Search

The area of software development and secure coding can benefit significantly from advancements in virtual assistants. Research has shown that many coders neglect security in favor of meeting deadlines. This shortcoming leaves systems vulnerable to attackers. While a plethora of tools are available for programmers to scan their code for vulnerabilities, finding the right tool can be challenging. It is therefore imperative to adopt measures to get programmers to utilize code analysis tools that will help them produce more secure code. This chapter looks at the limitations of existing approaches to secure coding and proposes a methodology that allows programmers to scan and fix vulnerabilities in program code by communicating with virtual assistants on their smart devices. With the ubiquitous move towards virtual assistants, it is important to design systems that are more reliant on voice than on standard point-and-click and keyboard-driven approaches. Consequently, we propose MyCodeAnalyzer, a Google Assistant app and code analysis framework, which was designed to interactively scan program code for vulnerabilities and flaws using voice commands during development. We describe the proposed methodology, implement a prototype, test it on a vulnerable project and present our results.

Network motifs have been widely used in the analysis of various biological networks, including protein-protein interaction (PPI) networks, transcription regulation networks (TRNs), and metabolic networks. Counting network motif involves expensive enumeration of sub-patterns and graph isomorphism. Many protein-protein interaction data-bases are readily available online and are constantly updated over a period of time by either adding or removing proteins and the respective interactions between them. There exists many motif enumeration algorithms that can be applied to protein-protein interaction databases. However, most existing algorithms run enumeration over the entire network every time a change is made to the network. This is not only computationally expensive but also highly inefficient as the size of the network and motif increases. In this work, we propose an exact and efficient algorithm for enumerating network motifs by utilizing only updated edges and vertices in a network. We demonstrate how our algorithm can quickly and robustly update the frequency of different sizes of network motifs in dynamic networks. Experimental results show that our approach is successful in reducing the computational time by eliminating overlapped subgraphs. Run-time monitoring of network motif distributions is very important in numerous practical domains where large networks are subject to localized changes, which is efficiently provided by the proposed algorithm.

Numerous agent-oriented methodologies that offer a rich pool of resources to support developers of agent-based systems have been proposed. However, the use of existing methodologies in industrial settings is still limited due to the large volume of methodologies, diversity of covered scopes, ambiguity in concepts, and lack of maturity. This makes it difficult for agent technology practitioners to choose the appropriate methodology that best fits their given development context. To eliminate such agent-based development bottleneck, it is important to introduce suitable methods for evaluating, comparing, and classifying agent-oriented methodologies in order to leverage their usage among practitioners. Having systems to evaluate methodologies can effectively help developers better understand existing methodologies, realize their benefits, outline their pros and cons, and assist practitioners with selecting the best-fit methodology for a specific agent-based project. In response, this paper proposes a novel criteria-based evaluation that is influenced by software engineering practices to assess and compare agentoriented methodologies. The proposed evaluation is derived from the software engineering body of knowledge (SWEBOK) and provides a simplified method to assess the coverage degree of an agent-oriented methodology with respect to major software knowledge areas such as the requirements and testing phases. We demonstrate the applicability of the proposed evaluation by applying it to three agent-oriented methodologies (PASSI, MaSE, and Prometheus) in the software engineering requirements and testing phases.

There has been substantial focus on software metrics over the last few decades. However, many activities within software engineering are often qualitative and are not consonant with automated approaches. Consequently, there are few tools to measure software development quality or to assess teamwork contribution. This paper uses ideas from the Goal-Questions-Metrics (GQM) paradigm to propose a set of metrics to track product and process quality throughout the software development process. The proposed metrics program consists of a set of quality metrics and associated standards that will encourage software development teams to produce high-quality products. We also propose a framework for a tool that implements the metrics tracking program and demonstrate its utility by developing an Eclipse plugin based on the proposed quality metrics.

Code-level vulnerabilities play a significant role in the number of data breaches that happen across the globe. There have been several efforts by researchers and developers alike to design tools that provide programmers with code scanning capabilities. However, many developers and businesses are skeptical of using some of these tools. One major reason for the lack of acceptance and use of code scanning tools is poor interface design and substandard presentation of bug/vulnerability warnings. In an effort to design a recommender system to help programmers write more secure code, we conducted a knowledge elicitation survey and usability study to provide insights about the expectations of programmers in regards to a usable interface. This article summarizes our findings.

Open source repositories contain a wealth of unstructured and unlabeled data from which useful knowledge can be extracted. This knowledge can be applied in a wide range of applications such as discovering how programmers improve their programs over time and finding patterns to detect and mitigate vulnerabilities. In this work, we propose to use text mining and machine learning to extract knowledge from open source code in order to categorize and structure source code. By mining a subset (over 600,000 Java files) of a 2011 dataset that contains over 70,000 open source projects, we present a case study showing that useful patterns can be extracted from source code and that these patterns can be used to create a recommender system to help programmers avoid unsafe practices. We demonstrate the utility of our proposed techniques by applying them to the detection of SOL Injection.

The security of computer programs and systems is a very critical issue. With the number of attacks launched on computer networks and software, businesses and IT professionals are taking steps to ensure that their information systems are as secure as possible. However, many programmers do not think about adding security to their programs until their projects are near completion. This is a major mistake because a system is as secure as its weakest link. If security is viewed as an afterthought, it is highly likely that the resulting system will have a large number of vulnerabilities, which could be exploited by attackers. One of the reasons programmers overlook adding security to their code is because it is viewed as a complicated or time-consuming process. This paper presents a tool that will help programmers think more about security and add security tactics to their code with ease. We created a model that learns from existing open source projects and documentation using machine learning and text mining techniques. Our tool contains a module that runs in the background to analyze code as the programmer types and offers suggestions of where security could be included. In addition, our tool fetches existing open source implementations of cryptographic algorithms and sample code from repositories to aid programmers in adding security easily to their projects.

We introduce a novel tool for visualizing netflow traffic on enterprise networks called 3D Parallel Coordinate Planes (3DPCP). This tool provides operators with the ability to manipulate the visual flow of network traffic information by arranging two-dimensional planes along a vertical time axis in 3D space.