Session ID Research Articles

Analysis of Web Vulnerability Using Open-Source Scanners on Different Types of Small Entrepreneur Web Applications in Malaysia

Most of Malaysia’s small entrepreneurs have switched to online platforms as an alternative to their physical businesses. Social media sites such as TikTok, Instagram, Twitter, and Facebook provide free advertising tools and convenient access to a broader global target. However, security issues on these websites remain questionable as users are exposed to web attacks due to the vulnerabilities on the websites. Considering the cost and lack of awareness of the importance of cybersecurity, some organizations find it not profitable to invest in securing their websites. Therefore, this paper aims to test Malaysian small entrepreneurs’ web applications using open-source scanners and analyse the results of web vulnerabilities detected. To do so, two types of open-source scanners, OWASP ZAP and IRONWASP, were installed to scan five websites found through advertisements on social media sites. The web vulnerability identification was based on the top 5 OWASP web vulnerability reports, and the results showed that five types of web vulnerabilities were detected. The analysis of the results showed that the top 5 web vulnerabilities in Malaysian small entrepreneurs’ websites are the ‘Missing Session Timeout’ vulnerability with 81.84 percent, the ‘Sensitive Information Passed as Clear Text in GET URL’ vulnerability with 14.74 percent, and the ‘Session ID Cookies not Marked Secure’ vulnerability with 2.47 percent. This paper provides security analysis on Small Medium Enterprise (SME) websites for future enhancement and consideration during development and implementation to avoid possible attacks. Therefore, developers are advised to handle these vulnerabilities by carefully managing the session timeout, and users are recommended to log out from the websites immediately after they are done.

THE EFFECT OF COVID-19 ON E-LEARNING DELIVERY AS AN APPLICATION PROJECT IN RWANDAN HIGH SCHOOLS

The study adopted descriptive research design using quantitative and qualitative approaches. Agent theory of E-Learning projects planning, and Project management theory of change were used in this study. The population involved in this was staff from NU Vision High School. The total population for this study was therefore composed by 214 persons. Purposive sampling technique was used to sample 139 respondents taken as sample size. Descriptive statistics with frequency distribution and correlation and regression analysis were used to analyse the data. Frequency tables were used to present the data to facilitate understanding and interpretation. The qualitative data was consolidated, analysed in terms of content and a narrative report was produced presenting the respondents' views on explore effect of COVID-19 on E-learning delivery: As an application of project based at NU Vision High School. The study will be a great important to the existing knowledge in E-Learning delivery and will contribute to increasing E-Learning projects planning standards amongst the project management professionals and the entire project industry. Findings indicated that of Access point, internet security database have an effect on E-Learning delivery in NU Vision High School. Besides, findings also revealed the coefficient of correlation equal to r= 0.802, p value=0.000. In this regard, regression analysis was used to conclude the results of the undertaken study and to provide some recommendations. This study recommends that prevent issues regarding the session security, NU Vision High School, should use session ID which is adequately long and unpredictable.

A Dataset of Service Time and Related Patient Characteristics from an Outpatient Clinic

Outpatient clinics’ productivity largely depends on their appointment scheduling systems. It is crucial for appointment scheduling to understand the intrinsic heterogeneity in patient and service types and act accordingly. This article describes an outpatient clinic dataset of consultation service time with heterogeneous characteristics. The dataset contains 6637 consultation records collected from 381 half-day sessions between 2018 and 2019. Each record includes encrypted session and patient IDs, consultation start and (approximated) end times, the month and day of the week, whether it was on a holiday, the patient’s visit count for a specific medical condition, gender, whether the consultation was cancer-related, and the distance from the patient’s mailing address to the clinic. These features can be used to classify patients into heterogeneous groups in studies of appointment scheduling. Therefore, this dataset with rich, heterogeneous patient characteristics provides a valuable opportunity for healthcare operations management researchers to develop, test, and benchmark the performance of their models and methods. It can also be used for studying appointment scheduling in other service industries. More generally, it provides pedagogical value in areas related to management science and operations research, applied statistics, and machine learning.

