Modern Web Services Research Articles

DynER: Optimized Test Case Generation for Representational State Transfer (REST)ful Application Programming Interface (API) Fuzzers Guided by Dynamic Error Responses

Modern web services widely provide RESTful APIs for clients to access their functionality programmatically. Fuzzing is an emerging technique for ensuring the reliability of RESTful APIs. However, the existing RESTful API fuzzers repeatedly generate invalid requests due to unawareness of errors in the invalid tested requests and lack of effective strategy to generate legal value for the incorrect parameters. Such limitations severely hinder the fuzzing performance. In this paper, we propose DynER, a new test case generation method guided by dynamic error responses during fuzzing. DynER designs two strategies of parameter value generation for purposefully revising the incorrect parameters of invalid tested requests to generate new test requests. The strategies are, respectively, based on prompting Large Language Model (LLM) to understand the semantics information in error responses and actively accessing API-related resources. We apply DynER to the state-of-the-art fuzzer RESTler and implement DynER-RESTler. DynER-RESTler outperforms foREST on two real-world RESTful services, WordPress and GitLab with a 41.21% and 26.33% higher average pass rate for test requests and a 12.50% and 22.80% higher average number of unique request types successfully tested, respectively. The experimental results demonstrate that DynER significantly improves the effectiveness of test cases and fuzzing performance. Additionally, DynER-RESTler finds three new bugs.

Python's Role in Accelerating Web Application Development with Django

Efficient, secure, and scalable web services are critical in today's digital environment. This study explores the field of web service development and addresses issues such system efficiency, project duration, and changing requirements. The goal of this study is to ensure reliable and efficient web services by streamlining the development process and utilizing the Django framework. The study highlights the application of Django's Model-Template-View (MTV) design pattern, which is customized for a listing management system. Smooth data interaction and effective system performance are ensured by the study's seamless integration of Django's capabilities with MySQL for database management. To further improve system performance, focus is given to standardizing data sharing protocols and expediting user authentication procedures. The automation of web page construction with Python, HTML, and CSS modules, which increases system efficacy, is a crucial component of the research. Furthermore, the study shows how crucial security measures are, such as encryption for data confidentiality and integrity, which are made possible by the REST API interaction with the front end and the Django REST framework. Along with discussing key attacks and weaknesses that are frequent in web technology, the article also offers strategies to reduce these risks. Through the use of suitable SDLC models and testing procedures, it recognizes the crucial role that software engineering processes play in the development process. Focusing attention to Django's feature set, scalability, and wide library support, the study proves its advantages over competing web frameworks. The goal of the research is to provide developers and students with the skills they need to fully utilize Django's capabilities, making it easier to create dependable, successful and safe online applications. This study advances knowledge in the field of web technology and service development by lighting the development, difficulties, and current solutions in these fields. The study's ultimate goal is to open the door for comprehensive, modern, and efficient web service creation in order to satisfy the growing need for effective web solutions in the current digital era.

FL-Online: An x-ray crystallographic web-server for atomic-scale structure analysis of biomolecule

Abstract FL-Online (http://fanlab.ac.cn) is an out-of-box modern web service featuring a user-friendly interface and simplified parameters, providing academic users with access to a series of online programs for biomolecular crystallography, including SAPI-online, OASIS-online, C-IPCAS-online and a series of upcoming software releases. Meanwhile, it is a highly scalable and maintainable web application framework that provides a powerful and flexible solution for academic web development needs. All the codes are open-source under MIT licenses in GitHub.

Doświadczenie kształcenia na odległość studentów psychologii komunikacji interpersonalnej

The article concerns the results of theoretical and empirical research of designing and realization of modern Web-services in the educational process of high school as well as implementation and application of Google Classroom service in the educational process of a university. The scientific and methodological bases of the research are substantiated. The features of Web-services were revealed and the economic, technical, functional, functional-educational, personal, and educational advantages of using Google Classroom in institutions of higher education were determined. The methodical steps of using Google Classroom in the process of teaching and studying the discipline “Psychology of Interpersonal Communication” by students of the specialty 053 Psychology were characterized. The results of Google Classroom service implementation in the process of studying by students the discipline are proven, empirically and statistically validated. The effect is an increase in the level of students’ effective interpersonal communication qualities that demonstrate the benefits of using this service for psychology students, especially during pandemic times. The issues of designing and implementing the Google Classroom service in the process of studying other psychological disciplines by students of humanities at all educational levels, as well as examining the advantages and disadvantages of using this service, are treated by the authors as promising for further research.

