Integrating and Monitoring Security in Software Applications

点击翻译按钮获取中文摘要

Major software security breaches occur daily in Canada and around the world. It is thus critical to improve software security to ensure that the digital environment is helpful and trusted by users. To deliver software functionalities in a timely manner for emerging domains such as the cloud, software service providers usually prioritize functionality over security requirements, resulting in software with potential security risks and systems vulnerable to attack. The growing complexity of software systems and their ever-changing runtime environments requires improved capability of security analysts and software engineers to monitor the security of such systems. The proposed research program will develop a variety of automated techniques to develop secure software by addressing security issues in different stages of a development life cycle and subsequent monitoring at runtime.******The proposed research will develop methods and tools for intrusion scenario description and automatic signature generation from the scenarios. A monitoring system will be developed to detect intrusions into software systems by comparing their run-time behavior with the generated signatures. Commonly recurring security problems can be addressed using security patterns. Such patterns will be used to realize security requirements in software design, with violation detected by automatic runtime analysis of the patterns. As security patterns are the design components that correspond to security requirements, any violation of patterns will indicate violation of the requirements. Software-as-a-Service (SaaS) are being used more and more to access various applications anytime anywhere. Given the constant threat of various attacks on cloud-based systems, security requirements must be given the same importance as functionality requirements and to this end, the proposed research will provide a novel comprehensive platform that allows security requirements and services to be incorporated in each stage of the SaaS development lifecycle. We will investigate the underlying operational environments of cloud and build defense mechanisms in the development and monitoring stages for ensuring the security of the cloud environment and its applications or services.******This research program will play a vital role in bridging the gap between software engineering and security engineering practices for complex software of new paradigms and computing environments that include cloud. The program is in alignment with the Government of Canada's priority for information security and safety and its commitment to protect Canadians from cyberattacks. A unique aspect of this program is to provide a balanced training facility for two PhD and two MSc students each year that will include both software engineering and security engineering principles for developing more secure software applications.