21 research outputs found
Impact assessment for vulnerabilities in open-source software libraries
Software applications integrate more and more open-source software (OSS) to
benefit from code reuse. As a drawback, each vulnerability discovered in
bundled OSS potentially affects the application. Upon the disclosure of every
new vulnerability, the application vendor has to decide whether it is
exploitable in his particular usage context, hence, whether users require an
urgent application patch containing a non-vulnerable version of the OSS.
Current decision making is mostly based on high-level vulnerability
descriptions and expert knowledge, thus, effort intense and error prone. This
paper proposes a pragmatic approach to facilitate the impact assessment,
describes a proof-of-concept for Java, and examines one example vulnerability
as case study. The approach is independent from specific kinds of
vulnerabilities or programming languages and can deliver immediate results
Vulnerable Open Source Dependencies: Counting Those That Matter
BACKGROUND: Vulnerable dependencies are a known problem in today's
open-source software ecosystems because OSS libraries are highly interconnected
and developers do not always update their dependencies. AIMS: In this paper we
aim to present a precise methodology, that combines the code-based analysis of
patches with information on build, test, update dates, and group extracted from
the very code repository, and therefore, caters to the needs of industrial
practice for correct allocation of development and audit resources. METHOD: To
understand the industrial impact of the proposed methodology, we considered the
200 most popular OSS Java libraries used by SAP in its own software. Our
analysis included 10905 distinct GAVs (group, artifact, version) when
considering all the library versions. RESULTS: We found that about 20% of the
dependencies affected by a known vulnerability are not deployed, and therefore,
they do not represent a danger to the analyzed library because they cannot be
exploited in practice. Developers of the analyzed libraries are able to fix
(and actually responsible for) 82% of the deployed vulnerable dependencies. The
vast majority (81%) of vulnerable dependencies may be fixed by simply updating
to a new version, while 1% of the vulnerable dependencies in our sample are
halted, and therefore, potentially require a costly mitigation strategy.
CONCLUSIONS: Our case study shows that the correct counting allows software
development companies to receive actionable information about their library
dependencies, and therefore, correctly allocate costly development and audit
resources, which is spent inefficiently in case of distorted measurements.Comment: This is a pre-print of the paper that appears, with the same title,
in the proceedings of the 12th International Symposium on Empirical Software
Engineering and Measurement, 201
Taxonomy of Attacks on Open-Source Software Supply Chains
The widespread dependency on open-source software makes it a fruitful target
for malicious actors, as demonstrated by recurring attacks. The complexity of
today's open-source supply chains results in a significant attack surface,
giving attackers numerous opportunities to reach the goal of injecting
malicious code into open-source artifacts that is then downloaded and executed
by victims.
This work proposes a general taxonomy for attacks on open-source supply
chains, independent of specific programming languages or ecosystems, and
covering all supply chain stages from code contributions to package
distribution. Taking the form of an attack tree, it covers 107 unique vectors,
linked to 94 real-world incidents, and mapped to 33 mitigating safeguards.
User surveys conducted with 17 domain experts and 134 software developers
positively validated the correctness, comprehensiveness and comprehensibility
of the taxonomy, as well as its suitability for various use-cases. Survey
participants also assessed the utility and costs of the identified safeguards,
and whether they are used
Towards the Detection of Malicious Java Packages
Open-source software supply chain attacks aim at infecting downstream users
by poisoning open-source packages. The common way of consuming such artifacts
is through package repositories and the development of vetting strategies to
detect such attacks is ongoing research. Despite its popularity, the Java
ecosystem is the less explored one in the context of supply chain attacks.
In this paper we present indicators of malicious behavior that can be
observed statically through the analysis of Java bytecode. Then we evaluate how
such indicators and their combinations perform when detecting malicious code
injections. We do so by injecting three malicious payloads taken from
real-world examples into the Top-10 most popular Java libraries from
libraries.io.
