检索结果-内蒙古大学图书馆

您好，读者！请登录

内蒙古大学图书馆

首页
概况
党建
资源
服务
科研支持
- 论文收录引用证明
- 科技查新
知识产权
档案馆
帮助

咨询与建议

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

您的常用邮箱：*

您的手机号码：*

问题描述：

当前已输入0个字，您还可以输入200个字

全部搜索
期刊论文
图书
学位论文
标准
纸本馆藏
外文资源发现
数据库导航
超星发现

高级检索

时间限定

出版年份：

文献类型

图书期刊文献学位论文多媒体

馆藏选择

电子馆藏纸本馆藏

核心期刊

全部期刊 SCI 收录期刊 SSCI 收录期刊 EI 收录期刊 CSCD 收录期刊 CSSCI 收录期刊

语言

中文英文

文献类型

期刊文献图书学位论文标准纸本馆藏

帮助

文字说明：

T=题名（书名、题名），A=作者（责任者），K=主题词，P=出版物名称，PU=出版社名称，O=机构（作者单位、学位授予单位、专利申请人），L=中图分类号，C=学科分类号，U=全部字段，Y=年（出版发行年、学位年度、标准发布年）

检索规则说明：

AND代表“并且”；OR代表“或者”；NOT代表“不包含”；(注意必须大写,运算符两边需空一格)

检索范例：

范例一：(K=图书馆学 OR K=情报学) AND A=范并思 AND Y=1982-2016
范例二：P=计算机应用与软件 AND (U=C++ OR U=Basic) NOT K=Visual AND Y=2011-2016

分类表

所选分类

>> <<

限定检索结果

文献类型

113 篇 会议
61 篇 期刊文献
7 篇 学位论文
1 册 图书

馆藏范围

182 篇 电子文献
0 种 纸本馆藏

日期分布

学科分类号

165 篇 工学
- 145 篇 计算机科学与技术...
- 49 篇 软件工程
- 44 篇 电气工程
- 19 篇 信息与通信工程
- 11 篇 控制科学与工程
- 9 篇 网络空间安全
- 3 篇 电子科学与技术（可...
- 2 篇 仪器科学与技术
- 2 篇 材料科学与工程（可...
- 2 篇 测绘科学与技术
- 2 篇 生物医学工程（可授...
- 2 篇 安全科学与工程
- 1 篇 机械工程
- 1 篇 土木工程
- 1 篇 石油与天然气工程
- 1 篇 交通运输工程
- 1 篇 食品科学与工程（可...
- 1 篇 生物工程
10 篇 管理学
- 7 篇 管理科学与工程(可...
- 4 篇 图书情报与档案管...
7 篇 理学
- 3 篇 数学
- 2 篇 化学
- 2 篇 生物学
- 1 篇 地理学
- 1 篇 地球物理学
6 篇 教育学
- 6 篇 教育学
3 篇 医学
- 1 篇 临床医学
- 1 篇 公共卫生与预防医...
2 篇 法学
- 2 篇 社会学
2 篇 文学
- 2 篇 新闻传播学

主题

182 篇 web application ...
17 篇 sql injection
13 篇 machine learning
12 篇 xss
11 篇 software securit...
11 篇 cross-site scrip...
9 篇 anomaly detectio...
9 篇 static analysis
7 篇 vulnerability de...
6 篇 cyber security
6 篇 penetration test...
6 篇 access control
6 篇 cross site scrip...
5 篇 deep learning
5 篇 web application ...
5 篇 security vulnera...
5 篇 security testing
5 篇 network security
5 篇 sql injection at...
4 篇 secure coding

机构

3 篇 malviya natl ins...
2 篇 beijing univ tec...
2 篇 natl inst techno...
2 篇 king abdulaziz u...
2 篇 univ sains malay...
2 篇 vanderbilt univ ...
2 篇 utp univ sci & t...
2 篇 arab open univ f...
2 篇 katholieke univ ...
2 篇 virginia tech | ...
2 篇 univ putra malay...
2 篇 stanford univ st...
1 篇 univ bridgeport ...
1 篇 int islamic univ...
1 篇 univ washington ...
1 篇 ilma univ fac co...
1 篇 saarland univ sa...
1 篇 king abdulaziz u...
1 篇 department of co...
1 篇 chonnam natl uni...