REST APIs Cloud Service Security Checks

Abstract: REST APIs are used by the majority of modern cloud and web services. This paper explains how an attacker can take advantage of REST API flaws to gain access to a service. We introduce four new security rules that take advantage of REST API’s and then demonstrate how a stateful REST API fuzzer can be extended with active property checkers that automatically test and identify violations of these rules. Then we talk about how to implement such checkers in both ways modularly and efficiently. Using these tools, we discovered new bugs in a number of production Azure and Office365 cloud services and discussed their security implications and resolve all these issues

Hiplot: a comprehensive and easy-to-use web service for boosting publication-ready biomedical data visualization.

Complex biomedical data generated during clinical, omics and mechanism-based experiments have increasingly been exploited through cloud- and visualization-based data mining techniques. However, the scientific community still lacks an easy-to-use web service for the comprehensive visualization of biomedical data, particularly high-quality and publication-ready graphics that allow easy scaling and updatability according to user demands. Therefore, we propose a community-driven modern web service, Hiplot (https://hiplot.org), with concise and top-quality data visualization applications for the life sciences and biomedical fields. This web service permits users to conveniently and interactively complete a few specialized visualization tasks that previously could only be conducted by senior bioinformatics or biostatistics researchers. It covers most of the daily demands of biomedical researchers with its equipped 240+ biomedical data visualization functions, involving basic statistics, multi-omics, regression, clustering, dimensional reduction, meta-analysis, survival analysis, risk modelling, etc. Moreover, to improve the efficiency in use and development of plugins, we introduced some core advantages on the client-/server-side of the website, such as spreadsheet-based data importing, cross-platform command-line controller (Hctl), multi-user plumber workers, JavaScript Object Notation-based plugin system, easy data/parameters, results and errors reproduction and real-time updates mode. Meanwhile, using demo/real data sets and benchmark tests, we explored statistical parameters, cancer genomic landscapes, disease risk factors and the performance of website based on selected native plugins. The statistics of visits and user numbers could further reflect the potential impact of this web service on relevant fields. Thus, researchers devoted to life and data sciences would benefit from this emerging and free web service.

Features of Creation and Use of Electronic Didactic Games in the Process of Training Bachelors in the Specialty «Vocational Education»

The article is devoted to the problem of electronic didactic games creating and using in the process of training bachelors majoring in «Vocational Education» in higher education institutions. The Professional standard «Teacher of vocational training» and the Standard of Higher Education of Ukraine of the first (bachelor's) level, fields of knowledge 01 «Education / Pedagogy», specialty 015 «Vocational Education (by specializations)» are analysed. The aim of the study is to reveal the features of the creation and use of electronic didactic games in the process of training bachelors majoring in «Vocational Education». Methods. The research methods used by the author are the analysis of concepts and scientific sources, government documents, modelling, synthesis and generalization of the obtained data. Results. It was found that the general competencies, job functions and vocational competencies (by work action or group of work actions) of the professional standard were clearly correlated with the general and vocational competencies of the Standard of Higher Education. It is proved that the acquisition of competencies provided by the first (bachelor's) level, field of knowledge 01 «Education / Pedagogy», specialty 015 «Vocational education (by specialization)», which meet the Standard of Higher Education, will enable graduates to perform the relevant job functions of vocational education teacher in vocational education institutions. It is argued that, in connection with the digitalization, gamification and distancing of education, it is important to form the «Vocational Education» seeker’s ability to use modern information technologies and integrate them into the educational environment. It is noted that the special attention in the forming of the vocational education future teachers' ability to use modern information technologies and integrate them into educational environments should be paid to students’ ability to use electronic didactic games in the educational process. It is stated that the ability to create and use electronic didactic games, interactive exercises correspond to the methodological and creative level of the formed ability of vocational education future teachers’ to use modern information technologies and integrate them into the educational environment. The list of the most effective, according to the author’s opinion, modern web services for the electronic didactic games creation is given; the electronic didactic games developed by students in the course of the discipline «Creative learning technologies» are presented. It is noted that the game is a relevant and effective curricular and extracurricular form in the education system. The content of the concepts «didactic game» and «electronic didactic game» is considered. Conclusions. It is proved that the use of electronic didactic games in the educational process can purposefully develop critical thinking and flexibility, the ability to analyse, compare, classify, systematize, structure, generalize etc.

