Traditional Web Applications Research Articles

Интерактивная геоинформационная система динамической визуализации характеристик аврорального овала на основе паттернов компонентно-ориентированного программирования

The practical need for operational monitoring of the position dynamics of the auroral oval is due to the negative technospheric manifestations of space weather effects observed in this spatial region. However, the well-known software tools for modeling the auroral oval solve this problem inefficiently from the point of view of informativeness and ergonomics. The paper proposes an approach to dynamic visualization of the characteristics of the auroral oval, which is available at the program level in the form of a traditional web application with the ability to render visual elements in the browser, as well as in the format of a standalone service like RESTful-API. The developed solution provides visualization of the following parameters: the probability of observing the glow of the upper layers of the atmosphere with the naked eye, the electric and magnetic potentials of the field in the region of the northern auroral belt, as well as various types of auroral precipitation. It is assumed that the proposed approach will make it possible to significantly increase the efficiency of the study of parameters in the auroral oval region by specialists and scientists in the relevant fields. At the same time, the high internal and low external connectivity of the developed software modules allow them to be integrated into third-party applications of various profiles and purposes.

SoK: Analysis Techniques for WebAssembly

WebAssembly is a low-level bytecode language that enables high-level languages like C, C++, and Rust to be executed in the browser at near-native performance. In recent years, WebAssembly has gained widespread adoption and is now natively supported by all modern browsers. Despite its benefits, WebAssembly has introduced significant security challenges, primarily due to vulnerabilities inherited from memory-unsafe source languages. Moreover, the use of WebAssembly extends beyond traditional web applications to smart contracts on blockchain platforms, where vulnerabilities have led to significant financial losses. WebAssembly has also been used for malicious purposes, like cryptojacking, where website visitors’ hardware resources are used for crypto mining without their consent. To address these issues, several analysis techniques for WebAssembly binaries have been proposed. This paper presents a systematic review of these analysis techniques, focusing on vulnerability analysis, cryptojacking detection, and smart contract security. The analysis techniques are categorized into static, dynamic, and hybrid methods, evaluating their strengths and weaknesses based on quantitative data. Our findings reveal that static techniques are efficient but may struggle with complex binaries, while dynamic techniques offer better detection at the cost of increased overhead. Hybrid approaches, which merge the strengths of static and dynamic methods, are not extensively used in the literature and emerge as a promising direction for future research. Lastly, this paper identifies potential future research directions based on the state of the current literature.

Enhancing Web Application Security: A Deep Learning and NLP-based Approach for Accurate Attack Detection

Abstract— Nowadays, web attacks have become more complicated, leading to the difficulty of traditional web application firewalls (WAFs) in recognizing those threats, especially when dealing with new attacks. Hence, machine learning/deep learning (ML/DL) approaches have been applied to the field of web attack detection with proven success. However, most existing ML/DL-based web attack detectors focus on a specific type of attack due to the difference in the payload of various attacks, which sets a border to the capability of those solutions in detecting new attack types. In this paper, we propose a novel DL-based solution for web attack detection, named DL-WAD, leveraging deep learning and natural language processing techniques. Moreover, DL-WAD is designed with a data preprocessing mechanism aimed at differentiating between regular web requests and malicious ones that carry attack payloads encompassing multiple types of web attacks. The experiment results indicate the effectiveness of our solution in protecting the target web services from a wide range of attacks with high accuracy.

Effect of head-mounted displays on students' acquisition of surgical suturing techniques compared to an e-learning and tutor-led course: A randomized controlled trial.

