On the design of more secure software-intensive systems by use of attack patterns

Applicability of Neural Networks to Software Security

“…In line with this argument many authors have argued that it is much better to find and fix flaws during the early phase of software development because it is more costly to fix the problem at a late stage of software development and much more costly when the software has been deployed (Spampinato et.al, 2008, Mockel and Abdallah, 2011, Gegick and Williams, 2007. To ensure that security is integrated during the design phase of SDLC, many techniques such as architectural risk analysis, threat modelling, attack trees, attack patterns, use of security tools and other approaches have been proposed (see chapter 2 for further discussion).…”

Specification, verification, and quantification of security in model-based systems

“…Gegick and Williams [60] identify security vulnerabilities in code level by tailoring attack patterns based on software components. These patterns take the form of regular expressions that are generic representations of vulnerabilities.…”

“…If a match exists, then the vulnerability may exist in the application being analyzed. The attacks patterns given in [60] are mainly based on code-level vulnerabilities especially the buffer-over flow and the SQL injection attacks.…”

Security Assessment of Software Design using Neural Network

“…In this technique, attack against a system is represented in a tree structure in which the root of the tree represents the goal of an attacker. The nodes in the tree represent the different types of actions the attacker can take to accomplish his goal on the software system or outside the software system which may be in the form of bribe or threat [6], [23]. "Attack trees are used for risk analysis, to answer questions about the system's security, to capture security knowledge in a reusable way, and to design, implement, and test countermeasures to attacks" [24].…”

“…Moreover, it requires great expertise to ascertain whether or not a software application has design-level flaws which makes it difficult to find and automate [9]. Many authors also argue that it is much better to find and fix flaws during the early phase of software development because it is more costly to fix the problem at a late stage of development and much more costly when the software has been deployed [6][29] [30]. Therefore, taking security into consideration at the design phase of SDLC will help greatly in producing secured software applications.…”