Spatial relationships of road network and cellular coverage based on the Open Geodata: review and user case of Irkutsk Region

Geographic information technologies and data are widely used to identify a variety of spatial relationships. The paper is devoted to the study of the mutual location between the road network (as exemplified by the public roads network) and cellular coverage of the Russian telecom operators on the territory of Russia. Transport researches are characterized with an emphasis of GIS projects. Then, an overview of modern web services, Open Data and Open Source developments in transport projects is made. The data, geodata services and web projects of cellular coverage for the territory of Russia are described by the examples of Russian-language sources. The practical part of the study shows the global transport accessibility raster datasets for the test region of Russia (Irkutsk Region, Siberian Federal District). An analysis of spatial relationships between roads and cellular coverages provided by VimpelCom/ Beeline, Megafon and MTS is based on the Open Data in the Open Source GIS application QGIS. Coverage varies between 63% (VimpelCom for the buffer zone of 2.5 km) and 94% (Megafon for the zone of 10 km), where 100% is the total number of cells (polygons) within the network of a respective operator in the region. We have noted that Open Data on the public road network and cellular communication for the territory of Russia differ by region, the studied communication datasets and data services do not contain significant attributive information, they consist of polygon geometry only. Frequency of their updates depends on the operating companies. The operators then provide the data for the publication to the Russian ministries and regional administrations.

A Large-scale Analysis of Hundreds of In-memory Key-value Cache Clusters at Twitter

Modern web services use in-memory caching extensively to increase throughput and reduce latency. There have been several workload analyses of production systems that have fueled research in improving the effectiveness of in-memory caching systems. However, the coverage is still sparse considering the wide spectrum of industrial cache use cases. In this work, we significantly further the understanding of real-world cache workloads by collecting production traces from 153 in-memory cache clusters at Twitter, sifting through over 80 TB of data, and sometimes interpreting the workloads in the context of the business logic behind them. We perform a comprehensive analysis to characterize cache workloads based on traffic pattern, time-to-live (TTL), popularity distribution, and size distribution. A fine-grained view of different workloads uncover the diversity of use cases: many are far more write-heavy or more skewed than previously shown and some display unique temporal patterns. We also observe that TTL is an important and sometimes defining parameter of cache working sets. Our simulations show that ideal replacement strategy in production caches can be surprising, for example, FIFO works the best for a large number of workloads.

Penalty- and Locality-aware Memory Allocation in Redis Using Enhanced AET

Due to large data volume and low latency requirements of modern web services, the use of an in-memory key-value (KV) cache often becomes an inevitable choice (e.g., Redis and Memcached). The in-memory cache holds hot data, reduces request latency, and alleviates the load on background databases. Inheriting from the traditional hardware cache design, many existing KV cache systems still use recency-based cache replacement algorithms, e.g., least recently used or its approximations. However, the diversity of miss penalty distinguishes a KV cache from a hardware cache. Inadequate consideration of penalty can substantially compromise space utilization and request service time. KV accesses also demonstrate locality, which needs to be coordinated with miss penalty to guide cache management. In this article, we first discuss how to enhance the existing cache model, the Average Eviction Time model, so that it can adapt to modeling a KV cache. After that, we apply the model to Redis and propose pRedis, Penalty- and Locality-aware Memory Allocation in Redis, which synthesizes data locality and miss penalty, in a quantitative manner, to guide memory allocation and replacement in Redis. At the same time, we also explore the diurnal behavior of a KV store and exploit long-term reuse. We replace the original passive eviction mechanism with an automatic dump/load mechanism, to smooth the transition between access peaks and valleys. Our evaluation shows that pRedis effectively reduces the average and tail access latency with minimal time and space overhead. For both real-world and synthetic workloads, our approach delivers an average of 14.0%∼52.3% latency reduction over a state-of-the-art penalty-aware cache management scheme, Hyperbolic Caching (HC), and shows more quantitative predictability of performance. Moreover, we can obtain even lower average latency (1.1%∼5.5%) when dynamically switching policies between pRedis and HC.