Although surgical suturing is one of the most important basic skills, many medical school graduates do not acquire sufficient knowledge of it due to its lack of integration into the curriculum or a shortage of tutors. E-learning approaches attempt to address this issue but still rely on the involvement of tutors. Furthermore, the learning experience and visual-spatial ability appear to play a critical role in surgical skill acquisition. Virtual reality head-mounted displays (HMDs) could address this, but the benefits of immersive and stereoscopic learning of surgical suturing techniques are still unclear. In this multi-arm randomized controlled trial, 150 novices participated. Three teaching modalities were compared: an e-learning course (monoscopic), an HMD-based course (stereoscopic, immersive), both self-directed, and a tutor-led course with feedback. Suturing performance was recorded by video camera both before and after course participation (>26 hours of video material) and assessed in a blinded fashion using the OSATS Global Rating Score (GRS). Furthermore, the optical flow of the videos was determined using an algorithm. The number of sutures performed was counted, visual-spatial ability was measured with the mental rotation test (MRT), and courses were assessed with questionnaires. Students' self-assessment in the HMD-based course was comparable to that of the tutor-led course and significantly better than in the e-learning course (P=0.003). Course suitability was rated best for the tutor-led course (x̄=4.8), followed by the HMD-based (x̄=3.6) and e-learning (x̄=2.5) courses. The median ΔGRS between courses was comparable (P=0.15) at 12.4 (95% CI 10.0-12.7) for the e-learning course, 14.1 (95% CI 13.0-15.0) for the HMD-based course, and 12.7 (95% CI 10.3-14.2) for the tutor-led course. However, the ΔGRS was significantly correlated with the number of sutures performed during the training session (P=0.002), but not with visual-spatial ability (P=0.626). Optical flow (R2=0.15, P<0.001) and the number of sutures performed (R2=0.73, P<0.001) can be used as additional measures to GRS. The use of HMDs with stereoscopic and immersive video provides advantages in the learning experience and should be preferred over a traditional web application for e-learning. Contrary to expectations, feedback is not necessary for novices to achieve a sufficient level in suturing; only the number of surgical sutures performed during training is a good determinant of competence improvement. Nevertheless, feedback still enhances the learning experience. Therefore, automated assessment as an alternative feedback approach could further improve self-directed learning modalities. As a next step, the data from this study could be used to develop such automated AI-based assessments.

Deep Learning for Vulnerability and Attack Detection on Web Applications: A Systematic Literature Review

Web applications are the best Internet-based solution to provide online web services, but they also bring serious security challenges. Thus, enhancing web applications security against hacking attempts is of paramount importance. Traditional Web Application Firewalls based on manual rules and traditional Machine Learning need a lot of domain expertise and human intervention and have limited detection results faced with the increasing number of unknown web attacks. To this end, more research work has recently been devoted to employing Deep Learning (DL) approaches for web attacks detection. We performed a Systematic Literature Review (SLR) and quality analysis of 63 Primary Studies (PS) on DL-based web applications security published between 2010 and September 2021. We investigated the PS from different perspectives and synthesized the results of the analyses. To the best of our knowledge, this study is the first of its kind on SLR in this field. The key findings of our study include the following. (i) It is fundamental to generate standard real-world web attacks datasets to encourage effective contribution in this field and to reduce the gap between research and industry. (ii) It is interesting to explore some advanced DL models, such as Generative Adversarial Networks and variants of Encoders–Decoders, in the context of web attacks detection as they have been successful in similar domains such as networks intrusion detection. (iii) It is fundamental to bridge expertise in web applications security and expertise in Machine Learning to build theoretical Machine Learning models tailored for web attacks detection. (iv) It is important to create a corpus for web attacks detection in order to take full advantage of text mining in DL-based web attacks detection models construction. (v) It is essential to define a common framework for developing and comparing DL-based web attacks detection models. This SLR is intended to improve research work in the domain of DL-based web attacks detection, as it covers a significant number of research papers and identifies the key points that need to be addressed in this research field. Such a contribution is helpful as it allows researchers to compare existing approaches and to exploit the proposed future work opportunities.

Ethereum-based decentralized car rental system

Abstract Blockchain is a pioneering technology that allows the creation of innovative information exchange ecosystems thanks to unique properties, such as immutability, distribution and transparency. By combining this technology with the emergent internet of things (IoT), many innovative business models can be created. The main objective of this work is to present the design and an initial implementation of a decentralized rental system that takes advantage of smart contracts developed on a public blockchain, combined with the potential of the IoT and its intimate relationship with cyber-physical systems. The logic to be implemented in the blockchain is applied in this paper by using the Ethereum programming language, so that the developed application covers the entire car rental process offered in traditional web applications, but adding more autonomy, functionalities and ease of use for both lessees and lessors. Following Ethereum application development guidelines, all business logic is located in the smart contracts implemented in the network, where they can be used to control the car rental system. While this is a work in progress, the results obtained in the first proof of concept have been very promising.

