Search

Previously, we have proposed a computational model for decision-making in crisis situations called C-RPD (Computational Recognition Primed Decision). In this paper, a software development process customized for Crisis Situations Decision-Making Systems (CSDMSs) is proposed. Agile processes can skillfully manage uncertainty in software requirements and some of their features like incremental development can solve some problems in developing CSDMSs. However, these processes do not provide comprehensive solutions for issues like the lack of enough knowledge about CSDMSs, very rapid changes, urgent need to overcome security challenges, high development unpredictability, and the performance test. Extreme Programming (XP) is one of the best and most widely-used agile processes. In this article, a customized version of XP called Crisis Situations Decision-Making Systems Software Development Process (CSDP) is proposed. Standing first and second in five national and international RoboCup rescue agent simulation tournaments from 2006 to 2010 bear witness to the efficiency of the developed software using CSDP. Relying on its characteristics, CSDP has been able to practically tackle the challenges of developing CSDMSs such as the lack of crisis-related knowledge and cumulative nature of crisis-related knowledge, difficulty of extracting knowledge, long development cycle, and sudden and frequent changes in system requirements.

Web application vulnerability scanners cannot detect business logic vulnerabilities (vulnerabilities related to logic) because they are not able to understand business logic of the web application. In order to identify business logic of the web application, this paper presents BLProM, the black box approach that identifies business processes of the web application. Detecting business processes of the web applications can be used in dynamic security testing to determine business logic vulnerabilities in the web applications. BLProM first extracts navigation graph of the web application then identifies business processes from the navigation graph. The evaluation conducted on three well-known open source web applications shows that BLProM is able to detect business logic processes. Experimental results show that BLProM improves web application scanning because it clusters web application pages and prevent scanning similar pages. The proposed approach is compared to OWASP ZAP, an open source web scanner. We show that BLProM improves web application scanning about % 96.

Insider threat is a significant security risk for organizations and hard to detect. Most introduced detection methods need contextual data entries about users, or preprocessed user activity logs to detect insider threats which it is costly and time-consuming. In this paper, we introduce a behavior analysis method that learns its context and detects multiple types of insider threats from raw logs and network traffic in real-time. This method, named XABA, learns user roles and exclusive behaviors, through analyzing raw logs related to each network session of the user. Then it checks for some abnormal patterns, and if so, triggers the appropriate alert. XABA is implemented on the big-stream platform to operate on high rates of network sessions. To evaluate XABA, a real traitor scenario is designed and detected with low false positive. XABA can detect diverse types of scenarios in many contexts without any predefined information or preprocessed activity logs.

Backdoor as a mechanism surreptitiously introduced into a computer system is widely used in performing network attacks. In this article, it is considered to detect its presence while helping an attacker to bypass normal authentication methods of a computer to maintain the access gained. In the latest researches have been done on this field so far, it is emphasized on analyzing only the behavior of backdoors. However, in this paper we propose a novel approach, combining systemic and behavioral features focusing on the "CMD" phase that the attacker sends commands to the victim. Through the detection method driven in this article, at first we gather the systemic and behavioral alerts produced while the attacker is installing and utilizing the backdoor interactively and then categorize them by specific features selected to give scores to the both aspects seen. Scores are given in two steps. The first step based on the prominent systemic alerts selected which are specified to backdoors and in the second step we give scores to the behavior it has in the command phase by creating and running a Markov Model. Literally, the scores are normalized and aggregated to determine the probability of backdoor residence on the computer monitored. We evaluated the algorithm in six different scenarios and by a group of well-known backdoors to make distinction between the proposed method and prior works.