Cybersecurity is an ongoing and critical concern because of the constant and persistent threats from malicious actors such as hackers and crackers. The widespread use of software systems has revolutionized modern society in various aspects, but it has also brought forth new challenges in safeguarding sensitive and confidential information with the evolution of information and communication technology (ICT). Quantifying security measures can provide evidence to support decision-making in software security, especially when it comes to evaluating the security performance of software systems. This involves understanding the main quality criteria of security metrics, which can aid in building security metrology models based on practical requirements. To further explore this topic, this study conducted a systematic literature review of security metrics and measures in the context of Secure Software Development (SSD). The study selected 61 research studies based on specific inclusion and exclusion criteria and extracted data from the selected articles. The study identified 215 software security metrics, which were then categorized based on Software Development Life Cycle (SDLC) phases. To evaluate the effectiveness of the most commonly cited metrics in each phase, the study applied a SWOT analysis to highlight their strengths, weaknesses, opportunities, and threats. The findings of this study offer valuable guidance to diligent and motivated researchers to investigate emerging research trends and address existing gaps in Secure Software Development. Furthermore, this investigation provides software professionals with a more comprehensive understanding of security measurements, constraints, and open-ended specific and general issues.

Many software development methodologies introduced to date place users at the centre of development process. Although the user is an important asset in the software development cycle however the user-centred approach is not sufficient to develop a software product that is structurally robust and reliable. User involvement in the development process does not always guarantee resilience and a more efficient design. To address this a hybrid-based software development paradigm is proposed here where the software development cycle includes a grammar model-based compiler with user-centred approach. The efficacy of the proposed system is tested with the development of an innovative computer-aided drawing technology (SETUP09) for blind and visually impaired people and the results are compared with an existing non-hybrid-based drawing software (IC2D). The results of this study confirm SETUP09 improves user satisfaction and provides abstract and concrete level system flexibility. Provided here are guidelines of the proposed hybrid approach for software development based on a formal approach. This hybrid approach enables the software designer to evaluate the software semantics before user scrutinization. The benefits of the approach include the facilitation of alternate development pathways affording the software designer the flexibility to amend the software without incurring significant technical challenges. In fact, the proposed approach enables the creation of a structural design that is independent from the development pathways. This approach should ease the time constraint in product development and resource constraints.

Software organizations are increasingly embracing the advantages of Global Software Development (GSD), such as access to highly skilled developers and reduced development costs. However, the implementation of Requirement Change Management (RCM) activities in GSD is often hindered by a lack of communication and coordination among project stakeholders, as well as an insufficient focus on traceability and monitoring of RCM activities. To overcome these issues, we have enhanced and improved an existing RCM framework to mitigate the identified challenges and to develop a quality product while achieving customer satisfaction and business objectives. To evaluate the effectiveness of the proposed Enhanced AZ-Model, we sought feedback from the industrial experts and performed a statistical analysis of the collected data. The Enhanced AZ-Model was further validated by performing simulations of the model. The empirical and simulation results indicate that the Enhanced AZ-model efficiently and effectively manage the demanded changes according to the budget and time constraints.

Binary similarity detection determines whether two given binary code snippets are similar or not, usually on function granularity. This task is challenging due to different compilation optimizations and CPU architectures. Recently, deep-learning methods have made great achievements in this field, although most of them use artificially selected features or ignore some important semantic information like code literals or function signatures during feature processing. In addition, random samples and pair loss function are used in similarity training, which only covers limited similarity relations between functions. In this paper, a new framework MFEN-Sim is proposed to detect similar binary functions. The framework contains three stages: feature extraction and normalization, mutli-feature based function feature embedding network (MFEN) and similarity learning network. Multiple features including assembly instructions, CFG structures and function code literals are extracted from binary functions. Then these features are fed into MFEN composed of three modules: function semantic and structure embedding module, function signature prediction module, and function code literal embedding module. The three modules generate embeddings representing the function semantic and structural features, the function signature prediction features and the function code literal features. Finally, MFEN-Sim utilizes a similarity training network based on contrastive learning to make MFEN recognize more similarity relations between functions. MFEN-Sim is evaluated on 281,601 functions in 144 binaries and 17 CVEs in real-world software. Experimental results show that our work outperforms state-of-the-art systems ( i.e., Gemini, FIT and SAFE) by 7.1%, 9.9% and 8.2% on AUC metric in cross-architecture, optimization-level similarity detection, and achieves higher recall than baselines in searching vulnerabilities in real-world applications.

A document by Saima Imtiaz. Click on the document to view its contents.

