检索结果-内蒙古大学图书馆

38th IEEE/ACM International Conference on Automated Software Engineering (ASE)

作者： Liu, Xinyue Ziarek, Lukasz Univ Buffalo Dept Comp Sci & Engn Buffalo NY 14068 USA

ISBN: (纸本)9798350329964

Identifying what front-end library runs on a web page is challenging. Although many mature detectors exist on the market, they suffer from false positives and the inability to detect libraries bundled by packers such as Webpack. Most importantly, the detection features they use are collected from developers' knowledge leading to an inefficient manual workflow and a large number of libraries that the existing detectors cannot detect. This paper introduces PTDETECTOR, which provides the first automated method for generating features and detecting libraries on web pages. We propose a novel data structure, the pTree, which we use as a detection feature. The pTree is well-suited for automation and addresses the limitations of existing detectors. We implement PTDETECTOR as a browser extension and test it on 200 top-traffic websites. Our experiments show that PTDETECTOR can identify packer-bundled libraries, and its detection results outperform existing tools.

关键词： Front end javascript Library Detection Web

来源：评论

学校读者我要写书评

暂无评论

Jack-in-the-box: An Empirical Study of javascript Bundling on the Web and its Security Implications 23

Jack-in-the-box: An Empirical Study of JavaScript Bundling o...

引用

30th ACM SIGSAC Conference on Computer and Communications Security (ACM CCS)

作者： Rack, Jeremy Staicu, Cristian-Alexandru CISPA Helmholtz Ctr Informat Secur Saarbrucken Germany

ISBN: (纸本)9798400700507

In recent years, we have seen an increased interest in studying the software supply chain of user-facing applications to uncover problematic third-party dependencies. Prior work shows that web applications often rely on outdated or vulnerable third-party code. Moreover, real-world supply chain attacks show that dependencies can also be used to deliver malicious code, e.g., for carrying cryptomining operations. Nonetheless, existing measurement studies in this domain neglect an important software engineering practice: developers often merge together third-party code into a single file called bundle, which they then deliver from their own servers, making it appear as first-party code. Bundlers like Webpack or Rollup are popular open-source projects with tens of thousand of GitHub stars, suggesting that this technology is widely-used by developers. Ignoring bundling may result in underestimating the complexity of modern software supply chains. In this work, we aim to address these methodological shortcomings of prior work. To this end, we propose a novel methodology for automatically detecting bundles, and partially reverse engineer them. Using this methodology, we conduct the first large-scale empirical study of bundled code on the web and examine its security implications. We provide evidence about the high prevalence of bundles, which are contained in 40% of all websites, and the average website includes more than one bundle. Following our methodology, we reidentify 1 051 vulnerabilities originating from 33 vulnerable npm packages, included in bundled code. Among the vulnerabilities, we find 17 critical and 59 high severity ones, which might enable malicious actors to execute attacks such as arbitrary code execution. Analyzing the low-rated libraries included in bundles, we discover 10 security holding packages, which suggest that supply-chain attacks affecting bundles are not only possible, but they are already happening.

关键词： software supply chain security bundles dependencies javascript

来源：评论

学校读者我要写书评

暂无评论

On the (un-)adoption of javascript front-end frameworks

引用

SOFTWARE-PRACTICE & EXPERIENCE 2022年第4期52卷 947-966页

作者： Ferreira, Fabio Borges, Hudson Silva Valente, Marco Tulio Univ Fed Minas Gerais Dept Comp Sci Belo Horizonte MG Brazil Ctr Informat IF Sudeste MG Campus Barbacena Barbacena MG Brazil Univ Fed Mato Grosso do Sul Dept Comp Sci Campo Grande MS Brazil