STUDY OF STATISTICAL STABILITY AND FAST CHARACTERISTICS OF THE PROPOSED HASHING FUNCTION OF THE IMPROVED CRYPTOGRAPHIC MODULE IN INFORMATION AND COMMUNICATION SYSTEMS

The study of statistical stability and speed characteristics of the proposed hashing function of the advanced module of cryptographic protection of information, which by recording information about the user ID, session ID, sending time, message length and its serial number, as well as using a new session key for encryption , allows to ensure the confidentiality and integrity of data in information and communication systems management processes. The object of research is the process of ensuring the confidentiality of data in information and communication systems management systems based on cloud technologies. The subject is the study of statistical stability and speed characteristics of the proposed hashing function of the advanced module of cryptographic protection in information and communication systems. The purpose of this work is to study the statistical stability and speed characteristics of the proposed hashing function of the advanced module of cryptographic protection in information and communication systems for process control based on cloud technologies. To use this module effectively, it is important to choose crypto-resistant encryption and hashing methods, as well as secret key synchronization. Cryptoalgorithms resistant to linear, differential, algebraic, quantum and other known types of cryptanalysis can be used as encryption and hashing functions. An experimental study was conducted, which confirmed the crypto-resistance of the advanced algorithm to linear and differential cryptanalysis and determined that the speed of cryptographic data processing by the advanced method using the developed encryption function is 1.98 times higher than analogues, and the key generation speed 1.17 times compared to the generators used in particular in the selected prototype.

Preventing data leakage by securing chat session with randomized session ID

Messaging applications have become one of the largest and most popular smartphone applications. It includes the capacity for the users to communicate between themselves via text messages, photos and files. It is necessary to safeguard all messages. Privacy is one of the biggest issues which most individuals in the world of instant messaging ignore. Although several instant messaging applications offer varying security for users, the weaknesses and danger of data assault are increasing. Not just business discussions, our data must also be safeguarded during everyday discussions since data is very sensitive for everybody, and data protection is very crucial to prevent undesired loss of information. To address these types of weaknesses and hazards associated with data attacks, we require an encrypted messaging protocol and also hide IP address method for a safe interaction. This paper's goal is to protect conversations from targeted attacker by securing the communication between user and hide IP address from unauthorized access.

INVESTIGATION OF LINEAR TRANSFORMATIONS OF THE PROPOSED HUSHING FUNCTION OF THE ADVANCED MODULE OF CRYPTOGRAPHIC PROTECTION IN INFORMATION AND CIRCUMSTANCES

This paper investigates the linear transformations of the hash function, which is part of the developed advanced module of cryptographic protection of information, which by capturing information about the user ID, session ID, sending time, message length and sequence number, as well as using a new session key generation procedure for encryption, allows you to ensure the confidentiality and integrity of data in information and communication systems process control. The object of research is the process of ensuring the confidentiality of data in information and communication systems management systems based on cloud technologies. The subject is the study of linear transformations of the proposed hashing function of the advanced module of cryptographic protection in information and communication systems. The purpose of this work is to study the linear transformations of the proposed hashing function of the advanced module of cryptographic protection in information and communication systems for process control based on cloud technologies. To use this module effectively, it is important to choose crypto-resistant encryption and hashing methods, as well as secret key synchronization. Cryptoalgorithms resistant to linear, differential, algebraic, quantum and other known types of cryptanalysis can be used as functions of cryptographic methods of encryption and hashing. The conducted experimental study of linear transformations of the proposed hashing function of the advanced module of cryptographic protection in information and communication systems confirmed the cryptoresistance of the advanced algorithm to linear cryptanalysis.

