Modern Web Applications Research Articles

Token based Detection and Neural Network based Reconstruction framework against code injection vulnerabilities

Security vulnerabilities are frequently detected and exploited in modern web applications. Intruders obtain unrestricted access to the information stored at the back-end database server of a web application by exploiting security vulnerabilities. Code injection attacks top the list due to lack of effective strategies for detecting and blocking injection attacks. The proposed Token based Detection and Neural Network based Reconstruction (TbD-NNbR) framework is a unique approach to detect and block code injections with negligible processing overheads. This framework makes use of an efficient token mapping and validation technique to match the statically generated legal query tokens against the parsed dynamic query tokens at run time. The proposed approach also has the provision to reconstruct queries from authenticated users. The prototype implementation of TbD-NNbR shows that it does not demand any source code modifications and incurs only a negligible computational overhead without any incidents of false positives or false negatives.

BLeak: automatically debugging memory leaks in web applications

Despite the presence of garbage collection in managed languages like JavaScript, memory leaks remain a serious problem. In the context of web applications, these leaks are especially pervasive and difficult to debug. Web application memory leaks can take many forms, including failing to dispose of unneeded event listeners, repeatedly injecting iframes and CSS files, and failing to call cleanup routines in third-party libraries. Leaks degrade responsiveness by increasing GC frequency and overhead, and can even lead to browser tab crashes by exhausting available memory. Because previous leak detection approaches designed for conventional C, C++ or Java applications are ineffective in the browser environment, tracking down leaks currently requires intensive manual effort by web developers. This paper introduces BLeak (Browser Leak debugger), the first system for automatically debugging memory leaks in web applications. BLeak's algorithms leverage the observation that in modern web applications, users often repeatedly return to the same (approximate) visual state (e.g., the inbox view in Gmail). Sustained growth between round trips is a strong indicator of a memory leak. To use BLeak, a developer writes a short script (17-73 LOC on our benchmarks) to drive a web application in round trips to the same visual state. BLeak then automatically generates a list of leaks found along with their root causes, ranked by return on investment. Guided by BLeak, we identify and fix over 50 memory leaks in popular libraries and apps including Airbnb, AngularJS, Google Analytics, Google Maps SDK, and jQuery. BLeak's median precision is 100%; fixing the leaks it identifies reduces heap growth by an average of 94%, saving from 0.5 MB to 8 MB per round trip. We believe BLeak's approach to be broadly applicable beyond web applications, including to GUI applications on desktop and mobile platforms.

Providing Geo-Elasticity in Geographically Distributed Clouds

Geographically distributed cloud platforms are well suited for serving a geographically diverse user base. However, traditional cloud provisioning mechanisms that make local scaling decisions are not adequate for delivering the best possible performance for modern web applications that observe both temporal and spatial workload fluctuations. We propose GeoScale, a system that provides geo-elasticity by combining model-driven proactive and agile reactive provisioning approaches. GeoScale can dynamically provision server capacity at any location based on workload dynamics. We conduct a detailed evaluation of GeoScale on Amazon’s geo-distributed cloud and show up to 40% improvement in the 95th percentile response time when compared to traditional elasticity techniques.

Workload Aware Incremental Repartitioning of NoSQL for Online Transactional Processing Applications

<p><span lang="EN-US">Numerous applications are deployed on the web with the increasing popularity of internet. The applications include, 1) Banking applications,<br /> 2) Gaming applications, 3) E-commerce web applications. Different applications reply on OLTP (Online Transaction Processing) systems. OLTP systems need to be scalable and require fast response. Today modern web applications generate huge amount of the data which one particular machine and Relational databases cannot handle. The E-Commerce applications are facing the challenge of improving the scalability of the system. Data partitioning technique is used to improve the scalability of the system. The data is distributed among the different machines which results in increasing number of transactions. The work-load aware incremental repartitioning approach is used to balance the load among the partitions and to reduce the number of transactions that are distributed in nature. Hyper Graph Representation technique is used to represent the entire transactional workload in graph form. In this technique, frequently used items are collected and Grouped by using Fuzzy C-means Clustering Algorithm. Tuple Classification and Migration Algorithm is used for mapping clusters to partitions and after that tuples are migrated efficiently.</span></p>