javascript is characterized by a rich ecosystem of libraries and frameworks. A key element in this ecosystem are frameworks used for implementing the front-end of web-based applications, such as Vue and React. However, despite their relevance, we have few works investigating the factors that drive the adoption-and un-adoption-of front-end-based javascript frameworks. Therefore, in this article, we first report the results of a survey with 49 developers where we asked them to describe the factors they consider when selecting a front-end framework. In the second part of the work, we focus on projects that migrate from one framework to another since javascript's ecosystem is also very dynamic. Finally, we provide a quantitative characterization of the migration effort and reveal the main barriers faced by the developers during this effort. Although not completely generalizable, our central findings are as follows: (a) popularity and learnability are the key factors that motivate the choice of front-end frameworks in javascript;(b) from the 49 surveyed developers, one out of four have plans to migrate to another framework in the future;(c) the time spent performing the migration is greater than or equal to the time spent using the old framework in all studied projects. We conclude with a list of implications for practitioners, framework developers, tool builders, and researchers.

关键词： front-end frameworks javascript software modernization software reengineering

来源：评论

学校读者我要写书评

暂无评论

Just-In-Time Defect Prediction on javascript Projects: A Replication Study

引用

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY 2022年第4期31卷 76-76页

作者： Ni, Chao Xia, Xin Lo, David Yang, Xiaohu Hassan, Ahmed E. Zhejiang Univ Sch Software Technol Zheda Rd 38 West Lake Dist Hangzhou Zhejiang Peoples R China Huawei Software Engn Applicat Technol Lab Jianghong Rd 410 Hangzhou Zhejiang Peoples R China Singapore Management Univ 80 Stamford Rd Singapore Singapore Zhejiang Univ Coll Comp Sci & Technol Rd 38 West Lake Dist Hangzhou Zhejiang Peoples R China Queens Univ 25 Union St Kingston ON Canada

Change-level defect prediction is widely referred to as just-in-time (JIT) defect prediction since it identifies a defect-inducing change at the check-in time, and researchers have proposed many approaches based on the language-independent change-level features. These approaches can be divided into two types: supervised approaches and unsupervised approaches, and their effectiveness has been verified on Java or C++ projects. However, whether the language-independent change-level features can effectively identify the defects of javascript projects is still unknown. Additionally, many researches have confirmed that supervised approaches outperform unsupervised approaches on Java or C++ projects when considering inspection effort. However, whether supervised JIT defect prediction approaches can still perform best on javascript projects is still unknown. Lastly, prior proposed change-level features are programming languageindependent, whether programming language-specific change-level features can further improve the performance of JIT approaches on identifying defect-prone changes is also unknown. To address the aforementioned gap in knowledge, in this article, we collect and label the top-20 most starred javascript projects on GitHub. javascript is an extremely popular and widely used programming language in the industry. We propose five javascript-specific change-level features and conduct a large-scale empirical study (i.e., involving a total of 176,902 changes) and find that (1) supervised JIT defect prediction approaches (i.e., CBS+) still statistically significantly outperform unsupervised approaches on javascript projects when considering inspection effort;(2) javascript-specific change-level features can further improve the performance of approach built with language-independent features on identifying defect-prone changes;(3) the change-level features in the dimension of size (i.e., LT), diffusion (i.e., NF), and javascript-specific (i.e., SO and TC) are the m

关键词： Defect prediction just-in-time defect prediction empirical study javascript

来源：评论

学校读者我要写书评

暂无评论

Juicing V8: A primary account for the memory forensics of the V8 javascript engine

引用

FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION 2022年 42卷

作者： Wang, Enoch Zurowski, Samuel Duffy, Orion Thomas, Tyler Baggili, Ibrahim Univ New Haven Samuel S Bergami Jr Cybersecur Ctr Cyber Forens Res & Educ Grp UNHcFREG West Haven CT 06516 USA Univ New Haven Connecticut Inst Technol West Haven CT USA