We found that the analysis of strings in the constant pool and of sensitive
APIs in the bytecode instructions aid in the task of detecting malicious Java
packages by significantly reducing the information, thus, making also manual
triage possible
Human Practice. Digital Ecologies. Our Future. : 14. Internationale Tagung Wirtschaftsinformatik (WI 2019) : Tagungsband
Erschienen bei: universi - UniversitÀtsverlag Siegen. - ISBN: 978-3-96182-063-4Aus dem Inhalt:
Track 1: Produktion & Cyber-Physische Systeme
Requirements and a Meta Model for Exchanging Additive Manufacturing Capacities
Service Systems, Smart Service Systems and Cyber- Physical SystemsâWhatâs the difference? Towards a Unified Terminology
Developing an Industrial IoT Platform â Trade-off between Horizontal and Vertical Approaches
Machine Learning und Complex Event Processing: Effiziente Echtzeitauswertung am Beispiel Smart Factory
Sensor retrofit for a coffee machine as condition monitoring and predictive maintenance use case
Stakeholder-Analyse zum Einsatz IIoT-basierter Frischeinformationen in der Lebensmittelindustrie
Towards a Framework for Predictive Maintenance Strategies in Mechanical Engineering - A Method-Oriented Literature Analysis
Development of a matching platform for the requirement-oriented selection of cyber physical systems for SMEs
Track 2: Logistic Analytics
An Empirical Study of Customersâ Behavioral Intention to Use Ridepooling Services â An Extension of the Technology Acceptance Model
Modeling Delay Propagation and Transmission in Railway Networks
What is the impact of company specific adjustments on the acceptance and diffusion of logistic standards?
Robust Route Planning in Intermodal Urban Traffic
Track 3: Unternehmensmodellierung & Informationssystemgestaltung (Enterprise Modelling & Information Systems Design)
Work System Modeling Method with Different Levels of Specificity and Rigor for Different Stakeholder Purposes
Resolving Inconsistencies in Declarative Process Models based on Culpability Measurement
Strategic Analysis in the Realm of Enterprise Modeling â On the Example of Blockchain-Based Initiatives for the Electricity Sector
Zwischenbetriebliche Integration in der Möbelbranche: Konfigurationen und Einflussfaktoren
Novicesâ Quality Perceptions and the Acceptance of Process Modeling Grammars
Entwicklung einer Definition fĂŒr Social Business Objects (SBO) zur Modellierung von Unternehmensinformationen
Designing a Reference Model for Digital Product Configurators
Terminology for Evolving Design Artifacts
Business Role-Object Specification: A Language for Behavior-aware Structural Modeling of Business Objects
Generating Smart Glasses-based Information Systems with BPMN4SGA: A BPMN Extension for Smart Glasses Applications
Using Blockchain in Peer-to-Peer Carsharing to Build Trust in the Sharing Economy
Testing in Big Data: An Architecture Pattern for a Development Environment for Innovative, Integrated and Robust Applications
Track 4: Lern- und Wissensmanagement (e-Learning and Knowledge Management)
eGovernment Competences revisited â A Literature Review on necessary Competences in a Digitalized Public Sector
Say Hello to Your New Automated Tutor â A Structured Literature Review on Pedagogical Conversational Agents
Teaching the Digital Transformation of Business Processes: Design of a Simulation Game for Information Systems Education
Conceptualizing Immersion for Individual Learning in Virtual Reality
Designing a Flipped Classroom Course â a Process Model
The Influence of Risk-Taking on Knowledge Exchange and Combination
Gamified Feedback durch Avatare im Mobile Learning
Alexa, Can You Help Me Solve That Problem? - Understanding the Value of Smart Personal Assistants as Tutors for Complex Problem Tasks
Track 5: Data Science & Business Analytics
Matching with Bundle Preferences: Tradeoff between Fairness and Truthfulness
Applied image recognition: guidelines for using deep learning models in practice
Yield Prognosis for the Agrarian Management of Vineyards using Deep Learning for Object Counting
Reading Between the Lines of Qualitative Data â How to Detect Hidden Structure Based on Codes
Online Auctions with Dual-Threshold Algorithms: An Experimental Study and Practical Evaluation
Design Features of Non-Financial Reward Programs for Online Reviews: Evaluation based on Google Maps Data
Topic Embeddings â A New Approach to Classify Very Short Documents Based on Predefined Topics
Leveraging Unstructured Image Data for Product Quality Improvement
Decision Support for Real Estate Investors: Improving Real Estate Valuation with 3D City Models and Points of Interest
Knowledge Discovery from CVs: A Topic Modeling Procedure
Online Product Descriptions â Boost for your Sales?