作者

4 篇 deepa g.
4 篇 zaaba zarul fitr...
4 篇 thilagam p. sant...
4 篇 marashdih abdall...
3 篇 govil mahesh cha...
3 篇 kozik rafal
3 篇 sabelfeld andrei
3 篇 johns martin
3 篇 choras michal
3 篇 gupta mukesh kum...
3 篇 joosen wouter
3 篇 xue yuan
3 篇 singh girdhari
3 篇 pais alwyn r.
3 篇 desmet lieven
2 篇 ko ryan k. l.
2 篇 walden james
2 篇 alhuzali abeer
2 篇 visaggio corrado...
2 篇 samsudin khairul...

语言

180 篇 英文
1 篇 葡萄牙文
1 篇 中文

检索条件"主题词=Web Application Security"

共 182 条记录，以下是61-70 订阅

全选清除本页清除全部题录导出标记到"检索档案"

详细简洁

排序：

Detection and Removing Cross Site Scripting Vulnerability in PHP web application

Detection and Removing Cross Site Scripting Vulnerability in...

引用

International Conference on Promising Electronic Technologies (ICPET)

作者： Marashdih, Abdalla Wasef Zaaba, Zarul Fitri Univ Sains Malaysia Sch Comp Sci Minden 11800 Pulau Pinang Malaysia

ISBN: (纸本)9781538622698

Cross Site Scripting (XSS) vulnerability acts as one of the chief widespread security issues in web applications. By reviewing the literature pertaining to XSS vulnerability, it has been found that many investigations have directed their energy only on XSS vulnerability detection, but not many studies have concentrated on removing XSS vulnerability. This paper embed the removal stage of XSS vulnerability to our previous approach of detection XSS vulnerability, in a way to make the approach fully to detect and remove XSS vulnerability from PHP source code. We conducted two experiments to detect and remove Reflected and Stored XSS vulnerability. The results show that our approach is able to detect and remove XSS vulnerability in PHP source code. More research is required in the field of removing XSS vulnerability from the application source code before deployment.

关键词： Cross Site Scripting security Vulnerability Software security XSS Vulnerability Removal web application security

来源：评论

学校读者我要写书评

暂无评论

Static Analysis for web Service security - Tools & Techniques for a Secure Development Life Cycle

Static Analysis for Web Service Security - Tools & Technique...

引用

IEEE International Symposium on Technologies for Homeland security (HST)

作者： Masood, Adnan Java, Jim Nova Southeastern Univ Grad Sch Comp & Informat Sci Ft Lauderdale FL 33314 USA

ISBN: (纸本)9781479917372

In this ubiquitous IoT (Internet of Things) era, web services have become a vital part of today's critical national and public sector infrastructure. With the industry wide adaptation of service-oriented architecture (SOA), web services have become an integral component of enterprise software eco-system, resulting in new security challenges. web services are strategic components used by wide variety of organizations for information exchange on the internet scale. The public deployments of mission critical APIs opens up possibility of software bugs to be maliciously exploited. Therefore, vulnerability identification in web services through static as well as dynamic analysis is a thriving and interesting area of research in academia, national security and industry. Using OWASP (Open web application security Project) web services guidelines, this paper discusses the challenges of existing standards, and reviews new techniques and tools to improve services security by detecting vulnerabilities. Recent vulnerabilities like Shellshock and Heartbleed has shifted the focus of risk assessment to the application layer, which for majority of organization means public facing web services and web/mobile applications. RESTFul services have now become the new service development paradigm normal;therefore SOAP centric standards such as XML Encryption, XML Signature, WS-security, and WS-SecureConversation are nearly not as relevant. In this paper we provide an overview of the OWASP top 10 vulnerabilities for web services, and discuss the potential static code analysis techniques to discover these vulnerabilities. The paper reviews the security issues targeting web services, software/program verification and security development life-cycle.

关键词： Static Code Analysis RESTFul API SOA web Services Cyber security Secure Design Secure Software Development Secure Software Development SOAP Source Code Analysis security Code Review Static Analysis Tool Service Oriented Architecture web Services security web application security Penetration Testing

来源：评论

学校读者我要写书评

暂无评论

An Approach to Generate Realistic HTTP Parameters for application Layer Deception 20th

An Approach to Generate Realistic HTTP Parameters for Applic...

