检索结果-内蒙古大学图书馆

web application security engineering

IEEE security & PRIVACY 2006年第4期4卷 16-24页

作者： Meier, J. D. Microsoft Corp Redmond WA 98052 USA

Integrating security throughout the life cycle can improve overall web application security. With a detailed review of the steps involved in applying security-specific activities throughout the software development life cycle, the author walks practitioners through effective, efficient application design, development, and testing. With this article, the author shares a way to improve web application security by integrating security throughout the life cycle. The ideas he present here are based on empirical evidence from consulting with hundreds of customers - real-world scenarios with real project constraints and security concerns - across a variety of scenarios and putting into practice the security techniques that the experts know. The result is an approach that has evolved and refined itself over time

关键词： Internet web application security security software development life cycle

来源：评论

学校读者我要写书评

暂无评论

web application security: An Investigation on Static Analysis with other Algorithms to Detect Cross Site Scripting 5

Web Application Security: An Investigation on Static Analysi...

引用

5th Information Systems International Conference (ISICO) on Role of Information Systems in Industry 4.0

作者： Marashdih, Abdalla Wasef Zaaba, Zarul Fitri Suwais, Khaled Mohd, Nur Azimah Univ Sains Malaysia Sch Comp Sci George Town 11800 Malaysia Arab Open Univ Fac Comp Studies Jeddah Saudi Arabia

Among web application vulnerabilities, XSS is the most frequently occurring. Where a web application accepts a user-input, it is possible for such vulnerability to inject malicious scripts. The greater part of the literature concentrated on the application of static analysis in order to locate XSS vulnerabilities. The reason for this is its capability of achieving effectively a 100 percent code coverage and observing every path of the program. Nevertheless, the main restriction of static analysis, being the false positive rate shown in the results, continues. Consequently, researchers began to merge static analysis with other algorithms, such as genetic algorithm, machine learning and pattern matching. This is to improve the XSS detection results as well as the static analysis run time. This essay defines the algorithms which formerly improved the static analysis outcomes regarding XSS vulnerability detection. Furthermore, each method's restriction was mentioned in which the studies continue to lack an efficient detection of XSS vulnerability in PHP web application. (C) 2019 The Authors. Published by Elsevier B.V.

关键词： Cross Site Scripting Secuirty security Vulnerability Software security Vulnerability Detection web application security

来源：评论

学校读者我要写书评

暂无评论

web application security Tools Analysis 3

Web Application Security Tools Analysis

引用

IEEE 3rd International Conference on Big Data security on Cloud (BigDatasecurity) / 3rd IEEE International Conference on High Performance and Smart Computing (HPSC) / 2nd IEEE International Conference on Intelligent Data and security (IDS)

作者： Alzahrani, Abdulrahman Alqazzaz, Ali Fu, Huirong Almashfi, Nabil Zhu, Ye Oakland Univ Dept Comp Sci & Engn Rochester MI 48309 USA Cleveland State Univ Elect & Comp Engn Dept Cleveland OH 44115 USA

ISBN: (纸本)9781509062966

Strong security in web applications is critical to the success of your online presence. security importance has grown massively, especially among web applications. Dealing with web application or website security issues requires deep insight and planning, not only because of the many tools that are available but also because of the industry immaturity. Thus, finding the proper tools requires deep understanding and several steps, including analyzing the development environment, business needs, and the web applications' complexity. In this paper, we demonstrate the architecture of web applications then list and evaluate the widespread security vulnerabilities. Those vulnerabilities are: Insufficient Transport Layer Protection, Information Leakage, Cross-Site Scripting, and SQL Injection. In addition, this paper analyzes the tools that are used to scan for these widespread vulnerabilities in web applications. Finally, it evaluates tools due to security vulnerabilities and gives recommendations to the web applications' users and administrators aiming to educate them.

关键词： web application web application security web application vulnerabilities

来源：评论

学校读者我要写书评

暂无评论

Ontology for attack detection: An intelligent approach to web application security

引用

COMPUTERS & security 2014年 45卷 124-146页

作者： Razzaq, Abdul Anwar, Zahid Ahmad, H. Farooq Latif, Khalid Munir, Faisal Natl Univ Sci & Technol Sch Elect Engn & Comp Sci Islamabad Pakistan King Faisal Univ Coll Comp Sci & Informat Technol Alahssa 31982 Saudi Arabia