Preventing data leakage by securing chat session with randomized session ID

Messaging applications have become one of the largest and most popular smartphone applications. It includes the capacity for the users to communicate between themselves via text messages, photos and files. It is necessary to safeguard all messages. Privacy is one of the biggest issues which most individuals in the world of instant messaging ignore. Although several instant messaging applications offer varying security for users, the weaknesses and danger of data assault are increasing. Not just business discussions, our data must also be safeguarded during everyday discussions since data is very sensitive for everybody, and data protection is very crucial to prevent undesired loss of information. To address these types of weaknesses and hazards associated with data attacks, we require an encrypted messaging protocol and also hide IP address method for a safe interaction. This paper's goal is to protect conversations from targeted attacker by securing the communication between user and hide IP address from unauthorized access.

Delta.AR: An augmented reality-based visualization platform for 3D genome

Delta.AR: An augmented reality-based visualization platform for 3D genome

Simulation and Analysis of Network Security Performance Using Attack Vector Method for Public Wifi Communication

The use of wifi networks in public spaces has a risk of robbery of user access data in cyberspace, such as banking transactions, social media and other online access. The threat of Man In The Middle Attack (MITM) attacks is carried out on public wifi networks to gain access to user information by illegal means. The attack vector simulation process is carried out on the site access exampleriset.com/dvwa/login.php. ARP Poisoning attack with Ettercap device performs interception and manipulation which provides 08: 00: 27: 25: 22: 99 MAC address information to the target. Session Hijacking attack simulations are carried out using a cookie manager plugin on the HTTP and HTTPS protocols. SSL Stripping attacks by better intercepting and downgrading HTTPS to HTTP communication protocols. Poisoning ARP attacks get information from targets such as Mobile IP MAC Address 192.168.3.249 F4: 09: D8: EA: EC: E7 and Server 192.168.3.5 08: 00; 27: CC: 59: OE and user: admin Passed: password. The results of the Session Hijacking attack on the HTTP protocol get a session id in the form of phpsessiid = 4f1pnfr081e4jero11truspb60 \ r \ n which is used the specified session id time without entering user authentication. The Session Hijacking attack on the HTTPS protocol was unsuccessful and the SSL Striping attack on the HTTPS protocol was unsuccessful

Prevention of session hijacking using token and session id reset approach

Session hijacking is the term used to describe the theft of user’s cookies and make clone of that cookies. The hacker uses packet sniffer to capture traffic between user and the server to steal the cookies which contain session information. The same then be used to impersonate the user and act as actual user on web. In this paper, Token and Session id Reset Approach has been proposed and implemented, to prevent the session hijacking by cookies cloning. Proposed technique uses; session id, token, IP and bowser fingerprints to authenticate the user on the web server. This technique stores token at the client side in local storage and it will not be stored in cookies. It has been observed that the Man In The Middle, Cross Site Scripting, Session fixation, Cookie-stealing malware, Predictable token and session id, Physical data theft, and Cookie Cloning attacks is hard to perform on the proposed approach.

Research Note: Texture characteristics of wooden breast fillets deboned at different postmortem times

The study aimed to understand whether deboning time contributes to the altered texture attributes of wooden breast (WB) fillets. To this purpose, 30 unaffected (NORM) and 30 severely affected (WB) carcasses were selected at 15 min postmortem (PM) and allotted into treatments with different deboning times: A (5 NORM + 5 WB; right fillets deboned at 15 min PM), B (5 NORM + 5 WB; right fillets deboned at 3 h PM), and C (5 NORM + 5 WB; right fillets deboned at 6 h PM). Left fillets from each carcass were deboned at 24 h PM. Multiple instrumental texture analyses were performed on the cranial-middle portion of the Pectoralis major muscles. Irrespective of deboning time, all fillets were subjected to a single 30% compression in the raw state at 24 h PM. All fillets were cooked at 24 h PM and subjected to shear force assessments at 48 h PM using blunt Meullenet-Owens razor shear, Meullenet-Owens razor shear, and Warner-Bratzler shear force. Using an ANOVA mixed model, deboning time was evaluated as a fixed effect within muscle condition (sampling session and carcass ID as random effects). Compression force assessment of raw meat at 24 h PM showed that WB fillets exhibited the greatest hardness when they were deboned at 6 h PM (15 min = 35.4 N; 3 h = 30.9 N; 6 h = 48.0 N; 24 h = 30.6 N; P < 0.05). Differently, deboning time had no effect (P > 0.05) on raw compression force values in NORM fillets. In cooked NORM fillets, shear force values were the greatest in fillets deboned at 15 min, and shear force gradually declined with deboning time through 24 h PM. On the contrary, no changes (P > 0.05) in shear values due to different deboning times were observed in cooked WB meat regardless of shear method. These results suggest that early PM changes in breast muscles and their influence on meat texture are different between normal and WB fillets.

