Multi-tier Web Applications Research Articles

Design and Implement of Teaching Resources Management Network Platform Based on MVC

Now the popular Struts+Spring+Hibernate framework provides a weak coupling, easily containable, lightweight J2EE software development model which helps to build high-quality Web applications. Through researching of SSH framework and ExtJS framework based on AJAX technology, an integration framework is designed, which is based on ExtJS+SSH ,and can be used to build a flexible, easily extended and maintainable multi-tier Web application platforms. In this paper, a teaching resource management network platform is introduced, which is based on the integration framework. Experimental results show that business operations, the database, and display will be divided completely by using this integration framework based on ExtJS and SSH, in order to achieve a system of weak coupling and high level of maintenance.

WebGuard: Enhancing Intrusion Detection in Multi-tier Web Applications

today's world web applications and internet services have become an integral part of daily life, enabling communication and the management of personal information from anywhere. In order to accommodate humungous increase in demand and data complexity, web applications are moved to multitier design. With the increase in popularity of web applications, these applications also become target of various attacks. To protect multitier web applications several intrusion detection systems (IDS) have been proposed. This paper focuses on development of WebGuard - designed to deploy the IDS at the front end web server as well as the back end data base server. WebGuard generates the containers for isolating user sessions using virtualization technique. This strategy mainly focuses on detecting SQL Injection, Privilege Escalation, Session Hijacking, Direct DB and Cross Site Scripting (XSS) Attacks in multi-tier web applications by using a pattern mapping algorithm. This paper also proposes a preventive system to secure web applications from XSS attacks.

Binary Protector: Intrusion Detection in Multitier Web Applications

The services of internet place a key role in the daily life by enabling the in sequence from anywhere. To provide somewhere to stay the communication and management in applications the web services has stimulated to multitier design. In this multitier the web servers contain front end logic and data with database servers. In this paper, we present binary protector intrusion detection systems which designs the network behavior of user sessions across both the front-end web server and the back-end database. By examining both web and subsequent database requests, we are able to rummage out attacks that independent IDS would not be able to distinguish.

Performance-controlled server consolidation for virtualized data centers with multi-tier applications

Modern data centers must provide performance assurance for complex system software such as multi-tier web applications. In addition, the power consumption of data centers needs to be minimized to reduce operating costs and avoid system overheating. Various power-efficient performance management strategies have been proposed based on dynamic voltage and frequency scaling (DVFS). Virtualization technologies have also made it possible to consolidate multiple virtual machines (VMs) onto a smaller number of active physical servers for even greater power savings, but at the cost of a higher overhead. This paper proposes a performance-controlled power optimization solution for virtualized server clusters with multi-tier applications. While most existing work relies on either DVFS or server consolidation in a separate manner, our solution utilizes both strategies for maximized power savings by integrating feedback control with optimization strategies. At the application level, a novel multi-input–multi-output controller is designed to achieve the desired performance for applications spanning multiple VMs, on a short time scale, by reallocating the CPU resources and conducting DVFS. At the cluster level, a power optimizer is proposed to incrementally consolidate VMs onto the most power-efficient servers on a longer time scale. Empirical results on a hardware testbed demonstrate that our solution outperforms pMapper, a state-of-the-art server consolidation algorithm, by having greater power savings and smaller consolidation overheads while achieving the required application performance. Extensive simulation results, based on a trace file of 5415 real servers, demonstrate the efficacy of our solution in large-scale data centers.

A Survey of Resource Management in Multi-Tier Web Applications

Web applications are mostly designed with multiple tiers for flexibility and software reusability. It is difficult to model the behavior of multi-tier Web applications due to the fact that the workload is dynamic and unpredictable and the resource demand in each tier is different. Those features also cause the task of resource allocation for multi-tier Web applications very challenging. In order to meet service level agreements (SLAs) with minimal resource costs, Web service providers should dynamically allocate appropriate resources to each tier. This is particularly important to minimize the monetary cost in the pay-as-you-go cloud computing environments. Recently, a number of rule and model based approaches have been proposed for resource provisioning in cloud computing. In this survey, we identify challenges of the resource allocation problem and conduct a comparative review on those rule and model based approaches for resource allocation in multi-tier Web sites. Given the analysis on their advantages and limitations, we outline research directions to further improve the effectiveness of resource management in multi-tier Web applications.

