More Like this

1. White-box Fuzzing in the Wild: A Chaos Engineering Module for DevOps Security Education

   Rahman, Md Mostafizur; Rashid, Md Bajlur; Barek, Md Abdul; Riad, ABM Kamrul; Rahman, Md Abdur; Shahriar, Hossain; Rahman, Akond; Wu, Fan; Francia, Guillermo; Faruk, Md Jobair; et al (July 2025, IEEE)

   In today’s fast-paced software development environments, DevOps has revolutionized the way teams build, test, and deploy applications by emphasizing automation, collaboration, and continuous integration/continuous delivery (CI/CD). However, with these advancements comes an increased need to address security proactively, giving rise to the DevSecOps movement, which integrates security practices into every phase of the software development lifecycle. DevOps security remains underrepresented in academic curricula despite its growing importance in the industry. To address this gap, this paper presents a handson learning module that combines Chaos Engineering and Whitebox Fuzzing to teach core principles of secure DevOps practices in an authentic, scenario-driven environment. Chaos Engineering allows students to intentionally disrupt systems to observe and understand their resilience, while White-box Fuzzing enables systematic exploration of internal code paths to discover cornercase vulnerabilities that typical tests might miss. The module was deployed across three academic institutions, and both pre- and post-surveys were conducted to evaluate its impact. Pre-survey data revealed that while most students had prior experience in software engineering and cybersecurity, the majority lacked exposure to DevOps security concepts. Post-survey responses gathered through ten structured questions showed highly positive feedback 66.7% of students strongly agreed, and 22.2% agreed that the hands-on labs improved their understanding of secure DevOps practices. Participants also reported increased confidence in secure coding, vulnerability detection, and resilient infrastructure design. These findings support the integration of experiential learning techniques like chaos simulations and white-box fuzzing into security education. By aligning academic training with realworld industry needs, this module effectively prepares students for the complex challenges of modern software development and operations. 

   more » « less
2. Motivators Matter When Gamifying Learning Activities

   https://doi.org/10.1007/978-3-031-26876-2_89  

   Dichev, C.; Dicheva, D.; Ismailova, R. (March 2023, 25th International Conference on Interactive Collaborative Learning (ICL2022))

   Auer, M.E.; Pachatz, W.; Rüütmann, T. (Ed.)

   Gamification, the use of game design elements in non-game contexts, has become a promising strategy for enhancing learners’ motivation, engagement, and performance. However, our understanding of how the motivational affordances of gamification interact with the motivational drivers engendered by a learning activity is still limited. In most of the studies the focus is on the role of the incorporated gamification elements, disregarding motivational factors associated with the learning activity, such as perceived utility, expectancy of success, and needed effort to complete it. Expectancy-Value model offers a practical method for estimating the level and quality of learners’ motivation towards a particular task as it accounts for both intrinsic and extrinsic motivators. Employing this model can shed a new light on the motivational potential of educational gamification. Accordingly, in this paper we present experiments with Expectancy-Value-Cost scale (EVC) as an instrument for estimating the level of students’ motivation towards a gamified learning activity. We studied empirically how the motivational factors measured by EVC relate to the level of learners’ engagement in gamified practicing and assessed their predictive qualities. 

   more » « less
3. Data Protection with SMSD Labware

   https://doi.org/10.1145/3287324.3293785  

   Shahriar, Hossain; Qian, Kai; Talukder, Md Arabin; Parizi, Reza (February 2019, Proc. of 50th ACM Technical Symposium on Computer Science Education (SIGCSE 2019))

   The majority of malicious mobile attacks take advantage of vulnerabilities in mobile applications, such as sensitive data leakage via inadvertent or side channel, unsecured sensitive data storage, data transmission, and many others. Most of these mobile vulnerabilities can be detected in the mobile software testing phase. However, most development teams often have virtually no time to address them due to critical project deadlines. To combat this, the more defect removal filters there are in the software development life cycle, the fewer defects that can lead to vulnerabilities will remain in the software product when it is released. As part of Secure Mobile Software Development (SMSD) project, we are currently developing capacity to address the lack of pedagogical materials and real world learning environment in secure mobile software development through effective, engaging, and investigative approaches. In this session, we provide details of a new implemented module named data protection. We also share our initial experience and feedback on the developed module. 

   more » « less
4. AppMine: Behavioral Analytics for Web Application Vulnerability Detection

   https://doi.org/10.1145/3338466.3358923  

   Jana, Indranil; Oprea, Alina (January 2019, The ACM Cloud Computing Security Workshop (CCSW))

   Web applications in widespread use have always been the target of large-scale attacks, leading to massive disruption of services and financial loss, as in the Equifax data breach. It has become common practice to deploy web applications in containers like Docker for better portability and ease of deployment.We design a system called AppMine for lightweight monitoring of web applications running in Docker containers and detection of unknown web vulnerabilities. AppMine is an unsupervised learning system, trained only on legitimate workloads of web applications, to detect anomalies based on either traditional models (PCA and one-class SVM), or more advanced neural-network architectures (LSTM). In our evaluation, we demonstrate that the neural network model outperforms more traditional methods on a range of web applications and recreated exploits. For instance, AppMine achieves average AUC scores as high as 0.97 for the Apache Struts application (with the CVE-2017-5638 exploit used in the Equifax breach), while the AUC scores for PCA and one-class SVM are 0.81 and 0.83, respectively. 

   more » « less
5. Hands-on File Inclusion Vulnerablity and Proactive Control for Secure Software Development

   https://doi.org/10.1109/COMPSAC.2019.10274  

   Shahriar, Hossain; Talukder, Md Arabin; Rahman, Mohammad; Chi, Hongmei; Ahamed, Sheikh; Wu, Fan (July 2019, Proc. of 43rd IEEE Conference on Computer, Software and Applications (COMPSAC))

   Security vulnerabilities in an application open the ways to security dangers and attacks, which can easily jeopardize the system executing that application. Therefore, it is important to develop vulnerability-free applications. The best approach would be to counteract against potential vulnerabilities during the coding with secure programming practices. Software security proactive control education for secure portable and web application advancement is of enormous interests in the Information Technology (IT) fields. In this paper, we proposed and developed innovative learning modules for software security proactive control based on several real-world scenarios to broaden and promote proactive control for secure software development in computing education. 

   more » « less