An enhanced deep learning based framework for web attacks detection, mitigation and attacker profiling

Protecting web applications is becoming challenging every passing day, primarily because of attack sophistication, omnipresence of web applications and over-reliance on traditional Web Application Firewalls (WAFs). Advanced Persistent Threats (APTs) make overwhelming use of web attacks during infiltration and expansion phase. Noteworthy research has been carried out to detect web attacks using deep learning because traditional approaches fail against complicated attacks having crafted payloads, scripts and cookie manipulations. This paper proposes a framework based on an enhanced hybrid approach where Deep Learning model is nested with a Cookie Analysis Engine for web attacks detection, mitigation and attacker profiling in real time. We first generated a huge dataset over a period of time and trained our Convolution Neural Network (CNN) based deep learning model using Hypertext Transfer Protocol (HTTP) request parameters like Type, Content length, Data and Requested URL etc. We also developed a Cookie Analysis Engine that checks all incoming cookie(s) for integrity, mutations and failed sanitization checks and informs the user about probable privacy infringement by third party cookies. The framework analyzes the cascading output from the classifier and cookie analysis engine and takes the final decision. We performed rigorous testing of the proposed framework wherein it was first validated on our own custom dataset giving an accuracy of 99.94%. It was also validated on a publicly available benchmark dataset and gave an accuracy of 98.74%. When deployed in a controlled real time environment, the attacker profiling feature enabled the framework to save useful processing time as the deep learning classifier does not get triggered for every incoming request. This makes it easy to deploy in any environment to protect web applications in real time.

An Art of Web Services using Web Mining and Semantic Web Techniques

Todays web browsers serve as an easy access to numerous sources of text and multimedia data. More than a billion pages are indexed by search engines, and finding the desired information is not an easiest task. Over the last decade, there is an explosive growth in the information available on the World Wide Web (WWW). The objective of this paper is to provide an outline of web mining, its various classifications, its subtasks, and to give a perspective to the research community about the potential of applying techniques to extract meaningful patterns. This paper also gives information in the area of web services, semantic web mining and comparison of traditional web applications and semantic web applications thereby providing the guidelines for future research in the area of web services using web mining and semantic web.

BlackWatch: Increasing Attack Awareness within Web Applications

Web applications are relied upon by many for the services they provide. It is essential that applications implement appropriate security measures to prevent security incidents. Currently, web applications focus resources towards the preventative side of security. While prevention is an essential part of the security process, developers must also implement a level of attack awareness into their web applications. Being able to detect when an attack is occurring provides applications with the ability to execute responses against malicious users in an attempt to slow down or deter their attacks. This research seeks to improve web application security by identifying malicious behavior from within the context of web applications using our tool BlackWatch. The tool is a Python-based application which analyzes suspicious events occurring within client web applications, with the objective of identifying malicious patterns of behavior. This approach avoids issues typically encountered with traditional web application firewalls. Based on the results from a preliminary study, BlackWatch was effective at detecting attacks from both authenticated and unauthenticated users. Furthermore, user tests with developers indicated BlackWatch was user-friendly, and was easy to integrate into existing applications. Future work seeks to develop the BlackWatch solution further for public release.

Discovering objects and services in context-aware IoT environments

The future IoT is expected to connect trillions of objects across infrastructures and domains worldwide. Compared to traditional web applications, the context of objects, such as dynamic object property values, may rapidly change. Browsing web pages with hyperlinks is unsuitable for representing and discovering the dynamic state of objects and services in the IoT, as the dynamic context is less keyword-rich than the relatively static contents on traditional web pages. This paper reviews state-of-the-art in discovering objects and services in the current IoT, and analyses the constraints. This paper also proposes a discovery mechanism, which is extended from previous work GGIoT. The proposed discovery mechanism is aware of dynamic context change in the IoT, and can improve the discovery process using automation.

Application Embedding: A Language Approach to Declarative Web Programming

Since the early days of the Web, web application developers have aspired to develop much of their applications declaratively. However, one aspect of the application, namely its business-logic is constantly left imperative. In this work we present Application Embedding, a novel approach to application development which allows all aspects of an application, including its business-logic, to be programmed declaratively. We develop this approach in a two-step process. First, we draw a mapping between web applications and Domain-Specific Languages (DSLs). Second, we note that out of the two methods for implementing DSLs, namely as either internal or external, most traditional web applications correspond to external DSLs, while the the technique that corresponds to DSL embedding (implementing internal DSLs) is left mostly unexplored. By projecting the well-known technique of DSL embedding onto web applications, we derive a novel technique--Application Embedding. Application embedding offers a separation of code assets that encourages reuse of imperative code, while keeping all application-specific assets, including those specifying its business- logic, declarative. As validation, we implemented a simple, though nontrivial web application using the proposed separation of assets. This implementation includes an application-agnostic imperative host application named FishTank, intended to be applicable for a wide variety of web applications, and a declarative definition of the different aspects of the specific application, intended to be loaded on that host. Our method of separation of code assets facilitates a better separation of work, in comparison to traditional methods. By this separation, host application developers can focus mostly on the extra-functional aspects of a web application, namely on improving performance, scalability, and availability, while developers of an embedded application can focus on the functional aspects of their application, without worrying about extra- functional concerns. The reusability of the host application makes the effort put into a better implementation cost-effective, since it can benefit all applications built on top of it.