SLA-based optimisation of virtualised resource for multi-tier web applications in cloud data centres

Dynamic virtualised resource allocation is the key to quality of service assurance for multi-tier web application services in cloud data centre. In this paper, we develop a self-management architecture of cloud data centres with virtualisation mechanism for multi-tier web application services. Based on this architecture, we establish a flexible hybrid queueing model to determine the amount of virtual machines for each tier of virtualised application service environments. Besides, we propose a non-linear constrained optimisation problem with restrictions defined in service level agreement. Furthermore, we develop a heuristic mixed optimisation algorithm to maximise the profit of cloud infrastructure providers, and to meet performance requirements from different clients as well. Finally, we compare the effectiveness of our dynamic allocation strategy with two other allocation strategies. The simulation results show that the proposed resource allocation method is efficient in improving the overall performance and reducing the resource energy cost.

Secure distributed programming with value-dependent types

AbstractDistributed applications are difficult to program reliably and securely. Dependently typed functional languages promise to prevent broad classes of errors and vulnerabilities, and to enable program verification to proceed side-by-side with development. However, as recursion, effects, and rich libraries are added, using types to reason about programs, specifications, and proofs becomes challenging. We present F*, a full-fledged design and implementation of a new dependently typed language for secure distributed programming. Our language provides arbitrary recursion while maintaining a logically consistent core; it enables modular reasoning about state and other effects using affine types; and it supports proofs of refinement properties using a mixture of cryptographic evidence and logical proof terms. The key mechanism is a new kind system that tracks several sub-languages within F* and controls their interaction. F* subsumes two previous languages, F7 and Fine. We prove type soundness (with proofs mechanized in Coq) and logical consistency for F*. We have implemented a compiler that translates F* to .NET bytecode, based on a prototype for Fine. F* provides access to libraries for concurrency, networking, cryptography, and interoperability with C#, F#, and the other .NET languages. The compiler produces verifiable binaries with 60% code size overhead for proofs and types, as much as a 45x improvement over the Fine compiler, while still enabling efficient bytecode verification. We have programmed and verified nearly 50,000 lines of F* including new schemes for multi-party sessions; a zero-knowledge privacy-preserving payment protocol; a provenance-aware curated database; a suite of web-browser extensions verified for authorization properties; a cloud-hosted multi-tier web application with a verified reference monitor; the core F* typechecker itself; and programs translated to F* from other languages such as F7 and JavaScript.

Using Container Architecture to Detect Intrusion for Multitier Web Application

An intrusion detection system is a computer-based information system designed to collect information about malicious activities in a set of targeted IT resources, analyze the information, and respond according to a predefined security policy. The most common computer intrusion detection systems detect signatures of known attacks by searching for attack-specific keywords in network traffic. Intrusion-detection systems aim at detecting attacks against computer systems and networks or in general, against information systems. This strategy is mainly focus on to detect intrusion in multitier web applications. Multitier web application include two ends that is front end as well as back end of the applications. The front end include web server which can responsible to run the application and gives that output to back end i.e. file server. This strategy is useful to identify the intrusion at both front end and back end of web application.

Pattern Mapping Approach for Detecting Xss Attacks In MultiTier Web Applications Using Double Guard

with the advent and explosive growth of the global Internet and electronic commerce environments, adaptive/automatic network intrusion and anomaly detection in wide area data networks and e-commerce infrastructures is fast gaining critical research and practical importance. Many researchers have been performed research for detecting intrusions in multi tier web applications. This paper focuses on Double guard that deploys the IDS at both front end web server and back end data base server has been developed. Virtualization technique has been used for creating containers for each user sessions. This strategy mainly focuses on detecting XSS attacks in multi tier web applications by employing a pattern mapping step wise algorithm. Cross Site Scripting Attack (XSS) belongs to top ten web application vulnerabilities. This paper proposes a mechanism to secure java web applications from XSS by applying a framework based on pattern mapping approach.

