检索结果-内蒙古大学图书馆

Reusable Inline Caching for javascript Performance 2019

Reusable Inline Caching for JavaScript Performance

40th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) part of ACM's Federated Computing Research Conference (FCRC)

作者： Choi, Jiho Shull, Thomas Torrellas, Josep Univ Illinois Champaign IL 61820 USA

ISBN: (纸本)9781450367127

javascript performance is paramount to a user's browsing experience. Browser vendors have gone to great lengths to improve javascript's steady-state performance. This has led to sophisticated web applications. However, as users increasingly expect instantaneous page load times, another important goal for javascript engines is to attain minimal startup times. In this paper, we reduce the startup time of javascript programs by enhancing the reuse of compilation and optimization information across different executions. Specifically, we propose a new scheme to increase the startup performance of Inline Caching (IC), a key optimization for dynamic type systems. The idea is to represent a substantial portion of the IC information in an execution in a context-independent way, and reuse it in subsequent executions. We call our enhanced IC design Reusable Inline Caching (RIC). We integrate RIC into the state-of-the-art Google V8 javascript engine and measure its impact on the initialization time of popular javascript libraries. By recycling IC information collected from a previous execution, RIC reduces the average initialization time per library by 17%.

关键词： Inline Caching javascript Scripting Language Dynamic Typing

来源：评论

学校读者我要写书评

暂无评论

鸿蒙javascript开发初体验(2)CSS语言与盒子模型

引用

无线电 2021年第9期 54-59页

作者：程晨不详

在上一期的文章中,我们介绍了鸿蒙系统应用中的任何一个页面都对应着1个.hml文件、4个.css文件和4个.js文件,其中页面风格由.css文件定义。在这一期的文章中,我们专门介绍一下CSS语言及页面布局中非常重要的盒子模型。

关键词：页面布局盒子模型 javascript CSS 文件定义初体验

来源：评论

学校读者我要写书评

暂无评论

An Empirical Study of Information Flows in Real-World javascript 14

An Empirical Study of Information Flows in Real-World JavaSc...

引用

14th ACM SIGSAC Workshop on Programming Languages and Analysis for Security (PLAS)

作者： Staicu, Cristian-Alexandru Schoepe, Daniel Balliu, Musard Pradel, Michael Sabelfeld, Andrei Tech Univ Darmstadt Darmstadt Germany Chalmers Univ Technol Gothenburg Sweden KTH Royal Inst Technol Stockholm Sweden

ISBN: (纸本)9781450368360

Information flow analysis prevents secret or untrusted data from flowing into public or trusted sinks. Existing mechanisms cover a wide array of options, ranging from lightweight taint analysis to heavyweight information flow control that also considers implicit flows. Dynamic analysis, which is particularly popular for languages such as javascript, faces the question whether to invest in analyzing flows caused by not executing a particular branch, so-called hidden implicit flows. This paper addresses the questions how common different kinds of flows are in real-world programs, how important these flows are to enforce security policies, and how costly it is to consider these flows. We address these questions in an empirical study that analyzes 56 real-world javascript programs that suffer from various security problems, such as code injection vulnerabilities, denial of service vulnerabilities, memory leaks, and privacy leaks. The study is based on a state-of-the-art dynamic information flow analysis and a formalization of its core. We find that implicit flows are expensive to track in terms of permissiveness, label creep, and runtime overhead. We find a lightweight taint analysis to be sufficient for most of the studied security problems, while for some privacy-related code, observable tracking is sometimes required. In contrast, we do not find any evidence that tracking hidden implicit flows reveals otherwise missed security problems. Our results help security analysts and analysis designers to understand the cost-benefit tradeoffs of information flow analysis and provide empirical evidence that analyzing information flows in a cost-effective way is a relevant problem.

关键词： information flow control taint tracking javascript implicit flow

来源：评论

学校读者我要写书评

暂无评论

Filtering Malicious javascript Code with Doc2Vec on an Imbalanced Dataset 14

Filtering Malicious JavaScript Code with Doc2Vec on an Imbal...

引用

14th Annual Asia Joint Conference on Information Security (AsiaJCIS)

作者： Mimura, Mamoru Suga, Yuya Natl Def Acad 1-10-20 Hashirimizu Yokosuka Kanagawa 2398686 Japan

