(Press-News.org) Researchers from North Carolina State University and IBM Research have developed a new natural language processing tool that businesses or other customers can use to ensure that software developers have a clear idea of the security policies to be incorporated into new software products.
Specifically, the research focuses on access control policies (ACPs), which are the security requirements that software developers need to bear in mind when developing new software. For example, an ACP for a university grading program needs to allow professors to give grades to students, but should not allow students to change the grades.
"These ACPs are important, but are often buried amidst a lengthy list of other requirements that customers give to developers," says Dr. Tao Xie, an associate professor of computer science at NC State and co-author of a paper on the research. These requirements are written in "natural language," which is the conversational language that people use when talking or corresponding via the written word.
Incomplete or inaccurate ACP requirements can crop up, for example, if the customer writing the ACP requirements makes a mistake or doesn't have enough technical know-how to accurately describe a program's security needs.
A second problem is that programmers may misinterpret some ACP requirements, or overlook them entirely.
In collaboration with IBM Research, Xie's research team has developed a solution that uses a natural language processing program to extract the ACP requirements from a customer's overall list of requirements and translate it into machine-readable language that computers can understand and enforce.
After the ACPs are extracted, they can be run through Access Control Policy Tool (ACPT) – also developed in Xie's research team in collaboration with the National Institute of Standards and Technology (NIST) – which verifies and tests the ACPs and determines whether the ACP requirements are adequate to meet the security needs of the program.
Once the ACP requirements have been translated into machine-readable language, they can also be incorporated into a policy-enforcement "engine" in the final software product – which ensures that ACPs cannot be overlooked by programmers.
"In general, developing a program that understands natural language text is very challenging," Xie says. "However, ACP requirements in software documents usually follow a certain style, using terms such as 'cannot be edited' or 'does not have the ability to edit.' Because ACPs tend to use such a limited number of phrases, it is much easier to develop a program that effectively translates natural language texts in this context."
###
The paper, "Automated Extraction of Security Policies from Natural-Language Software Documents," will be presented Nov. 13 at the 2012 International Symposium on the Foundations of Software Engineering (SIGSOFT'12/FSE-20) in Cary, N.C. Lead author of the paper is Xusheng Xiao, a Ph.D. student at NC State. Co-authors include Xie, Dr. Amit Paradkar of the IBM T.J. Watson Research Center and Dr. Suresh Thummalapenta of IBM Research India. The research was supported by the National Science Foundation, the U.S. Army Research Office, NIST, and the National Security Agency Science of Security Lablet.
New tool aims to ensure software security policies reflect user needs
2012-10-31
ELSE PRESS RELEASES FROM THIS DATE:
American consumers overvalue US-produced apparel, MU study finds
2012-10-31
COLUMBIA, Mo. -- In today's globalized economy, a large percentage of apparel products are multinational products as raw materials are produced, transported and assembled in different countries. However, consumers have little information about where and to what extent their apparel is produced domestically or overseas. Now, University of Missouri researchers have found that American consumers place a much higher value on apparel produced entirely in the US with US raw materials as opposed to products produced partially or entirely overseas. The value is so high, in fact, ...
Study suggests new way to prevent recurrent ear infections
2012-10-31
Eliminating bacteria's DNA and boosting antimicrobial proteins that already exist may help prevent middle ear infections from reoccurring. These are the findings from a Nationwide Children's Hospital study that examined how an immune defense protein common in the middle ear interacts with a structure meant to protect a colony of bacteria.
The bacterium nontypeable Haemophilus influenzae (NTHI) causes a wide range of diseases of both the lower and upper airways, including middle ear infection. NTHI, like most other bacteria, can form a biofilm, a robust community of ...
Finding triggers of birth defects in an embryo heart
2012-10-31
Researchers at Case Western Reserve University have found a way to create three-dimensional maps of the stress that circulating blood places on the developing heart in an animal model – a key to understanding triggers of heart defects.
The team has begun testing the technology to uncover how alcohol, drugs and other factors set off events that result in defects found in newborn humans.
Passing blood cells drag on the endothelial cells that line the growing heart, a phenomenon called shear stress, which has been linked to changes in gene expression that results in defects, ...
