检索结果-内蒙古大学图书馆

20th International Conference on Computational Science and Its Applications (ICCSA)

作者： Hegedus, Peter MTA SZTE Res Grp Artificial Intelligence Szeged Hungary

ISBN: (纸本)9783030588113;9783030588106

Software security has become a primary concern for both the industry and academia in recent years. As dependency on critical services provided by software systems grows globally, a potential security threat in such systems poses higher and higher risks (e.g. economical damage, a threat to human life, criminal activity). Finding potential security vulnerabilities at the code level automatically is a very popular approach to aid security testing. However, most of the methods based on machine learning and statistical models stop at listing potentially vulnerable code parts and leave their validation and mitigation to the developers. Automatic program repair could fill this gap by automatically generating vulnerability mitigation code patches. Nonetheless, it is still immature, especially in targeting security-relevant fixes. In this work, we try to establish a path towards automatic vulnerability fix generation techniques in the context of javascript programs. We inspect 361 actual vulnerability mitigation patches collected from vulnerability databases and GitHub. We found that vulnerability mitigation patches are not short on average and in many cases affect not just program code but test code as well. These results point towards that a general automatic repair approach targeting all the different types of vulnerabilities is not feasible. The analysis of the code properties and fix patterns for different vulnerability types might help in setting up a more realistic goal in the area of automatic javascript vulnerability repair.

关键词： Security Vulnerability javascript Prediction models Automatic repair

来源：评论

学校读者我要写书评

暂无评论

AN OPTIMIZATION METHOD OF javascript REDUNDANT CODE ELIMINATION BASED ON HYBRID ANALYSIS TECHNIQUE 17

AN OPTIMIZATION METHOD OF JAVASCRIPT REDUNDANT CODE ELIMINAT...

引用

17th IEEE International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP)

作者： Gao Qiong Li Wenmin Beijing Univ Posts & Telecommun Network Secur Ctr Inst Cyberspace Secur Beijing 100876 Peoples R China

ISBN: (纸本)9780738142593

Many websites import large javascript (JS) libraries to speed up development time and enhance user experience. However, many JS libraries that only partially utilized during page loading are all packaged into bundles. Redundant JS code inflates the page weight, which inflates the time it takes to download, parse, and compile JS resources. Therefore, it is very important to optimize the payload of JS resources to improve Web performance. This paper proposes a scheme combining static structure analysis technique and dynamic tracking technique to identify unused code during application execution and optimize the size of application bundle. Through the dependency relationship between the third-party libraries, this paper designed an analysis structure, which extract various types of function information to improve the redundant functions detection efficiency. After that, in the construction of the application bundle, this paper eliminated the redundant JS code. Our experiments show that the scheme is simple and effective, and reduces the amount of code in the bundle by 32.64% on average, and improves the accuracy by 23% on average compared with the coverage API redundancy detection tool. On the basis of ensuring the robustness of the code, the loading performance of the application is optimized.

关键词： javascript Redundant function detection Code optimization Hybrid analysis technique

来源：评论

学校读者我要写书评

暂无评论

1+X证书制度下高职“javascript程序设计”课程标准开发

引用

辽宁农业职业技术学院学报 2023年第1期25卷 29-33页

作者：韩芝萍柴方艳刘玉兵曹根军黑龙江农业经济职业学院黑龙江牡丹江157041

对比“1+X”Web前端开发技能等级证书制度要求,传统的“javascript程序设计”课程标准存在着课程目标与岗位需求不匹配,课程内容关联性、针对性不强,教学方式方法缺少多元互补,课程考核评价标准体系不完善等缺陷,重点从课程目标定位、... 详细信息

对比“1+X”Web前端开发技能等级证书制度要求,传统的“javascript程序设计”课程标准存在着课程目标与岗位需求不匹配,课程内容关联性、针对性不强,教学方式方法缺少多元互补,课程考核评价标准体系不完善等缺陷,重点从课程目标定位、课程内容重构、改革教学方法、创新课程评价等方面对课程标准进行修订,修订后的课程标准有效对接Web前端技能等级证书标准,有效适应岗位能力需求,有效提升软件开发专业人才培养质量。

关键词： Web前端开发 javascript 课程标准人才培养质量

来源：评论

学校读者我要写书评

暂无评论

Investigating and recommending co-changed entities for javascript programs

引用

JOURNAL OF SYSTEMS AND SOFTWARE 2021年 180卷

作者： Jiang, Zijian Zhong, Hao Meng, Na Virginia Polytech Inst & State Univ Blacksburg VA 24060 USA Shanghai Jiao Tong Univ Shanghai 200240 Peoples R China

