Input Validation Research Articles

Adaptive Symmetry Reference Trajectory Generation in Shared Autonomy for Active Knee Orthosis

Gait symmetry training plays an essential role in the rehabilitation of hemiplegic patients. Robotics-based gait training has been widely accepted by patients and clinicians. Reference trajectory generation for the affected side using the motion data of the unaffected side is an important way to achieve this. However, online generation of gait reference trajectory requires the algorithm to provide correct gait phase delay and could reduce the impact of measurement noise from sensors and input uncertainty from users. Based on an active knee orthosis (AKO) prototype, this work presents an adaptive symmetric gait trajectory generation framework for the gait rehabilitation of hemiplegic patients. Using the adaptive nonlinear frequency oscillators (ANFO) and movement primitives, we implement online gait pattern encoding and adaptive phase delay according to the real-time user input. A shared autonomy (SA) module with online input validation and arbitration has been designed to prevent undesired movements from being transmitted to the actuator on the affected side. The experimental results demonstrate the feasibility of the framework. Overall, this work suggests that the proposed method has the potential to perform gait symmetry rehabilitation in an unstructured environment and provide a kinematic reference for torque-assistance AKO.

Standardization of a Cytometric Bead Assay Based on Egg-Yolk Antibodies

Immunoassays are important tests for the detection of numerous molecular targets. Among the methods currently available, the cytometric bead assay has gained prominence in recent decades. Each microsphere that is read by the equipment represents an analysis event of the interaction capacity between the molecules under test. Thousands of these events are read in a single assay, thus ensuring high assay accuracy and reproducibility. This methodology can also be used in the validation of new inputs, such as IgY antibodies, for the diagnosis of diseases. These antibodies are obtained through immunizing chickens with the antigen of interest and then extracting the immunoglobulin from the yolk of the animals' eggs; therefore, this is a painless and highly productive method for obtaining the antibodies. In addition to a methodology for the high-precision validation of the antibody recognition capacity of this assay, this paper also presents a method for extracting these antibodies, determining the best coupling conditions for the antibodies and latex beads, and determining the sensitivity of the test.

A Call for Mandatory Input Validation and Fuzz Testing

AbstractThe on-going digitalization of our critical infrastructures is progressing fast. There is also a growing trend of serious and disrupting cyber-attacks. The digital services are often fragile, and with many weaknesses and vulnerabilities. This makes exploiting and attacking the services a little too easy. If the services verifies all inputs, many security threats will be avoided. Similarly, if one diligently tests the services with malformed inputs, one will uncover many security and software quality problems. In this paper we investigate “input validation” and “fuzz testing” as a means to improve security. The aim is not exhaustive coverage, but to provide indications of usefulness and to serve as a call for action.

An elliptical‐shaped rectangular slot antenna at 2.48 GHz for hyperthermia application

AbstractIn this paper, a novel integrated elliptical ringtone antenna has been proposed. The proposed antenna operates in the industrial, scientific and medical band and the overall size of the antenna is 128 × 128 × 1.58 mm3. The antenna provides a valid specific absorption rate input profile and displays better performance at 2.48 GHz. Simulation of the proposed structure was done on FEM‐based high frequency structure simulator 2020R1 software and validated by measured results.

Learning-based robotic grasping: A review.

As personalization technology increasingly orchestrates individualized shopping or marketing experiences in industries such as logistics, fast-moving consumer goods, and food delivery, these sectors require flexible solutions that can automate object grasping for unknown or unseen objects without much modification or downtime. Most solutions in the market are based on traditional object recognition and are, therefore, not suitable for grasping unknown objects with varying shapes and textures. Adequate learning policies enable robotic grasping to accommodate high-mix and low-volume manufacturing scenarios. In this paper, we review the recent development of learning-based robotic grasping techniques from a corpus of over 150 papers. In addition to addressing the current achievements from researchers all over the world, we also point out the gaps and challenges faced in AI-enabled grasping, which hinder robotization in the aforementioned industries. In addition to 3D object segmentation and learning-based grasping benchmarks, we have also performed a comprehensive market survey regarding tactile sensors and robot skin. Furthermore, we reviewed the latest literature on how sensor feedback can be trained by a learning model to provide valid inputs for grasping stability. Finally, learning-based soft gripping is evaluated as soft grippers can accommodate objects of various sizes and shapes and can even handle fragile objects. In general, robotic grasping can achieve higher flexibility and adaptability, when equipped with learning algorithms.