Frameworks are essential for software development, providing code design and reuse for its users. Well-known Java frameworks and APIs such as Spring, JUnit, and JPA rely on metadata usage, commonly defined by code annotations. Those frameworks use the Java Reflection API for consuming and processing these annotations. Code elements usually have some similarities and can also have the same annotation. This paper proposes a model for defining conventions over configuration for annotations usage decoupled from the metadata reading logic. With this model, if a convention is present, the framework will consider that the element is configured by a specific target annotation, even if the code element does not have the annotation. We implemented this model in the metadata reading framework Esfinge Metadata API. The model implementation was evaluated refactoring an existing framework to add support to conventions using our approach. As a result, it was possible to introduce the conventions only by adding configurations to the annotations. The model was further evaluated in an experiment in which participants implemented the Conventions over Configuration pattern using the Esfinge Metadata API and Java Reflection API. Based on the results, approach fulfilled its goal of supporting the definition of conventions decupled from the framework logic, making the code more readable and easier to maintain according to the participants perception.

Model-driven engineering (MDE) has become a leading methodology for the design and development of Real-Time Embedded Systems (RTES). It makes use of automatic code generation tools to reduce time, cost and effort associated with writing and maintaining software. However, automatic code generators tend to produce poor quality and inefficient code, which is unacceptable for safety critical systems. The verification and validation of such systems are crucial activities that require high-level code quality and coverage enforced by standards such as DO-178C/ED-12C for airborne software or ECSS in the European space domain. Simulink is a modelling tool offered by MathWorks widely used in the aerospace sector to develop and simulate models. The QGen tool-suite offers a C and Ada code generator appropriate for Simulink and Stateflow models. In this paper, we evaluate QGen aiming to demonstrate its applicability in embedded software products, its integrability in other modelling tools, and the quality of the autogenerated software. To that end, a set of Key Performance Indicators (KPI) have been defined to measure quantitative values mostly obtained with open-source tools. The evaluation adopts the Attitude Control System from the UPMSat-2 satellite as the technology demonstrator and its simulation and control Simulink models serve as evaluation models for this analysis. The contribution of this study has been to establish a quantitative methodology for the evaluation of the QGen tool-suite based on software metrics at varying granularity levels such as model and source code. This methodology should help the researchers to identify further metrics and use them to analyze not only automatic code generators, but also to establish a criterion to assess the technology readiness of other software products and tools.

Atoms of confusion, or simply “atoms,” are pieces of code that lead to misunderstanding while being interpreted. Previous research has shown that the presence of atoms has an effect on code readability. Aside from simple misunderstanding in lab setting, atoms of confusion are common and meaningful in open source C and C++ projects, and are thus removed by bug-fix commits. However, due to syntactical differences between language paradigms, the prevalence of atoms may vary in projects written in other languages (e.g. Java), which is yet to be explored. In this study, the first step is taken towards investigating the prevalence of 12 different atoms in the 13 most popular open-source Java projects. The relationship between the presence of atoms and aspects of code maintainability is also studied. Results show that, atoms are 4.7 time more prevalent in Java projects compared to open source C/C++ projects based on occurrence per line. For a total of 1085223 atoms in our corpus, they occur once every 4.8 lines. Some atoms are very obscure (e.g. the Logic As Control Flow atom which occurs once in 440060 lines). Some atoms are frequently occurring (e.g. the Infix Operator Precedence atom which occurs once in 6.4 lines). Impact of the presence of atoms on code maintainability is also explored. Besides, correlation between atoms are investigated. Results indicate that object oriented metrics contribute less in atom prevalence, whereas fine grained code-metrics have relatively better association.

Context/motivation: Design Thinking techniques have been widely used in software requirements elicitation to understand the necessities of stakeholders and end-users. However, there is a lack of evidence of their effectiveness when applied to vulnerable populations. Question/problem: What are the implications of using Design Thinking techniques to elicit requirements in a community of former inmates - and what would be the benefits of and challenges in this deployment? Principal ideas/results: In this paper, we report our experience of using Design Thinking for Requirements Elicitation of a mobile application, customized for the former inmates of the Brazilian Prison System and their families. Research methods: We applied techniques such as Brainstorming, Stakeholder Mapping, Personas Creation, Rapid Ethnography, and Interviews to obtain relevant data and create several prototypes. Contribution: These techniques contribute to the development of an uncommon application that aims to help the reintegration process of former inmates into society. Our results validate the initial hypothesis that such techniques, when applied to a sensitive context, assist product development that meets the end-users needs by creating a higher-quality product. Limitations: The main limitation of the research was the lack of access to low-literacy end-users and former inmates without previous experience using mobile devices.