javascript (JS) is one of the most popular programming languages due to its flexibility and versatility, but maintaining JS code is tedious and error-prone. In our research, we conducted an empirical study to characterize the relationship between co-changed software entities (e.g., functions and variables), and built a machine learning (ML)-based approach to recommend additional entity to edit given developers' code changes. Specifically, we first crawled 14,747 commits in 10 open-source projects;for each commit, we created at least one change dependency graph (CDG) to model the referencer-referencee relationship between co-changed entities. Next, we extracted the common subgraphs between CDGs to locate recurring co-change patterns between entities. Finally, based on those patterns, we extracted code features from co-changed entities and trained an ML model that recommends entities-to-change given a program commit. According to our empirical investigation, (1) three recurring patterns commonly exist in all projects;(2) 80%-90% of co-changed function pairs either invoke the same function(s), access the same variable( s), or contain similar statement(s);(3) our ML-based approach CoRec recommended entity changes with high accuracy (73%-78%). CoRec complements prior work because it suggests changes based on program syntax, textual similarity, as well as software history;it achieved higher accuracy than two existing tools in our evaluation. (C) 2021 Elsevier Inc. All rights reserved.

关键词： Multi-entity edit Change suggestion Machine learning javascript

来源：评论

学校读者我要写书评

暂无评论

Dynamic Property Caches A Step towards Faster javascript Proxy Objects 2020

Dynamic Property Caches A Step towards Faster JavaScript Pro...

引用

29th ACM SIGPLAN International Conference on Compiler Construction (CC)

作者： Serrano, Manuel Findler, Robert Bruce Univ Cote Azur INRIA Sophia Antipolis France Northwestern Univ Evanston IL USA

ISBN: (纸本)9781450371209

Inline caches and hidden classes are two essential components for closing the performance gap between static languages such as Java, Scheme, or ML and dynamic languages such as javascript or Python. They rely on the observation that for a particular object access located at a particular point of the program, the shapes, usually referred to as the hidden classes, of accessed objects are likely to be the same. Taking benefit of that invariant, they replace the expensive lookup the semantics of these languages normally demand with one test, the inline cache, and a memory read indexed by an offset computed during the last cache miss. These optimizations are essential but they are not general enough to cope with javascript's proxies. In particular, when the property name is itself unknown statically, inline cache-based optimizations always take a slow path. In this paper, we show how to generalize inline caches to cope with an unknown property name. The paper first discusses the general principle of the extension and then presents the experimental results we collected using a modified version of the Hop javascript compiler, demonstrating how the optimization is crucial for improving the performance of proxy objects (as they naturally use dynamic property names extensively). The evaluation report shows that the modified Hop outperforms all other implementations of the language, including the most efficient commercial ones, by a factor ranging from 2x to 100x. Even better, our optimizations are applicable to existing compilers as they require only straightforward changes to runtime data structures;no complex analyses are required.

关键词： javascript Hidden Classes Inline Caches

来源：评论

学校读者我要写书评

暂无评论

JSKernel: Fortifying javascript against Web Concurrency Attacks via a Kernel-like Structure 50

JSKernel: Fortifying JavaScript against Web Concurrency Atta...

引用

50th IEEE/IFIP Annual International Conference on Dependable Systems and Networks (DSN)

作者： Chen, Zhanhao Cao, Yinzhi Palo Alto Networks Santa Clara CA 95054 USA Johns Hopkins Univ Baltimore MD 21218 USA

ISBN: (纸本)9781728158099

As portals to the Internet, web browsers constitute prominent targets for attacks. Existing defenses that redefine web APIs typically capture information related to a single javascript function. Thus, they fail to defend against the so-called web concurrency attacks that use multiple interleaved functions to trigger a browser vulnerability. In this paper, we propose JSKERNEL, the first generic framework that introduces a kernel concept into javascript to defend against web concurrency attacks. The javascript kernel, inspired from operating system concepts, enforces the execution order of javascript events and threads to fortify security. We implement a prototype of JSKERNEL deployable as add-on extensions to three widely used web browsers, namely Google Chrome, Mozilla Firefox, and Microsoft Edge. These open-source extensions are available at (https://***/jskernel2019/jskernel) along with a usability demo at (https://***/). Our evaluation shows the prototype to be robust to web concurrency attacks, fast, and backward compatible with legacy websites.

关键词： javascript Side channel Attacks Web Concurrency Attacks

来源：评论

学校读者我要写书评

暂无评论

JSidentify: A Hybrid Framework for Detecting Plagiarism Among javascript Code in Online Mini Games 42

JSidentify: A Hybrid Framework for Detecting Plagiarism Amon...