Automation of Quantifying Security Risk Level on Injection Attacks Based on Common Vulnerability Scoring System Metric

An injection attack is a cyber-attack that is one of The Open Web Application Security Project Top 10 Vulnerabilities. These attacks take advantage of insufficient user input validation into the system through the input surface of a Web application as that user in the browser. The company’s cyber security team must filter thousands of attacks to prioritize which attacks are considered the most dangerous to be mitigated first. This activity of filtering thousands of attacks takes much time because you have to check these attacks one by one. Therefore, a method is needed to assess how dangerous a cyber-attack is that enters an organization’s or company’s server. Injection attack detection can be done by analyzing the request data in the web server log. Our research attempts to perform quantification modeling of the variations of two types of injection attacks, SQL Injection (SQLi) and Cross-Site Scripting (XSS), using Common Vulnerability Scoring System Metrics (CVSS). CVSS metrics are generally used to calculate the level of dangerous weakness in the system. This metric is never used to calculate the level of how dangerous an attack is. The modeling that we have made shows that SQLi and XSS attacks have many variations in levels ranging from low to high levels. We discovered that when classified with Common Weakness Enumeration Database, SQLi and XSS attacks CVE values would have high-level congruence with almost 94% value between one another vector on CVSS.

Efficient generation of valid test inputs for deep neural networks via gradient search

AbstractThe safety and robustness of deep neural networks (DNNs) are currently of great concern. Adequate testing is commonly an effective technique to ensure the software's trustworthiness. However, existing DNN testing methods generate many invalid test inputs, which inevitably brings increased computational overhead and reduces the efficiency of DNN testing. In this paper, we focus on testing task‐specific DNN and investigating diverse, valid and natural test input generation based on data augmentation techniques. Specifically, we propose AugTest, a DNN testing method based on stochastic optimization with momentum, searching for optimal compositions of data augmentation parameters to efficiently generate diverse and valid test inputs. Experimental results show that our proposed method can effectively explore the data manifold space and find valid test inputs with high diversity and naturalness. Compared with the best‐performing baseline, AugTest can generate more test inputs with more average diversity and less average time. Furthermore, the generated test inputs have competitive generalizability to DNNs with different structures. The test error rates exceed 70% when testing other DNN models performing similar tasks using the test inputs generated by AugTest. This implies that our method can produce more valid and generalized data to unveil DNNs' errors.

The Role of Electron–Electron Interaction in Charge Transport Calculations through Transition Metal Dichalcogenides Heterojunctions

2D materials have raised a lot of interest in the last decades, due to their novel and diverse properties, particularly for energy technology applications where materials such as molybdenum disulfide are known for their outstanding catalytic ability. While intensive research is devoted to 2D transition metal dichalcogenide (TMDCs) semiconductor characterization, comprehensive understanding of metal/semiconductor heterojunctions is still lacking especially for junctions containing 2D metallic monolayers other than graphene. Using wave‐packet propagation, charge transport of two electrons through heterojunctions is simulated, in order to assess the influence of the electron–electron interaction on the charge transport efficiency. TMDCs with similar structure for both metal and semiconductor monolayers are used, leading to a high‐quality metal contact. It is found that charge transport is more efficient in systems containing a chromium disulfide semiconductor monolayer compared to systems with MoS2 or tungsten disulfide. This trend in the efficiency is the same with and without electron–electron interaction, demonstrating the validity of the qualitative input provided by models that lack electron–electron interactions. Nevertheless, for all systems, the interaction increases charge transmission probability from the metal to the semiconductor, due to electronic repulsion that pushes one of the charge carriers forward across the interface.