Clock Skew Based Computer Identification on Different Types of Area Networks

The increase of client devices along with the growth of internet access currently affects to security threats at the user's identity. Identifiers that commonly used today, such as SSID, IP address, MAC address, cookies, and session IDs have a weakness, which is easy to duplicate. Computer identification based on clock skew is an identification method that is not easily duplicated because it is based on the hardware characteristics of the device. Clock skew is the deviation of the clock to the true time which causes each clock to run at a slightly different speed. This study aims to determine the effect of network types to the clock skew stability as a reliable device identification method. This research was conducted on five client computers which running windows and linux operating systems. The measurement was conducted based on three different types of area networks, i.e., LAN, MAN, and WAN. The skew estimation was done using two linear methods i.e., linear programming and linear regression. The measurement results show that the most stable clock skew is found on the LAN measurement because it meets the threshold tolerance limit i.e., ±1 ppm. Skew estimation using linear programming method has better accuracy than linear regression method.

Infrastructure‐based vehicular congestion detection scheme for V2I

SummaryWith the increasing number of vehicles, traffic jam becomes one of the major problems of the fast‐growing world. Intelligent transportation system (ITS) communicates perilous warnings and information on forthcoming traffic jams to all vehicles within its coverage region. Real‐time traffic information is the prerequisite for ITS applications development. In this paper, on the basis of the vehicle‐to‐infrastructure (V2I) communication, a novel infrastructure‐based vehicular congestion detection (IVCD) scheme is proposed to support vehicular congestion detection and speed estimation. The proposed IVCD derives the safety time (time headway) between vehicles by using iterative content‐oriented communication (COC) contents. Meanwhile, the roadside sensor (RSS) provides an infrastructure framework to integrate macroscopic traffic properties into the estimation of both the traffic congestion and vehicle safety speed. The main responsibilities of RSS in IVCD are to preserve privacy, aggregate data, store information, broadcast routing table, estimate safety speed, detect traffic jam, and generate session ID (S‐ID) for vehicles. Monte Carlo simulations in four typical Chinese highway settings are presented to show the advantage of the proposed IVCD scheme over the existing Greenshield's and Greenberg's macroscopic congestion detection schemes in terms of the realized congestion detection performance. Real road traces generated by Simulation of Urban Mobility (SUMO) over NS‐3.29 are utilized to demonstrate that the proposed IVCD scheme is capable of effectively controlling congestion in both single and multilane roads in terms of density and speed health with previous schemes in this field.

Request dependency integrity: validating web requests using dependencies in the browser environment

Web requests are the cornerstones of modern web applications. As the browser environment evolves with increasing complexity, attackers have various ways in triggering malicious requests to the server. Traditional security solutions, such as HTTP cookies and session IDs, are insufficient in helping the server to distinguish benign web requests from malicious ones. By design, a web application only expects requests to be generated in certain ways in the browser environment. Therefore, the dynamic browser behaviours and static browser environment that a web request depends on are invariant, which we call request dependency integrity. Based on this observation, we propose a comprehensive approach to validating web requests using dependencies in the browser environment. Our approach extracts the dependency of web requests from the browser, representing it in a request dependency graph (RDG). RDG allows web servers to detect malicious requests through enforcing the request dependency integrity, which is applicable to a wide range of malicious-request-based attacks. We develop an end-to-end solution called ClearRequest and build a prototype in the Firefox browser. We demonstrate the effectiveness of ClearRequest in evaluation using several types of malicious-request-based attacks.