基于Vaadin的旋转机械动平衡计算系统开发与应用

传统的WEB应用程序在不同终端不同平台开发时，为实现全方位、多角度的用户需要而采用不同的开发框架，这无疑增加了开发人员的开发量和维护量。Vaadin是一个用于创建富客户端(RIA)应用程序的前端开发框架，应用程序在不同终端和平台实现时都基于相同的框架，其具有种类丰富和功能完善的界面表现力、灵活的数据监听处理功能，同时能兼顾跨平台跨终端的触屏交互、动画切换等移动特性。为实现旋转机械动平衡计算在智能手机、PAD等移动终端的应用需求，同时兼顾系统交互性和功能性，本文基于Vaadin开发框架设计实现了旋转机械动平衡计算系统。实例应用表明，系统在跨平台跨终端实现时，不仅显著提高了开发效率，也兼顾了不同终端的用户体验。 Traditional WEB applications use different development framework in different terminal and different platform development, in order to achieve all-round, multi-angle user needs, which un-doubtedly increase the developer’s development amount and maintenance amount. Vaadin is a new development framework for creating rich client (RIA) applications, which are based on the same framework when they are implemented on different terminals and platforms, with a rich and well-defined interface presentation, flexible data listening processing functions, and mobile features, such as cross-platform cross-terminal touch screen interaction, animation switching and so on. In order to realize the application of rotating machinery dynamic balance calculation in mobile phones such as smart phones and PADs, taking into account the system interactivity and functionality at the same time, this paper realizes the dynamic balance calculation system of rotating machinery based on Vaadin development framework design. Case application shows that when the system implements on cross-platform cross-terminal, it not only significantly improves the development efficiency, but also takes into account the different terminal user experience.

A systematic mapping study of mobile application testing techniques

The importance of mobile application specific testing techniques and methods has been attracting much attention of software engineers over the past few years. This is due to the fact that mobile applications are different than traditional web and desktop applications, and more and more they are moving to being used in critical domains. Mobile applications require a different approach to application quality and dependability and require an effective testing approach to build high quality and more reliable software. We performed a systematic mapping study to categorize and to structure the research evidence that has been published in the area of mobile application testing techniques and challenges that they have reported. Seventy nine (79) empirical studies are mapped to a classification schema. Several research gaps are identified and specific key testing issues for practitioners are identified: there is a need for eliciting testing requirements early during development process; the need to conduct research in real-world development environments; specific testing techniques targeting application life-cycle conformance and mobile services testing; and comparative studies for security and usability testing.

SaaS-based enterprise application integration approach and case study

Software-as-a-Service (SaaS) has been well studied, and it is being adopted at a very fast pace. Enterprise application integration (EAI) is the key factor in many enterprises. Traditionally, SOA technique can be applied to EAI, especially the application of Web Service. In this paper, we propose that SaaS can also be applied to the field of EAI. Based on this, we propose the SaaS-based EAI approach which rebuilds one analog of legacy applications into SaaS architecture makes the rest applications be configured, and further solves the EAI problem. Besides, we also update the traditional SaaS maturity model, discuss relationships between SOA and SaaS in EAI, and explain how to further integrate SaaS applications by SOA. We implement an Eclipse plug-in which can introduce SaaS capabilities into traditional Web application automatically. Finally, the proposed approach is proved to be effective through a case study.

Migrating Traditional Web Applications to CMS-based Web Applications

In recent years, Content Management Systems (CMS) have proven to be the best platforms for maintaining the large amount of digital content managed by Web applications. Thus, many organizations have experienced the necessity to base its Web applications on these CMS platforms. To do this, they start a migration process which is complex and error prone. To support this process, we propose a method based on the principles of Architecture-Driven Modernization (ADM) which automates the migration of Web applications to CMS-based Web applications. This article focuses on the implementation of two artifacts of this method: 1) the DSL ASTM_PHP, a modeling language for defining a model from PHP code (ASTM_PHP model) and 2) the model-to-model transformation rules which generate automatically a KDM model from a ASTM_PHP model. To show the feasibility of this implementation, we use a case study based on a widget implemented in PHP which lists the online users of a Web application.