Understanding Acceleration Opportunities at Hyperscale

Modern web services run across hundreds of thousands of servers in a data center, i.e., at hyperscale. With the end of Moore’s Law and Dennard scaling, successive server generations running these web services exhibit diminishing performance returns, resulting in architects adopting hardware customization. An important question arises: Which web service software operations are worth building custom hardware for? To answer this question, we comprehensively analyze important Facebook production services and identify key acceleration opportunities. We then develop an open-source analytical model, Accelerometer, to help make well-informed hardware decisions for the acceleration opportunities we identify.

ПРОЄКТУВАННЯ ТА СТВОРЕННЯ ВЕБ-ОРІЄНТОВАНОГО ІНФОРМАЦІЙНОГО СЕРВІСУ З ОБМІНУ ВАЛЮТ

У роботі представлено результати дослідження засад проєктування та створення веб-орієнтованого інформаційного сервісу з обміну валют зі зручним інтерфейсом та відповідною базою різноманітних і якісних фінансових послуг. Проаналізовано складові валютного ринку крізь призму інформаційних засад його ефективного функціонування на світовому ринку фінансових послуг. Визначено коло основних завдань в контексті вирішення проблеми вибору оптимального курсоутворення гривні для стабільного забезпечення економічного розвитку, обґрунтовано вибір засобів програмної реалізації для розробки веб-сервісу. Цей вибір обумовлений можливістю розробникам створювати великі веб-застосунки. В ході дослідження виявлено, що впровадження такого сервісу дасть можливість забезпечити у фінансових та нефінансових установах якісне й ефективне проведення обмінних валютних операцій.

Development of the prototype of a geo-information web system for dynamic visualization of forest fire hazard

The article examines the prototype of an interactive system to display fire hazard in the forest during the fire season, prototype’s main characteristics and development methods of web GIS technologies. The proposed approach tracks changes in a special web map showing the state of fire danger in the forest based on the daily calculation of the fire hazard class under the current weather conditions. The analysis of data on forest types and frequency of fires proves that the calculations should include an increase in the natural fire hazard class concerning grass allotments in spring and autumn, as compared with summer. Changes in the weather conditions over time cause the map of a given area at a given point and time to change in accordance with the fire threats for these allotments. The developed interface for displaying the fire hazard data allows one to select the area under study and time range, as well as configure the data presentation template. The technological means used were the methods of Internet systems and geoportals producing geographic information, modern web technologies, libraries and services, including tools for dynamic representation of data of screen forms in web templates.

CanRisk Tool-A Web Interface for the Prediction of Breast and Ovarian Cancer Risk and the Likelihood of Carrying Genetic Pathogenic Variants.

The CanRisk Tool (https://canrisk.org) is the next-generation web interface for the latest version of the BOADICEA (Breast and Ovarian Analysis of Disease Incidence and Carrier Estimation Algorithm) state-of-the-art risk model and a forthcoming ovarian cancer risk model. The tool captures information on family history, rare pathogenic variants in cancer susceptibility genes, polygenic risk scores, lifestyle/hormonal/clinical features, and imaging risk factors to predict breast and ovarian cancer risks and estimate the probabilities of carrying pathogenic variants in certain genes. It was implemented using modern web frameworks, technologies, and web services to make it extensible and increase accessibility to researchers and third-party applications. The design of the graphical user interface was informed by feedback from health care professionals and a formal evaluation. This freely accessible tool was designed to be user friendly for clinicians and to boost acceptability in clinical settings. The tool incorporates a novel graphical pedigree builder to facilitate collection of the family history data required by risk calculations. The CanRisk Tool provides health care professionals and researchers with a user-friendly interface to carry out multifactorial breast and ovarian cancer risk predictions. It is the first freely accessible cancer risk prediction program to carry the CE marking. There have been over 3,100 account registrations, and 98,000 breast and ovarian cancer risk calculations have been run within the first 9 months of the CanRisk Tool launch.

