Method Using Command Abstraction Library for Iterative Testing Security of Web Applications

2015 ◽  
Vol 6 (3) ◽  
pp. 26-49
Author(s):  
Seiji Munetoh ◽  
Nobukazu Yoshioka
Keyword(s):  
Web Application ◽  
Web Applications ◽  
Agile Development ◽  
Application Framework ◽  
Security Testing ◽  
Application Development ◽  
Security Assurance ◽  
Security Issues ◽  
Granularity Level ◽  
Scripting Language

A framework based on a scripting language is commonly used in Web application development, and high development efficiency is often achieved by applying several Agile development techniques. However, the adaptation of security assurance techniques to support Agile development is still underway, particularly from the developer's perspective. The authors have addressed this problem by developing an iterative security testing method that splits the security test target application into two parts on the basis of the code lifecycle, application logic (“active development code”) and framework (“used code”). For the former, detailed security testing is conducted using static analysis since it contains code that is changed during the iterative development process. For the latter, an abstraction library at the command granularity level is created and maintained. The library identifies the behavior of an application from the security assurance standpoint. This separation reduces the amount of code to be statically inspected and provides a mechanism for sharing security issues among application developers using the same Web application framework. Evaluation demonstrated that this method can detect various types of Web application vulnerabilities.

Method Using Command Abstraction Library for Iterative Testing Security of Web Applications

2018 ◽  
pp. 192-215
Author(s):  
Seiji Munetoh ◽  
Nobukazu Yoshioka
Keyword(s):  
Web Application ◽  
Agile Development ◽  
Application Framework ◽  
Security Testing ◽  
Application Development ◽  
Security Assurance ◽  
Security Issues ◽  
Application Logic ◽  
Granularity Level ◽  
Scripting Language

A framework based on a scripting language is commonly used in Web application development, and high development efficiency is often achieved by applying several Agile development techniques. However, the adaptation of security assurance techniques to support Agile development is still underway, particularly from the developer's perspective. The authors have addressed this problem by developing an iterative security testing method that splits the security test target application into two parts on the basis of the code lifecycle, application logic (“active development code”) and framework (“used code”). For the former, detailed security testing is conducted using static analysis since it contains code that is changed during the iterative development process. For the latter, an abstraction library at the command granularity level is created and maintained. The library identifies the behavior of an application from the security assurance standpoint. This separation reduces the amount of code to be statically inspected and provides a mechanism for sharing security issues among application developers using the same Web application framework. Evaluation demonstrated that this method can detect various types of Web application vulnerabilities.

OAM: An Ontology Application Management Framework for Simplifying Ontology-Based Semantic Web Application Development

2016 ◽  
Vol 26 (01) ◽  
pp. 115-145 ◽  
Author(s):  
Marut Buranarach ◽  
Thepchai Supnithi ◽  
Ye Myat Thein ◽  
Taneth Ruangrajitpakorn ◽  
Thanyalak Rattanasawad ◽  
...  
Keyword(s):  
Semantic Web ◽  
Web Application ◽  
Web Applications ◽  
Data Publishing ◽  
Application Framework ◽  
Application Development ◽  
Development Environment ◽  
Application Management ◽  
Efficient Performance ◽  
Ontology Application

Although the Semantic Web data standards are established, ontology-based applications built on the standards are relatively limited. This is partly due to high learning curve and efforts demanded in building ontology-based Semantic Web applications. In this paper, we describe an ontology application management (OAM) framework that aims to simplify creation and adoption of ontology-based application that is based on the Semantic Web technology. OAM introduces an intermediate layer between user application and programming and development environment in order to support ontology-based data publishing and access, abstraction and interoperability. The framework focuses on providing reusable and configurable data and application templates, which allow the users to create the applications without programming skill required. Three forms of templates are introduced: database to ontology mapping configuration, recommendation rule and application templates. We describe two case studies that adopted the framework: activity recognition in smart home domain and thalassemia clinical support system, and how the framework was used in simplifying development in both projects. In addition, we provide some performance evaluation results to show that, by limiting expressiveness of the rule language, a specialized form of recommendation processor can be developed for more efficient performance. Some advantages and limitations of the application framework in ontology-based applications are also discussed.