EntscheidungsunterstĂŒtzung durch historienbasierte Dienstreihenfolgeplanung mit Pattern
A Semi-Automated Approach for Generating Online Review Templates
Machine Learning goes Measure Management: Leveraging Anomaly Detection and Parts Search to Improve Product-Cost Optimization
Bedeutung von Predictive Analytics fĂŒr den theoretischen Erkenntnisgewinn in der IS-Forschung
Track 6: Digitale Transformation und Dienstleistungen
Heuristic Theorizing in Software Development: Deriving Design Principles for Smart Glasses-based Systems
Mirroring E-service for Brick and Mortar Retail: An Assessment and Survey
Taxonomy of Digital Platforms: A Platform Architecture Perspective
Value of Star Players in the Digital Age
Local Shopping Platforms â Harnessing Locational Advantages for the Digital Transformation of Local Retail Outlets: A Content Analysis
A Socio-Technical Approach to Manage Analytics-as-a-Service â Results of an Action Design Research Project
Characterizing Approaches to Digital Transformation: Development of a Taxonomy of Digital Units
Expectations vs. Reality â Benefits of Smart Services in the Field of Tension between Industry and Science
Innovation Networks and Digital Innovation: How Organizations Use Innovation Networks in a Digitized Environment
Characterising Social Reading Platformsâ A Taxonomy-Based Approach to Structure the Field
Less Complex than Expected â What Really Drives IT Consulting Value
Modularity Canvas â A Framework for Visualizing Potentials of Service Modularity
Towards a Conceptualization of Capabilities for Innovating Business Models in the Industrial Internet of Things
A Taxonomy of Barriers to Digital Transformation
Ambidexterity in Service Innovation Research: A Systematic Literature Review
Design and success factors of an online solution for cross-pillar pension information
Track 7: IT-Management und -Strategie
A Frugal Support Structure for New Software Implementations in SMEs
How to Structure a Company-wide Adoption of Big Data Analytics
The Changing Roles of Innovation Actors and Organizational Antecedents in the Digital Age
Bewertung des Kundennutzens von Chatbots fĂŒr den Einsatz im Servicedesk
Understanding the Benefits of Agile Software Development in Regulated Environments
Are Employees Following the Rules? On the Effectiveness of IT Consumerization Policies
Agile and Attached: The Impact of Agile Practices on Agile Team Membersâ Affective Organisational Commitment
The Complexity Trap â Limits of IT Flexibility for Supporting Organizational Agility in Decentralized Organizations
Platform Openness: A Systematic Literature Review and Avenues for Future Research
Competence, Fashion and the Case of Blockchain
The Digital Platform Otto.de: A Case Study of Growth, Complexity, and Generativity
Track 8: eHealth & alternde Gesellschaft
Security and Privacy of Personal Health Records in Cloud Computing Environments â An Experimental Exploration of the Impact of Storage Solutions and Data Breaches
Patientenintegration durch Pfadsysteme
Digitalisierung in der StressprĂ€vention â eine qualitative Interviewstudie zu Nutzenpotenzialen
User Dynamics in Mental Health Forums â A Sentiment Analysis Perspective
Intent and the Use of Wearables in the Workplace â A Model Development
Understanding Patient Pathways in the Context of Integrated Health Care Services - Implications from a Scoping Review
Understanding the Habitual Use of Wearable Activity Trackers
On the Fit in Fitness Apps: Studying the Interaction of Motivational Affordances and Usersâ Goal Orientations in Affecting the Benefits Gained
Gamification in Health Behavior Change Support Systems - A Synthesis of Unintended Side Effects
Investigating the Influence of Information Incongruity on Trust-Relations within Trilateral Healthcare Settings
Track 9: Krisen- und KontinuitÀtsmanagement
Potentiale von IKT beim Ausfall kritischer Infrastrukturen: Erwartungen, Informationsgewinnung und Mediennutzung der Zivilbevölkerung in Deutschland
Fake News Perception in Germany: A Representative Study of Peopleâs Attitudes and Approaches to Counteract Disinformation
Analyzing the Potential of Graphical Building Information for Fire Emergency Responses: Findings from a Controlled Experiment