Proactive planning of bandwidth resource using simulation-based what-if predictions for Web services in the cloud

Resource planning is becoming an increasingly important and timely problem for cloud users. As more Web services are moved to the cloud, minimizing network usage is often a key driver of cost control. Most existing approaches focus on resources such as CPU, memory, and disk I/O. In particular, CPU receives the most attention from researchers, but the bandwidth is somehow neglected. It is challenging to predict the network throughput of modern Web services, due to the factors of diverse and complex response, evolving Web services, and complex network transportation. In this paper, we propose a methodology of what-if analysis, named Log2Sim, to plan the bandwidth resource of Web services. Log2Sim uses a lightweight workload model to describe user behavior, an automated mining approach to obtain characteristics of workloads and responses from massive Web logs, and traffic-aware simulations to predict the impact on the bandwidth consumption and the response time in changing contexts. We use a real-life Web system and a classic benchmark to evaluate Log2Sim in multiple scenarios. The evaluation result shows that Log2Sim has good performance in the prediction of bandwidth consumption. The average relative error is 2% for the benchmark and 8% for the real-life system. As for the response time, Log2Sim cannot produce accurate predictions for every single service request, but the simulation results always show similar trends on average response time with the increase of workloads in different changing contexts. It can provide sufficient information for the system administrator in proactive bandwidth planning.

Elastic Provisioning of Cloud Caches: A Cost-Aware TTL Approach

We consider elastic resource provisioning in the cloud, focusing on in-memory key-value stores used as caches. Our goal is to dynamically scale resources to the traffic pattern minimizing the overall cost, which includes not only the storage cost, but also the cost due to misses. In fact, a small variation of the cache miss ratio may have a significant impact on user perceived performance in modern web services, which in turn has an impact on the overall revenues for the content provider using such services. We propose and study a dynamic algorithm for TTL caches, which is able to obtain close-to-minimal costs. Since high-throughput caches require low complexity operations, we discuss a practical implementation of such a scheme requiring constant overhead per request independently from the cache size. We evaluate our solution with real-world traces collected from Akamai, and show that the TTL approach is able to track the optimal cache configuration and achieve significant cost savings specially in highly dynamic settings that are likely to require elastic cloud services.

Web service classification based on non-functional parameters using vote based classifier

Today the internet has become a very vital part of everyone’s life. Nowadays, Companies are offering their business in the form of web services to reach their customers. Web services help in business by providing a standard way to communicate with their customers. But the rapid introduction of modern web services in this dynamic business environment influences the service quality and customer satisfaction. So, there is a requirement to focus on the functional as well as the non-functional aspect of web services. In this paper, for accurately classifying the web services vote based classifier has been used. For classification J48, Naive Bayes, SVM and Random Forest are used as a base learner. The proposed vote based classifier model provides accurate classification and prediction by improving the recall and precision value as compared to individual classifiers. The experiment is conducted on a real dataset of web services to find out the accurate result. The results show that the vote based classifier performs better in comparison to others. Experimental outcomes show that the proposed approach determines the most promising results.

ВОЗМОЖНОСТИ ИСПОЛЬЗОВАНИЯ WEB-ТЕХНОЛОГИЙ ДЛЯ ВИЗУАЛИЗАЦИИ ДАННЫХ, ПОЛУЧАЕМЫХ С ПОМОЩЬЮ АКТИВНЫХ МЕТОДОВ ДИСТАНЦИОННОГО ЗОНДИРОВАНИЯ

An increasing number of types of spatial data is possible to display and operate using only technical means of web services and a standard browser, without the need to install GIS or CAD systems. One of these types of data is data obtained with using active methods of remote sensing (as a rule, they are point clouds), full-fledged work with which 3–4 years ago was possible only on high-performance computers and specialized software. The existing web technologies allow not only displaying point clouds, but also interactively interacting with them - to perform measurements, customize display styles, combine with spatial data of other types. The purpose of the article is to form criteria and analyze the performance of software tools for creating web services for visualizing data obtained with using active methods of remote sensing. For practical testing of the selected software and analysis according to the formulated system of criteria groups, several files containing point clouds from open sources were used. The research was carried out with using the software libraries Three.js, Deck.gl, Plas.io, Potree, CesiumJS and Blend4Web. Based on the testing results, summary tables of performance and functionality were formed. The obtained results demonstrate that in terms of performance, visualization tools, basic functions for designing and analyzing point clouds, modern web services are not inferior to specialized desktop software.

