More Like this

1. Build It, Break It, Fix It: Contesting Secure Development

   https://doi.org/10.1145/3383773  

   Parker, James; Hicks, Michael; Ruef, Andrew; Mazurek, Michelle L.; Levin, Dave; Votipka, Daniel; Mardziel, Piotr; Fulton, Kelsey R. (May 2020, ACM Transactions on Privacy and Security)
2. The Internet of Animals: what it is, what it could be

   https://doi.org/10.1016/j.tree.2023.04.007  

   Kays, Roland; Wikelski, Martin (May 2023, Trends in Ecology & Evolution)
3. Cross-Validation: What Does It Estimate and How Well Does It Do It?

   https://doi.org/10.1080/01621459.2023.2197686  

   Bates, Stephen; Hastie, Trevor; Tibshirani, Robert (May 2023, Journal of the American Statistical Association)
4. It Can Understand the Logs, Literally

   https://doi.org/10.1109/IPDPSW.2019.00084  

   Pi, Aidi; Chen, Wei; Zeller, Will; Zhou, Xiaobo (July 2019, 2019 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW))

   Workflow reconstruction through logs is crucial for troubleshooting targeted distributed systems. It is also challenging to extract enough information from logs and keep a concise view, which makes manual log analysis hard to practice. However, currently popular tools rely on identifier-based log parsing, leaving a large amount of workflow information unexploited. In this paper, we propose a log extraction approach NLog, which utilizes a natural language processing based approach to obtain the key information from log messages and identify the same object in logs generated by different statements without any domain knowledge. We propose to use keyed message, a new log storage structure to store the parsed logs. We implement NLog and apply it to distributed data analytics frameworks Spark and MapReduce. Evaluation results show that NLog can accurately identify the objects in log messages even without explicit identifiers. By using keyed messages, users can have a concise as well as flexible view of the workflows. 

   more » « less
5. Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It

   Daniel Votipka, Kelsey R. (August 2020, USENIX Security Symposium)

   null (Ed.)

   Secure software development is a challenging task requiring consideration of many possible threats and mitigations.This paper investigates how and why programmers, despite a baseline of security experience, make security-relevant errors.To do this, we conducted an in-depth analysis of 94 submissions to a secure-programming contest designed to mimic real-world constraints: correctness, performance, and security.In addition to writing secure code, participants were asked to search for vulnerabilities in other teams’ programs; in total, teams submitted 866 exploits against the submissions we considered. Over an intensive six-month period, we used iterative open coding to manually, but systematically, characterize each submitted project and vulnerability (including vulnerabilities we identified ourselves). We labeled vulnerabilities by type, attacker control allowed, and ease of exploitation,and projects according to security implementation strategy.Several patterns emerged. For example, simple mistakes were least common: only 21% of projects introduced such an error.Conversely, vulnerabilities arising from a misunderstanding of security concepts were significantly more common, appearing in 78% of projects. Our results have implications for improving secure-programming APIs, API documentation,vulnerability-finding tools, and security education. 

   more » « less