Search

Cyber attacks targeting software applications have a tremendous impact on our daily life. For example, attackers have utilized vulnerabilities of web applications to steal and gain unauthorized use of sensitive data stored in these systems. Previous studies indicate that security testing is highly precise, and therefore is widely applied to validate individual security requirements. However, dependencies between security requirements may cause additional vulnerabilities. Manual dependency detection faces scalability challenges, e.g., a previous study shows that the pairwise dependency analysis of 40 requirements would take around 12 hours. In this paper, we present a novel approach which integrates the interdependency among high-level security requirements, such as those documented in policies, regulations, and standards. We then use automated requirements tracing methods to identify product-level security requirements and their dependencies. Our manual analysis of HIPAA and FIPS 200 leads to the identification of five types of high-level security requirements dependencies, which further inform the automated tracing methods and guide the designs of system-level security tests. Experimental results on five projects in healthcare and education domains show the significant recall improvements at 81%. Our case study on a deployed production system uncovers four previously unknown vulnerabilities by using the detected requirements dependencies as test paths, demonstrating our approach's value in connecting requirements engineering with security testing.

At present, the available methods to diagnose active H. pylori infection are endoscopy with biopsy for histology, culture, rapid urease tests, 13C or 14C urea breath test, urine antibody and the stool antigen test. The aims of this study were to simplify the 13C urea test by measuring 13C in blood rather than breath, and to evaluate the usefulness of the 13C urea blood test for the diagnosis of H. pylori infection. Patients who underwent upper endoscopy for standard clinical indications (e.g. dyspepsia, abdominal pain) were enrolled. A total of 161 patients (93F, 68M, mean age 47 +/- 14.2) were evaluated; 50 (31%) of them were H. pylori positive, and 111(69%) were H. pylori negative. H. pylori infection was diagnosed with a rapid urease test (CLO-test) and 13C urea breath test (UBT). Performance characteristics for the 13C urea blood test for diagnosis and evaluation of H. pylori eradication were calculated using UBT and CLO as gold standards. The fifty H. pylori-positive patients were treated with triple antibiotic therapy for two weeks. Four weeks after finishing antibiotic therapy patients were retested with a commercial UBT and urea blood test. The 13C blood test had sensitivities of 92 and 98% and specificities of 96 and 100% as compared with urea breath test and CLO, respectively. We conclude that the 13C urea blood test is highly sensitive and specific for the initial diagnosis and control of eradication of H. pylori infection.