The drastic increase of javascript exploitation attacks has led to a strong interest in developing techniques to analyze malicious javascript. Existing analysis techniques fall into two general categories: static anal...
详细信息
ISBN:
(纸本)9783319788135;9783319788128
The drastic increase of javascript exploitation attacks has led to a strong interest in developing techniques to analyze malicious javascript. Existing analysis techniques fall into two general categories: static analysis and dynamic analysis. Static analysis tends to produce inaccurate results (both false positive and false negative) and is vulnerable to a wide series of obfuscation techniques. Thus, dynamic analysis is constantly gaining popularity for exposing the typical features of malicious javascript. However, existing dynamic analysis techniques possess limitations such as limited code coverage and incomplete environment setup, leaving a broad attack surface for evading the detection. To overcome these limitations, we present the design and implementation of a novel javascript forced execution engine named JSForce which drives an arbitrary javascript snippet to execute along different paths without any input or environment setup. We evaluate JSForce using 220,587 HTML and 23,509 PDF real-world samples. Experimental results show that by adopting our forced execution engine, the malicious javascript detection rate can be substantially boosted by 206.29% using same detection policy without any noticeable false positive increase.
Asynchronous client-server communication is a common source of errors in javascript web applications. Such errors are difficult to detect using ordinary testing because of the nondeterministic scheduling of AJAX event...
详细信息
ISBN:
(纸本)9781450355735
Asynchronous client-server communication is a common source of errors in javascript web applications. Such errors are difficult to detect using ordinary testing because of the nondeterministic scheduling of AJAX events. Existing automated event race detectors are generally too imprecise or too inefficient to be practically useful. To address this problem, we present anew approach based on a light-weight combination of dynamic analysis and controlled execution that directly targets identification of harmful AJAX event races. We experimentally demonstrate using our implementation, AJAX RACER, that this approach is capable of automatically detecting harmful AJAX event races in many websites, and producing informative error messages that support diagnosis and debugging. Among 20 widely used web pages that use AJAX, AjAxRAcER discovers harmful AJAX races in 12 of them, with a total of 72 error reports, and with very few false positives.
Bluetooth Low Energy (BLE) is currently the dominating wireless network solution for eHealth and sports. However, most BLE sensors require dedicated applications with limited development capabilities. This paper prese...
详细信息
ISBN:
(纸本)9781538642948
Bluetooth Low Energy (BLE) is currently the dominating wireless network solution for eHealth and sports. However, most BLE sensors require dedicated applications with limited development capabilities. This paper presents a method for rapid development of applications in distributed BLE IoT systems for eHealth and sports. The method is implemented as a javascript web framework based on HTML5 canvas, WebSocket and Web Bluetooth APIs. This paper demonstrates how the framework can be applied to develop an application for monitoring physical activity and heart rate. The framework enables software and service operators to iteratively create, tune and deploy filter algorithms in distributed BLE IoT systems, without rebooting nodes or restarting programs using dynamic software updating.
jQuery is a javascript library which can he used by developers when creating webpages. It gained popularity among web developm for normalizing web APIs in a time when browser incompatibilities were more common. Howeve...
详细信息
ISBN:
(纸本)9781728119700
jQuery is a javascript library which can he used by developers when creating webpages. It gained popularity among web developm for normalizing web APIs in a time when browser incompatibilities were more common. However, modern browser vendors have adopted API standards which diminish the need for such a library. When these modern API standar& are used instead of IQuery, page size is lowered. causing an improvement in page performance. This paper introduces a tool called utliQuerify which can transform snippets that make use of jQuery's functionalities into equivalent code that uses modern web API standards. uniQuerify also aids developers by displaying relevant documentation and the steps taken to transform the code, increasing developer familiarity with modern APIs.
javascript has seen meteoric growth in popularity as it has increasingly become the language of choice for developers, both for front-end web development and server code development through various javascript framewor...
详细信息
ISBN:
(纸本)9781450358033
javascript has seen meteoric growth in popularity as it has increasingly become the language of choice for developers, both for front-end web development and server code development through various javascript frameworks and ***. Part of the reason for its wide use is that it is a prototype based language with dynamic types, making it easy to learn and program in. This flexibility and ease of programming comes at the cost of performance. There are two sources of significant slowdown. First, since the number and type of properties of prototypes is dynamic, accessing a property involves a slow dictionary lookup, as opposed to it being present at a fixed offset from the base address. Second, the dynamism in type of values necessitates wrapping and unwrapping of values into objects with a variety of checks including for type of the value. To mitigate these performance problems, this paper proposes JSCore, a core specialized for javascript execution, that vastly reduces the performance degradation due to the above two causes. It uses a hardware lookup table to accelerate property access, and extends the data path to store data types with the data, nearly eliminating the second source of slowdown. Combining the two, JSCore accelerates real world javascript applications by 23%.