An annotation-based approach for finding bugs in neural network programs

As neural networks are increasingly included as core components of safety–critical systems, developing effective testing techniques specialized for them becomes crucial. The bulk of the research has focused on testing neural-network models; but these models are defined by writing programs, and there is growing evidence that these neural-network programs often have bugs too.This paper presents aNNoTest: an approach to generating test inputs for neural-network programs. A fundamental challenge is that the dynamically-typed languages (e.g., Python) commonly used to program neural networks cannot express detailed constraints about valid function inputs (e.g., matrices with certain dimensions). Without knowing these constraints, automated test-case generation is prone to producing invalid inputs, which trigger spurious failures and are useless for identifying real bugs. To address this problem, we introduce a simple annotation language tailored for concisely expressing valid function inputs in neural-network programs. aNNoTest takes as input an annotated program, and uses property-based testing to generate random inputs that satisfy the validity constraints. In the paper, we also outline guidelines that simplify writing aNNoTest annotations.We evaluated aNNoTest on 19 neural-network programs from Islam et al’s survey. Islam et al. (2019), which we manually annotated following our guidelines — producing 6 annotations per tested function on average. aNNoTest automatically generated test inputs that revealed 94 bugs, including 63 bugs that the survey reported for these projects. These results suggest that aNNoTest can be a valuable approach to finding widespread bugs in real-world neural-network programs.

A Survey on Web Application Penetration Testing

Websites are becoming increasingly effective communication tools. Nevertheless, web applications are vulnerable to attack and can give attackers access to sensitive information or unauthorized access to accounts. The number of vulnerabilities in web applications has increased dramatically over the past decade. Many are due to improper validation and sanitization of input. Identifying these vulnerabilities is essential for developing high-quality, secure web applications. Whenever a website is released to the public, it is required to have had penetration testing to a certain standard to ensure the security of the information. Application-level security vulnerability detection is possible for many commercial and open-source applications. However, developers are curious about which tools detect security vulnerabilities and how quickly they do so. The purpose of this study is to discuss penetration testing and how it can be implemented. This paper also explores the hazards and vulnerabilities associated with the web environment as well as the protective measures that can be taken. In addition, a comprehensive review and comparison of common web penetration testing tools is provided. The aim of this paper is to help web penetration testers choose a technology that is optimal for their requirements. The paper also sets out to guide and provide recommendations to users for choosing the best web penetration test tool and increasing their awareness of secure web environments. The study results indicate that not all web penetration testing tools offer the same features and that combining analysis tools can provide detailed information about web vulnerabilities.

Optimization and simulation of arc welding robot parameters based on offline programming

Automatic welding is most frequently utilized in engineering and manufacturing to improve efficiency. The importance of a robot in a current welding system takes full advantage of manual welding and regulates the burden of operator duties. The virtual process affects the operator's responsibilities, bead geometry, production quality, and shop floor platform. The goal of this study is to identify the simulation process parameter that has the greatest influence on variables such arc length, speed, and duration in arc welding. The Robot Studio ABB software has been utilized to make offline programming operations and to synchronize the route configuration of virtual arc welding robot and gun on imported solid geometry. Based on parameter data gathered from the robot studio, the simufact welding simulation configured the melting efficiency and bead geometry. The two simulation numerical variables data were used as input for the optimal solution validation in multi-objective optimization. The resulting emphasis of the experiment pursued on 0.001 m thickness of stainless-steel welding material: the melting efficiency is 0.42% and 467 Nm/s arc voltages during the arc travel of 0.0207 m/s and bead sensitivity are 2.68 VM/Nm/s. The MATLAB Pareto genetic algorithm is used to optimize the arc length, arc speed, and arc duration parameters adjusted in module language edit text format, which shows the preferred parameter of selected thickness. The results show that arc length and arc speed are practical as best solution dominators, while arc time is the non-dominating solution.

