检索结果-内蒙古大学图书馆

Cloud Computing to Improve javascript Processing Efficiency of Mobile Applications

JOURNAL OF INFORMATION PROCESSING SYSTEMS 2017年第4期13卷 731-751页

作者： Kim, Daewon Dankook Univ Dept Appl Comp Engn Yongin South Korea

The burgeoning distribution of smartphone web applications based on various mobile environments is increasingly focusing on the performance of mobile applications implemented by javascript and HTML5 (Hyper Text Markup Language 5). If application software has a simple functional processing structure, then the problem is benign. However, browser loads are becoming more burdensome as the amount of javascript processing continues to increase. Processing time and capacity of the javascript in current mobile browsers are limited. As a solution, the Web Worker is designed to implement multi-threading. However, it cannot guarantee the computing ability as a native application on mobile devices, and is not sufficient to improve processing speed. The method proposed in this research overcomes the limitation of resources as a mobile client and guarantees performance by native application software by providing high computing service. It shifts the javascript process of a mobile device on to a cloud-based computer server. A performance evaluation experiment revealed the proposed algorithm to be up to 6 times faster in computing speed compared to the existing mobile browser's javascript process, and 3 to 6 times faster than Web Worker. In addition, memory usage was also less than the existing technology.

关键词： Cloud HTML5 javascript Mobile

来源：评论

学校读者我要写书评

暂无评论

A Model for Reasoning About javascript Promises

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2017年第OOPSLA期1卷 1-24页

作者： Madsen, Magnus Lhotak, Ondrej Tip, Frank Univ Waterloo Waterloo ON Canada Northeastern Univ Boston MA 02115 USA

In javascript programs, asynchrony arises in situations such as web-based user-interfaces, communicating with servers through HTTP requests, and non-blocking I/O. Event-based programming is the most popular approach for managing asynchrony, but suffers from problems such as lost events and event races, and results in code that is hard to understand and debug. Recently, ECMAScript 6 has added support for promises, an alternative mechanism for managing asynchrony that enables programmers to chain asynchronous computations while supporting proper error handling. However, promises are complex and error-prone in their own right, so programmers would benefit from techniques that can reason about the correctness of promise-based code. Since the ECMAScript 6 specification is informal and intended for implementers of javascript engines, it does not provide a suitable basis for formal reasoning. This paper presents lambda(p), a core calculus that captures the essence of ECMAScript 6 promises. Based on lambda(p), we introduce the promise graph, a program representation that can assist programmers with debugging of promise-based code. We then report on a case study in which we investigate how the promise graph can be helpful for debugging errors related to promises in code fragments posted to the StackOverflow website.

关键词： EcmaScript 6 Promises javascript Formal Semantics Promise Graph

来源：评论

学校读者我要写书评

暂无评论

Practical Initialization Race Detection for javascript Web Applications

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2017年第OOPSLA期1卷 1-22页

作者： Adamsen, Christoffer Quist Moller, Anders Tip, Frank Aarhus Univ Aarhus Denmark Northeastern Univ Boston MA 02115 USA

Event races are a common source of subtle errors in javascript web applications. Several automated tools for detecting event races have been developed, but experiments show that their accuracy is generally quite low. We present a new approach that focuses on three categories of event race errors that often appear during the initialization phase of web applications: form-input-overwritten errors, late-event-handler-registration errors, and access-before-definition errors. The approach is based on a dynamic analysis that uses a combination of adverse and approximate execution. Among the strengths of the approach are that it does not require browser modifications, expensive model checking, or static analysis. In an evaluation on 100 widely used websites, our tool INITRACER reports 1 085 initialization races, while providing informative explanations of their causes and effects. A manual study of 218 of these reports shows that 111 of them lead to uncaught exceptions and at least 47 indicate errors that affect the functionality of the websites.