Hybrid Broadcast Group Management Protocol for Secure, Scalable and Efficient Group Communication

In hasty growth of communication, security plays a central role in maintaining confidentiality of data in group communication. Keeping the data intended for the group in confidential manner is the most important security feature need to be sustained for the group communication. An efficient group key management mechanism named as Hybrid Broadcast Group Management Protocol (HBGMP) is devised based on the Reverse Function (RF) and Chinese Remainder Theorem (CRT). The distinctive security among the subgroups is ensured by the reverse function and the session ID of each subgroup is calculated by employing Chinese remainder theorem. By contraption, the Session ID using Chinese Remainder Theorem, with which a cohort of n users requires Sub Group Service Provider (SGSP) to do O (n/m) computation for communication and the storage cost are diminished by diverting the computing load of the Group Service Provider (GSP) into the SGSP. The significance of this protocol is the group member needs to store only two different values during the entire life span and also the rekey message is broadcasted which brings down the communication cost to O(1). The protocol is defined generally for any applications in hybrid architecture. The proposed architecture using CRT and Reverse function is scalable for hefty sized dynamically changing group.

A Prevention Model for Session Hijack Attacks in Wireless Networks Using Strong and Encrypted Session ID

Abstract Most of the web applications are establishing the web session with the client. It is very important to protect the wireless networks against session hijacking attack. Session Hijack attack is easy to execute and difficult to detect. Wireless networks do not have specific boundary regions for the packets to be transferred. As the data packets are transferred in air, the chances of sniffing the network packets by the hackers or attackers are high by using the network sniffing tools. In this paper, we have proposed the Strong and Encrypted Session ID to prevent the session hijack attacks in web applications. Session ID is generated and the generated Session ID is encrypted, using a Secret Key Sharing algorithm and decrypted at the client side. We have tested the integrity of the session ID of length 32, 92 and 212 characters in a web application. Attacks are executed to capture the session ID of a web application. Our experimental results proved that 212 characters encrypted session ID completely prevents the session hijack attacks in web applications of wireless networks.

Web's Dynamic Session IDs: Design and Analysis

A number of websites is recently faced with the problems from Session Hijacking Attacks which are simple to be launched with higher possibility of success. Besides, this attacking is now popular amongst the hackers in which it is ranked on the Top 10 Web Attacking. Session Hijacking can be launched by capturing Cookie/Session IDs within an LAN, or by using XSS (Cross Site Scripting), which allows hackers to steal cookies from across the world and then use the captured Cookie/Session ID to access the system on a victim’s identity. This problem is a result of using a Static Session ID. This research proposes a model to protect against Session hijacking by using a Non-Static Session ID instead of a Static Session ID. We combine Hashing of the Secret with Time to create the constantly changeable Session ID. With this model, a victim’s session ID captured by hacker will not be able to be used for replay attacks. In addition, this model can prevent both manual and automatic Session Hijackings in which Client and Server has no need to synchronize the time and to use NTP.

Dynamic 2D-barcodes for multi-device Web session migration including mobile phones

This article introduces a novel Web architecture that supports session migration in multi-device Web applications, particularly the case when a user starts a Web session on a computer and wishes to continue on a mobile phone. The proposed solution for transferring the needed session identifiers across devices is to dynamically generate pictures of 2D-barcodes containing a Web address and a session ID in an encoded form. 2D-barcodes are a cheap, fast and robust approach to the problem. They are widely known and used in Japan, and are spreading in other countries. Variations on the topic are covered in the article, including a possible migration from a mobile device to a computer (opposite direction), and between two or more mobile phones (possibly back and forth). The results show that this HCI approach is inexpensive, efficient, and works with most camera-phones on the market; the author does see any other mature technique with such assets.

