Java natively supports serialisation and deserialisation, features that are necessary to enable distributed systems to exchange Java objects. Deserialisation of data from malicious sources can lead to security exploits including remote code execution because by default Java does not validate deserialised data. In the absence of validation, a carefully crafted payload can trigger arbitrary functionality. The state-of-the-art general mitigation strategy for deserialisation exploits in Java is deserialisation filtering that validates the contents of an object input stream before the object is deserialised using user-provided filters. In this paper we describe a novel technique called ds-prefix for automatic synthesis of deserialisation filters (as regular expressions) from examples. We focus on synthesis of allowlists (permitted behaviours) as they provide a better level of security. ds-prefix is based on deserialisation heuristics and specifically targets synthesis of deserialisation allowlists. We evaluate our approach by executing ds-prefix on popular open-source systems and show that ds-prefix can produce filters preventing real CVEs using a small number of training examples. We also compare our approach with other synthesis tools which demonstrates that ds-prefix outperforms existing tools and achieves better F1-score.

Various third-party single sign-on (SSO) services (e.g., Facebook Login and Twitter Login) are widely deployed by web applications to facilitate their authentication and authorization processes. Nevertheless, integrating these services in a secure manner remains challenging, such that security issues are continually reported in recent years. In this work, we develop MoScan, a model-based scanner that can be used by software testers and security analysts for detecting and reporting security vulnerabilities in SSO implementations. MoScan takes as input a state machine built based on an SSO standard and our empirical study to represent participants' states and transitions during the login process. In the testing process, it analyzes network traces captured during the execution of SSO services, and increments the state machine which is then used to generate payloads to test the protocol participants. We evaluate MoScan with 23 real-world websites which integrate the Facebook SSO service to test its capability of identifying security vulnerabilities. To show the adaptability of MoScan's state machine, we also test it on Twitter and LinkedIn’s SSO services, and Github's authentication plugin in Jenkins. It detects three known weaknesses and one new logic fault from them, showing a new perspective in testing stateful protocol implementations like SSO services. Our demonstration and the source code of MoScan are available at https://github.com/baigd/moscan.

Nowadays, industrial research labs operate like startups. In a relatively short amount of time, researchers are expected not only to explore innovative ideas but also show how the new ideas can add value to the organisation. One way to do this, especially when developing tools, is to construct usable prototypes. When the technology underlying the research tool is highly complex or niche, like program analysis, field trials with potential users also help explaining and demonstrating the benefits of the tool. Getting support from potential users helps demonstrate value to the organisation, which in turn justifies conducting more extensive research and investing more resources to enhance the initial prototype.

We present an approach in automatic test generation that combines features of static analysis and bounded symbolic computation that is capable of producing a test suite that can be used to declare a program under test safe within bounds. We first use the results produced by static analysis which will identify a list of potential errors in the program. We restrict our search to the locations where errors can exist and aim to find exactly one test case per real bug. We have built a prototype tool (called Batg) that implements our approach. We report the results of running it on a number of benchmarks from well known benchmarking suites. We compare Batgto KLEE (an automatic test generation framework) and CBMC(a bounded model checker). This comparison is based on the time taken by the tools, the number of bugs found and the number of generated test cases. We analyse the results of our experiment, demonstrating the benefits of our approach.

This paper describes the rationale and an incremental approach to introduce a new curriculum in the area of service management and engineering. This is done in the context of an existing software engineering and information system program. So the total cost of the new curriculum is not high. The approach, with relatively low start-up costs, is suitable for small departments. As with any new programme or degree there is a problem of getting the concepts known in the marketplace. The School of IT in initiating this programme is actively working with several organizations to promote the ideas to potential employees and students.

This paper is a report on how sustainable and fruitful cooperation was achieved between a small university department and an industry partner. It outlines the range and type of activities that need tube undertaken over a longer than normal duration. It also describes the expectations from the industry partner for the cooperation to be successful.

Privacy policies are usually expressed at a high level using languages such as P3P, EPAL, which are independent of applications. To check if a system satisfies a privacy policy requires to link it with the behaviour of the system and its environment. We propose a framework which is based on models to support the automation of testing if a software system meets a policy. In our framework, policies and system's behaviour are expressed using formal models. These formal models are then combined and used to derive test cases. The main advantage of this approach is the automation of the testing process. We demonstrateits applicability via two examples..

In this article we present a technique which helps students in understanding proofs in the context of automata theory. The main conclusion is that student understanding can be improved by using a collection of lemmas and trying to automate the proof in a mechanical theorem prover.

In this article, we present an approach to defining UML diagrams in terms of state predicates and using the theorem prover PVS (Prototype Verification System) to verify consistency between various diagrams. We focus on the dynamic aspects of the various diagrams. Our approach can easily handle partially specified systems as the behaviour is described in terms of the history of the computation.

Abstract In this article, we discuss the effect of architectures on behaviours and the notions of equivalence for CCS terms. Two types of architectures are considered viz, shared memory systems and distributed memory systems. Processes can be logically migrated in shared memory systems while in distributed memory systems, processes are bound to a location and require explicit migration. Communication in shared memory systems can follow the CCS principle. A complete equational characterisation of the bisimulation equivalence induced by the execution on multiprocessors requires an extended syntax; which captures the process of compiling and loading. To permit a realistic description of communication in distributed systems, asynchronous actions are required. Due to this the complete axiomatisation for the bisimulation equivalence is more sensitive to the causal structure of the processes. A practical interpretation to the complete axiomatisation of the bisimulation equivalence is also given.

An important issue in real-time computing is the development of a sufficiently abstract computational model. This model must enable one to specify, analyze, and implement distributed real-time systems. Therefore, there must also be a programming language based on the model. A description is given of such a programming language and its operational semantics. In the design of the language the applicative paradigm is extended to permit specification of parallelism, distribution, and time and temporal constraints. The language has constructs that use ideas from temporal logic and polymorphism to specify timing constraints. It uses the concept of events and a declarative event-handling style to represent communication and asynchrony. The formal model described is an operational semantics for the language and is based on dynamic algebras. The initial structure of the abstract machine for the language is described, and examples of transition rules are presented.>

Some of the fundamental issues and tradeoffs involved in the translation and execution of programs written in the Ada language and intended for distributed execution are examined. The memory access architecture, binding time and degree of system homogeneity are the three basic characteristics in terms of which target systems can be described. Library subprograms and library packages are identified as natural distributable units of the language. The program-to-process/memory mapping and the unit of the language to be distributed are the key issues in the distribution of Ada. The implications of various alternatives for these are analyzed.>