DoubleGuard: Detecting Intrusions in Multitier Web Applications

Internet services and applications have become an inextricable part of daily life, enabling communication and the management of personal information from anywhere. To accommodate this increase in application and data complexity, web services have moved to a multitiered design wherein the webserver runs the application front-end logic and data are outsourced to a database or file server. In this paper, we present DoubleGuard, an IDS system that models the network behavior of user sessions across both the front-end webserver and the back-end database. By monitoring both web and subsequent database requests, we are able to ferret out attacks that an independent IDS would not be able to identify. Furthermore, we quantify the limitations of any multitier IDS in terms of training sessions and functionality coverage. We implemented DoubleGuard using an Apache webserver with MySQL and lightweight virtualization. We then collected and processed real-world traffic over a 15-day period of system deployment in both dynamic and static web applications. Finally, using DoubleGuard, we were able to expose a wide range of attacks with 100 percent accuracy while maintaining 0 percent false positives for static web services and 0.6 percent false positives for dynamic web services.

Modellus

The rising complexity of distributed server applications in Internet data centers has made the tasks of modeling and analyzing their behavior increasingly difficult. This article presents Modellus , a novel system for automated modeling of complex web-based data center applications using methods from queuing theory, data mining, and machine learning. Modellus uses queuing theory and statistical methods to automatically derive models to predict the resource usage of an application and the workload it triggers; these models can be composed to capture multiple dependencies between interacting applications. Model accuracy is maintained by fast, distributed testing, automated relearning of models when they change, and methods to bound prediction errors in composite models. We have implemented a prototype of Modellus, deployed it on a data center testbed, and evaluated its efficacy for modeling and analysis of several distributed multitier web applications. Our results show that this feature-based modeling technique is able to make predictions across several data center tiers, and maintain predictive accuracy (typically 95% or better) in the face of significant shifts in workload composition; we also demonstrate practical applications of the Modellus system to prediction and provisioning of real-world data center applications.

Hierarchical availability analysis of multi-tiered Web applications

Multi-tiered Web applications must offer their services with superior availability in order to encourage customers to choose online services over the traditional brick-and-mortar options. A systematic, quantitative analysis is the first step in ensuring that multi-tiered Web applications meet their high availability expectations. This paper proposes a hierarchical, model-based methodology to assess the availability of multi-tiered Web applications. The hierarchical approach partitions the analysis into three levels, which allows a systematic consideration of several factors that are relevant to application availability without encountering the issues of model complexity and intractability. We illustrate the approach via experimentation using the TPC-W benchmark. We also demonstrate how the approach could be used to guide resource provisioning decisions.

A workload-driven approach to database query processing in the cloud

This paper is concerned with data provisioning services (information search, retrieval, storage, etc.) dealing with a large and heterogeneous information repository. Increasingly, this class of services is being hosted and delivered through Cloud infrastructures. Although such systems are becoming popular, existing resource management methods (e.g. load-balancing techniques) do not consider workload patterns nor do they perform well when subjected to non-uniformly distributed datasets. If these problems can be solved, this class of services can be made to operate in more a scalable, efficient, and reliable manner. The main contribution of this paper is a approach that combines proprietary cloud-based load balancing techniques and density-based partitioning for efficient range query processing across relational database-as-a-service in cloud computing environments. The study is conducted over a real-world data provisioning service that manages a large historical news database from Thomson Reuters. The proposed approach has been implemented and tested as a multi-tier web application suite consisting of load-balancing, application, and database layers. We have validated our approach by conducting a set of rigorous performance evaluation experiments using the Amazon EC2 infrastructure. The results prove that augmenting a cloud-based load-balancing service (e.g. Amazon Elastic Load Balancer) with workload characterization intelligence (density and distribution of data; composition of queries) offers significant benefits with regards to the overall system's performance (i.e. query latency and database service throughput).

