SCSA - Source Code Security Assessment Lab
COMSATS University Islamabad, Lahore Campus
Research Domains:
Cyber Security | Software Evolution and Maintenance | Software Reuse | Software Vulnerability Detection | Malware Detection | Code Clones Detection and Analysis | Software Testing
The Source Code Security Assessment Research Lab (SCSA) is dedicated to advancing the field of software security by focusing on the systematic analysis and improvement of source code. Our lab is at the forefront of research and innovation, developing cutting-edge techniques to identify, assess, and mitigate vulnerabilities in software systems.
Our mission is to enhance the security and robustness of software applications through rigorous research and practical solutions. We employ a multidisciplinary approach, combining expertise in computer science, cybersecurity, and software engineering to tackle complex security challenges. By leveraging state-of-the-art tools and methodologies, we aim to uncover hidden weaknesses in code and propose effective countermeasures. The lab's research encompasses a broad spectrum of activities, including static and dynamic code analysis, code clone detections, formal verification, and the development of automated tools for vulnerability detection. We also focus on secure coding practices and educational initiatives to equip developers with the knowledge and skills necessary to write secure code from the ground up.
Collaboration is a cornerstone of our lab's philosophy. We work closely with industry partners, government agencies, and academic institutions to ensure that our research has a tangible impact on the real world. Through these partnerships, we strive to bridge the gap between theoretical research and practical application, ultimately contributing to a safer digital environment. In addition to local and national collaborations, we actively engage with foreign universities to foster international cooperation and knowledge exchange. These partnerships enable us to stay at the cutting edge of global research trends and leverage diverse expertise from around the world. By participating in joint research projects, student and faculty exchanges, and international conferences, we aim to broaden the impact of our work and contribute to the global effort in securing software systems. The Source Code Security Assessment Research Lab is committed to fostering a culture of innovation, excellence, and ethical responsibility. We invite researchers, students, and industry professionals to join us in our quest to secure the software that powers our modern world. Together, we can build a future, where software security is no longer an afterthought but a fundamental aspect of software development.
Cybercrimes are on a dramatic rise in the worldwide basis. The crime rate is growing day by day in every field or department which is directly or indirectly connected to the internet including Government, business or any individual. The main objective of our interest is to evaluate the vulnerabilities in different software systems at source code level by tracing their patch files. We have proposed different ways to collect or trace the vulnerability code, which can be very helpful for security experts, organizations and software developers to maintain the security measures. By following our proposed methods users can build their own vulnerability data-set and can detect vulnerabilities in any system by using suitable code clone detection technique. In an era where data is a valuable asset, protecting it from cyber threats is not just an option but a necessity. Through a combination of technological solutions, vigilant monitoring, and informed practices, we create a safer digital environment for all.
Vulnerability detection and exploit is becoming a very important part of security, especially in malware code delivery, hacking a system, efforts to create patches, improving the source code, or updating a software. Vulnerabilities in applications, including browsers, media players, online services, document readers, and so forth. are often exploited and cause a serious damage. In this research area, We proposed a vulnerability detection technique to detect vulnerabilities in software. In the research results, we detected vulnerabilities in some very famous recently available software, including latest version of Linux, HTC‐kernel, FindX‐8.1‐kernel, and in 7‐TB of C/C++ source code (152,823 open source projects). Furthermore, we performed an empirical evaluation and verification on these vulnerabilities. Regular vulnerability assessments are crucial in maintaining robust security, as they help organizations promptly address and remediate risks.
Android malware detection is the practice of identifying and mitigating malicious software specifically targeting Android devices. Security researchers and antivirus industry have speckled a stress on Android malware, which can actually damage your phones and threatens the Android markets. In this research area, we proposed and developed DroidMD, a scalable self-improvement based tool based on auto optimization of signature set, which detect malicious apps in the market at source code level. A prototype has been developed tested and implemented to detect malware in Android applications. In the future we are aiming the Utilization of deep learning techniques to analyze vast amounts of data and detect complex patterns in malware behavior. Development of models that can adapt to evolving malware tactics and adversarial attacks designed to bypass traditional detection methods. By ensuring robust malware detection, users can protect their personal data and maintain the integrity of their devices.
Code clones detection involves identifying duplicate or similar code segments within a codebase. These clones can lead to increased maintenance costs and potential bugs if changes are made inconsistently. Advanced detection tools use techniques such as textual comparison, abstract syntax tree analysis, and token-based approaches to find exact and near-duplicate code fragments. Many techniques have been developed over the years to detect code clones in different software systems to maintain security measures. These techniques often require the source code to compare the subject system against a very large data set of big code. Our research presents index‐based features extraction technique (IBFET- already published) to detect code clones at a very large‐scale level to billions of LOC at file level granularity. The MapReduce rule of divide and conquer is used for a count and retrieve the similar features between different systems. Our approach is faster, flexible, scalable, and provides accurate results with high authenticity.
By framing testing problems as search problems, SBST applies algorithms like genetic algorithms, simulated annealing, and particle swarm optimization to generate efficient and effective test cases. This approach can significantly enhance coverage, find hidden bugs, and optimize resource utilization. This project presents an automated, model based test data generation approach for CPS system that have complex input and output structures. In this project, we aim to develop a tool to automate test data generation for complex CPS system based on models, that also entertain the complexity and constraints in the test data.. The proposed approaches will generate valid data to explore the input space of the SUT (system under test). For generating the valid data, to be fit for its intended purpose, the data usually has to satisfy various logical constraints between the data inputs. By integrating SBST, organizations can achieve higher quality software with reduced manual effort and increased reliability.
Logs can help to generate machine learning based effective test data for complex systems. Logs play a crucial role in generating machine learning-based effective test data for complex systems. By capturing detailed runtime information, logs provide invaluable insights into system behavior, user interactions, and edge cases that may not be covered by traditional testing methods. Machine learning algorithms can analyze these logs to identify patterns, detect anomalies, and predict potential failure points. Using this data, testers can create more realistic and comprehensive test scenarios that mirror actual usage conditions. This approach ensures higher test coverage, uncovers hidden defects, and enhances the overall reliability of complex systems. Leveraging logs for test data generation not only improves the quality of the software but also optimizes the testing process, making it more efficient and effective.
Test smell detection in Behavior-Driven Development (BDD) specifications involves identifying indicators of poor test design or implementation that can lead to inefficiencies or errors. Common test smells in BDD include redundant or overlapping scenarios, inconsistent or ambiguous steps, and overly complex feature files. Automated tools and manual inspection techniques analyze BDD specifications to detect these smells, improving test readability, maintainability, and effectiveness. By addressing test smells early in the development cycle, teams can enhance the reliability and efficiency of their BDD tests. This ensures that tests accurately reflect desired behaviors and requirements, facilitating clearer communication between stakeholders and reducing the risk of undetected defects. Effective test smell detection promotes better software quality and supports continuous improvement in BDD practices.
Cyber Security
Software Evolution and Maintenance
Software Reuse
Software Vulnerability Detection
Malware Detection
Code Clones Detection and Analysis
Software Testing
Note: Advance technologies based on Artificial Intelligence and Machine Learning would be used to conduct the projects
If you are interested, please send your CV at junaidakram@cuilahore.edu.pk