V8 is the open source interpreter developed by Google to enable javascript (JS) functionality in Chrome and power other software. Malicious threat actors abuse the usage of JS because most modern-day browsers implicitly trust script code to execute. To aid in incident response and memory forensics in such scenarios, our work introduces the first generalizable account of the memory forensics of the V8 JS engine and provides practitioners with a list of objects and their descriptors extracted from a memory image. These objects can be used to reveal key information about a user and their activity. We analyzed the V8 engine and its garbage collection process. We then developed and validated a Volatility plugin - V8MapScan - to reconstruct V8 objects from a memory image. The runtime of the V8 engine is housed within the V8 isolate which contains its own heap manager and garbage collector. Within the heap of the isolate exists a root object map known as the MetaMap. By using the MetaMap and a object-fitting technique, we were able to extract objects, object-maps, and object properties. The V8MapScan plugin scans process memory for the MetaMap data structure contained within the V8 isolate using its data structure, references to objects can be found and extracted. Our findings were verified with Chrome DevTool's Heap Profiler. Our approach recovered the majority of objects indicated by the heap profiler with common types such as the ONE_BYTE_INTERNALIZED_STR type returning more than 98.9%. Lastly, we provide a case study using our tools on the Monero Cryptocurrency Miner. (C) 2022 The Authors. Published by Elsevier Ltd.

关键词： Memory forensics Volatility V8 javascript Memory analysis Object recovery

来源：评论

学校读者我要写书评

暂无评论

javascript&Me, A Tool to Support Research into Code Transformation and Browser Security 22

JavaScript&Me, A Tool to Support Research into Code Transfor...

引用

31st ACM International Conference on Information and Knowledge Management (CIKM)

作者： Lima, Susana Morla, Ricardo Routar, Joao Univ Porto Porto Portugal Jscrambler Porto Portugal Univ Porto ECE Dept Porto Portugal Univ Porto INESC TEC Porto Portugal

ISBN: (纸本)9781450392365

Doing research into code variations and their applications to browser security is challenging. One of the most important aspects of this research is to choose a relevant dataset on which machine learning algorithms can be applied to yield useful results. Although javascript code is widely available on various sources, such as package managers, code hosting platforms, and websites, collecting a large corpus of javascript and curating it is not a simple task. We present a novel open-source tool that helps with this task by allowing the automatic and systematic collection, processing, and transformation of javascript code. These three steps are performed by independent modules, and each one can be extended to incorporate new features, such as additional code sources, or transformation tools, adding to the flexibility of our tool and expanding its usability. Additionally, we use our tool to create a corpus of around 270k javascript files, including regular, minified, and obfuscated code, on which we perform a brief analysis. The conclusions from this analysis show the importance of properly curating a dataset before using it in research tasks, such as machine learning classifiers, reinforcing the relevance of our tool.

关键词： javascript Code Collection Code Processing Code Transformations

来源：评论

学校读者我要写书评

暂无评论

Identify javascript Trends in Crowdsourcing Small Tasks 17th

Identify Javascript Trends in Crowdsourcing Small Tasks

引用

17th International Conference on Evaluation of Novel Approaches to Software Engineering (ENASE)

作者： Zozas, Ioannis Anagnostou, Iason Bibi, Stamatia Univ Western Macedonia Dept Elect & Comp Engn Kozani Greece

ISBN: (纸本)9783031365966;9783031365973

A popular alternative non-conventional model for software development is crowdsourcing, which aims at decomposing software project into tasks that assigns them to individual stakeholders, through an open call for participation. A major challenge is to ensure community participation in developing high-quality solutions by each individual stakeholder. It is of high importance to be aware of the skills that can be acquired by the crowd, especially in cases of constantly evolving development environments, such as the javascript programming language and its applications. In the current paper, we aim at exploring trends in crowdsourcing javascript small tasks as an attempt to unveil a) popularity as the core technological skills and the functionalities that are more frequently crowdsourced, b) success as the relationship between the technological skills and the functionalities crowdsourced, and d) the monetary reward differences between these technological skills and the functionalities relationships. We have analyzed contest data collected from the Bountify crowdsourcing platform, resulting that while javascript small task development focuses on multiple technologies, frameworks, and libraries, that frequently overlap or complement each other, popularity, success, and monetary reward of the latter, in most cases are not associated.

关键词： javascript Crowdsourcing Small tasks Bountify

来源：评论

学校读者我要写书评

暂无评论

Student Research Abstract: A Hybrid Approach to Design Embedded Software Using javascript's Non-blocking Principle 23

Student Research Abstract: A Hybrid Approach to Design Embed...