Research on resource allocation for multi-tier web applications in a virtualization environment

Resource allocation for multi-tier web applications in virtualization environments is one of the most important problems in autonomous computing. On one hand, the more resources that are provisioned to a multitier web application, the easier it is to meet service level objectives (SLO). On the other hand, the virtual machine which hosts the multi-tier web application needs to be consolidated as much as possible in order to maintain high resource utilization. This paper presents an adaptive resource controller which consists of a feedback utilization controller and an auto-regressive and moving average model (ARMA)-based model estimator. It can meet application-level quality of service (QoS) goals while achieving high resource utilization. To evaluate the proposed controllers, simulations are performed on a testbed simulating a virtual data center using Xen virtual machines. Experimental results indicate that the controllers can improve CPU utilization and make the best tradeoff between resource utilization and performance for multi-tier web applications.

Secure distributed programming with value-dependent types

Distributed applications are difficult to program reliably and securely. Dependently typed functional languages promise to prevent broad classes of errors and vulnerabilities, and to enable program verification to proceed side-by-side with development. However, as recursion, effects, and rich libraries are added, using types to reason about programs, specifications, and proofs becomes challenging. We present F*, a full-fledged design and implementation of a new dependently typed language for secure distributed programming. Unlike prior languages, F* provides arbitrary recursion while maintaining a logically consistent core; it enables modular reasoning about state and other effects using affine types; and it supports proofs of refinement properties using a mixture of cryptographic evidence and logical proof terms. The key mechanism is a new kind system that tracks several sub-languages within F* and controls their interaction. F* subsumes two previous languages, F7 and Fine. We prove type soundness (with proofs mechanized in Coq) and logical consistency for F*. We have implemented a compiler that translates F* to .NET bytecode, based on a prototype for Fine. F* provides access to libraries for concurrency, networking, cryptography, and interoperability with C#, F#, and the other .NET languages. The compiler produces verifiable binaries with 60% code size overhead for proofs and types, as much as a 45x improvement over the Fine compiler, while still enabling efficient bytecode verification. To date, we have programmed and verified more than 20,000 lines of F* including (1) new schemes for multi-party sessions; (2) a zero-knowledge privacy-preserving payment protocol; (3) a provenance-aware curated database; (4) a suite of 17 web-browser extensions verified for authorization properties; and (5) a cloud-hosted multi-tier web application with a verified reference monitor.

Using Link Gradients to Predict the Impact of Network Latency on Multitier Applications

Managing geographically dispersed deployments of complex multitier applications involves dealing with the substantial effects of network latency. However, the effects of network latency on an application's end-to-end performance can be far from obvious, thus making it difficult to predict the true impact of infrastructure changes such as network upgrades or server relocation on the users of an application. In this paper, we propose a new metric to quantify this impact called the link gradient. We develop a novel noise-resistant, nonintrusive technique to measure the link gradients in running systems without requiring knowledge of the system structure by using a combination of run-time delay injection and spectral analysis. We evaluate the intrusiveness and accuracy of our approach using micro-benchmarks and a deployment of two benchmark multitier Web applications on PlanetLab. Using these results, we show that link gradients can be used to accurately predict the impact of network latency changes on the end-to-end responsiveness of individual application transactions, even in new application configurations and without requiring a dedicated test environment.

