86 citations · 116 across the 10 of their papers we have counts for
6 papers · 1 filter
S3C2 Summit 2023-11: Industry Secure Supply Chain Summit
Nusrat Zahan, Yasemin Acar, Michel Cukier +5
Cyber attacks leveraging or targeting the software supply chain, such as the SolarWinds and the Log4j incidents, affected thousands of businesses and their customers, drawing atten…
Leveraging Large Language Models to Detect npm Malicious Packages
Nusrat Zahan, Philipp Burckhardt, Mikola Lysenko +2
Existing malicious code detection techniques demand the integration of multiple tools to detect different malware patterns, often suffering from high misclassification rates. There…
Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools in a Large Java-based System
Aishwarya Seth, Saikath Bhattacharya, Sarah Elder +2
Security resources are scarce, and practitioners need guidance in the effective and efficient usage of techniques and tools available in the cybersecurity industry. Two emerging to…
Do Software Security Practices Yield Fewer Vulnerabilities?
Nusrat Zahan, Shohanuzzaman Shohan, Dan Harris +1
Due to the ever-increasing security breaches, practitioners are motivated to produce more secure software. In the United States, the White House Office released a memorandum on Exe…
OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics
Nusrat Zahan, Parth Kanakiya, Brian Hambleton +2
The OpenSSF Scorecard project is an automated tool to monitor the security health of open-source software. This study evaluates the applicability of the Scorecard tool and compares…
What are Weak Links in the npm Supply Chain?
Nusrat Zahan, Thomas Zimmermann, Patrice Godefroid +3
Modern software development frequently uses third-party packages, raising the concern of supply chain security attacks. Many attackers target popular package managers, like npm, an…