63 citations · 92 across the 18 of their papers we have counts for
18 papers
Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools in a Large Java-based System
Aishwarya Seth, Saikath Bhattacharya, Sarah Elder +2
Security resources are scarce, and practitioners need guidance in the effective and efficient usage of techniques and tools available in the cybersecurity industry. Two emerging to…
S3C2 Summit 2023-06: Government Secure Supply Chain Summit
William Enck, Yasemin Acar, Michel Cukier +3
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-know…
S3C2 Summit 2023-02: Industry Secure Supply Chain Summit
Trevor Dunlap, Yasemin Acar, Michel Cucker +4
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-know…
S3C2 Summit 2202-09: Industry Secure Suppy Chain Summit
Mindy Tran, Yasemin Acar, Michel Cucker +4
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-know…
A Comparative Study of Software Secrets Reporting by Secret Detection Tools
Setu Kumar Basak, Jamison Cox, Bradley Reaves +1
Background: According to GitGuardian's monitoring of public GitHub repositories, secrets sprawl continued accelerating in 2022 by 67% compared to 2021, exposing over 10 million sec…
Trusting code in the wild: A social network-based centrality rating for developers in the Rust ecosystem
Nasif Imtiaz, Preya Shabrina, Laurie Williams
As modern software extensively uses open source packages, developers regularly pull in new upstream code through frequent updates. While a manual review of all upstream changes may…
SecretBench: A Dataset of Software Secrets
Setu Kumar Basak, Lorenzo Neil, Bradley Reaves +1
According to GitGuardian's monitoring of public GitHub repositories, the exposure of secrets (API keys and other credentials) increased two-fold in 2021 compared to 2020, totaling…
What Challenges Do Developers Face About Checked-in Secrets in Software Artifacts?
Setu Kumar Basak, Lorenzo Neil, Bradley Reaves +1
Throughout 2021, GitGuardian's monitoring of public GitHub repositories revealed a two-fold increase in the number of secrets (database credentials, API keys, and other credentials…
An investigation of security controls and MITRE ATT\&CK techniques
Md Rayhanur Rahman, Laurie Williams
Attackers utilize a plethora of adversarial techniques in cyberattacks to compromise the confidentiality, integrity, and availability of the target organizations and systems. Infor…
Investigating co-occurrences of MITRE ATT\&CK Techniques
Md Rayhanur Rahman, Laurie Williams
Cyberattacks use adversarial techniques to bypass system defenses, persist, and eventually breach systems. The MITRE ATT\&CK framework catalogs a set of adversarial techniques and…
From Threat Reports to Continuous Threat Intelligence: A Comparison of Attack Technique Extraction Methods from Textual Artifacts
Md Rayhanur Rahman, Laurie Williams
The cyberthreat landscape is continuously evolving. Hence, continuous monitoring and sharing of threat intelligence have become a priority for organizations. Threat reports, publis…
Do Software Security Practices Yield Fewer Vulnerabilities?
Nusrat Zahan, Shohanuzzaman Shohan, Dan Harris +1
Due to the ever-increasing security breaches, practitioners are motivated to produce more secure software. In the United States, the White House Office released a memorandum on Exe…
Do I really need all this work to find vulnerabilities? An empirical case study comparing vulnerability detection techniques on a Java application
Sarah Elder, Nusrat Zahan, Rui Shu +4
CONTEXT: Applying vulnerability detection techniques is one of many tasks using the limited resources of a software project. OBJECTIVE: The goal of this research is to assist manag…
OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics
Nusrat Zahan, Parth Kanakiya, Brian Hambleton +2
The OpenSSF Scorecard project is an automated tool to monitor the security health of open-source software. This study evaluates the applicability of the Scorecard tool and compares…
Are your dependencies code reviewed?: Measuring code review coverage in dependency updates
Nasif Imtiaz, Laurie Williams
As modern software extensively uses free open source packages as dependencies, developers have to regularly pull in new third-party code through frequent updates. However, without…
Reducing the Cost of Training Security Classifier (via Optimized Semi-Supervised Learning)
Rui Shu, Tianpei Xia, Huy Tu +2
Background: Most of the existing machine learning models for security tasks, such as spam detection, malware detection, or network intrusion detection, are built on supervised mach…
Dazzle: Using Optimized Generative Adversarial Networks to Address Security Data Class Imbalance Issue
Rui Shu, Tianpei Xia, Laurie Williams +1
Background: Machine learning techniques have been widely used and demonstrate promising performance in many software security tasks such as software vulnerability prediction. Howev…
What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey
Md Rayhanur Rahman, Rezvan Mahdavi-Hezaveh, Laurie Williams
Cybersecurity researchers have contributed to the automated extraction of CTI from textual sources, such as threat reports and online articles, where cyberattack strategies, proced…