引用

42nd ACM/IEEE International Conference on Software Engineering - Companion Proceedings (ICSE-Companion) / 42nd ACM/IEEE International Conference on Software Engineering - Software Engineering in Practice (ICSE-SEIP)

作者： Xia, Qun Zhou, Zhongzhu Li, Zhihao Xu, Bin Zou, Wei Chen, Zishun Ma, Huafeng Liang, Gangqiang Lu, Haochuan Guo, Shiyu Xiong, Ting Deng, Yuetang Xie, Tao Tencent Inc Shenzhen Peoples R China Sun Yat Sen Univ Guangzhou Peoples R China Fudan Univ Shanghai Peoples R China Peking Univ Beijing Peoples R China

ISBN: (纸本)9781450371230

Online mini games are lightweight game apps, typically implemented in javascript (JS), that run inside another host mobile app (such as WeChat, Baidu, and Alipay). These mini games do not need to be downloaded or upgraded through an app store, making it possible for one host mobile app to perform the aggregated services of many apps. Hundreds of millions of users play tens of thousands of mini games, which make a great profit, and consequently are popular targets of plagiarism. In cases of plagiarism, deeply obfuscated code cloned from the original code often embodies malicious code segments and copyright infringements, posing great challenges for existing plagiarism detection tools. To address these challenges, in this paper, we design and implement JSidentify, a hybrid framework to detect plagiarism among online mini games. JSidentify includes three techniques based on different levels of code abstraction. JSidentify applies the included techniques in the constructed priority list one by one to reduce overall detection time. Our evaluation results show that JSidentify outperforms other existing related state-of-the-art approaches and achieves the best precision and recall with affordable detection time when detecting plagiarism among online mini games and clones among general JS programs. Our deployment experience of JSidentify also shows that JSidentify is indispensable in the daily operations of online mini games in WeChat.

关键词： Plagiarism Detection Online Mini Games javascript Clone Detection

来源：评论

学校读者我要写书评

暂无评论

课程思政与javascript程序设计课程教学融合研究

引用

新教育时代电子杂志（学生版） 2023年第4期 166-168页

作者：刘小芬尤澜涛苏州工业园区服务外包职业学院江苏苏州 215125 苏州工业园区服务外包职业学院江苏苏州 215125

党的十八大以来，党中央高度重视培养社会主义建设者和接班人，坚持把立德树人作为教育的根本任务，不断开创我国教育事业发展新局面。本文以计算机软件专业课程《javascript 程序设计》为例，探索课程思政与javascript专业课程融合方... 详细信息

党的十八大以来，党中央高度重视培养社会主义建设者和接班人，坚持把立德树人作为教育的根本任务，不断开创我国教育事业发展新局面。本文以计算机软件专业课程《javascript 程序设计》为例，探索课程思政与javascript 专业课程融合方法，深度挖掘课程中蕴含的思政元素并设计教学案例，从而在专业教学中落实立德树人根本任务，培养担当民族复兴大任的时代新人。

关键词： javascript 课程思政思政资源

来源：评论

学校读者我要写书评

暂无评论

Improving Detection Accuracy for Malicious javascript Using GAN 20th

Improving Detection Accuracy for Malicious JavaScript Using ...

引用

20th International Conference on Web Engineering (ICWE)

作者： Guo, Junxia Cao, Qiyun Zhao, Rilian Li, Zheng Beijing Univ Chem Technol Coll Informat Sci & Technol Beijing Peoples R China

ISBN: (纸本)9783030505783;9783030505776

Dynamic web pages are widely used in web applications to provide better user experience. Meanwhile, web applications have become a primary target in cybercriminals by injecting malware, especially javascript, to perform malicious activities through impersonation. Thus, in order to protect users from attacks, it is necessary to detect those malicious codes before they are executed. Since the types of malicious codes increase quickly, it is difficult for the traditional static and dynamic approaches to detect new style of malicious code. In recent years, machine learning has been used in malicious code identification approaches. However, a large number of labeled samples are required to achieve good performance, which is difficult to acquire. This paper proposes an efficient method for improving the classifiers' recognition rate in detecting malicious javascript based on Generative Adversarial Networks (GAN). The output from the GAN is used to train classifiers. Experimental results show that our method can achieve better accuracy with a limited set of labeled sample.

关键词： Malicious code detection javascript GAN Classifier

来源：评论

学校读者我要写书评

暂无评论

Optimizing Away javascript Obfuscation 20

Optimizing Away JavaScript Obfuscation

引用

20th IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM)

作者： Herrera, Adrian Def Sci & Technol Grp Canberra ACT Australia

ISBN: (纸本)9781728192482

javascript is a popular attack vector for releasing malicious payloads on unsuspecting Internet users. Authors of this malicious javascript often employ numerous obfuscation techniques in order to prevent the automatic detection by antivirus and hinder manual analysis by professional malware analysts. Consequently, this paper presents SAFE- DEOBS, a javascript deobfuscation tool that we have built. The aim of SAFE- DEOBS is to automatically deobfuscate javascript malware such that an analyst can more rapidly determine the malicious script's intent. This is achieved through a number of static analyses, inspired by techniques from compiler theory. We demonstrate the utility of SAFE-DEOBS through a case study on real-world javascript malware, and show that it is a useful addition to a malware analyst's toolset.

关键词： javascript malware obfuscation static analysis

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：