Conventional detection techniques struggle to keep up with the inherent complexity of web application design and hence the ever growing variety of attacks that can exploit it. security frameworks modeled using an ontological approach are a promising new line of defense that can be highly effective in detecting zero day and sophisticated web application attacks because they can capture the context of the contents of information such as HTML pages or in-line scripts and have the ability to filter these contents by taking into consideration their consequences to the target applications. The goal of this article is to demonstrate how an ontology-engineering methodology may be systematically applied for designing and evaluating such security systems. A detailed ontological model is shown that caters to the generalized working of web applications, the underlying communication protocols and attacks. More specifically the proposed ontological model because it captures the context can not only detect HTTP protocol specification attacks but also helps focus only on specific portions of the request and response where a malicious script is possible. The model also captures the context of important attacks, the various technologies used by the hackers, source, target and vulnerabilities exploited by the attack, impact on system components and controls for mitigation. A comprehensive and best metrics suite for ontology evaluation has been used for assessing the quality of proposed model which includes correctness, accuracy, consistency, soundness, task orientation, completeness, conciseness, expandability, reusability, clarity, integrity, efficiency and expressiveness. The proposed model ranked well against the above mentioned metrics. Moreover a prototype attack detection system based upon the proposed model showed improved performance and detection rate and low rate of false positives while detecting OWASP's top ten listed web attacks. (C) 2014 Elsevier Ltd. All rights reserved

关键词： web application security Ontology based intelligent system Semantic security Cyber security Information security

来源：评论

学校读者我要写书评

暂无评论

web application security: An Investigation on Static Analysis with other Algorithms to Detect Cross Site Scripting

引用

Procedia Computer Science 2019年 161卷 1173-1181页

作者： Abdalla Wasef Marashdih Zarul Fitri Zaaba Khaled Suwais Nur Azimah Mohd School of Computer Sciences Universiti Sains Malaysia 11800 Pulau Pinang Malaysia Faculty of Computer Studies Arab Open University Saudi Arabia

Among web application vulnerabilities, XSS is the most frequently occurring. Where a web application accepts a user-input, it is possible for such vulnerability to inject malicious scripts. The greater part of the literature concentrated on the application of static analysis in order to locate XSS vulnerabilities. The reason for this is its capability of achieving effectively a 100 percent code coverage and observing every path of the program. Nevertheless, the main restriction of static analysis, being the false positive rate shown in the results, continues. Consequently, researchers began to merge static analysis with other algorithms, such as genetic algorithm, machine learning and pattern matching. This is to improve the XSS detection results as well as the static analysis run time. This essay defines the algorithms which formerly improved the static analysis outcomes regarding XSS vulnerability detection. Furthermore, each method’s restriction was mentioned in which the studies continue to lack an efficient detection of XSS vulnerability in PHP web application.

关键词： Cross Site Scripting Secuirty security Vulnerability Software security Vulnerability Detection web application security

来源：评论

学校读者我要写书评

暂无评论

Defending on-line web application security with user-behavior surveillance

Defending on-line web application security with user-behavio...

引用

3rd International Conference on Availability, Reliability and security

作者： Cheng, Yu-Chin Laih, Chi-Sung Lai, Gu-Hsin Chen, Chia-Mei Chen, Tsuhan Natl Cheng Kung Univ Tainan 70101 Taiwan Natl Sun Yat Sen Univ Kaohsiung Taiwan Carnegie Mellon Univ Pittsburgh PA 15213 USA

ISBN: (纸本)9780769531021

With the incoming of information era, web-based service has been developed rapidly and offered more and more business. These "open", and widely "web enabled" applications are subject to greater and greater levels and types of attacks as hackers exploit vulnerabilities within the software like SQL Injection and Cross Site Scripts (XSS) attack. In this paper, we proposed a type of novel Embedded Markov Model (EMM) to detect different web application attacks, monitor the on-line user behavior and defend the malevolent user promptly. Comparing to previous web application attacks detecting approaches, our EMM approach can not only detect user's invalidated input errors but also find out the unreasonable page transition behavior. By detecting unreasonable page transition, we can immediately defend the malevolent or silly user behavior to avoid the further web system failures and sensitive information disclosure. Furthermore, we implement an on-line user behavior surveillance system and use the real web traffic to evaluate the performance of our system. The experiment results show that our proposed EMM method can discover the abnormal behavior of malevolent user and detect the invalidated input attacks like SQL injection, ASS and string buffer overflow attacks.