If-transpiler: Inlining of hybrid flow-sensitive security monitor for JavaScript

A key characteristic of modern web applications is their heavy reliance on client-side JavaScript libraries. They use the libraries to achieve interactivity, reactivity, and service composition. Instead of writing their own, modern web applications developers, typically, use several third-party JavaScript libraries to achieve such level of engagement. This poses a security risk of leaking private information to illegal channels. Tracking information flow is one known technique to address such concern. This paper presents a framework that inlines a hybrid flow-sensitive security monitor for JavaScript. To our knowledge, our framework is the first in the literature to propose a hybrid flow-sensitive approach that targets JavaScript. Our approach operates as a source-to-source compiler (a transpiler), in which, the input is JavaScript source and the output is an instrumented version with the flow-sensitive security monitor inlined. Hence the output of our approach is portable JavaScript code that is not tied to a particular JavaScript engine. We start by presenting the hybrid flow-sensitive security monitor and its noninterference security property. Then we present the formalization of our inlining transpiler with respect to the hybrid monitor. We prove that the inlined version of the security monitor is observationally equivalent to the original version. Finally, we present and discuss the implementation of the inlining transpiler and assess empirically its security effectiveness and its efficiency with respect to un-instrumented code and to other implementations in the literature.

Data driven exploratory attacks on black box classifiers in adversarial domains

While modern day web applications aim to create impact at the civilization level, they have become vulnerable to adversarial activity, where the next cyber-attack can take any shape and can originate from anywhere. The increasing scale and sophistication of attacks, has prompted the need for a data driven solution, with machine learning forming the core of many cybersecurity systems. Machine learning was not designed with security in mind, and the essential assumption of stationarity, requiring that the training and testing data follow similar distributions, is violated in an adversarial domain. In this paper, an adversary's view point of a classification based system, is presented. Based on a formal adversarial model, the Seed-Explore-Exploit framework is presented, for simulating the generation of data driven and reverse engineering attacks on classifiers. Experimental evaluation, on 10 real world datasets and using the Google Cloud Prediction Platform, demonstrates the innate vulnerability of classifiers and the ease with which evasion can be carried out, without any explicit information about the classifier type, the training data or the application domain. The proposed framework, algorithms and empirical evaluation, serve as a white hat analysis of the vulnerabilities, and aim to foster the development of secure machine learning frameworks.

Datamonkey 2.0: A Modern Web Application for Characterizing Selective and Other Evolutionary Processes.

Inference of how evolutionary forces have shaped extant genetic diversity is a cornerstone of modern comparative sequence analysis. Advances in sequence generation and increased statistical sophistication of relevant methods now allow researchers to extract ever more evolutionary signal from the data, albeit at an increased computational cost. Here, we announce the release of Datamonkey 2.0, a completely re-engineered version of the Datamonkey web-server for analyzing evolutionary signatures in sequence data. For this endeavor, we leveraged recent developments in open-source libraries that facilitate interactive, robust, and scalable web application development. Datamonkey 2.0 provides a carefully curated collection of methods for interrogating coding-sequence alignments for imprints of natural selection, packaged as a responsive (i.e. can be viewed on tablet and mobile devices), fully interactive, and API-enabled web application. To complement Datamonkey 2.0, we additionally release HyPhy Vision, an accompanying JavaScript application for visualizing analysis results. HyPhy Vision can also be used separately from Datamonkey 2.0 to visualize locally executed HyPhy analyses. Together, Datamonkey 2.0 and HyPhy Vision showcase how scientific software development can benefit from general-purpose open-source frameworks. Datamonkey 2.0 is freely and publicly available at http://www.datamonkey.org, and the underlying codebase is available from https://github.com/veg/datamonkey-js.

Comparison of front-end frameworks for web applications development

Modern web applications, due to the functionalities they provide in their user interfaces, have a complex program structure. Manually writing a program code, due to the complexity of the entire application, can result in uneven quality and content of individual application parts. Maintaining such developed applications is more difficult. Because of this, web applications are often developed by using different frameworks. A framework allows structuring, simpler and more uniform program script writing, and thus easier web application maintenance. There are various frameworks that can be used in the development of web applications, for different parts of the application. Those analyzed in this paper are used in the development of front end parts of web applications. According to their design, a web application can be developed as the Multi Page (MPA) or the Single Page (SPA). This paper explains the difference between MPA and SPA web applications. The advantages and disadvantages of MPA are demonstrated in relation to SPA web applications. Required characteristics that the framework should have in order to be optimized for creating MPA and SPA web applications are set. The hypothesis has been tested: There is a framework that is optimized for the development of both MPA and SPA applications. Possibilities, architecture and development techniques of a web application using front end frameworks, as well as the suitability of such frameworks for the development of MPA and SPA web applications have been analysed. Choosing a framework for the hypothesis testing has been performed based on the popularity of available frameworks. The required characteristics have been analyzed on the three most popular frameworks: Angular, Vue.js and React-js. It has been shown that the Vue.js framework is the most optimized framework for the development of both MPA and SPA applications.

