检索结果-南通市图书馆

Systematic Approach for Web Protection Runtime Tools’Effectiveness Analysis

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computer Modeling in Engineering & Sciences 2022年第12期133卷 579-599页

作者： Tomás Sureda Riera Juan Ramón bermejo Higuera javier bermejo Higuera Juan Antonio Sicilia Montalvo José javier Martínez Herráiz Computer Science Department University of AlcaláMadrid28801Spain Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLogrono26006Spain

Web applications represent one of the principal vehicles by which attackers gain access to an organization’s network or resources.Thus,different approaches to protect web applications have been proposed to date.Of them,the two major approaches are Web Application Firewalls(WAF)and Runtime Application Self Protection(RASP).It is,thus,essential to understand the differences and relative effectiveness of both these approaches for effective decisionmaking regarding the security of web applications.Here we present a comparative study between WAF and RASP simulated settings,with the aim to compare their effectiveness and efficiency against different categories of attacks.For this,we used computation of different metrics and sorted their results using F-Score index.We found that RASP tools scored better than WAF tools.In this study,we also developed a new experimental methodology for the objective evaluation ofweb protection tools since,to the best of our knowledge,nomethod specifically evaluates web protection tools.

关键词： Web Application Firewall(WAF) Runtime Application Self Protection(RASP) F-Score web attacks experimental methodology

The variability of juvenile dispersal in an opportunistic raptor

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Current Zoology 2023年第3期69卷 244-254页

作者： Jorge Garcia-Macia Gabriel Lopez-Poveda javier De La Puente Ana bermejo-bermejo Manuel Galan Ernesto Alvarez Sara Morollon Vicente Urios Vertebrates Zoology Research Group University of AlicanteApdo.99E-03080 AlicanteSpain SEO/BirdLife Bird Monitoring UnitC/Melquiades Biencinto34E-28053MadridSpain GREFA C/MontedelPilarS/NE-28220 MajadahondaMadridSpain

The juvenile dispersal of raptors is a crucial stage that stretches from parental independence to the establishment of the first breeding area.Between 2012 and 2020,44 juvenile red kites Milvus milvus from the Spanish breeding population were tagged using GPS telemetry to study their dispersal.Juveniles left the parental breeding area at the end of their first summer and performed wandering movements throughout the Iberian Peninsula,returning to the parental breeding area the following year,repeating the same pattern until they settled in their first breeding area.We analyzed the mean distance from the nest,the maximum reached distances,and the traveled distances(daily and hourly)during the first 2 years of dispersal and compared them.Despite the high individual variability,variables describing the dispersal movements of juveniles showed a decreasing trend during the second dispersal year:80% of individuals reached a shorter maximum distance in the second year,70% decreased their mean distance to the nest,65% decreased their hourly traveled distances,and 50% decreased their daily traveled distances.On the other hand,the red kites usually combined wandering movements with the establishment of temporary settlement areas(TSA).The average duration of settlement in the TSAs was 75±40 days(up to 182 days)and was located at 182±168 km from the nest.In those areas,juveniles used 781.0±1895.0 km^(2)(KDE 95%).Some of the TSAs were used by several individuals,which suggests that these areas might be good targets for conservation in future management plans.

关键词： GPS telemetry landfills movement ecology natal dispersal red kite spatial ecology

Benchmarking Approach to Compare Web Applications Static Analysis Tools Detecting OWASP Top Ten Security Vulnerabilities

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computers, Materials & Continua 2020年第9期64卷 1555-1577页

作者： Juan R.bermejo Higuera javier bermejo Higuera Juan A.Sicilia Montalvo javier Cubo Villalba Juan JoséNombela Pérez Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLa Rioja26006Spain

To detect security vulnerabilities in a web application,the security analyst must choose the best performance Security Analysis Static Tool(SAST)in terms of discovering the greatest number of security vulnerabilities as possible.To compare static analysis tools for web applications,an adapted benchmark to the vulnerability categories included in the known standard Open Web Application Security Project(OWASP)Top Ten project is required.The information of the security effectiveness of a commercial static analysis tool is not usually a publicly accessible research and the state of the art on static security tool analyzers shows that the different design and implementation of those tools has different effectiveness rates in terms of security performance.Given the significant cost of commercial tools,this paper studies the performance of seven static tools using a new methodology proposal and a new benchmark designed for vulnerability categories included in the known standard OWASP Top Ten project.Thus,the practitioners will have more precise information to select the best tool using a benchmark adapted to the last versions of OWASP Top Ten project.The results of this work have been obtaining using widely acceptable metrics to classify them according to three different degree of web application criticality.