PCCR: Pancreatic Cancer Collaborative Registry

The Pancreatic Cancer Collaborative Registry (PCCR) is a multi-institutional web-based system aimed to collect a variety of data on pancreatic cancer patients and high-risk subjects in a standard and efficient way. The PCCR was initiated by a group of experts in medical oncology, gastroenterology, genetics, pathology, epidemiology, nutrition, and computer science with the goal of facilitating rapid and uniform collection of critical information and biological samples to be used in developing diagnostic, prevention and treatment strategies against pancreatic cancer. The PCCR is a multi-tier web application that utilizes Java/JSP technology and has Oracle 10 g database as a back-end. The PCCR uses a “confederation model” that encourages participation of any interested center, irrespective of its size or location. The PCCR utilizes a standardized approach to data collection and reporting, and uses extensive validation procedures to prevent entering erroneous data. The PCCR controlled vocabulary is harmonized with the NCI Thesaurus (NCIt) or Systematized Nomenclature of Medicine-Clinical Terms (SNOMED-CT). The PCCR questionnaire has accommodated standards accepted in cancer research and healthcare. Currently, seven cancer centers in the USA, as well as one center in Italy are participating in the PCCR. At present, the PCCR database contains data on more than 2,700 subjects (PC patients and individuals at high risk of getting this disease). The PCCR has been certified by the NCI Center for Biomedical Informatics and Information Technology as a cancer Biomedical Informatics Grid (caBIG®) Bronze Compatible product. The PCCR provides a foundation for collaborative PC research. It has all the necessary prerequisites for subsequent evolution of the developed infrastructure from simply gathering PC-related data into a biomedical computing platform vital for successful PC studies, care and treatment. Studies utilizing data collected in the PCCR may engender new approaches to disease prognosis, risk factor assessment, and therapeutic interventions.

Multicenter Breast Cancer Collaborative Registry

The Breast Cancer Collaborative Registry (BCCR) is a multicenter web-based system that efficiently collects and manages a variety of data on breast cancer (BC) patients and BC survivors. This registry is designed as a multi-tier web application that utilizes Java Servlet/JSP technology and has an Oracle 11g database as a back-end. The BCCR questionnaire has accommodated standards accepted in breast cancer research and healthcare. By harmonizing the controlled vocabulary with the NCI Thesaurus (NCIt) or Systematized Nomenclature of Medicine-Clinical Terms (SNOMED-CT), the BCCR provides a standardized approach to data collection and reporting. The BCCR has been recently certified by the National Cancer Institute’s Center for Biomedical Informatics and Information Technology (NCI CBIIT) as a cancer Biomedical Informatics Grid (caBIG®) Bronze Compatible product.The BCCR is aimed at facilitating rapid and uniform collection of critical information and biological samples to be used in developing diagnostic, prevention, treatment, and survivorship strategies against breast cancer. Currently, seven cancer institutions are participating in the BCCR that contains data on almost 900 subjects (BC patients and survivors, as well as individuals at high risk of getting BC).

Adaptive resource provisioning for read intensive multi-tier applications in the cloud

A Service-Level Agreement (SLA) provides surety for specific quality attributes to the consumers of services. However, current SLAs offered by cloud infrastructure providers do not address response time, which, from the user’s point of view, is the most important quality attribute for Web applications. Satisfying a maximum average response time guarantee for Web applications is difficult for two main reasons: first, traffic patterns are highly dynamic and difficult to predict accurately; second, the complex nature of multi-tier Web applications increases the difficulty of identifying bottlenecks and resolving them automatically. This paper proposes a methodology and presents a working prototype system for automatic detection and resolution of bottlenecks in a multi-tier Web application hosted on a cloud in order to satisfy specific maximum response time requirements. It also proposes a method for identifying and retracting over-provisioned resources in multi-tier cloud-hosted Web applications. We demonstrate the feasibility of the approach in an experimental evaluation with a testbed EUCALYPTUS-based cloud and a synthetic workload. Automatic bottleneck detection and resolution under dynamic resource management has the potential to enable cloud infrastructure providers to provide SLAs for Web applications that guarantee specific response time requirements while minimizing resource utilization.

Log-based middleware server recovery with transaction support

Providing enterprises with reliable and available Web-based application programs is a challenge. Applications are traditionally spread over multiple nodes, from user (client), to middle tier servers, to back end transaction systems, e.g. databases. It has proven very difficult to ensure that these applications persist across system crashes so that "exactly once" execution is produced, always important and sometimes essential, e.g., in the financial area. Our system provides a framework for exactly once execution of multi-tier Web applications, built on a commercially available Web infrastructure. Its capabilities include low logging overhead, recovery isolation (independence), and consistency between mid-tier and transactional back end. Good application performance is enabled via persistent shared state in the middle tier while providing for private session state as well. Our extensive experiments confirm both the desired properties and the good performance.