait for HRD or leaders when outside the city.
 
 

Chapter 31 - Internet History (Web and Browser Caching)

Along with the development of current technology that has been very sophisticated and rapidly happening in this world, namely in a company, agency, even the world of education as well. At PT Sintech Berkah Abadi has an obligation to give permission to employees who submit. At this time, the management of employee exit permits is still running manually and has not been centralized computerized. Therefore, it requires papers in each process and is less efficient and it is difficult to control permit approval by employees if the HRD and the Chair are outside the office. The method used to develop an information system is to apply the analytical method using SWOT analysis, as well as data collection methods, there are three stages that must be done in collecting data, namely, Observation, Interview, and determining Literature Review (Literature Study) with the journal. The design method is done using the Unified Modeling Language (UML), Notepad ++, XAMPP and the web browser used to open the web that has been designed, Google Chrome. With the licensing system in and out of employees at PT Sintech Berkah Abadi can make it easier for employees to permit and more efficient in its use because they do not have to wait for HRD or leaders when outside the city.
 
 

Web Workers is a specification that defines an API which allows Web application developers to use background workers running scripts in parallel. Web Workers is used with JavaScript and is platform-independent. Hence, Web applications written in JavaScript can be used for a wide variety of purposes. There are many Web applications and some of them, for instance Internet election campaign and real-time broadcasting, need secure communications. We can include digital signatures with such Web applications to guarantee their security of communications. In this demonstration proposal, we assess the performance of parallel implementations of public key cryptosystems on several Web browsers (Internet Explorer, Google Chrome, Opera, and Firefox). With our implementation, it is possible to verify a message in 1.03 milliseconds on a Windows PC and 5.49 milliseconds on an Android tablet (Nexus 7). We also propose cryptography applications for Web browsers.

Safari is a really great web browser—and so is Firefox, and so is Google Chrome. And in addition to those, there are others that are also great, which you'll learn about in this chapter. Still, while I use Safari quite a bit, I don't use it exclusively. I like to bounce around between several different browsers, using each as my main web tool for a couple of weeks, and then switching to a different one. During this time, I still continue to use others for minor tasks, so I'm constantly seeing what works and what doesn't with the range of web browsers for Mac OS X.KeywordsSnow LeopardInternet Relay ChatLayout EngineKeyboard NavigationChrome ExtensionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Computers without connections to the outside world considered as almost useless tools these days. Network equipment, such as routers and switches, is one of the most critical resources in this everything-is-connected world. Hence, a vulnerable network device might cause a significantly negative effect to related organizations. In this paper, we quantitatively analyze the two network OSes, Cisco IOS and Juniper JUNOS in the security vulnerability point of view. We first, apply a vulnerability discovery model on both systems, and estimate the future behaviors of the discovery trends. Then the severity of vulnerabilities with CVSS and types of vulnerabilities discovered are also examined. The analysis shows that a vulnerability discovery model represents properly the discovery trends for the network OSes. Also the result shows that most of the time vulnerabilities in network OSes are compromised via remote networks with no authentication required systems.