170 citations · 564 across the 17 of their papers we have counts for
17 papers
An Extended Model of Software Configuration
Rezvan Mahdavi-Hezaveh, Sameeha Fatima, Laurie Williams
Feature toggles and configuration options are modern programmatic techniques to easily include or exclude functionality in a software product. The research contributions to these t…
What are the Practices for Secret Management in Software Artifacts?
Setu Kumar Basak, Lorenzo Neil, Bradley Reaves +1
Throughout 2021, GitGuardian's monitoring of public GitHub repositories revealed a two-fold increase in the number of secrets (database credentials, API keys, and other credentials…
Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages
Nasif Imtiaz, Aniqa Khanom, Laurie Williams
Vulnerabilities in open source packages can be a security risk for the client projects that use these packages as dependencies. When a new vulnerability is discovered in a package,…
What are Weak Links in the npm Supply Chain?
Nusrat Zahan, Thomas Zimmermann, Patrice Godefroid +3
Modern software development frequently uses third-party packages, raising the concern of supply chain security attacks. Many attackers target popular package managers, like npm, an…
A Comparative Study of Vulnerability Reporting by Software Composition Analysis Tools
Nasif Imtiaz, Seaver Thorne, Laurie Williams
Background: Modern software uses many third-party libraries and frameworks as dependencies. Known vulnerabilities in these dependencies are a potential security risk. Software comp…
Memory Error Detection in Security Testing
Nasif Imtiaz, Laurie Williams
We study 10 C/C++ projects that have been using a static analysis security testing tool. We analyze the historical scan reports generated by the tool and study how frequently memor…
Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard
Sarah Elder, Nusrat Zahan, Val Kozarev +3
Lack of security expertise among software practitioners is a problem with many implications. First, there is a deficit of security professionals to meet current needs. Additionally…
Omni: Automated Ensemble with Unexpected Models against Adversarial Evasion Attack
Rui Shu, Tianpei Xia, Laurie Williams +1
Background: Machine learning-based security detection models have become prevalent in modern malware and intrusion detection systems. However, previous studies show that such model…
The 'as Code' Activities: Development Anti-patterns for Infrastructure as Code
Akond Rahman, Effat Farhana, Laurie Williams
Context: The 'as code' suffix in infrastructure as code (IaC) refers to applying software engineering activities, such as version control, to maintain IaC scripts. Without the appl…
How to Better Distinguish Security Bug Reports (using Dual Hyperparameter Optimization
Rui Shu, Tianpei Xia, Jianfeng Chen +2
Background: In order that the general public is not vulnerable to hackers, security bug reports need to be handled by small groups of engineers before being widely discussed. But l…
Security Smells in Ansible and Chef Scripts: A Replication Study
Akond Rahman, Md. Rayhanur Rahman, Chris Parnin +1
Context: Security smells are recurring coding patterns that are indicative of security weakness, and require further inspection. As infrastructure as code (IaC) scripts, such as An…
Software Development with Feature Toggles: Practices used by Practitioners
Rezvan Mahdavi-Hezaveh, Jacob Dremann, Laurie Williams
Background: Using feature toggles is a technique that allows developers to either turn a feature on or off with a variable in a conditional statement. Feature toggles are increasin…
Better Security Bug Report Classification via Hyperparameter Optimization
Rui Shu, Tianpei Xia, Laurie Williams +1
When security bugs are detected, they should be (a)~discussed privately by security software engineers; and (b)~not mentioned to the general public until security patches are avail…
Source Code Properties of Defective Infrastructure as Code Scripts
Akond Rahman, Laurie Williams
Context: In continuous deployment, software and services are rapidly deployed to end-users using an automated deployment pipeline. Defects in infrastructure as code (IaC) scripts c…
Bugs in Infrastructure as Code
Akond Rahman, Sarah Elder, Faysal Hossain Shezan +3
Infrastructure as code (IaC) scripts are used to automate the maintenance and configuration of software development and deployment infrastructure. IaC scripts can be complex in nat…
Where Are The Gaps? A Systematic Mapping Study of Infrastructure as Code Research
Akond Rahman, Rezvan Mahdavi-Hezaveh, Laurie Williams
Context:Infrastructure as code (IaC) is the practice to automatically configure system dependencies and to provision local and remote instances. Practitioners consider IaC as a fun…
Improving Vulnerability Inspection Efficiency Using Active Learning
Zhe Yu, Christopher Theisen, Laurie Williams +1
Software engineers can find vulnerabilities with less effort if they are directed towards code that might contain more vulnerabilities. HARMLESS is an incremental support vector ma…