关键词： web application security web security web attacks user behavior Markov model

来源：评论

学校读者我要写书评

暂无评论

webHOLE: Developing a web-based hands-on learning environment to assist beginners in learning web application security

引用

EDUCATION AND INFORMATION TECHNOLOGIES 2024年第6期29卷 6579-6610页

作者： Su, Jun-Ming Natl Univ Tainan Dept Informat & Learning Technol Tainan Taiwan

With the rapid growth of web applications, web application security (WAS) has become an important cybersecurity issue. For effective WAS protection, it is necessary to cultivate and train personnel, especially beginners, to develop correct concepts and practical hands-on abilities through cybersecurity education. At present, many methods offer vulnerable web environments to support practical hands-on training, including large-scale "Capture the Flag" mode (e.g., Cyber Range), pre-configured virtual machine images (e.g., Mutillidae), pre-built stand-alone applications (e.g., webGoat), and web-based system (e.g., Damn Vulnerable web application). However, beginners need not only hands-on training tools and systems but also assistance to support effective learning. Moreover, pre-built training content and exercises are usually not easy to modify and thus lack the flexibility to meet specific teaching needs. Therefore, this study proposed and developed the web-based Hands-On Learning Environment (webHOLE) to efficiently assist beginners in learning WAS. To improve the flexibility of the training content, a web-based authoring tool was developed in webHOLE to create customized hands-on learning exercises. Accordingly, learners can learn and practice the WAS training content online with learning assistance provided by the hands-on learning system. The hands-on abilities of the learners can be efficiently assessed by the hands-on testing system using online exams with progressive hints and automatic grading. Furthermore, to improve the effectiveness of teaching and testing, a portfolio analysis scheme using a data mining technique was developed to identify learning barriers and problematic test items. webHOLE was applied to an actual beginner-level WAS course for undergraduate students. The experimental results showed the benefits of webHOLE on WAS learning, with a significant improvement in learning outcomes. Students expressed high satisfaction with webHOLE's learning as

关键词： Cybersecurity education web application security Practical hands-on ability Hands-on learning web-based learning Portfolio analysis

来源：评论

学校读者我要写书评

暂无评论

Work in Progress - web Penetration Testing: Effectiveness of Student Learning in web application security

Work in Progress - Web Penetration Testing: Effectiveness of...

引用

41st Annual Frontiers in Education Conference (FIE)

作者： Kam, Hwee-Joo Pauli, Joshua J. North Cent Michigan Coll Petoskey MI USA Dakota State Univ Madison SD USA

ISBN: (纸本)9781612844695

web penetration testing embodies both the understanding of attack and defense philosophies. By learning malicious hacking activities, students will understand the perspectives of attackers and realize how to defend a web application system. To foster information security education, it is important to introduce the attack understanding philosophy. Using student group projects, this study aims to measure student learning effectiveness in web application security and to discover how students perceive learning given the attack understanding philosophy. In support of triangulation, this research will employ pre-test and post-test study along with the grounded theory approach. The future research findings will propose a framework to improve student learning effectiveness and student learning perception in web application security.

关键词： web application security web penetration testing Information security education

来源：评论

学校读者我要写书评

暂无评论

On the applicability of combinatorial testing to web application security testing: A case study 2

On the applicability of combinatorial testing to web applica...

引用

2nd International Workshop on "Joining AcadeMiA and Industry Contributions to Test Automation and Model-Based Testing", JAMAICA 2014

作者： Garn, Bernhard Kapsalis, Ioannis Simos, Dimitris E. Winkler, Severin SBA Research ViennaA-1040 Austria Security Research ViennaA-1040 Austria

ISBN: (纸本)9781450329330

Case studies for evaluating tools in security testing are powerful. Although they cannot achieve the scientific rigor of formal experiments, the results can provide sufficient information to help professionals judge if a specific technology being evaluated will benefit their organization. This paper reports on a case study done for evaluating and revisiting a recently introduced combinatorial testing methodology used for web application security purposes. It further reports on undertaken practical experiments thus strengthening the applicability of combinatorial testing to web application security testing. Copyright 2014 ACM.

关键词： Combinatorial testing Penetration testing tools security testing web application security

来源：评论

学校读者我要写书评

暂无评论

Towards an Understanding of web application security Threats and Incidents

引用

Journal of Information Privacy and security 2011年第4期7卷 54-69页

作者： Gerhard Steinke[a] Emanuel Tundrea[b] & Kenmoro Kelly[a] [a] Seattle Pacific University - Seattle USA [b] Emanuel University - Oradea Romania

This paper examines a variety of sources that provide web application security vulnerabilities and incident data. In particular, the research tracks the impact of SQL Injection, Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities. A comparison of vulnerability data versus attacks that have actually resulted in data compromises is studied to determine how the type of vulnerabilities relate to actual methods used to steal data. The paper concludes with recommendations for more secure web applications.

关键词： web application security Threats and Vulnerability Databases SQL Injection Cross-Site Scripting

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：