Track 10: Human-Computer Interaction
Towards a Taxonomy of Platforms for Conversational Agent Design
Measuring Service Encounter Satisfaction with Customer Service Chatbots using Sentiment Analysis
Self-Tracking and Gamification: Analyzing the Interplay of Motivations, Usage and Motivation Fulfillment
Erfolgsfaktoren von Augmented-Reality-Applikationen: Analyse von Nutzerrezensionen mit dem Review-Mining-Verfahren
Designing Dynamic Decision Support for Electronic Requirements Negotiations
Who is Stressed by Using ICTs? A Qualitative Comparison Analysis with the Big Five Personality Traits to Understand Technostress
Walking the Middle Path: How Medium Trade-Off Exposure Leads to Higher Consumer Satisfaction in Recommender Agents
Theory-Based Affordances of Utilitarian, Hedonic and Dual-Purposed Technologies: A Literature Review
Eliciting Customer Preferences for Shopping Companion Apps: A Service Quality Approach
The Role of Early User Participation in Discovering Software â A Case Study from the Context of Smart Glasses
The Fluidity of the Self-Concept as a Framework to Explain the Motivation to Play Video Games
Heart over Heels? An Empirical Analysis of the Relationship between Emotions and Review Helpfulness for Experience and Credence Goods
Track 11: Information Security and Information Privacy
Unfolding Concerns about Augmented Reality Technologies: A Qualitative Analysis of User Perceptions
To (Psychologically) Own Data is to Protect Data: How Psychological Ownership Determines Protective Behavior in a Work and Private Context
Understanding Data Protection Regulations from a Data Management Perspective: A Capability-Based Approach to EU-GDPR
On the Difficulties of Incentivizing Online Privacy through Transparency: A Qualitative Survey of the German Health Insurance Market
What is Your Selfie Worth? A Field Study on Individualsâ Valuation of Personal Data
Justification of Mass Surveillance: A Quantitative Study
An Exploratory Study of Risk Perception for Data Disclosure to a Network of Firms
Track 12: Umweltinformatik und nachhaltiges Wirtschaften
KommunikationsfĂ€den im Nadelöhr â Fachliche Prozessmodellierung der Nachhaltigkeitskommunikation am Kapitalmarkt
Potentiale und Herausforderungen der Materialflusskostenrechnung
Computing Incentives for User-Based Relocation in Carsharing
Sustainabilityâs Coming Home: Preliminary Design Principles for the Sustainable Smart District
Substitution of hazardous chemical substances using Deep Learning and t-SNE
A Hierarchy of DSMLs in Support of Product Life-Cycle Assessment
A Survey of Smart Energy Services for Private Households
Door-to-Door Mobility Integrators as Keystone Organizations of Smart Ecosystems: Resources and Value Co-Creation â A Literature Review
Ein EntscheidungsunterstĂŒtzungssystem zur ökonomischen Bewertung von Mieterstrom auf Basis der Clusteranalyse
Discovering Blockchain for Sustainable Product-Service Systems to enhance the Circular Economy
Digitale RĂŒckverfolgbarkeit von Lebensmitteln: Eine verbraucherinformatische Studie
Umweltbewusstsein durch audiovisuelles Content Marketing? Eine experimentelle Untersuchung zur Konsumentenbewertung nachhaltiger Smartphones
Towards Predictive Energy Management in Information Systems: A Research Proposal
A Web Browser-Based Application for Processing and Analyzing Material Flow Models using the MFCA Methodology
Track 13: Digital Work - Social, mobile, smart
On Conversational Agents in Information Systems Research: Analyzing the Past to Guide Future Work
The Potential of Augmented Reality for Improving Occupational First Aid
Prevent a Vicious Circle! The Role of Organizational IT-Capability in Attracting IT-affine Applicants
Good, Bad, or Both? Conceptualization and Measurement of Ambivalent User Attitudes Towards AI
A Case Study on Cross-Hierarchical Communication in Digital Work Environments
âShow Me Your People Skillsâ - Employing CEO Branding for Corporate Reputation Management in Social Media
A Multiorganisational Study of the Drivers and Barriers of Enterprise Collaboration Systems-Enabled Change
The More the Merrier? The Effect of Size of Core Team Subgroups on Success of Open Source Projects