引用

20th International Conference on Applied Cryptography and Network security (ACNS)

作者： Sahin, Merve Hebert, Cedric Lozoya, Rocio Cabrera SAP Secur Res Sophia Antipolis France

ISBN: (纸本)9783031092343;9783031092336

Deception is a form of active defense that aims to confuse and divert attackers who try to tamper with a system. Deceptive techniques have been proposed for web application security, in particular, to enrich a given application with deceptive elements such as honey cookies, HTTP parameters or HTML comments. Previous studies describe how to automatically add and remove such elements into the application traffic, however, the elements themselves need to be decided manually, which is a tedious task (especially for large-scale applications) and makes the adoption of deception more cumbersome. In this paper, we aim to automate the generation of deceptive HTTP parameter names for a given web application. Such parameters should seamlessly blend into application context and be indistinguishable from the rest of the parameters, in order to maximize the deception effect. To achieve this, we propose to use word embeddings trained with a domain-specific corpus obtained from existing web application source code. We evaluate our method through a survey, where we ask the participants to identify the deceptive parameters in two different web applications' APIs. Moreover, the survey is composed of two variants in order to further experiment with the impact of the quantity and enticement of deceptive parameters. The results confirm the effectiveness of our method in generating indistinguishable honey parameter names. We also find that the participants' expectation of the ratio of honey parameters remains constant, regardless of the actual number. Thus, a higher number of honeytokens can provide a stronger defense. Moreover, making attackers aware of deception can help to obfuscate the real attack surface, e.g., by masquerading more than 10% of the real application elements to look like traps. Finally, although our work focuses on the generation of parameter names, we also discuss other related challenges in a holistic way, and provide multiple directions for future research.

关键词： web application security Deception Active defense

来源：评论

学校读者我要写书评

暂无评论

Payload Recognition and Detection of Cross Site Scripting Attack 2

Payload Recognition and Detection of Cross Site Scripting At...

引用

2nd International Conference on Anti-Cyber Crimes (ICACC)

作者： Zalbina, M. Ridwan Septian, Tri Wanda Stiawan, Deris Idris, Moh. Yazid Heryanto, Ahmad Budiarto, Rahmat Sriwijaya Univ Fac Comp Sci Dept Comp Engn Inderalaya Indonesia Univ Teknol Malaysia Fac Comp Johor Baharu Malaysia Albaha Univ Coll Comp Sci & IT Albaha Saudi Arabia

ISBN: (纸本)9781509058143

web application becomes the leading solution for the utilization of systems that need access globally, distributed, cost-effective, as well as the diversity of the content that can run on this technology. At the same time web application security have always been a major issue that must be considered due to the fact that 60% of Internet attacks targeting web application platform. One of the biggest impacts on this technology is Cross Site Scripting (XSS) attack, the most frequently occurred and are always in the TOP 10 list of Open web application security Project (OWASP). Vulnerabilities in this attack occur in the absence of checking, testing, and the attention about secure coding practices. There are several alternatives to prevent the attacks that associated with this threat. Network Intrusion Detection System can be used as one solution to prevent the influence of XSS Attack. This paper investigates the XSS attack recognition and detection using regular expression pattern matching and a preprocessing method. Experiments are conducted on a testbed with the aim to reveal the behaviour of the attack.

关键词： component Cross Site Scripting (XSS) NIDS web application security data payload regular expression

来源：评论

学校读者我要写书评

暂无评论

SQL Injection is Still Alive: A Study on SQL Injection Signature Evasion Techniques

SQL Injection is Still Alive: A Study on SQL Injection Signa...