HMIPv6 네트워크에서 자원예약 시그널링 지연을 줄이기 위한 크로스오버 노드 발견 및 지역적 자원 갱신 방안

이동 네트워크 환경에서 MN(Mobile Node)의 핸드오버 후 새로운 경로 상에 자원을 예약할 때 시그널링 지연을 최소화하기 위해서는 이전 경로와 새로운 경로가 만나는 지점에 있는 노드인 크로스오버 노드(Crossover Node:CRN)를 발견하는 것이 중요하다. 일반적으로 크로스오버 노드의 발견은 MN과 CN(Correspondent Node)간 설립된 종단간 SID(Session ID)를 주요키로 사용하여 이루어지지만, HMIPv6(Hierarchical Mobile IPv6) 네트워크에서 MAP(Mobility Anchor Point)과 HA(Home Agent)간 군집(Aggregate) 세션 단위로 자원예약을 하는 경우에는 이와 같은 일반적인 방법의 적용이 어렵다. 군집 예약을 할 때에는 종단간 SID와는 별도로 군집 SID를 사용하는데, MN의 핸드오버 후 이전 MAP과 HA간 설립된 세션의 군집 SID가 새로운 MAP과 HA간 설립된 세션의 군집 SID와 달라서 SID를 이용하여 크로스오버 노드를 발견할 수 없기 때문이다. 이에, 본 논문에서는 HMIPv6 네트워크에서 차세대 네트워크 시그널링 프로토콜인 NSIS(Next Step in Signaling)를 이용하여 자원을 예약하는 경우 군집 예약이 이루어진 MAP과 HA간 터널상에서 크로스오버 노드를 발견하고, 크로스오버 노드를 발견한 즉시, 군집 예약된 자원의 갱신이 지역적으로 이루어지도록 하는 방안을 제안한다. 시뮬레이션을 통해, 시그널링 메시지가 항상 터널의 끝 노드까지 전달되는 기존 방안에 비해 제안하는 방안이 자원 예약을 위한 시그널링 지연을 단축시키고, 핸드오버 동안의 평균 처리율을 향상시킴을 알 수 있었다. In order to minimize the signaling delay for a resource reservation on the new routing path after the handover of Mobile Node(MN) is completed, it is important to discover the crossover node where the old and new routing paths meet. With the 크로스오버 노드 being found, the signaling messages only need to be transferred on the changed part of the end-to-end path. The crossover node is generally discovered using the end-to-end Session ID(SID) of the established session between MN and Correspondent Node(CN). However, in the Hierarchical Mobile IPv6(HMIPv6) network, if the Mobile Anchor Point (MAP) reserves the resource by aggregate with the Home Agent(HA), the crossover node discovery cannot be performed in the general way since the aggregate SID that has established between the previous MAP and HA is different from the that of the current MAP and HA after MN's handover. In this paper, we propose a mechanism to discover the crossover node within the tunnel between the MAP and the HA in an HMIPv6 network, assuming that the Next Steps in Signaling(NSIS) is deployed for the resource reservation and the aggregate reservation is applied over the MAP and HA tunnel. The local repair required for the change of path is performed upon the crossover node discovery. The simulation results show that the proposed scheme reduces the signaling delay for the reservation and outperforms the existing scheme with respect to throughput during the handover.

Best Practice in Managing HTTP-Based Client Sessions

Most organizations now have substantial investments in their online Internet presences. For major financial institutions and retailers, the Internet provides both a cost effective means of presenting their offerings to customers, and a method of delivering a personalised 24/7 presence. In almost all cases, the preferred method of delivering these services is over common HTTP. Due to limitations within the protocol, there is no in-built facility to identify or track a particular customer (or session) uniquely within an application. Thus the connection between the customer’s Web browser and the organisation's Web service is commonly referred to as being “stateless”. Because of this, organizations have been forced to adopt custom methods of managing client sessions if they wish to maintain state. An important aspect of correctly managing state information through session IDs relates directly to authentication processes. While it is possible to insist that a client using an organization's Web application provide authentication information for each “restricted” page or data submission, it would soon become tedious and untenable. Thus session IDs are not only used to follow clients throughout the Web application, they are also used to identify each unique, authenticated user — thereby indirectly regulating access to site content or information.