SQL Injection Attack: Quick View

SQL injection is a type of security vulnerability that occurs in database-driven web applications where an attacker injects malicious code into the application to gain unauthorized access to sensitive information. This paper aims to provide a comprehensive and systematic review of the existing methods for preventing and detecting SQL injection attacks. The review covers a range of techniques, including input validation, parameterized queries, and intrusion detection systems, as well as the advantages and disadvantages of each method. The most common prevention techniques include input validation, parameterized queries, and stored procedures, while the most common detection techniques include intrusion detection systems (IDS), honeypots, and signature-based detection. The choice of method will depend on the specific requirements of the organization and the level of security required. Still, a combination of prevention and detection methods is likely to be the most effective way to secure web applications against SQL injection attacks. The paper concludes that SQL injection attacks continue to be a significant security threat to web applications, and it is essential for organizations to implement effective prevention and detection methods to secure their web applications against SQL injection attacks.

Enhancing Monte Carlo Workflows for Nuclear Reactor Analysis with Metamodel-Driven Modeling

Monte Carlo codes are essential components of many reactor physics simulation workflows as high-fidelity continuous-energy neutron transport solvers. Among Monte Carlo radiation transport codes, MCNP is particularly notable due to its diverse simulation capabilities, large user base, and long validation history. Despite being a powerful simulation tool, MCNP provides limited capabilities to allow automated execution, model transformation, or support for user-defined logic and abstractions that limit its compatibility with modern workflows. To better integrate MCNP into a modern scientific workflow, we have developed an intuitive yet full-featured MCNP Application Program Interface (API) in Python, named MCNPy, which provides a specialized set of classes for MCNP input development. Moreover, to guarantee that our reading, writing, and modeling capabilities remain self-consistent (and to render the huge scope of the MCNP API manageable), we have adopted a strategy of model-driven software development in which a generalized model of the MCNP input format has been created. From this generalized model, or “metamodel,” problem-specific implementations such as an engine for input validation or a codebase for programmatic operations may be automatically generated. Since MCNPy primarily acts as a Python front-end to the underlying Java API that directly interfaces with the metamodel, it is intrinsically linked to the metamodel and thus remains maintainable. With MCNPy, users can programmatically read, write, and modify any syntactically valid MCNP input file regardless of its origin. These capabilities allow users to automate complicated tasks like design optimization and model translation for nuclear systems. As examples, this work demonstrates the use of MCNPy to find the critical radius of a plutonium sphere and to translate a 9000+ line MCNP input file into a corresponding OpenMC model.

Role of Artificial Intelligence in Human Resource Management in the Middle East Countries

The primary goal of this article is to contribute to the field of technology adoption research by providing researchers, organizations, HR leaders, service providers, and decision-makers with advanced understanding and valid inputs on the development of AI-based HR solutions and the determinants of adoption. The overall objective of this research is to determine the general attitude of HR managers toward the adoption of AI in HRM and to assess the factors that determine the adoption of AI from the perspective of HR managers. The proposed adoption factors were grouped into four constructs, innovation characteristics, trust, technology-organizational-environment (TOE) factors, and emphasized HR roles within the organization. The research was conducted among HR managers in Middle Eastern countries, specifically Jordan, Kuwait, Saudi Arabia, and Qatar. An online questionnaire was used to collect data from a total of 389 respondents. The results showed that respondents were largely positive toward AI applications in HRM. This positive attitude can be inferred from the mean values of two variables, relative advantage and attitude toward the application of AI in HRM. The research results showed that HR managers have a positive attitude and confidence that emerging AI applications can contribute to supporting the efficiency, effectiveness, and quality of HRM. In addition, the results showed a constructive perception of the relative benefits of AI. Researchers, policymakers, and service providers are also recommended to investigate the phenomenon from two perspectives, first, the impact of attitudes on actual adoption decisions and second, the factors that influence this impact.
 Keywords: artificial intelligence, HRM, technology adoption, HR leaders, technologicalorganizational- environmental