Taxonomy of Login Attacks in Web Applications and Their Security Techniques Using Behavioral Biometrics

2020 ◽  
pp. 122-139
Author(s):  
Rizwan Ur Rahman ◽  
Deepak Singh Tomar
Keyword(s):  
Web Application ◽  
Initial Phase ◽  
Web Applications ◽  
Application Development ◽  
Web Application Security ◽  
Application Security ◽  
Security Issues ◽  
Large Numbers ◽  
Web Application Development ◽  
The Web

Research into web application security is still in its initial phase. In spite of enhancements in web application development, large numbers of security issues remain unresolved. Login attacks are the most malevolent threats to the web application. Authentication is the method of confirming the stated identity of a user. Conventional authentication systems suffer from a weakness that can compromise the defense of the system. An example of such vulnerabilities is login attack. An attacker may exploit a pre-saved password or an authentication credential to log into web applications. An added problem with current authentication systems is that the authentication process is done only at the start of a session. Once the user is authenticated in the web application, the user's identity is assumed to remain the same during the lifetime of the session. This chapter examines the level login attacks that could be a threat to websites. The chapter provides a review of vulnerabilities, threats of login attacks associated with websites, and effective measures to counter them.

scholarly journals Framework Design for Modular Web-based Application Using Model-CollectionService-Controller-Presenter (MCCP) Pattern

2017 ◽  
Vol 2 (1) ◽  
Author(s):  
Aryo Pinandito
Keyword(s):  
Information System ◽  
Web Application ◽  
Design Pattern ◽  
Data Exchange ◽  
Data Communication ◽  
Communication Process ◽  
Application Framework ◽  
Application Development ◽  
Web Based ◽  
Organization Model

Information system is one of the most important business supports in organizations. Web-based applications become an appropriate solution to overcome the dynamically changing environment among different units in an organization. Model-View-Controller (MVC) is a well-known design pattern in web-based application development due to the separation of an application into several parts, hence it is easy to reuse and maintain. However, such design pattern requires improvements since the information system handles business process choreography and integration between application. Therefore, modifying the interaction of object of class in a design pattern become a challenging problem. In this paper, an application framework based on Model-CollectionService-Controller-Presenter (MCCP) design pattern, which is a modification of an MVC, was proposed. The proposed framework allows multiple different applications to run and provides inter-application data exchange mechanisms to improve the data communication process between applications. Several performance comparisons with another popular web application framework are also presented.

scholarly journals Purwarupa Framework Aplikasi Desktop Menggunakan Teknologi Web

2015 ◽  
Vol 9 (1) ◽  
pp. 23
Author(s):  
Firmansyah Adiputra ◽  
Khabib Mustofa
Keyword(s):  
Web Application ◽  
Web Applications ◽  
Application Framework ◽  
Web Browser ◽  
Web Technologies ◽  
Desktop Application ◽  
New Type

AbstrakAplikasi desktop adalah aplikasi yang berjalan lokal dalam lingkungan desktop dan hanya dapat diakses oleh pengguna desktop. Ini berbeda dengan aplikasi web yang dapat diakses dari manapun melalui jaringan. Namun tidak seperti halnya aplikasi desktop, aplikasi web yang berjalan di atas web browser tidak dapat berintegrasi dengan aplikasi desktop yang berjalan pada sisi klien.Dalam penelitian ini dibangun purwarupa framework yang diberi nama HAF (Hybrid Application Framework). HAF digunakan untuk mengembangkan dan mengeksekusi jenis aplikasi desktop baru yang diberi nama HyApp (Hybrid Application). Melalui HAF, HyApp dibangun menggunakan teknologi web dan dapat diakses secara lokal maupun melalui jaringan. Saat diakses secara lokal, walaupun dikembangkan dengan teknologi web, HyApp dapat berkomunikasi dengan aplikasi desktop lainnya. Selain itu, melalui API yang disediakan oleh HAF, HyApp akan dapat menerapkan perilaku yang berbeda berdasarkan modus pengaksesan yang dilakukannya. Kata kunci—framework, aplikasi desktop, aplikasi web    AbstractDesktop application is an application that runs locally in a desktop environment and can be accessed only by desktop users. It differs from web application which can be accessed from anywhere through networks. But unlike desktop applications, web applications cannot integrate nicely with desktop applications from where it is accessed.This research developes a prototype of framework which is named HAF (Hybrid Application Framework). HAF is used for developing and executing a new type of desktop application, named HyApp (Hybrid Application). Through HAF, HyApp is built using web technologies and can be accessed either locally or from networks. When accessed locally, even though it is built using web technologies, it still can communicate with other desktop applications. Also by using APIs provided by HAF, HyApp is capable to behave differently based on whether it is accessed locally or remotely. Keywords—framework, desktop applications, web applications