Client side web programming more or less

Users expect modern web applications to be interactive, dynamic, and process requests instantaneously just like desktop applications. Demands like this have lead to a rise in client side web progra...

Open chemistry: RESTful web APIs, JSON, NWChem and the modern web application

An end-to-end platform for chemical science research has been developed that integrates data from computational and experimental approaches through a modern web-based interface. The platform offers an interactive visualization and analytics environment that functions well on mobile, laptop and desktop devices. It offers pragmatic solutions to ensure that large and complex data sets are more accessible. Existing desktop applications/frameworks were extended to integrate with high-performance computing resources, and offer command-line tools to automate interaction—connecting distributed teams to this software platform on their own terms. The platform was developed openly, and all source code hosted on the GitHub platform with automated deployment possible using Ansible coupled with standard Ubuntu-based machine images deployed to cloud machines. The platform is designed to enable teams to reap the benefits of the connected web—going beyond what conventional search and analytics platforms offer in this area. It also has the goal of offering federated instances, that can be customized to the sites/research performed. Data gets stored using JSON, extending upon previous approaches using XML, building structures that support computational chemistry calculations. These structures were developed to make it easy to process data across different languages, and send data to a JavaScript-based web client.

X509-free access to WLCG resources

Access to WLCG resources is authenticated using an x509 and PKI infrastructure. Even though HEP users have always been exposed to certificates directly, the development of modern Web Applications by the LHC experiments calls for simplified authentication processes keeping the underlying software unmodified.In this work we will show a solution with the goal of providing access to WLCG resources using the user’s home organisations credentials, without the need for user-acquired x509 certificates. In particular, we focus on identity providers within eduGAIN, which interconnects research and education organisations worldwide, and enables the trustworthy exchange of identity-related information. eduGAIN has been integrated at CERN in the SSO infrastructure so that users can authenticate without the need of a CERN account.This solution achieves x509-free access to Grid resources with the help of two services: STS and an online CA. The STS (Security Token Service) allows credential translation from the SAML2 format used by Identity Federations to the VOMS-enabled x509 used by most of the Grid. The IOTA CA (Identifier-Only Trust Assurance Certification Authority) is responsible for the automatic issuing of short-lived x509 certificates. The IOTA CA deployed at CERN has been accepted by EUGridPMA as the CERN LCG IOTA CA, included in the IGTF trust anchor distribution and installed by the sites in WLCG. We will also describe the first pilot projects which are integrating the solution.

Extensibility Interaction Flow Modeling Language Metamodels to Develop New Web Application Concerns

Web engineering is a systematic approach to develop web applications, and numerous web engineering methods have been proposed. These methods were extended through defining new models by using different mechanisms to capture the web application concepts. Due to the complexity rising of web applications, the web engineering methods cannot provide web solutions anymore. Even though Interaction Flow Modeling Language (IFML) is recently proposed as a new method for developing web applications, it has limitations. Therefore these methods need to be improved. In this paper, we present the ability of IFML extensibility to support new concerns from web applications. Moreover, we extend IFML through UML mechanisms to support new concerns from the context to the user interface. The new IFML solves the lack of context web application through defining a new model and becomes a new direction to develop concerns modern web applications.

Detection, Avoidance, and Attack Pattern Mechanisms in Modern Web Application Vulnerabilities

In this paper, we present comprehensive survey of secured web application by identifying numerous serious threats faced by several-related organizations. Based on this, we have summarized the statistics of all emerging web application vulnerabilities by referring several-linked vulnerabilities and their classifications like US-CERT, CVE, CWE, NVD, OWASP etc. In addition, we present a comprehensive survey of the emerging web application weaknesses and discuss how to avoid, detect and attack pattern mechanisms of all critical web threats. Moreover, a detailed comparison has also been presented for all emerging web application exposures corresponding to certain threat agents, which indicates the level of the threat for a recognized vulnerability. In addition, we discuss numerous precautions that can be taken while defining lifecycle of web applications with hacking tools and describe ways to launch & utilize safety procedures and regular security controls in a recursive manner.