关键词： Web application benchmark security vulnerability Security Analysis Static Tools assessment methodology false positive false negative precision f-measure

MMALE—A Methodology for Malware Analysis in Linux Environments

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computers, Materials & Continua 2021年第5期67卷 1447-1469页

作者： Joséjavier de Vicente Mohino javier bermejo Higuera Juan Ramón bermejo Higuera Juan Antonio Sicilia Montalvo Manuel Sánchez Rubio Joséjavier Martínez Herraiz Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLogroño26006La RiojaSpain Departamento de Ciencias de la Computación de la Escuela Politécnica Superior Universidad de Alcaláde HenaresAlcaláde HenaresMadridSpain

In a computer environment,an operating system is prone to malware,and even the Linux operating system is not an exception.In recent years,malware has evolved,and attackers have become more qualified compared to a few years ago.Furthermore,Linux-based systems have become more attractive to cybercriminals because of the increasing use of the Linux operating system in web servers and Internet of Things(IoT)devices.Windows is the most employed OS,so most of the research efforts have been focused on its malware protection rather than on other operating systems.As a result,hundreds of research articles,documents,and methodologies dedicated to malware analysis have been reported.However,there has not been much literature concerning Linux security and protection from malware.To address all these new challenges,it is necessary to develop a methodology that can standardize the required steps to perform the malware analysis in depth.A systematic analysis process makes the difference between good and ordinary malware analyses.Additionally,a deep malware comprehension can yield a faster and much more efficient malware eradication.In order to address all mentioned challenges,this article proposed a methodology for malware analysis in the Linux operating system,which is a traditionally overlooked field compared to the other operating systems.The proposed methodology is tested by a specific Linux malware,and the obtained test results have high effectiveness in malware detection.

关键词： Malware analysis methodology analysis Linux malware IoT malware

Hybrid Security Assessment Methodology for Web Applications

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computer Modeling in Engineering & Sciences 2021年第1期126卷 89-124页

作者： Roddy A.Correa Juan Ramon bermejo Higuera javier bermejo Higuera Juan Antonio SiciliaMontalvo Manuel Sanchez Rubio A.Alberto Magrenan Universidad Tecnica Particular de Loja San Cayetano AltoLojaEcuador Escuela Superior de Ingenieria y Tecnologia Universidad Internacional de La RiojaLogrono26006Spain Universidad de la Rioja Logrono26006Spain

This study presents a methodology to evaluate and prevent security vulnerabilities issues for web applications.The analysis process is based on the use of techniques and tools that allow to perform security assessments of white box and black box,to carry out the security validation of a web application in an agile and precise way.The objective of the methodology is to take advantage of the synergies of semi-automatic static and dynamic security analysis tools and manual checks.Each one of the phases contemplated in the methodology is supported by security analysis tools of different degrees of coverage,so that the results generated in one phase are used as feed for the following phases in order to get an optimized global security analysis result.The methodology can be used as part of other more general methodologies that do not cover how to use static and dynamic analysis tools in the implementation and testing phases of a Secure Software Development Life Cycle(SSDLC).A practical application of the methodology to analyze the security of a real web application demonstrates its effectiveness by obtaining a better optimized vulnerability detection result against the true and false positive metrics.Dynamic analysis with manual checking is used to audit the results,24.6 per cent of security vulnerabilities reported by the static analysis has been checked and it allows to study which vulnerabilities can be directly exploited externally.This phase is very important because it permits that each reported vulnerability can be checked by a dynamic second tool to confirm whether a vulnerability is true or false positive and it allows to study which vulnerabilities can be directly exploited externally.Dynamic analysis finds six(6)additional critical vulnerabilities.Access control analysis finds other five(5)important vulnerabilities such as Insufficient Protected Passwords or Weak Password Policy and Excessive Authentication Attacks,two vulnerabilities that permit brute force attacks.

