Mittuniversitetet

Context: Broken Access Control (BAC) is ranked by OWASP as the most critical web security risk. Open-source JavaScript projects, with their openness and diverse contributors, are particularly exposed. Objective: This study investigates the prevalence and patterns of BAC vulnerabilities in open-source JavaScript projects, addressing the lack of empirical evidence beyond enterprise systems. Method: A hybrid approach combined Semgrep static analysis with manual penetration testing. A curated set of 166 GitHub repositories was scanned using custom rules for Insecure Direct Object Reference (IDOR), unprotected routes, forced browsing, and token/session flaws; flagged cases were validated in Docker with Postman. Results: Static analysis flagged 33 repositories as potentially vulnerable, of which 5 were confirmed to contain exploitable BAC vulnerabilities through manual penetration testing. Confirmed issues included unauthenticated endpoints, parameter-based privilege escalation, and insecure token or Cross-Origin Resource Sharing (CORS) handling. Static analysis was useful, but showed high false positives and limited contextual accuracy. Conclusion: BAC vulnerabilities recur in open-source JavaScript projects. Static tools aid in detection but require manual validation for reliable assessment. 

The Draft-Based Iterative Feedback Accelerator (DIFA) is an AI-enhanced extension of the FAMS (Shahzad et al., 2023), which is designed to address challenges in providing scalable, high-quality formative feedback in higher education. Formative feedback is crucial for metacognitive development and self-regulated learning, yet its effective implementation is often limited in large cohorts, particularly for neurodiverse learners who need structured and transparent feedback. Moreover, the rise in students' reliance on generative AI raises concerns about deep learning, highlighting the need for assessment designs that promote meaningful cognitive engagement. DIFA transforms AI from a passive tool into an active pedagogical assistant within the feedback loop. It allows students to submit ongoing, incomplete work for evaluation, shifting focus from outcome-oriented grading to a process centered on reflection and continuous improvement. DIFA features reusable feedback fragments and a repository of common errors.

DIFA offers a modern approach to feedback by processing student drafts to generate context-specific responses that instructors can refine. This makes iterative feedback cycles more manageable within existing workloads. It enhances the Feedback and Assessment Management System (FAMS) by using natural language processing (NLP) to automate the categorization of feedback and create descriptive titles, improving organization and retrieval. When predefined feedback is unavailable, a lightweight language model trained on historical data generates relevant and clear responses, transforming the system into an adaptive feedback generator.

The architecture employs a teacher-in-the-loop approach where AI-generated feedback serves as a draft for instructors to review and refine. This ensures that AI enhances, rather than replaces, educators' professional judgment. By integrating AI into organizing and refining feedback, the DIFA system creates a continuous, data-driven feedback cycle that lightens instructors' workloads while delivering timely, personalized responses. Moreover, incorporating AI within a structured assessment framework helps prevent students' misuse of generative AI, positioning it as a tool for genuine learning.

Preliminary results show that this AI-enhanced architecture improves feedback delivery while maintaining the necessary depth and personalization for effective formative assessment. The DIFA system allows for iterative revisions rather than just final outputs, illustrating how explainable AI can enhance educational expertise. Future developments will include a student-facing interface that focuses on adaptive explanations and interactive feedback for neurodiverse learners

Cloud computing has become a cornerstone of modern technology, offering on-demand and scalable access to shared computational resources. As critical infrastructure increasingly migrates to cloud environments, concerns regarding data privacy and security have intensified. Users often need to trust service providers, despite risks like unauthorized access, insider threats, and data breaches. This study presents Git as a use-case of trust-dependent cloud services and investigates the potential of an end-to-end encrypted Git service on trust assumptions, security guarantees, and application performance. A prototype (E2Git) was designed to enforce end-to-end encryption at the application layer by encrypting repository contents and metadata on the client side, and automating key distribution across users and workstations, under the assumption of a fully covert adversary with complete access to the cloud infrastructure. The prototype’s security features and performance characteristics were evaluated in comparison with existing secure Git solutions. Although the E2Git prototype incurs elevated resource overhead during push operations, due to retransmission of a monolithically encrypted and compressed repository snapshot, it strengthens confidentiality and reduces server trust assumptions for repository contents and Git metadata. Notably, the E2Git prototype outperforms the standard Git client in terms of execution time during clone and fetch operations. These findings highlight the feasibility of trustless version control and the application of end-to-end encryption to secure sensitive data and enhance privacy in cloud environments.

Virtual learning environments offer new possibilities for technology enhanced teaching and learning, but providing rapid, individualised feedback for complex assignments in large student groups remains challenging. This paper presents a Formative Assessment Management System (FAMS), a computer-based tool for teachers to generate written feedback at scale with minimal overhead. FAMS leverages archived feedback fragments and thematic identifiers to create pertinent feedback while consistently maintaining quality and fairness. The system has been implemented in programming courses and yielded promising results, including reduced feedback delivery time and maintained feedback quality. Future research will evaluate FAMS from student and teacher perspectives, conforming to educational action research, continuous quality improvements, and investigating correlations between aspect-based assessment and learning outcomes.

For the Android malware detection / classification anti-malware community has relied on traditional malware detection methods as a countermeasure. However, traditional detection methods are developed for detecting the computer malware, which is different from Android malware in structure and characteristics. Thus, they may not be useful for Android malware detection. Moreover, majority of suggested detection approaches may not be generalized and are incapable of detecting zero-day malware due to different reasons such as available data set with specific set of examples. Thus, their detection accuracy may be questionable. To address this problem, this paper presents a malware classification approach with a reliable detection accuracy and evaluate the approach using artificially generated examples. The suggested approach generates the signature profiles and behavior profiles of each application in the data set, which are further used as input for the classification task. For improving the detection accuracy, feature fusion of features from filter methods and wrapper method and algorithm fusion is investigated. Without affecting the detection accuracy, the optimal balance between real world examples and synthetic examples is also investigated. The experimental results suggest that both AUC and F1 can be obtained up to 0.94 for both known and unknown malware using original examples and synthetic examples.