引用

International Conference on Informatics and Creative Multimedia (ICICM)

作者： Sadeghian, Amirmohammad Zamani, Mazdak Ibrahim, Suhaimi Univ Teknol Malaysia Adv Informat Sch Kuala Lumpur Malaysia

ISBN: (纸本)9780769551333

SQL injection is one of the biggest challenges for the web application security. Based on the studies by OWASP, SQL injection has the highest rank in the web based vulnerabilities. In case of a successful SQL injection attack, the attacker can have access to the web application database. With the rapid rise of SQL injection based attacks, researchers start to provide different security solutions to protect web application against them. One of the most common solutions is the using of web application firewalls. Usually these firewalls use signature based technique as the main core for the detection. In this technique the firewall checks each packet against a list of predefined SQL injection attacks known as signatures. The problem with this technique is that, an attacker with a good knowledge of SQL language can change the look of the SQL queries in a way that firewall cannot detect them but still they lead to the same malicious results. In this paper first we described the nature of SQL injection attack, then we analyzed current SQL injection detection evasion techniques and how they can bypass the detection filters, afterward we proposed a combination of solutions which helps to mitigate the risk of SQL injection attack.

关键词： SQL injection Signature Evasion IDS IPS Firewall web application security

来源：评论

学校读者我要写书评

暂无评论

Towards a Secure SCRUM Process for Agile web application Development 17

Towards a Secure SCRUM Process for Agile Web Application Dev...

引用

12th International Conference on Availability, Reliability and security (ARES)

作者： Maier, Patrik Ma, Zhendong Bloem, Roderick Graz Univ Technol Inst Appl Informat Proc & Commun Graz Austria Austrian Inst Technol Ctr Digital Safety & Secur Vienna Austria

ISBN: (纸本)9781450352574

Agile development such as Scrum and Extreme Programming deliver software in short iterations for quick response to rapid business requirement and market changes. However, established secure software development methodologies are mostly based on linear models such as waterfall and V-model, making them unsuitable for direct application in an agile environment. This paper presents a proposal for integrating security activities into Scrum process for developing secure web applications. We identify gaps in existing approaches to secure agile development and analyze established security engineering activities. We then adapt these activities and orchestrate them into Scrum development process to achieve both security and agility. Our proposal is evaluated by a Scrum team developing commercial JAVA EE applications in an opinion survey.

关键词： secure Scrum agile development Secure Development Lifecycle (SDL) web application security

来源：评论

学校读者我要写书评

暂无评论

Half-Baked Cookies: Hardening Cookie-Based Authentication for the Modern web 16

Half-Baked Cookies: Hardening Cookie-Based Authentication fo...

引用

11th ACM Asia Conference on Computer and Communications security (ASIA CCS)

作者： Mundada, Yogesh Feamster, Nick Krishnamurthy, Balachander Georgia Tech Atlanta GA 30332 USA Princeton Univ Princeton NJ 08544 USA AT&T Labs Res Florham Pk NJ USA

ISBN: (纸本)9781450342339

Modern websites use multiple authentication cookies to allow visitors to the site different levels of access. The complexity of modern web applications can make it difficult for a web application programmer to ensure that the use of authentication cookies does not introduce vulnerabilities. Even when a programmer has access to all of the source code, this analysis can be challenging;the problem becomes even more vexing when web programmers cobble together off-the-shelf libraries to implement authentication. We have assembled a checklist for modern web programmers to verify that the cookie based authentication mechanism is securely implemented. Then, we developed a tool, Newton, to help a web application programmer to identify authentication cookies for specific parts of the website and to verify that they are securely implemented according to the checklist. We used Newton to analyze 149 sites, including the Alexa top-200 and many other popular sites across a range of categories including search, shopping, and finance. We found that 113 of them-including high-profile sites such as Yahoo, Amazon, and Fidelity-were vulnerable to hijacking attacks. Many websites have already acknowledged and fixed the vulnerabilities that we found using Newton and reported to them.

关键词： web application security browser cookies

来源：评论

学校读者我要写书评

暂无评论

XSS Attack Prevention Using DOM-Based Filter 4th

XSS Attack Prevention Using DOM-Based Filter

引用

4th International Conference on Advanced Computing, Networking and Informatics (ICACNI)

作者： Dalai, Asish Kumar Ankush, Shende Dinesh Jena, Sanjay Kumar Natl Inst Technol Rourkela Rourkela India Maverick Labs Pvt Ltd Pune Maharashtra India