With the increasing popularity of the web, some new web technologies emerged and introduced dynamics to web applications, in comparison to HTML, as a static programming language. javascript is the language that provid...
详细信息
ISBN:
(纸本)9781538649275
With the increasing popularity of the web, some new web technologies emerged and introduced dynamics to web applications, in comparison to HTML, as a static programming language. javascript is the language that provided a dynamic web site which actively communicates with users. javascript is used in today's web applications as a client script language and on the server side. The javascript language supports the Model View Controller (MVC) architecture that maintains a readable code and clearly separates parts of the program code. The topic of this research is to compare the popular javascript frameworks: AngularJS, Ember, Knockout, Backbone. All four frameworks are based on MVC or similar architecture. In this paper, the advantages and disadvantages of each framework, the impact on application speed, the ways of testing such JS applications and ways to improve code security are presented.
We present a novel, unified approach to the development of compositional symbolic execution tools, which bridges the gap between traditional symbolic execution and compositional program reasoning based on separation l...
详细信息
ISBN:
(纸本)9781450364416
We present a novel, unified approach to the development of compositional symbolic execution tools, which bridges the gap between traditional symbolic execution and compositional program reasoning based on separation logic. We apply our approach to javascript, providing support for full verification, whole-program symbolic testing, and automatic compositional testing based on bi-abduction.
Record-replay techniques are developed to facilitate debugging client-side javascript application failures. They faithfully record all events that reveal a failure, but record many events irrelevant to the failure. De...
详细信息
ISBN:
(纸本)9781538650127
Record-replay techniques are developed to facilitate debugging client-side javascript application failures. They faithfully record all events that reveal a failure, but record many events irrelevant to the failure. Delta debugging adopts the divide-and-conquer algorithm to generate a minimal event subtrace that still reveals the same failure. However, delta debugging is slow because it may generate lots of syntactically infeasible candidate event subtraces in which some events can trigger syntactical errors (e.g., ReferenceError and TypeError), and thus cannot be replayed as expected. Based on this observation, we propose EvMin, an effective and efficient approach to remove failure-irrelevant events from an event trace. We use the variable usage information (e.g., DOM variable usage) in an event to model the event's context. We require that, each event in an event subtrace has the compatible context with its corresponding one in the original event trace. In this way, we avoid generating syntactically infeasible event subtraces, and dramatically speed up delta debugging. We have implemented EvMin and evaluated it on 10 real-world javascript application failures. Our evaluation shows that EvMin generates 72% fewer event subtraces, and takes 84% less time than delta debugging.
Recent trends in IoT (Internet of Things) has seen increasing number of devices being shipped with full-fledged operating systems, allowing more complex and stateful applications written in high-level languages (e.g.,...
详细信息
ISBN:
(纸本)9781538694459
Recent trends in IoT (Internet of Things) has seen increasing number of devices being shipped with full-fledged operating systems, allowing more complex and stateful applications written in high-level languages (e.g., javascript) to be run on the edge. The benefits of pushing computations towards the edge is that one can reduce the network costs of data transmission. Just like any other distributed system, we need to guarantee in IoT the availability of running processes, and thus need a live-migration mechanism for such programs. However, well-studied VM migration techniques are costly and impractical in IoT, due to the resource constraints and diversity of devices. In this demo paper, we present a demo of ThingsMigrate [1], a javascript middleware for enabling live-migration of stateful javascript applications in a platform-independent manner, along with a web dashboard used to monitor and control the IoT devices.
WebGIS has a wide range of application requirements,but development and application require high labor and resource *** order to solve this contradiction,a SaaS mode WebGIS system is *** the statistical summary of var...
详细信息
WebGIS has a wide range of application requirements,but development and application require high labor and resource *** order to solve this contradiction,a SaaS mode WebGIS system is *** the statistical summary of various application scenarios,the system provides a variety of geographic information atomic services to choose *** can freely combine these services to implement a WebGIS system that meets their *** user interface is implemented by an online HTML editing system,and the data structure is self-made through a metadata service,and the business logic is self-made through service assembly and business *** rules are ultimately done through event processing by client-side *** the establishment of an instance,the feasibility of SaaS mode WebGIS system is verified,and users can build WebGIS system according to their own needs.
暂无评论