ISBN: (纸本)9781728125565

Drive-by download attacks are one of main threats on the Internet. Several detection methods are to build run-time environments that allow javascript code to run and track its behavior while it runs. Dynamic analysis requires too much time to examine all the web pages a client accesses. Hence, lightweight filtering methods to detect unseen malicious javascript snippets are required. Static analysis often extracts statistical and lexical features from the associated javascript code of each web page in order to build detection models. In general, static analysis imposes no runtime overhead. These methods are, however, vulnerable to code obfuscation techniques. Some researchers attempt to detect obfuscated VBA macros with Natural Language Processing (NLP) techniques. In these methods, neural networks extract the features automatically in contrast with traditional approaches. In addition, since several methods are evaluated with a balanced dataset, the practical performance is still open to discussion. To evaluate the practical performance, these methods have to be evaluated with imbalanced datasets. In this paper, we attempt to detect unseen malicious javascript snippets with Doc2Vec, an unsupervised algorithm to generate vectors for documents with neural networks. To mitigate the class imbalance problem, our method uses a clustering-based undersampling technique. Furthermore, we build a web crawler and generate an imbalanced dataset with over 20,000 samples. The evaluation result shows that our method achieves a F-measure of 0.71.

关键词： javascript Class Imbalance Problem K-means DBSCAN Word Vector Paragraph Vector Doc2vec SVM

来源：评论

学校读者我要写书评

暂无评论

On the Impact of Outdated and Vulnerable javascript Packages in Docker Images 26

On the Impact of Outdated and Vulnerable Javascript Packages...

引用

26th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)

作者： Zerouali, Ahmed Cosentino, Valerio Mens, Tom Robles, Gregorio Gonzalez-Barahona, Jesus M. UMONS Mons Belgium Bitergia Madrid Spain URJS Mostoles Spain

ISBN: (纸本)9781728105918

Containerized applications, and in particular Docker images, are becoming a common solution in cloud environments to meet ever-increasing demands in terms of portability, reliability and fast deployment. A Docker image includes all environmental dependencies required to run it, such as specific versions of system and third-party packages. Leveraging on its modularity, an image can be easily embedded in other images, thus simplifying the way of sharing dependencies and building new software. However, the dependencies included in an image may be out of date due to backward compatibility requirements, endangering the environments where the image has been deployed with known vulnerabilities. While previous research efforts have focused on studying the impact of bugs and vulnerabilities of system packages within Docker images, no attention has been given to third-party packages. This paper empirically studies the impact of npm javascript package vulnerabilities in Docker images. We based our analysis on 961 images from three official repositories that use ***, and 1,099 security reports of packages available on npm, the most popular javascript package manager. Our results reveal that the presence of outdated npm packages in Docker images increases the risk of potential security vulnerabilities, suggesting that Docker maintainers should keep their installed javascript packages up to date.

关键词： Docker npm javascript empirical analysis security vulnerability outdated software

来源：评论

学校读者我要写书评

暂无评论

IDVE: an Integrated Development and Verification Environment for javascript 19

IDVE: an Integrated Development and Verification Environment...

引用

3rd International Conference on Art, Science, and Engineering of Programming (Programming)

作者： Schuster, Christopher Flanagan, Cormac Univ Calif Santa Cruz Santa Cruz CA 95064 USA

ISBN: (纸本)9781450362573

Program verifiers statically check programs based on source code annotations such as invariants, pre- and postconditions. These annotations can be more precise than simple types. For example, a sorting routine might be annotated with a postcondition stating that its result is sorted. However, the verification process for these annotations can become complex. Therefore, simple error messages may not be sufficient to help the programmer resolve verification issues. In order to improve the programming experience for verified programming, this paper presents IDVE, an integrated development and verification environment that lets users interactively inspect and debug verification issues. The goal of IDVE is to provide a development tool that assists users with program verification analogous to how interactive step-by-step debugging avoids manual "printf debugging". IDVE enables programmers to interactively manipulate assumptions and assertions of verification conditions with a novel verification inspector, and IDVE automatically generates tests that serve as executable and debuggable counterexamples. In addition to presenting the approach and implementation of the integrated development and verification environment, we also conducted a user study with 18 participants to evaluate how the proposed features of the environment are perceived. Participants with and without prior experience with program verifiers had to solve a series of simple programming and verification tasks and answer an online survey. Features of IDVE were generally seen as helpful or potentially helpful but user interface design is an essential factor for their utility.

关键词： programming environments program verification javascript test generation interactive debugging

来源：评论

学校读者我要写书评

暂无评论

Concurrency Control of javascript with Arrows 6

Concurrency Control of JavaScript with Arrows

引用

6th International Workshop on Reactive and Event-Based Languages and Systems (REBLS)

作者： Zhao, Tian Berger, Adam Li, Yonglun Univ Wisconsin Milwaukee Milwaukee WI 53201 USA

ISBN: (纸本)9781450369862

Concurrency control is difficult in javascript programs, where event race due to asynchronous computation is a major source of errors. While methods such as promises, cancellation tokens, and reactive programming offer their own advantages in addressing this problem, none offer a complete solution. In this work, we present an integrated solution for concurrency control of javascript using a library, arrowjs, which is based on the abstraction of arrows. Arrowjs uses continuation passing style to chain callbacks and it implicitly generates progress objects to manage concurrency. Arrowjs can implement a form of push-based reactive programming, where event streams are arrowloops communicating through shared memory. Arrowjs thus provides interoperability between thread-like callback chains and event streams with a uniform concurrency control mechanism.

