• Journal of Korea Multimedia Society
• /
• v.14 no.10
• /
• pp.1335-1347
• /
• 2011

The dissemination and use of mobile applications have been rapidly expanding these days. And in such a situation, the security of mobile applications has emerged as a new issue. Although the safety of general software such as desktop and enterprise software is systematically achieved from the development phase to the verification phase through secure coding, there have been not sufficient studies on the safety of mobile applications yet. This paper deals with deriving weakness enumeration specialized in mobile applications and implementing a tool that can automatically analyze the derived weakness. Deriving the weakness enumeration can be achieved based on CWE(Common Weakness Enumeration) and CERT(Computer Emergency Response Team) relating to the event-driven method that is generally used in developing mobile applications. The analysis tool uses the dynamic tests to check whether there are specified vulnerabilities in the source code of mobile applications. Moreover, the derived vulnerability could be used as a guidebook for programmers to develop mobile applications.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06b
• /
• pp.226-228
• /
• 2012

최근 HTML5, AJAX(Asynchronous JavaScript XML) 등으로 구현된 웹 애플리케이션이 널리 이용됨에 따라 웹 애플리케이션에 존재하는 취약점을 악용하는 공격 사례가 증가하고 있다. 웹 애플리케이션의 안전한 개발과 유지보수를 위해, 설계/구현 단계에서의 취약점 완화를 통한 예방, 그리고 운영 단계에서의 공격 탐지 및 대응이 필요하다. 더불어, 위험한 취약점들 및 공격 패턴들을 분석하고 우선순위를 부여하여, 웹 애플리케이션 개발 단계 및 운영 단계에서 심각한 취약점과 공격들을 우선 고려해야 한다. 본 논문에서는 OWASP Top 10과 CWE(Common Weakness Enumeration)를 연동시켜 CAPEC(Common Attack Pattern Enumeration and Classification)에서 웹 관련 주요 공격 패턴을 선별하고 순위화하였다. CWE는 취약점 예방에 도움을 주며, 순위화된 공격 패턴은 웹 애플리케이션에서 주요 공격들을 효율적으로 방어할 수 있게 하여 준다.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.2
• /
• pp.127-137
• /
• 2012

Recently, as modern Internet uses mashups, Web 3.0, JavaScript/AJAX widely, the rate at which new vulnerabilities are being discovered is increasing rapidly. It can subsequently introduce big security threats. In order to efficiently mitigate these web application vulnerabilities and security threats, it is needed to rank vulnerabilities based on severity and consider the severe vulnerabilities during a specific phase of software development lifecycle (SDLC) for web applications. In this paper, we have first verified whether the risk rating methodology of OWASP Top 10 vulnerabilities is a reasonable one or not by analyzing the vulnerability data of web applications in the US National Vulnerability Database (NVD). Then, by inspecting the vulnerability information of web applications based on OWASP Top-10 2010 list and CWE (Common Weakness Enumeration) directory, we have mapped the web-related entries of CWE onto the entries of OWASP Top-10 2010 and prioritized them. We have also presented which phase of SDLC is associated with each vulnerability entry. Using this approach, we can prevent or mitigate web application vulnerabilities and security threats efficiently.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2012.11a
• /
• pp.1057-1059
• /
• 2012

스마트폰이 대중화되면서 안드로이드 애플리케이션의 보안문제가 대두되고 있다. PC환경의 소프트웨어는 개발단계에서부터 시큐어코딩을 통해 안전성을 확보하고 있으나 안드로이드 애플리케이션의 경우는 연구가 더 필요한 상황이다. 본 논문에서는 CWE(Common Weakness Enumeration)의 취약점 분류 체계와 CAPEC(Common Attack Pattern Enumeration and Classification)의 공격 패턴 분류 체계와 CERT(Computer Emergency Response Team)의 취약점 발생 예방을 위한 정책들을 통해 안드로이드 애플리케이션의 최신화된 취약점 목록을 도출하고 카테고리별로 분류하여 취약점을 효율적으로 분석하는 기법을 제안한다.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.17 no.4
• /
• pp.77-83
• /
• 2021

As Open Source Software(OSS) recently invigorates, many companies actively use the OSSes in their business software. With such OSS invigoration, our web application is developed in order to provide the safety in using the OSSes, and update the information on the new vulnerabilities and the patches at all times by crawling the web pages of the relevant OSS home pages and the managing organizations of the vulnerabilities. By providing the updated information, our application helps the OSS users and developers to be aware of such security issues, and gives them to work in the safer environment from security risks. In addition, our application can be used as a security platform to greatly contribute to preventing potential security incidents not only for companies but also for individual developers.

• KIPS Transactions on Software and Data Engineering
• /
• v.12 no.10
• /
• pp.431-436
• /
• 2023

Recently the incorporation of artificial intelligence approaches in the field of software engineering has been one of the big topics. In the world, there are actively studying in two directions: 1) software engineering for artificial intelligence and 2) artificial intelligence for software engineering. We attempt to apply artificial intelligence to software engineering to identify and refactor bad code module areas. To learn the patterns of bad code elements well, we must have many datasets with bad code elements labeled correctly for artificial intelligence in this task. The current problems have insufficient datasets for learning and can not guarantee the accuracy of the datasets that we collected. To solve this problem, when collecting code data, bad code data is collected only for code module areas with high-complexity, not the entire code. We propose a method for exploring common weakness enumeration by learning the collected dataset based on transfer learning of the CodeBERT model. The CodeBERT model learns the corresponding dataset more about common weakness patterns in code. With this approach, we expect to identify common weakness patterns more accurately better than one in traditional software engineering.