Constrained Form-Finding of Tension–Compression Structures using Automatic Differentiation

This paper proposes a computational approach to form-find pin-jointed bar structures subjected to combinations of tension and compression forces. The generated equilibrium states can meet additional structural and geometrical constraints via gradient-based optimization. We achieve this by extending the combinatorial equilibrium modeling (CEM) framework in three important ways. First, we introduce a new topological object, the auxiliary trail, to expand the range of structures that can be form-found with the framework. Then, we leverage automatic differentiation (AD) to obtain an exact value of the gradient of the sequential and iterative calculations of the CEM form-finding algorithm, instead of a numerical approximation. Finally, we encapsulate our research developments into an open-source design tool written in Python that is usable across different CAD platforms and operating systems. After studying four different structures –a self-stressed tensegrity, a tree canopy, a curved bridge, and a spiral staircase– we demonstrate that our approach enables the solution of constrained form-finding problems on a diverse range of structures more efficiently than in previous work. • A computational form-finding method is extended to enhance the form generation of spatial structures in static equilibrium subjected to tension and compression forces. The output forms can satisfy combinations of force and geometric constraints via gradient-based optimization. • A new topological modeling object, the auxiliary trail, is presented which simplifies the representation of a structure as a valid input to the method herein extended. • Automatic differentiation (AD) is leveraged to obtain an exact value of the gradient of a sequential and iterative form-finding algorithm with marginal human intervention. The application of AD leads to significant computational performance gains, especially when solving large constrained form-finding problems. • A standalone, open-source design tool is developed which enables the formulation and the solution of constrained form-finding problems in plain and simple Python code. The design tool is readily usable on three different operating systems and on three distinct 3D modeling software environments.

Evaluation of Generic PAH Profiles Commonly Used in Receptor Models: Implications for Source Control Policy

The use of receptor models, such as EPA’s Chemical Mass Balance, to develop source control policies requires careful consideration of the validity of model inputs. Given the challenges of determining appropriate site-specific polycyclic aromatic hydrocarbons (PAH) source profiles, researchers investigating sources of PAHs in sediments often take profiles from the literature. Some published profiles, such as those first proposed in Li et al. (2003), have been used so often they have effectively become default inputs. In this paper, we investigate the origins of Li’s profiles, and use statistical methods to evaluate how accurately they represent the sources claimed. The results indicate that due to high intrasource variability and intersource similarities, Li’s profiles fail to meet assumptions underlying receptor models and should not be used as generic PAH source inputs. Implications of the misapplication of receptor models used to promote source control policies are discussed. The results call into question a series of papers that claim that refined tar pavement sealers are a significant source of PAHs in urban sediments.

An Enhanced Static Taint Analysis Approach to Detect Input Validation Vulnerability

The detection of feasible paths helps to minimize the false positive rate. However, the previous works did not consider the feasibility of the program paths during the analysis detection of input validation vulnerabilities, which led to false positive results. They also needed to validate the usage of the proper sanitization functions for each context of the user input. Therefore, we proposed an enhanced static taint analysis approach to analyse the source code and track the tainted inputs in the program. It started by examining the source code to find the feasibility of each path in the program. The tainted variables were tracked through the analysis until the sink statement, which executes the tainted variables. An algorithm was built to enhance the static analyzer to handle the variables handling functions in PHP. The proposed approach was evaluated with SARD datasets and large-scale PHP programs. The results indicated that the precision in detecting XSS vulnerability was approximately 44% better than WAP and 26% better than RIPS, and its precision in detecting SQL injection was about 10% better than WAP and 19% better than RIPS. Furthermore, the proposed approach outperformed previous symbolic execution studies regarding the number of detected vulnerabilities.

