@conference {822, title = {Minimizing Software-Rooted Risk through Library Implementation Selection}, booktitle = {Proceedings of the 2023 IEEE CSR Workshop on Data Science for Cyber Security (DS4CS)}, year = {2023}, abstract = {

In contemporary Internet of Things (IoT) systems, complex software artifacts are deployed to realize the required functionalities. The business logic of these software artifacts is uniquely composed through code that is customly developed according to the requirements, while all software artifacts utilize libraries that implement generic functionalities, which are needed in the context of the realized operations. Libraries, however, often entail vulnerabilities, which may be exploited by threat agents to attack the system. In many cases, the functionality required by an application is realized by a number of alternative libraries, with each library having its own list of vulnerabilities, while differentiations in other non-functional properties (e.g. execution efficiency, memory footprint etc.) may also be present. In this paper, we present an approach for automating the task of minimizing the risk level of IoT systems that is owing to the vulnerabilities of libraries required by software artifacts. The proposed approach exploits knowledge on which libraries provide equivalent implementations of the same functionalities, and automatically assesses the risk level of candidate library combinations and finally selects the library configuration exhibiting the minimum risk level to bundle into the executable software artifact. Additionally, the risk level of candidate implementations is constantly monitored for new vulnerability identifications or fixes in the implementations, triggering new risk assessments and producing new executables as appropriate. The proposed approach can be used in IoT platform deployment to minimize the software-rooted risk level.

}, author = {Panagiotis Sotiropoulos and Christos-Minas Mathas and Costas Vassilakis and Nicholas Kolokotronis} } @article {823, title = {A Software Vulnerability Management Framework for the Minimization of System Attack Surface and Risk}, journal = {Electronics}, volume = {12}, year = {2023}, month = {may}, pages = {2278}, abstract = {

Current Internet of Things (IoT) systems comprise multiple software systems that are deployed to provide users with the required functionalities. System architects create system blueprints and draw specifications for the software artefacts that are needed; subsequently, either custom-made software is developed according to these specifications and/or ready-made COTS/open source software may be identified and customized to realize the overall system goals. All deployed software however may entail vulnerabilities, either due to insecure coding practices or owing to misconfigurations and unexpected interactions. Moreover, software artefacts may implement a much broader set of functionalities than may be strictly necessary for the system at hand, in order to serve a wider range of needs, and failure to appropriately configure the deployed software to include only the required modules results in the further increase of the system attack surface and the associated risk. In this paper, we present a software vulnerability management framework which facilitates (a) the configuration of software to include only the necessary features, (b) the execution of security-related tests and the compilation of platform-wide software vulnerability lists, and (c) the prioritization of vulnerability addressing, considering the impact of each vulnerability, the associated technical debt for its remediation, and the available security budget. The proposed framework can be used as an aid in IoT platform implementation by software architects, developers, and security experts.

}, keywords = {IoT systems, risk management, software vulnerabilities, system design, system security, technical debt}, doi = {10.3390/electronics12102278}, url = {https://doi.org/10.3390/electronics12102278}, author = {Panagiotis Sotiropoulos and Christos-Minas Mathas and Costas Vassilakis and Nicholas Kolokotronis} } @article {776, title = {Application cases of the Additional Testsuites Framework}, year = {2020}, abstract = {

The Additional Testsuites Framework is a novel test suite management approach, which allows for holistic management of test suites for any software program. In particular, the tests can be maintained in a centralized repository, and are expanded and maintained independently of specific versions of the associated program. Through the use of annotations, tests are categorized and distributed to the desired versions of the software program. Currently, the Additional Testsuites Framework concept has been implemented and successfully used for testing a number of real-world software programs, notably including the JBoss Server. The presented framework also supports test-based development, while it can also support additional functionalities, such as dynamic/selective program builds. In this report, we provide a list of notable cases where the AT Framework has been applied on real-world software programs.

}, author = {Panagiotis Sotiropoulos and Costas Vassilakis} } @article {721, title = {Detection of intermittent faults in software programs through identification of suspicious shared variable access patterns}, journal = {Journal of Systems and Software}, volume = {159}, year = {2020}, month = {30 October 2019}, pages = {110455}, abstract = {Intermittent faults are a very common problem in the software world, while difficult to be debugged. Most of the existing approaches though assume that suitable instrumentation has been provided in the program, typically in the form of assertions that dictate which program states are considered to be erroneous. In this paper we propose a method that can be used to detect probable sources of intermittent faults within a program. Our method proposes certain points in the code, whose data interdependencies combined with their execution interweaving indicate that they could be the cause of intermittent faults. It is the responsibility of the user to accept or reject these proposals. An advantage of this method is that it removes the need for having predefined assertion points in the code, being able to detect potential sources of intermittent faults in the whole bulk of the code, with no instrumentation requirements on the side of the programmer. The proposed approach exploits information from the dynamic behavior of the program. In comparison with parser-based approaches which analyze only the program structure, our approach is immutable to language term changes and in general is not depending on any user-provided assertions or configuration.}, keywords = {Fault detection, Intermittent faults, Model-based checking, Shared variables}, issn = {0164-1212}, doi = {10.1016/j.jss.2019.110455}, author = {Panagiotis Sotiropoulos and Costas Vassilakis} }