Using of Node.js in creating application based on event-driven architecture

This paper discusses a new programming method - event driven programming. This method is compared with other popular ways of implementing web services to find its weak points and discover in which areas of modern web applications it could be implemented.

Decreasing the Management Burden in Multi-tier Systems Through Partial Correlation-Based Monitoring

Modern web applications often consist of hundreds of services distributed in different servers or tiers. On one hand, this architecture may provide easy abstraction and modularity for software deve...

Modern and Responsive Mobile-enabled Web Applications

Rapid web technology improvements in the last few years have powered software developers to quickly write responsive mobile-friendly applications. The innovative web frameworks and libraries make it easy to have same software code base for desktop and mobile devices. Single-page applications offer a more-native-app-like experience to the user. This also means a web application can easily be converted to a native mobile application if desired. This allows software products to be evolved continuously at a much faster pace with features added on daily basis. The software companies who can adopt these technologies will most likely see the benefit in the long run as they can offer new and modified products faster than their competitors.In this paper, we review some of the state-of-the-art web technologies, third-party libraries, and frameworks for quick interactive web development. Finally, we present a simple interactive browser-based, mobile friendly web application which was developed using one of the latest web development framework.

Securing web applications from SQLIA using progressive detector

Web applications are distributed applications that are stored on a server and delivered to users over the internet. Many people enjoy its utilisation due its benefits such as global access, cost saving, faster delivery of products and opportunities to manage the business from anywhere in the world. The users of web applications expect that the web applications should be secure and reliable, while doing their online transactions. But, modern web applications face threats like cross-site scripting, cookie poisoning, buffer overflow etc. Among the attacks of web applications, SQLIA is one of the most significant of such threats. SQL injection attack is a type of injection attack (SQLIA), in which SQL commands are injected as data-plane input in order to affect the execution of predefined SQL commands. SQL injection is a code injection technique that exploits the security vulnerability occurring in the database layer of an application. It allows attackers to get unauthorised access to the back-end database consisting of confidential user information. The paper presents a novel approach and it prevents all types of SQLIAs with minimum time frame. The proposed system aims at preventing all types of SQLIA by quick identification of malicious query at run time. This novel approach has been framed with the progressive detector (PD) tool and carried out on real time web applications. The experimental results clearly show that the Progressive Detector prevents all kinds of SQLIAs with minimum time frames.

Cyber Crime

Cyber Crime

APOGEN: automatic page object generator for web testing

Modern web applications are characterized by ultra-rapid development cycles, and web testers tend to pay scant attention to the quality of their automated end-to-end test suites. Indeed, these quickly become hard to maintain, as the application under test evolves. As a result, end-to-end automated test suites are abandoned, despite their great potential for catching regressions. The use of the Page Object pattern has proven to be very effective in end-to-end web testing. Page objects are facade classes abstracting the internals of web pages into high-level business functions that can be invoked by the test cases. By decoupling test code from web page details, web test cases are more readable and maintainable. However, the manual development of such page objects requires substantial coding effort, which is paid off only later, during software evolution. In this paper, we describe a novel approach for the automatic generation of page objects for web applications. Our approach is implemented in the tool Apogen, which automatically derives a testing model by reverse engineering the target web application. It combines clustering and static analysis to identify meaningful page abstractions that are automatically turned into Java page objects for Selenium WebDriver. Our evaluation on an open-source web application shows that our approach is highly promising: Automatically generated page object methods cover most of the application functionalities and result in readable and meaningful code, which can be very useful to support the creation of more maintainable web test suites.

Understanding JavaScript Event-Based Interactions with Clematis

Web applications have become one of the fastest-growing types of software systems today. Despite their popularity, understanding the behavior of modern web applications is still a challenging endeavor for developers during development and maintenance tasks. The challenges mainly stem from the dynamic, event-driven, and asynchronous nature of the JavaScript language. We propose a generic technique for capturing low-level event-based interactions in a web application and mapping those to a higher-level behavioral model. This model is then transformed into an interactive visualization, representing episodes of triggered causal and temporal events, related JavaScript code executions, and their impact on the dynamic DOM state. Our approach, implemented in a tool called C lematis , allows developers to easily understand the complex dynamic behavior of their application at three different semantic levels of granularity. Furthermore, C lematis helps developers bridge the gap between test cases and program code by localizing the fault related to a test assertion. The results of our industrial controlled experiment show that C lematis is capable of improving the comprehension task accuracy by 157% while reducing the task completion time by 47%. A follow-up experiment reveals that C lematis improves the fault localization accuracy of developers by a factor of two.