Investigating the Input Validation Vulnerabilities in C Programs

Input validation is a fairly universal programming practice that helps reduce the chances of producing protection-related vulnerabilities in software. In this paper, an experiment is conducted to specifically determine the input validation issues found in programs and the problematic functions that lead to such issues. The experiment evaluated 12 arbitrarily selected open source C projects written by different programmers. The top two most common input validation problems are buffer overflow/XSS and potential memory mismanagement. In addition, the functions that caused the first problem are (a) strings/text functions (e.g., strcpy and strcmp), and (b) functions that read from standard input, STDIN (e.g., scanf and gets). In contrast, the functions that caused the second problem are (a) memory allocation/deallocation functions (e.g., memmove and malloc), and (b) file manipulation functions (e.g., fopen and fseek). Furthermore, the goto construct—to a small extent—plays a role. The recommendations are that (a) developers are encouraged to use memory-safe programming languages, otherwise, they should perform different types of checks for the validity of inputs as soon as they are entered, and (b) they should have the required knowledge of secure source code and use tools/suites to manage malformed strings.

Simulation and Prediction of Groundwater Dynamics in Nagarjuna Sagar Right Canal (NSRC) Command for Normal and Extreme Groundwater Recharge Conditions

Groundwater Modeling is the best tool to optimize the different combinations and to select the best combination for sustainable groundwater management. Using computer models, best solution or scenario can optimize by creating model with real conditions. In this study, computer model Visual MODFLOW was applied to Nagarjuna Sagar Right Canal Command area to simulate the groundwater dynamics. The net area irrigated under Nagarjuna Sagar Right Canal is 4.75 lakh ha. The aquifer properties of various layers and boundary conditions were fed in to the model as input for calibration and validation of the model. After calibration and validation, the model was used to predict the groundwater dynamics in the study area using different recharge scenarios. The validated groundwater model was used to predict the groundwater levels in the study area for the years 2020, 2030 and 2040 with different recharge scenarios. Global climate model was used to generate future weather data. MarkSim developed by the International Centre for Tropical Agriculture (CIAT) was used to generate the weather parameters like maximum and minimum temperatures for the years 2020, 2030 and 2040. The different recharge scenarios with average, lowest and highest recharge over the study period and projected evapotranspiration have been used and revealed that the groundwater levels increase with the increase in recharge and decreases with the decrease in recharge. The results revealed that the groundwater depleted area would decrease with the highest recharge scenario and it would increase with the lowest recharge scenario in future. The deeper groundwater table would be expected in future at Chimakurthy and Thalluru villages of Prakasam district and Karempudi and Piduguralla villages of Guntur district in the study area. This condition may be due to the excess utilization of groundwater which is less than the groundwater recharge in particular villages. The construction of rainwater harvesting structures for artificial groundwater recharge in those areas should be carried out immediately.

ARTE: Automated Generation of Realistic Test Inputs for Web APIs

Automated test case generation for web APIs is a thriving research topic, where test cases are frequently derived from the API specification. However, this process is only partially automated since testers are usually obliged to manually set meaningful valid test inputs for each input parameter. In this article, we present ARTE, an approach for the automated extraction of realistic test data for web APIs from knowledge bases like DBpedia. Specifically, ARTE leverages the specification of the API parameters to automatically search for realistic test inputs using natural language processing, search-based, and knowledge extraction techniques. ARTE has been integrated into RESTest, an open-source testing framework for RESTful APIs, fully automating the test case generation process. Evaluation results on 140 operations from 48 real-world web APIs show that ARTE can efficiently generate realistic test inputs for 64.9% of the target parameters, outperforming the state-of-the-art approach SAIGEN (31.8%). More importantly, ARTE supported the generation of over twice as many valid API calls (57.3%) as random generation (20%) and SAIGEN (26%), leading to a higher failure detection capability and uncovering several real-world bugs. These results show the potential of ARTE for enhancing existing web API testing tools, achieving an unprecedented level of automation.