International Journal of Software Engineering and Knowledge Engineering

Contrary to popular belief, not all intelligent systems have Quick Intelligence. There are a surprisingly large number of intelligent systems, quasi-intelligent systems and semi-intelligent systems that have Slow Intelligence. Such Slow Intelligence Systems are often neglected in mainstream research on intelligent systems, but they are really worthy of our attention and emulation. I will describe the characteristics of Slow Intelligence Systems and present a general framework for Slow Intelligence Systems. I will then discuss evolutionary query processing and mission control in emergency management systems as two examples of Artificial Slow Intelligence Systems. Researchers and practitioners are both invited to explore the applications of Slow Intelligence Systems in software engineering and knowledge engineering, and publish their findings in IJSEKE.

As use of information systems in R&D environments has increased enormously, the risks of technology leakage through information systems have become more serious. To provide a basic guideline of R&D security which helps enterprise executives to solve the managerial problems of R&D security planning is a purpose of this paper. This paper provides an integrated security framework including R&D security goal, R&D-related division and activity, and pool of controls. With the integrated security framework suggested in this paper, an enterprise that invests hundreds of thousands of dollars to develop a new product can adapt itself to mitigate security risks and reduce potential losses of technology leakage. It could be believed to be the first attempt to provide the R&D-specific security framework for enterprise executives to solve the security problems in R&D environments.

Increasing demand for security commercial products requires an improvement of methods for evaluating their software quality. Existing standards offer general frameworks but more specific models which reflect the perception of experts and customers as well as the particular characteristics of this type of products are needed. This article presents a method for generating domain-oriented software quality models for specific types of applications. It is applied to the generation of a model for security COTS products based on systematic review of standards, related literature and conclusions of evaluation experiences as well as the statistical analysis of information collected from 203 security experts and practitioners. Results reveal interesting conclusions on the importance given by users to the different quality characteristics of security commercial software products.

Software vulnerability is a key determiner of confidence in computer systems and networks. Usually, software requirements are listed at the beginning of software design, whereas vulnerabilities appear only after development is complete and sometimes only after the system is operational. Therefore, the security requirements during the design stage should address software vulnerabilities. This paper presents a method of representing software vulnerabilities as atomic vulnerabilities (AVs): an AV is an undividable cause-unit of vulnerability, and a set of AVs and the relationships among them represent software vulnerabilities. The AV concept originates from system theory and modeling methodology. AVs and the relationships among them can be used to construct a behavioral model of systems and networks with a focus on vulnerability. The logical relationships among AVs are named vulnerability expressions (VXs). With all the accumulated VXs of the systems and networks, we can set security requirements that resolve or circumvent vulnerabilities effectively and reinforce confidence in system and network robustness. The contribution of this paper is to use the concepts of AV and VX to derive the security requirements considering software vulnerabilities for secure systems and networks. The requirement derived can be used to complement the vulnerable situation caused by software that is developed without cognizance of security consideration.

Over the last few years, numerous vulnerabilities have been reported in software, and successful exploitations of these vulnerabilities have resulted in severe consequences such as denial of services and application state corruptions. Researches have shown that effective quality assurance methods can prevent such consequences when applied during software (or applications) development processes. Software security testing is a popular assurance method in this direction. However, effective testing involves obtaining an effective test suite (or collection of test cases) that can reveal specific faults. Over the last few years, different testing approaches have been applied for revealing vulnerabilities in software. However, only few works have assessed the effectiveness of test suites for revealing vulnerabilities. We believe that bringing the idea of mutation-based assessment of test adequacy for vulnerabilities can help in detecting and removing vulnerabilities proactively. In this work, we apply mutation-based adequate testing for one of the worst vulnerabilities namely buffer overflow (BOF). We propose 16 mutation operators to force the generation of adequate test suites for BOF vulnerabilities. A prototype tool is developed to automatically generate mutants and perform mutation analysis with input test cases. The effectiveness of the operators is evaluated by using several benchmark programs having BOF vulnerabilities, and the results indicate that the proposed operators are effective for testing BOF vulnerabilities. Moreover, we present an analysis to find selective mutation operators for reducing the cost of mutation-based testing of BOF vulnerabilities.

To adapt to the firm's environmental changes continuously, the customer relationship management system is a key which monitors external changes and adapts internal cultures and processes in response to external challenges. Increasing use of customer relationship management systems in competitive business environments has given rise to various kinds of security problems. This paper reviews previous studies on customer relationship management systems, protection of customer information, and evaluation of information security systems. Finally, considering the characteristics of customer relationship management systems and security evaluation methodology, this paper suggests the assessment criteria for security risks of customer relationship management systems.