Shao-Fang Wen

Mr. Shao-Fang Wen

Norwegian University of Science and Technology, Trondheim, Sør-Trøndelag, Norway
orcid
avatar
Co-authors
avatar
Following
avatar
Followers

Research Focus & Metrics

Explore full metrics on Scilit

Academic Career Length

10Years (2017-Present)

(Calculated once Scilit publication data is synced: current year − year of first publication + 1)

Representative Publications

View All Publications
14 December 2024 in International Journal of Information Security
Verified
Journal Article
Open access
PDF file
SWShao-Fang Wen
Shao-Fang Wen
ASAnkur Shukla
Ankur Shukla
BKBasel Katt
Basel Katt
System Security Assurance (SSA) has emerged as a critical methodology for organizations to verify the trustworthiness of their systems by evaluating security measures against industry standards, legal requirements, and best practices to identify any weakness and demonstrate compliance. In recent years, the role of Artificial Intelligence (AI) in enhancing cybersecurity has received increased attention, with an increasing number of literature reviews highlighting its diverse applications. However, there remains a significant gap in comprehensive reviews that specifically address the integration of AI within SSA frameworks. This systematic literature review seeks to fill this research gap by assessing the current state of AI in SSA, identifying key areas where AI contributes to improve SSA processes, highlighting the limitations of current methodologies, and providing the guidance for future advancements in the field of AI-driven SSA.
9 October 2023 in Computers & Security
Verified
Journal Article
Open access
SWShao-Fang Wen
Shao-Fang Wen
BKBasel Katt
Basel Katt
10 August 2022 in Journal of Cybersecurity and Privacy
Verified
Journal Article
Open access
PDF file
SWShao-Fang Wen
Shao-Fang Wen
ASAnkur Shukla
Ankur Shukla
BKBasel Katt
Basel Katt
Security assurance (SA) is a technique that helps organizations to appraise the trust and confidence that a system can be operated correctly and securely. To foster effective SA, there must be systematic techniques to reflect the fact that the system meets its security requirements and, at the same time, is resilient against security vulnerabilities and failures. Quantitative SA evaluation applies computational and mathematical techniques for deriving a set of SA metrics to express the assurance level that a system reaches. Such metrics are intended to quantify the strength and weaknesses of the system that can be used to support improved decision making and strategic planning initiatives. Utilizing metrics to capture and evaluate a system’s security posture has gained attention in recent years. However, scarce work has described how to combine SA evaluation while taking into account both SA metrics modeling and analysis. This paper aims to develop a novel approach for the modeling, calculation, and analysis of SA metrics that could ultimately enhance quantitative SA evaluation.
19 December 2022 in Journal of Applied Security Research
Verified
Journal Article
Open access
SWShao-Fang Wen
Shao-Fang Wen
BKBasel Katt
Basel Katt
Security assurance evaluation (SAE) is a technique that helps organizations to appraise the trust and confidence that a system can be operated correctly and securely. This paper contributes to the research on quantitative SAE by proposing an ontology-based assurance metrics computation solution, which consists of (1) a quantitative SAE approach, (2) an ontology for modeling the security assurance components and metrics, and (3) a metrics calculation engine for automatically generating metrics values. The feasibility and effectiveness of the proposed ontology-based SAE approach are examined through a preliminary ontology evaluation as well as a practical application-based evaluation.
4 June 2019 in Journal of Applied Security Research
Verified
Journal Article
Closed access
SWShao-Fang Wen
Shao-Fang Wen
BKBasel Katt
Basel Katt
Learning software security is one of the most challenging tasks in the information technology sector due to the vast amount of security knowledge and the difficulties in understanding its practical applications. Conventional teaching approaches give little attention to how to improve the effectiveness of learning in the domain of software security. Context-based learning has been proven to be a sound pedagogical methodology; however, it is still unclear how to synthesize the prescription in the domain of software security. In this article, a context-based approach to software security learning is proposed for structuring and presenting security knowledge. To evaluate the proposed approach, a quasi-experiment was designed and executed in the setting of a university learning environment. The experiment results indicate that the proposed context-based learning approach not only yields significant knowledge gains compared to the conventional approach but also gains better learning satisfaction of students.
20 June 2019 in Information
Verified
Journal Article
Open access
PDF file
SWShao-Fang Wen
Shao-Fang Wen
BKBasel Katt
Basel Katt
Knowledge of software security is highly complex since it is quite context-specific and can be applied in diverse ways. To secure software development, software developers require not only knowledge about general security concepts but also about the context for which the software is being developed. With traditional security-centric knowledge formats, it is difficult for developers or knowledge users to retrieve their required security information based on the requirements of software products and development technologies. In order to effectively regulate the operation of security knowledge and be an essential part of practical software development practices, we argue that security knowledge must first incorporate features that specify what contextual characteristics are to be handled, and represent the security knowledge in a format that is understandable and acceptable to the individuals. This study introduces a novel ontology approach for modeling security knowledge with a context-based approach, by which security knowledge can be retrieved, taking the context of the software application at hand into consideration. In this paper, we present our security ontology with the design concepts and the corresponding evaluation process.