关键词： event race detection javascript dynamic analysis

来源：评论

学校读者我要写书评

暂无评论

Fast and Precise Type Checking for javascript

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2017年第OOPSLA期1卷 1–30页

作者： Chaudhuri, Avik Vekris, Panagiotis Goldman, Sam Roch, Marshall Levi, Gabriel Facebook Inc Menlo Pk CA 94025 USA Univ Calif San Diego La Jolla CA 92093 USA

In this paper we present the design and implementation of FLOW, a fast and precise type checker for javascript that is used by thousands of developers on millions of lines of code at FACEBOOK every day. FLOW uses sophisticated type inference to understand common javascript idioms precisely. This helps it find non-trivial bugs in code and provide code intelligence to editors without requiring significant rewriting or annotations from the developer. We formalize an important fragment of Flow's analysis and prove its soundness. Furthermore, FLOW uses aggressive parallelization and incrementalization to deliver near-instantaneous response times. This helps it avoid introducing any latency in the usual edit-refresh cycle of rapid javascript development. We describe the algorithms and systems infrastructure that we built to scale FLow's analysis.

关键词： Type Systems Type Inference javascript

来源：评论

学校读者我要写书评

暂无评论

针对恶意javascript识别的降维方法

引用

计算机工程与应用 2018年第21期54卷 20-24,36页

作者：刘鹏睿宋礼鹏中北大学大数据学院大数据与网络安全研究所太原030051

针对将javascript代码N-gram处理后识别算法特征维度较高的问题,提出一种高效的降维方法。该方法利用TF-IDF-like模型分别计算特征在正常样本和恶意样本中的权重,基于特征权重在两类样本中的差异度进行降维。基于多个识别算法,将提出的... 详细信息

针对将javascript代码N-gram处理后识别算法特征维度较高的问题,提出一种高效的降维方法。该方法利用TF-IDF-like模型分别计算特征在正常样本和恶意样本中的权重,基于特征权重在两类样本中的差异度进行降维。基于多个识别算法,将提出的降维方法与基于主成分分析(Principal Component Analysis,PCA)的降维方法进行比较,实验结果表明:当识别算法维度相同时,基于本文所给降维方法的识别算法在识别效果方面优于基于PCA的识别算法;当降维后识别算法的维度超过某个阈值时,随着识别算法维度的增长,本降维方法的时间开销增长速率远低于PCA方法。

关键词：降维 TF-IDF-like模型特征差异度 javascript 主成分分析(PCA)

来源：评论

学校读者我要写书评

暂无评论

基于javascript的恶意网页异常检测方法研究

基于JavaScript的恶意网页异常检测方法研究

引用

作者：马洪亮北京交通大学

学位级别：博士

当前,基于Web的服务和应用已经广泛普及,每天都会有大量的用户访问Web页面,Web客户端安全也由此变得非常重要。作为Web前端开发事实上的标准语言,javascript既为用户提供了丰富便利的服务,也为用户终端带来了很多安全风险。若是Web客户... 详细信息