Low-resistance connections facilitate multi-walled carbon nanotubes for interconnects
2012-10-31
Using a new method for precisely controlling the deposition of carbon, researchers have demonstrated a technique for connecting multi-walled carbon nanotubes to the metallic pads of integrated circuits without the high interface resistance produced by traditional fabrication techniques.
Based on electron beam-induced deposition (EBID), the work is believed to be the first to connect multiple shells of a multi-walled carbon nanotube to metal terminals on a semiconducting substrate, which is relevant to integrated circuit fabrication. Using this three-dimensional fabrication ...
Bullying has long-term health consequences
2012-10-31
HUNTSVILLE, TX (10/30/12) -- Childhood bullying can lead to long term health consequences, including general and mental health issues, behavioral problems, eating disorders, smoking, alcohol use, and homelessness, a study by the Crime Victims' Institute at Sam Houston State University found.
"What is apparent from these results is that bullying victimization that occurs early in life may have significant and substantial consequences for those victims later in life," said Leana Bouffard, Director of the Crime Victims' Institute. "Thus, the adverse health consequences of ...
Metabolic syndrome makes a difference in hormone therapy risk
2012-10-31
CLEVELAND, Ohio (October 29, 2012)—A new analysis of the Women's Health Initiative (WHI) trials show that women who had metabolic syndrome before they started hormone therapy had a greatly increased risk of heart attack or dying of heart disease. Women who didn't have metabolic syndrome beforehand showed no increased risk. The study was published this month online in Menopause, the journal of the North American Menopause Society.
"Our findings emphasize the importance of assessing cardiovascular disease risk status when hormone therapy is considered for relief of menopausal ...
ASA infrared eye sees tropical cyclone Nilam soak Sri Lanka
2012-10-31
Tropical Storm 02B was renamed Tropical Cyclone Nilam when NASA's Aqua satellite captured an infrared image of the storm soaking Sri Lanka on its crawl to a landfall in southern India.
The Atmospheric Infrared Sounder (AIRS) instrument aboard NASA's Aqua satellite captured an infrared image of Tropical Cyclone Nilam on Oct. 29 at 2029 4:29 p.m. EDT. At the time of the AIRS image, the strongest storms with coldest cloud top temperatures were covering Sri Lanka and stretched into the open waters of the Northern Indian Ocean. Cloud top temperatures in those areas were ...
NASA satellites capture Hurricane Sandy's massive size
2012-10-31
NASA's Aqua satellite captured a visible image Sandy's massive circulation. Sandy covers 1.8 million square miles, from the Mid-Atlantic to the Ohio Valley, into Canada and New England.
The Moderate Resolution Imaging Spectroradiometer (MODIS) instrument aboard NASA's Aqua satellite captured a visible image Sandy's massive circulation on October 29 at 18:20 UTC (2:20 p.m. EDT). Sandy covered 1.8 million square miles, from the Mid-Atlantic to the Ohio Valley, into Canada and New England. Sandy made landfall hours after the MODIS image was taken.
Sandy was still a hurricane ...
NASA sees Tropical Storm Rosa being born and powering up quickly
2012-10-31
The seventeenth tropical depression of the eastern Pacific Ocean hurricane season formed early on October 30 and quickly strengthened into Tropical Storm Rosa. Infrared data from NASA's Aqua satellite revealed strong convection in the storm's center, hinting at that intensification.
When NASA's Aqua satellite flew over Tropical Depression 17E at 5:41 a.m. EDT (0951 UTC) on Tuesday, October 30, the Atmospheric Infrared Sounder (AIRS) instrument took an infrared picture of the storm. The AIRS data showed a large, circular area of very strong convection (rising air that ...
Women with lupus have a higher risk for preeclampsia
2012-10-31
New research reports that women with systemic lupus erythematosus (SLE) have a two-fold increase in risk of preeclampsia—a dangerous condition in which pregnant women develop high blood pressure (hypertension) and protein in their urine (proteinuria) after 20 weeks of gestation. According to the findings published in Arthritis Care & Research, a journal of the American College of Rheumatology (ACR), use of Disease-Modifying Antirheumatic Drugs (DMARDs) during pregnancy was rare in the study population, but women who did use these medications show a statistically non-significant ...