关键词： javascript Concurrency Arrows Reactive

来源：评论

学校读者我要写书评

暂无评论

Estimating the maintenance effort of javascript Applications 45

Estimating the maintenance effort of JavaScript Applications

引用

45th Euromicro Conference on Software Engineering and Advanced Applications (SEAA) / 22nd Euromicro Conference on Digital System Design (DSD)

作者： Zozas, Ioannis Bibi, Stamatia Ampatzoglou, Apostolos Sarigiannidis, Panagiotis Univ Western Macedonia Dept Informat & Telecommun Kozani Greece Univ Macedonia Dept Appl Informat Thessaloniki Greece

ISBN: (纸本)9781728134215

Successful software project survival and progress over time is highly dependent on effectively managing the maintenance process. Estimating accurately maintenance process factors like the maintenance effort and the level of changes required for a new release is considered a crucial task for allocating resources. In this work we examine the maintenance process factors of javascript applications, which at the moment are understudied despite the need of language specific maintenance models. Furthermore we propose two maintenance indices for estimating the changes and the effort required for maintaining javascript applications by considering a variety of maintenance drivers. We evaluated the proposed indices through a case study on 5,788 releases coming from 60 popular javascript applications. The results show that project activity factors (i.e., number of open bugs and number of corrective maintenance activities) are important maintenance drivers. The proposed indices are evaluated in terms of predictive and discriminative power and both achieve high accuracy.

关键词： software maintenance effort javascript maintenance index software development open source software

来源：评论

学校读者我要写书评

暂无评论

JSLess: A Tale of a Fileless javascript Memory-Resident Malware 15th

JSLess: A Tale of a Fileless Javascript Memory-Resident Malw...

引用

15th International Conference on Information Security Practice and Experience (ISPEC)

作者： Saad, Sherif Mahmood, Farhan Briguglio, William Elmiligi, Haytham Univ Windsor Sch Comp Sci Windsor ON Canada Thompson Rivers Univ Kamloops BC Canada

ISBN: (纸本)9783030343392;9783030343385

New computing paradigms, modern feature-rich programming languages and off-the-shelf software libraries enabled the development of new sophisticated malware families. Evidence of this phenomena is the recent growth of fileless malware attacks. Fileless malware or memory resident malware is an example of an Advanced Volatile Threat (AVT). In a fileless malware attack, the malware writes itself directly onto the main memory (RAM) of the compromised device without leaving any trace on the compromised device's file system. For this reason, fileless malware presents a difficult challenge for traditional malware detection tools and in particular signature-based detection. Moreover, fileless malware forensics and reverse engineering are nearly impossible using traditional methods. The majority of fileless malware attacks in the wild take advantage of MS PowerShell, however, fileless malware are not limited to MS PowerShell. In this paper, we designed and implemented a fileless malware by taking advantage of new features in javascript and HTML5. The proposed fileless malware could infect any device that supports javascript and HTML5. It serves as a proof-of-concept (PoC) to demonstrate the threats of fileless malware in web applications. We used the proposed fileless malware to evaluate existing methods and techniques for malware detection in web applications. We tested the proposed fileless malware with several free and commercial malware detection tools that apply both static and dynamic analysis. The proposed fileless malware bypassed all the anti-malware detection tools included in our study. In our analysis, we discussed the limitations of existing approaches/tools and suggested possible detection and mitigation techniques.

关键词： Fileless malware Unconventional malware Web vulnerabilities javascript HTML5 Polymorphic malware

来源：评论

学校读者我要写书评

暂无评论

浅谈javascript中定时器函数的教学设计

引用

电脑校园 2021年第6期 38-39页

作者：李芙蓉武汉城市职业学院，湖北武汉 430000

“javascript程序设计”是软件技术专业的必修课，是一门Web前端的专业核心课程。而定时器函数是javascript中最重要的函数。本文在教学中以简易计时器为例进行讲解，采用以学生自己实践、自主学习为主，老师引导、适时指点为辅，让学... 详细信息

“javascript程序设计”是软件技术专业的必修课，是一门Web前端的专业核心课程。而定时器函数是javascript中最重要的函数。本文在教学中以简易计时器为例进行讲解，采用以学生自己实践、自主学习为主，老师引导、适时指点为辅，让学生通过小组合作讨论交流的方式完成整节课学习的方法，提高学生利用setInterval定时器解决现实问题的能力。为学习javascript后面的知识打下坚实的基础。

关键词： javascript 定时器函数计时器 setInterval

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：