U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 1126 - 1150 of 7107

NIST Cybersecurity For IoT Program

November 19, 2024
Author(s)
Katerina Megas, Barbara Cuthill, Michael Fagan, Paul Watrobski
This article explains the NIST Cybersecurity for IoT Program, and the body of work it produces.

Leveraging Combinatorial Coverage in the Machine Learning Product Lifecycle

June 27, 2024
Author(s)
Jaganmohan Chandrasekaran, erin lanus, tyler cody, laura freeman, Raghu N. Kacker, M S Raunak, D. Richard Kuhn
The data-intensive nature of machine learning (ML)-enabled systems introduces unique challenges in test and evaluation. We present an overview of combinatorial coverage, exploring its applications across the ML-enabled system lifecycle and its potential to

Assured Autonomy through Combinatorial Methods

May 2, 2024
Author(s)
David Kuhn, M S Raunak, Raghu Kacker, Jaganmohan Chandrasekaran, Erin Lanus, Tyler Cody, Laura Freeman
Autonomous systems are proliferating rapidly, with strong interest in everything from vacuum cleaners and lawnmowers, to self-driving cars and autonomous farm equipment. Can these systems be trusted to function safely? Many conventional software

Poisoning Attacks against Machine Learning: Can Machine Learning be Trustworthy?

October 25, 2022
Author(s)
Alina Oprea, Anoop Singhal, Apostol Vassilev
Many practical applications benefit from Machine Learning (ML) and Artificial Intelligence (AI) technologies, but their security needs to be studied in more depth before the methods and algorithms are actually deployed in critical settings. In this article

The Path to Consensus on Artificial Intelligence Assurance

March 15, 2022
Author(s)
Laura Freeman, Feras Batarseh, D. Richard Kuhn, M S Raunak, Raghu N. Kacker
Widescale adoption of intelligent algorithms requires that Artificial Intelligence (AI) engineers provide assurances that an algorithm will perform as intended. Providing such guarantees involves quantifying capabilities and the associated risks across

A Trusted Federated System to Share Granular Data Among Disparate Database Resources

March 15, 2021
Author(s)
Joanna DeFranco, David F. Ferraiolo, D. Richard Kuhn, Joshua D. Roberts
Sharing data between different organizations is a challenge primarily due to database management systems (DBMSs) being different types that impose different schemas to represent and retrieve data. In addition, maintaining security and privacy is a concern

Narrow Spectrum Software Testing Addressing Complexity and Trust

April 9, 2020
Author(s)
David R. Kuhn, Mohammad Raunak
Combination coverage based testing supplements basic structural coverage based test selection. This provides a sound test engineering method with defensible, quantitative measures of test completeness.

Input Space Coverage Matters

January 15, 2020
Author(s)
David R. Kuhn, Raghu N. Kacker, Yu Lei, Dimitris Simos
Testing is the most commonly used approach for software assurance, yet it remains as much judgement and art as science. Structural coverage adds some rigor to the process by establishing formally defined criteria for some notion of test completeness, but

Opaque Wrappers and Patching: Negative Results

November 21, 2019
Author(s)
Paul E. Black, Monika Singh
When a patch is released for buggy software, bad actors may be able to analyze the patch and create an attack on unpatched machines. A wrapper could block attacking inputs, but it, too, gives attackers critical information. An opaque wrapper hides such

Rethinking Distributed Ledger Technology

March 20, 2019
Author(s)
David R. Kuhn, Dylan J. Yaga, Jeffrey M. Voas
Blockchains were designed to solve the problem of double-spending in cryptocurrencies, and the success of the Bitcoin design has generated vastly more interest than previous proposals for digital currencies. Blockchains are being used in other areas as

No Phishing beyond This Point

June 27, 2018
Author(s)
Kristen Greene, Michelle P. Steves, Mary F. Theofanos
As phishing continues to evolve, what is your organization doing to stay off the hook?

What Happened to Software Metrics?

May 25, 2017
Author(s)
Jeffrey M. Voas, David R. Kuhn
In the 1980's, the software quality community was all 'a buzz' with seemingly endless 'potential' approaches for producing higher quality software. At the forefront of that was software metrics, along with the corresponding software testing techniques and

Combinatorial Methods in Security Testing

October 20, 2016
Author(s)
Dimitris Simos, D. Richard Kuhn, Artemios Voyiatzis, Raghu N. Kacker
This article introduces combinatorial testing-based approaches for security testing and presents case studies and experiences. The success of the presented research program motivates further intensive research on the field of combinatorial security testing

Entropy as a Service: Unlocking Cryptography's Full Potential

September 7, 2016
Author(s)
Apostol T. Vassilev, Robert L. Staples
Securing the Internet of Things (IoT) requires strong cryptography, which depends on the availability of good entropy for generating unpredictable keys and accurate clocks. Attacks abusing weak keys or old inputs portend challenges for IoT. EaaS is a novel

Whatever Happened to Formal Methods for Security?

August 23, 2016
Author(s)
Kim B. Schaffer, Jeffrey M. Voas
We asked 7 experts 7 questions to find out what has occurred recently in terms of applying formal methods (FM) to security-centric, cyber problems. We were curious as to whether this successful methodology in "safety-critical" has succeeded as well for

Demystifiying the Internet of Things

June 27, 2016
Author(s)
Jeffrey M. Voas
This short column introduces the need for a foundational science to the Internet of Things (IoT). It introduces the notion of primitives and elements, and their relationship to trustworthiness.

Metamorphic Testing for Cybersecurity

June 27, 2016
Author(s)
Tsong Yueh Chen, Fei-Ching Kuo, Wenjuan Ma, Willy Susilo, Dave Towey, Jeff Voas, Zhi Q. Zhou
Testing is a major approach for the detection of software defects, including security vulnerabilities. This article introduces metamorphic testing (MT), a relatively new testing method, and discusses how the new perspective of MT can help to conduct

Insights on Formal Methods of Cybersecurity

May 27, 2016
Author(s)
Jeffrey M. Voas, Kim B. Schaffer
We asked 7 experts 1 simple question to find out what has occurred recently in terms of applying formal methods (FM) to security-centric, cyber problems: Please summarize in a paragraph the state of the research and practitioner communities in formal

Third-Party Software's Trust Quagmire

December 18, 2015
Author(s)
Jeffrey M. Voas, George Hurlburt
Integrating software developed by third-party organizations into a larger system raises concerns about the software's quality, origin, functionality, security, and interoperability. Addressing these concerns requires rethinking the roles of software's

Expanding Continuous Authentication with Mobile Devices

November 13, 2015
Author(s)
Kim B. Schaffer
Continuous Authentication has been around but has been met with several limitations. Recent development of mobile platforms are providing relief for many of these limitations as they take advantage of multiple sensors and sufficient processing power for

Introducing Combinatorial Testing in a Large Organization

April 23, 2015
Author(s)
Jon Hagar, Thomas Wissink, D. Richard Kuhn, Raghu N. Kacker
A two-year study of eight pilot projects to introduce combinatorial testing in a large aerospace corporation found that the new methods were practical, significantly lowered development costs, and improved test coverage by 20 to 50 percent.
Displaying 1126 - 1150 of 7107
Was this page helpful?