当前,基于Web的服务和应用已经广泛普及,每天都会有大量的用户访问Web页面,Web客户端安全也由此变得非常重要。作为Web前端开发事实上的标准语言,javascript既为用户提供了丰富便利的服务,也为用户终端带来了很多安全风险。若是Web客户端应用程序存在用户不曾预知的漏洞,或者不知情用户在访问恶意页面后操作不当,恶意网页中的javascript代码就会严重威胁客户端安全。互联网上时刻都活跃着大量的恶意网页,每天都会产生大量新的恶意网页,因此,针对恶意网页进行检测一直都是安全研究者关注的热点问题。本文在总结现有研究成果的基础上,先从攻击者的角度介绍了现有的一些攻击技术和方法,分析了相关攻击技术的特点,总结出具有不同攻击行为恶意javascript代码的相关特征。再从防护者的角度介绍了相关的检测方法,分析了各种检测方法的优缺点,重点介绍并分析了异常检测方法的特点,尤其是半监督异常检测方法。从数据收集和异常检测的角度分析了半监督异常检测方法的优点,据此给出了基于javascript对恶意网页进行异常检测的基本框架。基于此框架,从轻量级恶意网页异常检测、混淆drive-by-download攻击检测和混淆恶意javascript代码自动化反混淆三个方面提出检测方法并实现检测原型系统,主要研究内容和创新点如下:（1）提出了一种轻量级的恶意网页异常检测方法。其核心思想是将大量繁杂无规律的javascript代码用少量特征词代替,并以特征词在页面代码中的分布作为检测特征。这极大的减少了数据特征维度,并保留了代码本身的执行流程、逻辑关系和信息熵。检测方法只使用静态分析,分为数据收集、数据预处理、特征提取、检测器等几个部分。数据收集是抓取网页内容,数据预处理是将javascript代码从页面中分离出来后,再对代码进行词法解析。特征提取是以代码词法解析后的特征词分布为特征。检测器中使用的训练数据只须正常行为数据即可,通过主成分分析（PCA）、最近邻（K-NN）和单分类支持向量机（One-class SVM）三种算法检测恶意网页。从实际环境中收集了 javascript正常与恶意代码共20996条,实验结果表明,检测系统在1%误报率的情况下能达到90%的检测率,同时检测系统每秒平均能有效检测250个网页,达到了轻量级检测之目的。（2）提出了一种检测混淆drive-by-download攻击的方法。检测方法将静态分析和动态分析有机的结合起来,利用静态分析完成轻量级检测静态混淆javascript代码。根据代码变量值的变化提出了 9个动态行为特征,提出“变量劫持”技术并借鉴状态机模型对这些动态特征建模,使动态分析过程中能够即时检测混淆代码中的攻击行为,并具有一定的反混淆作用。具体而言,在静态分析中,假设正常页面不使用混淆javascript代码,即便使用也是极少。这样只须对正常页面中代码进行训练即可,以扩展后的特征词分布为特征,以测试数据与训练数据的偏移距离作为代码是否混淆依据,若偏移距离大于设定的阈值,则认为是混淆代码。在动态分析中,以从javascript代码中获取的变量初值和变量终值提取的9个动态特征作为检测混淆代码具有drive-by-download攻击行为的特征,结合“变量劫持”技术和变量状态模型检测具体攻击行为和进行反混淆。从实际环境中收集了javascript正常与恶意代码共70463条,实验结果表明,当选用PCA算法时,检测系统使用的静态分析方法对混淆drive-by-download攻击的检测在误报率为0.1%的情况下能达到99%的检测率。提出的动态分析方法能够即时检测出80%以上具有drive-by-download攻击行为的混淆代码,能够提供被检测出恶意代码的具体攻击行为信息。（3）提出并实现了一种检测混淆并能自动化反混淆javascript代码的方法和一种反混淆效果度量方法。通过对9种在线混淆工具和多种混淆技术的深入分析,总结出混淆javascript代码的普遍性外部静态行为特征和内部动态行为特征。检测系统前端通过静态分析以带权重的扩展特征词分布为检测特征,权重的计算方法是从训练样本的整体进行考虑,计算依据为:包含某个特征词样本数量较多,则该特征词权重值应该相应较大,采用One-Class SVM、K-NN和PCA算法检测混淆代码。检测系统后端通过动态分析利用抽象语法树AST（Abstract Syntax Tree）进行反混淆。动态分析分为两个步骤:首先遍历混淆代码抽象语法树AST的节点;其次根据节点类型跟踪并分析节点上的相关变量,利用相关的变量终值进行反混淆。通过对混淆操作和反混淆操作的形式化定义,提出了以编辑距离、Jaccard相似度和文本特征相似度为度量值的评价模型,达到了准确和客观的评价反混淆效果之目的。从实际

关键词：恶意网页异常检测 drive-by-download攻击 Web安全混淆反混淆静态分析动态分析 javascript

来源：评论

学校读者我要写书评

暂无评论

Dependence-Driven Delimited CPS Transformation for javascript 2016

Dependence-Driven Delimited CPS Transformation for JavaScrip...

引用

15th ACM International Conference on Generative Programming - Concepts and Experiences (GPCE)

作者： Philips, Laure De Koster, Joeri De Meuter, Wolfgang De Roover, Coen Vrije Univ Brussel Software Languages Lab Brussels Belgium

ISBN: (纸本)9781450344463

In today's web applications asynchronous requests to remote services using callbacks or futures are omnipresent. The continuation of such a non-blocking task is represented as a callback function that will later be called with the result of the request. This style of programming where the remainder of a computation is captured in a continuation function is called continuation-passing style (CPS). This style of programming can quickly lead to a phenomenon called "callback hell", which has a negative impact on the maintainability of applications that employ this style. Several alternatives to callbacks are therefore gaining traction within the web domain. For example, there are a number of frameworks that rely on automatically transforming sequential style code into the continuation-passing style. However, these frameworks often employ a conservative approach in which each function call is transformed into CPS. This conservative approach can sequentialise requests that could otherwise be run in parallel. So-called delimited continuations can remedy, but require special marks that have to be manually inserted in the code for marking the beginning and end of the continuation. In this paper we propose an alternative strategy in which we apply a delimited CPS transformation that operates on a Program Dependence Graph instead to find the limits of each continuation. We implement this strategy in javascript and demonstrate its applicability to various web programming scenarios.