Demo proposal

Simple is a web framework for Haskell. Simple came out of our work on Hails, a platform for secure web applications. For Hails, we needed a flexible web framework that uses no unsafe language features and can be used to build apps outside the IO monad. Unlike many mainstream web frameworks, Simple does not enforce a particular structure or paradigm. Instead, it simply provides a set of composable building blocks to help developers structure and organize their web applications. We've used Simple to build both traditional web applications as well as applications with explicit, strong safety and security guarantees. In the demonstration, we'll focus on the former -- introducing the framework and motivating it's utility for traditional web apps -- and show how we can leverage the LIO information flow control library to add mandatory security policies to apps.

An Approach for Systematically Analyzing and Specifying Security Requirements for the Converged Web-Mobile Applications

As the use of web and mobile applications is becoming pervasive for service delivery and user mobility support, enterprises are now increasingly fighting against a huge number of emerging security threats which interfere with the process of service delivery. As an attempt to help the enterprises in dealing with the emerging security threats in the converged service delivery architecture, this paper presents a methodology for security threat analysis and security requirements specification in web/mobile applications development. The presented methodology is based on a case study Livestock Data Center (LDC) system, which is being developed and it allows both web and mobile interfaces as service delivery channels. Hence the system serves as a representative of other similar setups of service delivery. In addition to the processes of analysis and security specification, the methodology involves threat modeling as well. There are several threat models in the literature. The STRIDE threats model is one among the existing threats models that is used to identify security threats that needs to be addressed in systems such as the LDC system. The STRIDE threats model has been used to identify the likely security threats to our case study. On applying the STRIDE threats model the following threats were identified as prominent: sensitive data exposure, weak server side controls, client side injection, and weak authentication and authorization. The identified security threats were compared to existing threats in traditional web and mobile applications separately in order to figure out the changes when the two computing platforms come together. The findings from our case study have shown that the proposed methodology for security threat analysis and security design can be useful in security requirements specifications in the converged web-mobile applications during development, and can be generally used to assist developers of other similar systems.

A NOVEL APPROACH FOR EVALUATION OF APPLYING AJAX IN THE WEB SITE

Now a day’s mostly web applications are developing by AJAX technology due to its number of advantages over traditional web application, so instead of developing new AJAX based web application, convert the traditional web application into AJAX based web application is a good approach. It may save our time as well as our cost. But here a question can be arising is that how we can check that whether there is a need to apply AJAX on traditional web application or not. Because some time, some traditional web applications have good performance and there is no need to apply AJAX. But tester still thinks that after applying AJAX, performance of the web application will increase at each time. So to check this condition (applying AJAX or not) we develop a model. The model works as test suite in front of web application tester. Suppose there is a web application and tester has a traditional web application (non Ajax based), and he/she wants to know whether he/she should apply Ajax on that particular web application or not. Our model provides guidance to tester to fulfill his/ her aim.

Automatic Testing of AJAX Applications through Dynamic Analysis of User Interface State Change

The growing popularity and importance of web applications have been increasing continuously in recent years. Use of JAVASCRIPT and dynamic DOM (Document Object Model) manipulation on the client side of web applications is becoming a widespread approach for achieving rich interactivity and responsiveness in modern web applications. AJAX (Asynchronous JAVASCRIPT and XML) based web applications rely on asynchronous client-server communication and client-side runtime manipulation of the DOM tree. This not only makes them fundamentally different from traditional web applications but also make them more error prone and harder to test. The proposed method for testing automatically AJAX application is based on a crawler to infer a state-flow graph for all client-side user interface states of an AJAX application. Focus is on obtaining a model by “crawling” an AJAX application, automatically clicking buttons and other user interface elements. In order to recognize failures in executions, use of invariants are proposed [1]. These invariants can be generic (e.g., after any client-side change the DOM should remain W3C-compliant valid HTML) or application-specific (e.g., the home-button in any state should lead back to the starting state). General Terms AJAX, JAVASCRIPT, XML, DOM

A Model-Based Approach for Crawling Rich Internet Applications

New Web technologies, like AJAX, result in more responsive and interactive Web applications, sometimes called Rich Internet Applications (RIAs). Crawling techniques developed for traditional Web applications are not sufficient for crawling RIAs. The inability to crawl RIAs is a problem that needs to be addressed for at least making RIAs searchable and testable. We present a new methodology, called “model-based crawling”, that can be used as a basis to design efficient crawling strategies for RIAs. We illustrate model-based crawling with a sample strategy, called the “hypercube strategy”. The performances of our model-based crawling strategies are compared against existing standard crawling strategies, including breadth-first, depth-first, and a greedy strategy. Experimental results show that our model-based crawling approach is significantly more efficient than these standard strategies.