scholarly journals Model-Driven Approach to develop Rich Web Applications

2018 ◽  
Vol 21 (2) ◽  
Author(s):  
Guido Nuñez ◽  
Daniel Bonhaure ◽  
Magalí González ◽  
Nathalie Aquino ◽  
Luca Cernuzzi
Keyword(s):  
Code Generation ◽  
Web Application ◽  
Web Applications ◽  
Application Development ◽  
Internet Applications ◽  
Architecture Model ◽  
Model Driven ◽  
Rich Internet Applications ◽  
Preliminary Validation ◽  
Model Driven Approach

Many Web applications have among their features the possibility of distributing their data and their business logic between the client and the server, also allowing an asynchronous communication between them. These features, originally associated with the arrival of Rich Internet Applications (RIA), remain particularly relevant and desirable. In the area of RIA, there are few proposals that simultaneously consider these features, adopt Model-Driven Development (MDD), and use implementation technologies based on scripting. In this work, we start from MoWebA, an MDD approach to web application development, and we extend it by defining a specific architecture model with RIA functionalities, supporting the previously mentioned features. We have defined the necessary metamodels and UML profiles, as well as transformation rules that allow you to generate code based on HTML5, Javascript, jQuery, jQuery Datatables and jQuery UI. The preliminary validation of the proposal shows positive evidences regarding the effectiveness, efficiency and satisfaction of the users with respect to the modeling and code generation processes of the proposal.

Focused Requirements Engineering Method for Web Application Development

2010 ◽  
pp. 1537-1545
Author(s):  
Ala M. Abu-Samaha ◽  
Lana S. Al-Salem
Keyword(s):  
Requirements Engineering ◽  
System Application ◽  
Business Strategy ◽  
Web Application ◽  
Web Applications ◽  
Application Development ◽  
Web Engineering ◽  
Business Objectives ◽  
Application Requirements ◽  
The Web

The requirements phase of the system/application development process typically involves the activities of requirements elicitation, analysis, validation, and specification. The main goal of such a process is “to develop a requirements speci- fication document which defines the system to be procured and which can act as a basis for the system design” (Sawyer, Sommerville, & Viller, 1996). Hence the underpinning assumption of the requirements engineering (RE) process is to transform the operational needs of an organisation into complete, consistent, and unambiguous system/application specifications through an iterative process of definition and validation (Pohl ,1994). The Web engineering (WE) literature provides a limited number of methods and techniques that can be used to manage the RE process in a Web development context [e3-value framework (Gordijn, Akkermans, & van Vliet, 2000), SOARE approach (Bleistein, Aurum, Cox, & Ray, 2004), e-prototyping (Bleek, Jeenicke, & Klischewski, 2002), AWARE (Bolchini & Paolini, 2004), and SSM/ICDT (Meldrum & Rose, 2004)]. Despite the availability of such a limited number of Web requirements engineering (WRE) methods, many researchers criticised such methods for their failure to address the necessity to align the Web application’ requirements to the organisation’s business strategy. Hence, the recommendation of many researchers (Al-Salem & Abu- Samaha, 2005a; Bleistein 2005; Bleistein, Cox, & Verner, 2004; Vidgen, Avison, Wood, & Wood-Harper, 2002) is to utilise a general WRE framework for the development of Web applications that can align the application’s requirements to the organisation’s business needs and its future vision. The objective of such a WRE framework is to incorporate the elicitation/analysis of business strategy as part of the application’s RE process. This chapter presents a WRE method that extends Sommerville and Kotonya’s viewpoint-oriented requirements definition (VORD) and Kaplan and Norton’s balanced scorecard (BSC) to elicit the Web application’ requirements and to plan/analyze the business strategy, respectively. In addition, eWARE (extended Web application requirements engineering) deploys the concept of “requirements alignment” to attain business objectives during the requirements discovery, elicitation, and formalisation process to identify the services of the Web application that will achieve the business objectives in order to improve the organisation’s profitability and competitiveness. The chapter is organised into a number of sections. The second section of this chapter provides a background to Web applications in terms of defi- nition and differentiating characteristics. The third section provides a discussion of eWARE method in terms of phases and activities. This section is divided into two subsections to cover the activities of the two prominent phases of the eWARE process in more detail. The fourth and fifth sections provide a discussion of possible future trends in WRE and a number of concluding remarks.

