Code obfuscation has become an essential practice in modern software development, designed to make source or machine code challenging for both humans and computers to comprehend. It plays a crucial role in cybersecurity by protecting intellectual property, safeguarding trade secrets, and preventing unauthorized access or reverse engineering. However, the lack of transparency in obfuscated code raises significant ethical concerns, including the potential for harmful or unethical uses such as hidden data collection, malicious features, back doors, and concealed vulnerabilities. These issues highlight the need for a balanced approach that ensures the protection of developers’ intellectual property while addressing ethical responsibilities related to user privacy, transparency, and societal impact. This paper investigates various code obfuscation techniques, their benefits, challenges, and practical applications, underscoring their relevance in contemporary software development. This study examines obfuscation methods and tools, evaluates machine learning models—including Random Forest, Gradient Boosting, and Support Vector Machine—and presents experimental results aimed at classifying obfuscated versus non-obfuscated files. Our findings demonstrate that these models achieve high accuracy in identifying obfuscation methods employed by tools such as Jlaive, Oxyry, PyObfuscate, Pyarmor, and py-obfuscator. This research also addresses emerging ethical concerns and proposes guidelines for a balanced, responsible approach to code obfuscation.

A permutation of a sequence of events is a common construction in many testing environments. Covering all possible permutations has clearly an exponential behavior; so one can ask for partial (easier) requirement, to cover all possible orders: permutations induced on of a small cardinality subset of elements. In our paper we show better (both lower and upper) bounds on this event sequencing testing problem. We also discuss another variant of the problem where we impose restrictions on the permutations. In this case we show how to achieve an exponential growth in the complexity of the problem. We also give solutions for specific cases of the problem.

The cyber threat landscape is highly dynamic, posing a significant risk to the operations of systems and organisations. An organisation should, therefore, continuously monitor for new threats and properly contextualise them to identify and manage the resulting risks. Risk identification is typically performed manually, relying on the integration of information from various systems as well as subject matter expert knowledge. This manual risk identification hinders the systematic consideration of new, emerging threats. This paper describes a novel method to promote automated cyber risk identification: OnToRisk. This artificial intelligence method integrates information from various sources using formal ontology definitions, and then relies on these definitions to robustly frame cybersecurity threats and provide risk-related insights. We describe a successful case study implementation of the method to frame the threat from a newly disclosed vulnerability and identify its induced organisational risk. The case study is representative of common and widespread real-life challenges, and, therefore, showcases the feasibility of using OnToRisk to sustainably identify new risks. Further applications may contribute to establishing OnToRisk as a comprehensive, disciplined mechanism for risk identification.

We present a new model-based approach for testing systems that use sequences of actions and assertions as test vectors. Our solution includes a method for quantifying testing quality, a tool for generating high-quality test suites based on the coverage criteria we propose, and a framework for assessing risks. For testing quality, we propose a method that specifies generalized coverage criteria over sequences of actions, which extends previous approaches. Our publicly available tool demonstrates how to extract effective test suites from test plans based on these criteria. We also present a Bayesian approach for measuring the probabilities of bugs or risks, and show how this quantification can help achieve an informed balance between exploitation and exploration in testing. Finally, we provide an empirical evaluation demonstrating the effectiveness of our tool in finding bugs, assessing risks, and achieving coverage.

We evolve survivors for the CodeGuru competition --- assembly programs that run the longest in shared memory, by resisting attacks from adversary survivors and finding their weaknesses. For evolving top-notch solvers, we specify a Backus Normal Form (BNF) for the assembly language and synthesize the code from scratch using Genetic Programming (GP). We evaluate the survivors by running CodeGuru games against human-written winning survivors. Our evolved programs found weaknesses in the programs they were trained against and utilized them. This work has important applications for cyber-security, as we utilize evolution to detect weaknesses in survivors. The assembly BNF is domain-independent; thus, by modifying the fitness function, it can detect code weaknesses and help fix them. Finally, the CodeGuru competition offers a novel platform for analyzing GP and code evolution in adversarial environments. To support further research in this direction, we provide a thorough qualitative analysis of the evolved survivors and the weaknesses found.