Static Extracting Method of Software Intended Behavior Based on API Functions Invoking

The method of extracting and describing the intended behavior of software precisely has become one of the key points in the fields of software behavior＇s dynamic and trusted authentication. In this paper, the author proposes a specified measure of extracting SIBDS （software intended behaviors describing sets） statically from the binary executable using the software＇s API functions invoking, and also introduces the definition of the structure used to store the SIBDS in detail. Experimental results demonstrate that the extracting method and the storage structure definition offers three strong properties： （i） it can describe the software＇s intended behavior accurately; （ii） it demands a small storage expense; （iii） it provides strong capability to defend against mimicry attack.

Trust Shell Based Constitution Model of Trusted Software

Since the guarantee of trustiness is considered inadequate in traditional software development methods,software developed using these methods lacks effective measures for ensuring its trustiness.Combining agent technique with the support of trusted computing provided by TPM,a trust-shell-based constitution model of trusted software(TSCMTS)is demonstrated,trust shell ensures the trustiness of software logically.The concept of Trust Engine is proposed,which extends the "chain of trust" of TCG into application,and cooperates with TPM to perform integrity measurement for software entity to ensure the static trustiness;Data Structure called trust view is defined to represent the characteristic of software behavior.For the purpose of improving the accuracy of trustiness constraints,a strategy for determining the weights of characteristic attributes based on information entropy is proposed.Simulation experiments illustrate that the trustiness of software developed by the TSCMTS is improved effectively without performance degradation.

An Unknown Trojan Detection Method Based on Software Network Behavior

Aiming at the difficulty of unknown Trojan detection in the APT flooding situation, an improved detecting method has been proposed. The basic idea of this method originates from advanced persistent threat （APT） attack intents： besides dealing with damaging or destroying facilities, the more essential purpose of APT attacks is to gather confidential data from target hosts by planting Trojans. Inspired by this idea and some in-depth analyses on recently happened APT attacks, five typical communication characteristics are adopted to describe application’s network behavior, with which a fine-grained classifier based on Decision Tree and Na ve Bayes is modeled. Finally, with the training of supervised machine learning approaches, the classification detection method is implemented. Compared with general methods, this method is capable of enhancing the detection and awareness capability of unknown Trojans with less resource consumption.

Roundtable： Research Opportunities and Challenges for Large-Scale Software Systems

For this special section on software systems, six research leaders in software systems, as guest editors tor this special section, discuss important issues that will shape this field＇s future research directions. The essays included in this roundtable article cover research opportunities and challenges for large-scale software systems such as querying organization- wide software behaviors （Xusheng Xiao）, logging and log analysis （Jian-Ouang Lou）, engineering reliable cloud distributed systems （Shan Lu）, usage data （David C. Shepherd）, clone detection and management （Xin Peng）, and code search and beyond （Qian-Xiang Wang）. - Tao Xie, Leading Editor of Software Systems.

An Approach of Trustworthy Software Design with Automatically Adapting Software Update

In this paper, we merge software trustworthiness with software design and present an approach to trustworthy software design with an automatically adapting software update. First, software behavior and results can be expected and behavior states can be monitored when a software runs by introducing a trustworthy behavior trace on a software and inserting a checkpoint sensor at each checkpoint of the trustworthy software. Second, an updated approach of the trustworthy behavior trace for the software at the level of checkpoints is presented. The trustworthy behavior traces of the software for two versions can be merged adequately by constructing split points and merge points between two trustworthy behavior traces. Finally, experiments and analyses show that： （1） the software designed by our approach can detect and report the anomaly in a software automatically and effectively, so it has a higher ability of trustworthiness evaluation than the traditional software; and （2） our approach can realize the accurate update of the trustworthy behavior trace with a lower space overhead of checkpoints when the software updates.

A Visualization Method of Requirement Checking Based on Software Behavior

In order to verify requirements model/document the consistency between software and users＇ true minds, we present a software behavior-oriented requirements visualization method. The implementation method for software behavior-oriented requirements visualization is advanced in this paper first. Then, the basis language is introduced as the foundation of the method. At last, we put forward the tool platform that can achieve the requirement visualization, The result demonstrates that the method can generate requirement animation rapidly to check the correctness of the requirement. It can effectively reduce the requirements change and save a lot of software development costs.

Comparison of SETAM with Security Use Case and Security Misuse Case:A Software Security Testing Study

A software security testing behavior model,SETAM,was proposed in our previous work as the integrated model for describing software security testing requirements behavior,which is not only compatible with security functions and latent typical misuse behaviors,but also with the interaction of them.In this paper,we analyze the differences between SETAM with security use case and security misuse case in different types of security test requirements.To illustrate the effectiveness of SETAM,we compare them in a practical case study by the number of test cases and the number of faults detected by them.The results show that SETAM could decrease about 34.87% use cases on average,and the number of faults detected by SETAM increased by 71.67% in average,which means that our model can detect more faults with fewer test cases for software security testing.

Research on Android Malware Detection and Interception Based on Behavior Monitoring

Focusing on the sensitive behaviors of malware, such as privacy stealing and money costing, this paper proposes a new method to monitor software behaviors and detect malicious applications on Android platform. According to the theory and implementation of Android Binder interprocess communication mechanism, a prototype system that integrates behavior monitoring and intercepting, malware detection, and identification is built in this work. There are 50 different kinds of samples used in the experiment of malware detection, including 40 normal samples and 10 malicious samples. The theoretical analysis and experimental result demonstrate that this system is effective in malware detection and interception, with a true positive rate equal to 100% and a false positive rate less than 3%.