Einzeltreffer — DigiBib

Proponemos una solución para guíar las auditorías de seguridad de código basada en aprendizaje de máquina, que no reemplaza al auditor sino que da indicaciones al mismo sobre dónde buscar vulnerabilidades primero. Sostenemos que este es un mejor enfoque que las auditorías automáticas y las herramientas tradicionales de análisis estático en términos de falsos positivos y negativos. ; #Auditorias ; #Máquinas ; Resumen en idioma extranjero We propose a solution to guide manual code security auditing, based on machine learning techniques, which does not replace the former, but instead gives pointers to the pentester as to where to look for vulnerabilities first. We claim this is a better approach than fully automated scanners and traditional static analysis tools in terms of false positives and negatives.

Titel:	Machine learning for prioritizing security code-based Vulnerability discovery
Autor/in / Beteiligte Person:	Ballestas, Rafael ; García Bedoya, Olmer
Link:	View record in BASE (Volltext) http://hdl.handle.net/20.500.12010/17241 http://expeditio.utadeo.edu.co Volltext
Zeitschrift:	instname:Universidad de Bogotá Jorge Tadeo Lozano ; reponame:Expeditio Repositorio Institucional UJTL, 2021
Veröffentlichung:	Universidad de Bogotá Jorge Tadeo Lozano ; Maestría en Ingeniería y Analítica de Datos, 2021
Medientyp:	Hochschulschrift
DOI:	20.500.12010/17241
Schlagwort:	Colombia Ingeniería Máquinas Automatización Auditorías Seguridad Security auditing Subject Geographic: Colombia
Sonstiges:	Nachgewiesen in: BASE Sprachen: English, Middle (1100-1500) Collection: Expeditio - Repositorio Institucional Universidad de Bogotá Jorge Tadeo Lozano (UTADEO) Document Type: master thesis File Description: 58 páginas; application/pdf Language: English, Middle (1100-1500) Relation: Alon, U., Zilberstein, M., Levy, O., and Yahav, E. (2019). code2vec: learning distributed representations of code. Proc. ACM Program. Lang., 3(POPL):1– 29.; Antunes, N. and Vieira, M. (2009). Comparing the Effectiveness of Penetration Testing and Static Code Analysis on the Detection of SQL Injection Vulnerabilities in Web Services. In 2009 15th IEEE Pacific Rim International Symposium on Dependable Computing, pages 301–306, Shanghai, China. IEEE.; Chang, Y., Liu, B., Cong, L., Deng, H., Li, J., and Chen, Y. (2019). Vulnerability Parser: A Static Vulnerability Analysis System for Android Applications. J. Phys.: Conf. Ser., 1288:012053.; Chong, S., Guttman, J., Datta, A., Myers, A., Pierce, B., Schaumont, P., Sherwood, T., and Zeldovich, N. (2016). Report on the NSF Workshop on Formal Methods for Security. arXiv:1608.00678 [cs]. arXiv: 1608.00678.; Dauber, E., Caliskan, A., Harang, R., Shearer, G., Weisman, M., Nelson, F., and Greenstadt, R. (2019). Git Blame Who?: Stylistic Authorship Attribution of Small, Incomplete Source Code Fragments. Proceedings on Privacy Enhancing Technologies, 2019(3):389–408. arXiv: 1701.05681; Ferreira, A. M. and Kleppe, H. (2011). Effectiveness of Automated Application Penetration Testing Tools. Technical report, OS3 University of Amsterdam.; FluidAttacks (2020). Integrates.; Free Software Foundation (2020). GNU diffutils; Ghaffarian, S. M. and Shahriari, H. R. (2017). Software Vulnerability Analysis and Discovery Using Machine-Learning and Data-Mining Techniques: A Survey. ACM Computing Surveys, 50(4):1–36.; Li, Z., Zou, D., Xu, S., Jin, H., Zhu, Y., and Chen, Z. (2018a). SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities. arXiv:1807.06756 [cs, stat]. arXiv: 1807.06756.; Li, Z., Zou, D., Xu, S., Ou, X., Jin, H., Wang, S., Deng, Z., and Zhong, Y. (2018b). VulDeePecker: A Deep Learning-Based System for Vulnerability Detection. Proceedings 2018 Network and Distributed System Security Symposium. arXiv: 1801.01681.; Moor, O. d., Verbaere, M., Hajiyev, E., Avgustinov, P., Ekman, T., Ongkingco, N., Sereni, D., and Tibble, J. (2007). Keynote Address: .QL for Source Code Analysis. In Seventh IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM 2007), pages 3–16, Paris, France. IEEE; Ng, A. (2016). What Artificial Intelligence Can and Can’t Do Right Now. Harvard Business Review. Section: Analytics.; Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V., Vanderplas, J., Passos, A., Cournapeau, D., Brucher, M., Perrot, M., and Duchesnay, E. (2011). Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825–2830.; Rice, H. G. (1953). Classes of recursively enumerable sets and their decision problems. Trans. Amer. Math. Soc., 74(2):358–366.; Schwartz, E. J., Avgerinos, T., and Brumley, D. (2010). All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask). In 2010 IEEE Symposium on Security and Privacy, pages 317–331, Oakland, CA, USA. IEEE.; Sommer, R. and Paxson, V. (2010). Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. In 2010 IEEE Symposium on Security and Privacy, pages 305–316, Oakland, CA, USA. IEEE.; Stefinko, Y., Piskozub, A., and Banakh, R. (2016). Manual and automated penetration testing. Benefits and drawbacks. Modern tendency. In 2016 13th International Conference on Modern Problems of Radio Engineering, Telecommunications and Computer Science (TCSET), pages 488–491, Lviv, Ukraine. IEEE.; Yamaguchi, F., Wressnegger, C., Gascon, H., and Rieck, K. (2013). Chucky: exposing missing checks in source code for vulnerability discovery. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS ’13, pages 499–510, Berlin, Germany. ACM Press.; http://hdl.handle.net/20.500.12010/17241; http://expeditio.utadeo.edu.co Rights: info:eu-repo/semantics/openAccess ; Abierto (Texto Completo)

Klicken Sie ein Format an und speichern Sie dann die Daten oder geben Sie eine Empfänger-Adresse ein und lassen Sie sich per Email zusenden.

BibTeX Citavi, JabRef, u.a.
(Literaturverwaltung)

PDF kein Volltext!
(Merkzettel, Notizen)

RIS Endnote, Citavi u.a.
(Literaturverwaltung)

MODS
(XML zur Weiterverarbeitung)

oder

Wählen Sie das für Sie passende Zitationsformat und kopieren Sie es dann in die Zwischenablage, lassen es sich per Mail zusenden oder speichern es als PDF-Datei.

Gewünschter Zitations-Stil:

oder

Bitte prüfen Sie, ob die Zitation formal korrekt ist, bevor Sie sie in einer Arbeit verwenden. Benutzen Sie gegebenenfalls den "Exportieren"-Dialog, wenn Sie ein Literaturverwaltungsprogramm verwenden und die Zitat-Angaben selbst formatieren wollen.

Machine learning for prioritizing security code-based Vulnerability discovery