关键词： CPS transformation Program Dependence Graph javascript

来源：评论

学校读者我要写书评

暂无评论

MetropolJS: Visualizing and Debugging Large-Scale javascript Program Structure with Treemaps

MetropolJS: Visualizing and Debugging Large-Scale JavaScript...

引用

IEEE Workshop on Program Comprehension

作者： Joshua D Scarsbrook Ryan K L Ko Bill Rogers David Bainbridge University of Waikato

ISBN: (数字)9781450357142

ISBN: (纸本)9781538661697

As a result of the large scale and diverse composition of modern compiled javascript applications, comprehending overall program structure for debugging is challenging. In this paper we present our solution: MetropolJS. By using a Treemap-based visualization it is possible to get a high level view within limited screen real estate. Previous approaches to Treemaps lacked the fine detail and interactive features to be useful as a debugging tool. This paper introduces an optimized approach for visualizing complex program structure that enables new debugging techniques where the execution of programs can be displayed in real time from a bird's-eye view. The approach facilitates highlighting and visualizing method calls and distinctive code patterns on top of code segments without a high overhead for navigation. Using this approach enables fast analysis of previously difficult-to-comprehend code bases.

关键词： javascript Treemaps Debugging Debugging program structure Java Script PROGRAM EXECUTION Codes code pattern

来源：评论

学校读者我要写书评

暂无评论

javascript优化编译执行模式下的动态污点分析技术

引用

清华大学学报（自然科学版） 2017年第9期57卷 932-938页

作者：梁彬龚伟刚游伟李赞石文昌数据工程与知识工程教育部重点实验室(中国人民大学) 北京100872 中国人民大学信息学院北京100872

目前,主流的javascript执行引擎为了提高效率,引入优化编译执行模式,对频繁运行的热点函数进行即时优化编译。优化编译执行模式的引入,给通过动态插桩实现javascript程序的动态污点分析(dynamic taint analysis,DTA)带来了新的挑战。针... 详细信息

目前,主流的javascript执行引擎为了提高效率,引入优化编译执行模式,对频繁运行的热点函数进行即时优化编译。优化编译执行模式的引入,给通过动态插桩实现javascript程序的动态污点分析(dynamic taint analysis,DTA)带来了新的挑战。针对这一问题,该文针对HTML5混合型安卓应用,通过修改其所使用的V8javascript引擎,基于动态插桩实现了一种优化编译执行模式下的动态污点分析方法。该方法使用污染包裹对象的方式对污点标签进行存储,在优化编译执行模式下的Hydrogen中间代码层面进行插桩操作。实验结果表明:该方法能够有效地在优化编译执行模式下进行污点跟踪,且性能开销也在可以接受的范围内。

关键词：优化编译动态污点分析(DTA) javascript

来源：评论

学校读者我要写书评

暂无评论

Semantics of Asynchronous javascript 13

Semantics of Asynchronous JavaScript

引用

13th ACM SIGPLAN International Symposium on Dynamic Languages (DLS)

作者： Loring, Matthew C. Marron, Mark Leijen, Daan Google Inc Mountain View CA 94043 USA Microsoft Res Redmond WA USA

ISBN: (纸本)9781450355261

The *** runtime has become a major platform for developers building cloud, mobile, or IoT applications using javascript. Since the javascript language is single threaded, *** programs must make use of asynchronous callbacks and event loops managed by the runtime to ensure applications remain responsive. While conceptually simple, this programming model contains numerous subtleties and behaviors that are defined implicitly by the current *** implementation. This paper presents the first comprehensive formalization of the *** asynchronous execution model and defines a high-level notion of async-contexts to formalize fundamental relationships between asynchronous events in an application. These formalizations provide a foundation for the construction of static or dynamic program analysis tools, support the exploration of alternative *** event loop implementations, and provide a high-level conceptual framework for reasoning about relationships between the execution of asynchronous callbacks in a *** application.

关键词： javascript Asynchrony

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：