Automated security testing for web applications on industrial automation and control systems

2019 ◽  
Vol 67 (5) ◽  
pp. 383-401
Author(s):  
Steffen Pfrang ◽  
Anne Borcherding ◽  
David Meier ◽  
Jürgen Beyerer
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Web Application ◽  
Web Applications ◽  
Security Testing ◽  
Industrial Automation ◽  
Local Networks ◽  
Automation And Control ◽  
And Control ◽  
The Web

Abstract Industrial automation and control systems (IACS) play a key role in modern production facilities. On the one hand, they provide real-time functionality to the connected field devices. On the other hand, they get more and more connected to local networks and the internet in order to facilitate use cases promoted by “Industrie 4.0”. A lot of IACS are equipped with web servers that provide web applications for configuration and management purposes. If an attacker gains access to such a web application operated on an IACS, he can exploit vulnerabilities and possibly interrupt the critical automation process. Cyber security research for web applications is well-known in the office IT. There exist a lot of best practices and tools for testing web applications for different kinds of vulnerabilities. Security testing targets at discovering those vulnerabilities before they can get exploited. In order to enable IACS manufacturers and integrators to perform security tests for their devices, ISuTest was developed, a modular security testing framework for IACS. This paper provides a classification of known types of web application vulnerabilities. Therefore, it makes use of the worst direct impact of a vulnerability. Based on this analysis, a subset of open-source vulnerability scanners to detect such vulnerabilities is selected to be integrated into ISuTest. Subsequently, the integration is evaluated. This evaluation is twofold: At first, willful vulnerable web applications are used. In a second step, seven real IACS, like a programmable logic controller, industrial switches and cloud gateways, are used. Both evaluation steps start with the manual examination of the web applications for vulnerabilities. They conclude with an automated test of the web applications using the vulnerability scanners automated by ISuTest. The results show that the vulnerability scanners detected 53 % of the existing vulnerabilities. In a former study using commercial vulnerability scanners, 54 % of the security flaws could be found. While performing the analysis, 45 new vulnerabilities were detected. Some of them did not only break the web server but crashed the whole IACS, stopping the critical automation process. This shows that security testing is crucial in the industrial domain and needs to cover all services provided by the devices.

scholarly journals Making the Web 2.0 Faster for Next Generation

2019 ◽  
Vol 9 (1) ◽  
pp. 2922-2924
Keyword(s):  
Web 2.0 ◽  
Programming Language ◽  
User Experience ◽  
Web Application ◽  
Web Applications ◽  
Digital Content ◽  
Server Side ◽  
Application Systems ◽  
Scripting Language ◽  
The Web

Undeniably the most favored web scripting language is PHP. Almost 80% of the internet’s server-side web applications are written in PHP which includes big giants like WordPress, Wikipedia, and Facebook. In present-day, at an accelerating pace, the quantity of digital content is burgeoning. A heterogeneous set of users' devices is being amassed by these contents and administering these contents manually is an infeasible solution engendering an increasing set of problems. A solution to this problem would be to switch to a web programming language, which can be compiled. We are describing an easy to deploy and a continuous conversion mechanism for converting existing Web 2.0 PHP application systems into Facebook’s HHVM supported Hack server-side application systems. We are trying to use the power of Hack language and amplify the performance of existing PHP server-side applications. Instead of interpreting all of your code Hack translates it to assembly and runs that instead, which can lead to an immense amount of increase in performance. We are using Hacktificator, a tool developed by Facebook Developers and our demo web application running on HHVM to test and convert user’s existing PHP codebase to Hack language. With this proposed methodology we do not have to make any change to existing codebase manually or hire new engineers for the conversion, nor do we have to take down our live systems. Conversion can be done on the fly and will result in approximately 2x to 20x better performance. The availability of this tool can save costs for manual conversion, save time as well as improve the user experience of websites with better performance

Sign in / Sign up

Export Citation Format

Share Document