The Impact of Anthropomorphic and Functional Chatbot Design Features in Enterprise Collaboration Systems on User Acceptance
Digital Feedback for Digital Work? Affordances and Constraints of a Feedback App at InsurCorp
The Effect of Marker-less Augmented Reality on Task and Learning Performance
Antecedents for Cyberloafing â A Literature Review
Internal Crowd Work as a Source of Empowerment - An Empirical Analysis of the Perception of Employees in a Crowdtesting Project
Track 14: GeschÀftsmodelle und digitales Unternehmertum
Dividing the ICO Jungle: Extracting and Evaluating Design Archetypes
Capturing Value from Data: Exploring Factors Influencing Revenue Model Design for Data-Driven Services
Understanding the Role of Data for Innovating Business Models: A System Dynamics Perspective
Business Model Innovation and Stakeholder: Exploring Mechanisms and Outcomes of Value Creation and Destruction
Business Models for Internet of Things Platforms: Empirical Development of a Taxonomy and Archetypes
Revitalizing established Industrial Companies: State of the Art and Success Principles of Digital Corporate Incubators
When 1+1 is Greater than 2: Concurrence of Additional Digital and Established Business Models within Companies
Special Track 1: Student Track
Investigating Personalized Price Discrimination of Textile-, Electronics- and General Stores in German Online Retail
From Facets to a Universal Definition â An Analysis of IoT Usage in Retail
Is the Technostress Creators Inventory Still an Up-To-Date Measurement Instrument? Results of a Large-Scale Interview Study
Application of Media Synchronicity Theory to Creative Tasks in Virtual Teams Using the Example of Design Thinking
TrustyTweet: An Indicator-based Browser-Plugin to Assist Users in Dealing with Fake News on Twitter
Application of Process Mining Techniques to Support Maintenance-Related Objectives
How Voice Can Change Customer Satisfaction: A Comparative Analysis between E-Commerce and Voice Commerce
Business Process Compliance and Blockchain: How Does the Ethereum Blockchain Address Challenges of Business Process Compliance?
Improving Business Model Configuration through a Question-based Approach
The Influence of Situational Factors and Gamification on Intrinsic Motivation and Learning
Evaluation von ITSM-Tools fĂŒr Integration und Management von Cloud-Diensten am Beispiel von ServiceNow
How Software Promotes the Integration of Sustainability in Business Process Management
Criteria Catalog for Industrial IoT Platforms from the Perspective of the Machine Tool Industry
Special Track 3: Demos & Prototyping
Privacy-friendly User Location Tracking with Smart Devices: The BeaT Prototype
Application-oriented robotics in nursing homes
Augmented Reality for Set-up Processe
Mixed Reality for supporting Remote-Meetings
Gamification zur Motivationssteigerung von Werkern bei der Betriebsdatenerfassung
Automatically Extracting and Analyzing Customer Needs from Twitter: A âNeedminingâ Prototype
GaNEsHA: Opportunities for Sustainable Transportation in Smart Cities
TUCANA: A platform for using local processing power of edge devices for building data-driven services
Demonstrator zur Beschreibung und Visualisierung einer kritischen Infrastruktur
Entwicklung einer alltagsnahen persuasiven App zur Bewegungsmotivation fĂŒr Ă€ltere Nutzerinnen und Nutzer
A browser-based modeling tool for studying the learning of conceptual modeling based on a multi-modal data collection approach
Exergames & Dementia: An interactive System for People with Dementia and their Care-Network
Workshops
Workshop Ethics and Morality in Business Informatics (Workshop Ethik und Moral in der Wirtschaftsinformatik â EMoWIâ19)
Model-Based Compliance in Information Systems - Foundations, Case Description and Data Set of the MobIS-Challenge for Students and Doctoral Candidates
Report of the Workshop on Concepts and Methods of Identifying Digital Potentials in Information Management
Control of Systemic Risks in Global Networks - A Grand Challenge to Information Systems Research
Die Mitarbeiter von morgen - Kompetenzen kĂŒnftiger Mitarbeiter im Bereich Business Analytics
Digitaler Konsum: Herausforderungen und Chancen der Verbraucherinformati