ISBN: (纸本)9789811033766;9789811033759

Cross-site scripting (XSS) is one of the most critical vulnerabilities found inweb applications. XSS vulnerability present inweb application that takes untrusted data and sends it to a web browser without proper input validation. XSS attack allows the adversary to execute scripts in the victim browser which can deface web sites, hijack user sessions, or redirect the user to malicious contents. Some of the proposed methods to XSS attack include the use of regular expressions to identify the presence of malicious content. However, this can be bypassed using parsing quirks and client-side filtering mechanisms such as Noscript and Noxes tool. The existing solutions are comparatively slow and cannot withstand against all attack vectors. Some of the existing approaches are too restrictive resulting in loss of functionality. In this paper, an API for server-side response filtering has been developed. The proposed method allows the HTML to pass through but blocks the harmful scripts. Unlike other approaches it requires a minor modification in existing web application. The performance evaluation shows that the proposed technique is having high fidelity and comparatively less response time.

关键词： XSS attack Input validation DOM web application security

来源：评论

学校读者我要写书评

暂无评论

Idea: Java vs. PHP: security Implications of Language Choice for web applications 10

Idea: Java vs. PHP: Security Implications of Language Choice...

引用

2nd International Symposium on Engineering Secure Software and Systems

作者： Walden, James Doyle, Maureen Lenhof, Robert Murray, John No Kentucky Univ Dept Comp Sci Highland Hts KY 41099 USA

ISBN: (纸本)9783642117466

While Java and PEEP are two of the most popular languages for open source web applications found at ***, Java has had a much better security reputation than PHP. In this paper, we examine whether that reputation is deserved. We studied whether the variation in vulnerability density is greater between languages or between different applications written in a. single language by comparing eleven open source web applications written in Java with fourteen such applications written in PHP. To compare the languages, we created a Common Vulnerability Metric (CVM), which is the count of four vulnerability types common to both languages. Common Vulnerability Density (CVD) is CVM normalized by code size. We measured CVD for two revisions of each project, one from 2006 and the other from 2008. CVD values were higher for the aggregate PHP code base than the Java code base, but PEEP had a better rate of improvement, with a decline from 6.25 to 2.36 vulnerabilities/KLOC compared to 1.15 to 0.63 in Java. These changes arose from an increase in code size in both languages and a decrease in vulnerabilities in PHP. The variation between projects was greater than the variation between languages, ranging from 0.52 to 14.39 for Java and 0.03 to 121.36 in PHP for 2006. We used security and software metrics to examine the sources of difference between projects.

关键词： web application security security metrics open source

来源：评论

学校读者我要写书评

暂无评论

A Survey on web application Vulnerabilities and Countermeasures

A Survey on Web Application Vulnerabilities and Countermeasu...

引用

6th International Conference on Computer Sciences and Convergence Information Technology (ICCIT)

作者： Atashzar, Hasty Torkaman, Atefeh Bahrololum, Marjan Tadayon, Mohammad H. ICT Research Institute (ITRC) Iran

ISBN: (纸本)9788988678558

security vulnerabilities continue to infect web applications, allowing attackers to access sensitive data and exploiting legitimate web sites as a hosting ground for malware. Consequently, researchers have focused on various approaches to detect and prevent critical classes of security vulnerabilities in web applications, including anomaly-based and misuse-based detection mechanisms, static and dynamic server-side and client-side web application security policy enforcement. This paper present a survey on web application security aspects includes critical vulnerabilities, hacking tools and also approaches to improve web application and websites security level.

关键词： web application security web application Vulnerabilities Fundamental and Mitigating Solution

来源：评论

学校读者我要写书评

暂无评论

没有更多数据了...

全选清除本页清除全部题录导出标记到“检索档案”

共19页 << < 3 4 5 6 7 8 9 10 11 12 > >>

检索报告对象比较合并检索0

隐藏清空

合并搜索

回到顶部

执行限定条件

内容：

评分：

请选择保存的检索档案：

请选择收藏分类：

订阅名称：

通借通还

温馨提示：

图书名称：

借书校区：

取书校区：

手机号码：

邮箱地址：

一卡通帐号：

电话和邮箱必须正确填写，我们会与您联系确认。

联系人：

所在院系：

联系邮箱：

联系电话：

内蒙古自治区呼和浩特市赛罕区大学西街235号邮编: 010021

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：