引用

38th Annual ACM Symposium on Applied Computing (ACM SAC)

作者： Oliveira, Fernando Luis Fed Univ Pelotas UFPel Fed Inst Farroupilha IFFar Pelotas RS Brazil

ISBN: (纸本)9781450395175

Embedded Systems (ES) are present in several domains like automotive, smart homes, smart cities, industry, and healthcare, to name but a few. ES brings new challenges to designing embedded software that requires a high level of abstraction and being aware of resource consumption, mainly on resource-constrained devices. Modern programming languages like javascript ( JS) can help solve these issues. However, JS is an interpreted language that demands attention to develop applications considering the balance between performance and resource consumption. In this scenario, this paper introduces an architecture design that proposes to model software for embedded systems as event-driven applications. Our design combines traditional architectures traits of Time-triggered (TT) and Event-triggered (ET) into a framework named JSEVAsync, promoting a hybrid system that explores javascript's non-blocking concept as a development interface to structure the algorithms into asynchronous units. As a result, we aid the development of applications with high abstraction levels and better resource consumption. To validate it, we compare C- and javascript-based applications, analyze the source code (static code analysis) to extract software quality metrics, and explore the results from the energy consumption perspective. We found that writing code through JSEVAsync can be up to 21% more energy efficient than the traditional method and can improve design-time metrics.

关键词： Internet of Things Embedded Software Design javascript

来源：评论

学校读者我要写书评

暂无评论

Modular design on tile layout experiment with javascript

引用

INTERNATIONAL JOURNAL OF INTERACTIVE DESIGN AND MANUFACTURING - IJIDEM 2022年第3期16卷 1163-1173页

作者： Jiang, Yi Shanghai Inst Visual Arts Coll Fash Shanghai Peoples R China

As a kind of building material, decorative ceramic tiles boast unique functional advantages and artistic aesthetics. However, they face problems such as inflexible laying methods and highly homogenized motifs. In the digital era, computer technology has become an indispensable tool in modern innovation. This experiment uses javascript as the programing language for decorative ceramic tile layout and modular pattern design software, marking a new practice in man-machine high-efficiency coordinated creation. Innovative capacity is a key factor determining the lifeline of a product. The motifs of decorative ceramic tiles designed with the help of the software based on the experiment can automatically and quickly form a multitude of diverse layouts in the laying process. Moreover, the software has iterative extendibility and can not only allow users to give full play to their subjective creativity but also meet the demand of modern market for high efficiency, individuality and diversity. The experiment mentioned in this paper was an important attempt to achieve the goal.

关键词： javascript Modular design Single tile module Modular point alignment method Ceramic tile layout Decoration

来源：评论

学校读者我要写书评

暂无评论

TransAST: A Machine Translation-Based Approach for Obfuscated Malicious javascript Detection 53

TransAST: A Machine Translation-Based Approach for Obfuscate...

引用

53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)

作者： Qin, Yan Wang, Weiping Chen, Zixian Song, Hong Zhang, Shigeng Cent South Univ Sch Comp Sci & Engn Changsha Peoples R China

ISBN: (纸本)9798350347937

As an essential part of the website, javascript greatly enriches its functions. At the same time, javascript has become the most common attack payload on malicious websites. Although researchers are constantly proposing methods to detect malicious javascript, the emergence of obfuscation technology makes it difficult for previous approaches to detect disguised malicious javascript effectively. To solve this problem, we find that there are fixed templates for generating obfuscated code, which makes the original and obfuscated script have a mapping relationship in their structure. The structure information of the code is critical for malicious detection. Therefore, this paper proposes TransAST, a novel static detection method for obfuscated malicious javascript. Our approach's key is restoring the obfuscated javascript structure information by training the machine translation model. The experiment shows it can achieve 91.35% accuracy and 94.57% recall in the public dataset, which is 5.5% and 10.94% higher than the existing optimal method.

关键词： javascript de-obfuscation machine translation abstract syntax tree

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：