Modeling of polygraphic web-service using colored Petri nets

The use of Petri Networks as a tool for graphical and mathematical modeling of complex systems and processes has recently been widespread. Visual representation techniques and simulations, such as Petri colored networks, are effective at the development stage of complex systems, since they allow formally to describe and model the system at different levels of abstraction and investigate them dynamically. An example of a dynamic system is web-services. Web services and their components can interact with different applications that meet the standards of web services. As a rule, one service does not meet the needs of users, and services are becoming more and more complex. In fact, a modern web service is created by combining different web services and their components to create a component service that offers a set of new functional services. When combining and sharing Web services the most critical is the interaction of Web services and their components among themselves, which requires a detailed study of the functioning of the processes and modeling their behavior to improve their efficiency.Polygraphic web-service is a complex program system that organizes the provision of printing services. It works with the client through the Internet and provides an opportunity to find the necessary service at the printing centers for the best possible means, to make an order, to use various services, to pay for services, to choose a means of payment and delivery of printed products. The complex structure of the web-service requires the study and modeling of the interaction of its components to ensure the effectiveness of the operation.To model the composite web service system, it is necessary to identify the main and auxiliary subsystems by means of structural analysis. The block diagram of a web-service is presented in fig. 1. As a structural analysis tool, we used a data flow diagram (DFD) in the notation of a similar Heine-Sarson notation. A top-level contextual chart contains a set of subsystems connected by data streams.A model of a polygraphic web-service in the form of Petri's network in a hierarchical form was developed and presented for the purpose of analysis of separate networks of the second level. This enables to analyze all parts of the network separately and use the results to formulate conclusions about the correctness of the construction of the entire network. In the presence of links between networks of the second level, it is necessary to add additional criteria for the analysis of networks, which are connected with the addition of the main network of cities and transitions between networks of the second level, the number of which depends on the number of possible states of interaction between networks of the second level.

A study on user authentication method using speaker authentication mechanism in login process

인터넷과 스마트폰 활용이 대중화되면서 사용자들은 다양한 방법과 미디어를 통해 언제 어디서나 정보시스템에 접근하여 필요한 서비스를 이용하는 다채널 환경에서 살고 있다. 이러한 서비스를 받는 과정에서 사용자는 본인임을 인증하는 사용자 인증 단계를 필수적으로 수행해야 하는데 대표적인 방식이 아이디 패스워드 인증 방식이다. 아이디 패스워드 기반의 사용자 인증 방식은 본인의 인증정보를 기억 후 키보드를 통한 입력만으로 인증이 가능하므로 타 인증 방식들과 비교했을 시 가장 편리하다는 평가를 받는다. 반면 현대 웹 서비스에선 요구하는 패스워드의 문자열 조합방식이 다르고 복잡성이 높은 엔트로피 값의 패스워드 설정만을 허용하고 있다. 이러한 복잡한 문자열로 구성된 패스워드는 사용자가 이용하고자 하는 서비스가 많을수록 개인정보 유출방지를 위해 주기적으로 패스워드 변경을 권고하기 때문에 이를 기억해야 할 사용자 인증정보의 개수도 비례하여 증가한다. 이러한 높은 엔트로피 값을 가지는 사용자의 인증정보를 시각 장애인이나 손사용이 불편한 사람 혹은 고령층이 일일이 기억하고 키보드 입력을 통해 사용하기엔 어려움이 따른다. 따라서 본 논문에서는 위와 같은 취약계층 및 일반 사용자에게 로그인 과정에서의 간편한 사용자 인증 방식 제공을 위해 구글 어시스턴트와 MFCC 및 DTW 알고리즘 그리고 화자 인증을 사용한 사용자 인증 방식을 제안한다.With the popularization of the Internet and smartphone uses, people in the modern era are living in a multi-channel environment in which they access the information system freely through various methods and media. In the process of utilizing such services, users must authenticate themselves, the typical of which is ID & password authentication. It is considered the most convenient method as it can be authenticated only through the keyboard after remembering its own credentials. On the other hand, modern web services only allow passwords to be set with high complexity by different combinations. Passwords consisting of these complex strings also increase proportionally, since the more services users want to use, the more user authentication information they need to remember is recommended periodically to prevent personal information leakage. It is difficult for the blind, the disabled, or the elderly to remember the authentication information of users with such high entropy values and to use it through keyboard input. Therefore, this paper proposes a user authentication method using Google Assistant, MFCC and DTW algorithms and speaker authentication to provide the handicapped users with an easy user authentication method in the login process.