关键词： Web applications security vulnerability weakness security analysis white box black box interactive application security testing static application security testing dynamic application security testing

Combinatorial Method with Static Analysis for Source Code Security in Web Applications

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computer Modeling in Engineering & Sciences 2021年第11期129卷 541-565页

作者： Juan Ramon bermejo Higuera javier bermejo Higuera Juan Antonio Sicilia Montalvo Tomas Sureda Riera Christopher I.Argyros A.Alberto Magrenan Escuela Superior de Ingenierıa y Tecnologıa Universidad Internacional de La RiojaLogronoLa Rioja26006Spain Computer Science Department University of AlcalaMadrid28801Spain Department of Computing and Technology Cameron UniversityLawton73505OklahomaUSA Universidad de la Rioja LogronoLa Rioja26006Spain

Security weaknesses in web applications deployed in cloud architectures can seriously affect its data confidentiality and integrity.The construction of the procedure utilized in the static analysis tools of source code security differs and therefore each tool finds a different number of each weakness type for which it is designed.To utilize the possible synergies different static analysis tools may process,this work uses a new method to combine several source codes aiming to investigate how to increase the performance of security weakness detection while reducing the number of false positives.Specifically,five static analysis tools will be combined with the designed method to study their behavior using an updated benchmark for OWASP Top Ten Security Weaknesses(OWASP TTSW).The method selects specific metrics to rank the tools for different criticality levels of web applications considering different weights in the ratios.The findings show that simply including more tools in a combination is not synonymous with better results;it depends on the specific tools included in the combination due to their different designs and techniques.

关键词： Weakness benchmark security testing analysis comparative methodology tools combination web application

Wind effects on the migration routes of trans-Saharan soaring raptors： geographical, seasonal, and interspecific variation

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Current Zoology 2016年第2期62卷 89-97页

作者： javier VIDAL-MATEO Ugo MELLONE Pascual LOPEZ-LOPEZ javier De LA PUENTE clara GARCIA-RIPOLLES Ana bermejo Vicente URIOS Vertebrates Zoology Research Group Departamento de Ciencias Ambientales y Recursos Naturales Universityof Alicante Apdo. 99 E-03080 Alicante Spain SEO/BirdLife Area de Estudio y Seguimiento de AyesC/Melquiades Biencinto 34 E-28053 Madridl Spain

Wind is among the most important environmental factors shaping birds' migration patterns. Birds must deal with the displacement caused by crosswinds and their behavior can vary according to different factors such as flight mode, migratory season, experience, and distance to goal areas. Here we analyze the relationship between wind and migratory movements of three raptor species which migrate by soaring-gliding flight: Egyptian vulture , booted eagle , and short-toed snake eagle . We analyzed daily migratory segments (i.e., the path joining consecutive roosting locations) using data recorded by GPS satellite telemetry. Daily movements of Egyptian vultures and booted eagles were significantly affected by tailwinds during both autumn and spring migrations. In contrast, daily movements of short-toed eagles were only significantly affected by tailwinds during autumn migration. The effect of crosswinds was significant in all cases. Interestingly, Egyptian vultures and booted eagles showed latitudinal differences in their behavior: both species compensated more frequently at the onset of autumn migration and, at the end of the season when reaching their wintering areas, the proportion of drift segments was higher. In contrast, there was a higher drift at the onset of spring migration and a higher compensation at the end. Our results highlight the effect of wind patterns on the migratory routes of soaring raptors, with different outcomes in relation to species, season, and latitude, ultimately shaping the loop migration patterns that current tracking techniques are showing to be widespread in many long distance migrants.

关键词：迁徙路线季节种间变异撒哈拉地理迁移模式鸟类迁徙环境因子

Role of STIM1 in neurodegeneration

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

World Journal of Biological Chemistry 2018年第2期9卷 16-24页

作者： Carlos Pascual-Caro Noelia Espinosa-bermejo Eulalia Pozo-Guisado Francisco javier Martin-Romero Department of Biochemistry and Molecular Biology School of Life Sciences and Institute of Molecular Pathology Biomarkers University of Extremadura Department of Cell Biology School of Medicine and Institute of Molecular Pathology Biomarkers University of Extremadura

STIM1 is an endoplasmic reticulum(ER) protein with a key role in Ca^(2+)mobilization. Due to its ability to act as an ER-intraluminal Ca^(2+) sensor, it regulates store-operated Ca^(2+) entry(SOCE), which is a Ca^(2+) influx pathway involved in a wide variety of signalling pathways in eukaryotic cells. Despite its important role in Ca^(2+) transport, current knowledge about the role of STIM1 in neurons is much more limited. Growing evidence supports a role for STIM1 and SOCE in the preservation of dendritic spines required for long-term potentiation and the formation of memory. In this regard, recent studies have demonstrated that the loss of STIM1, which impairs Ca^(2+) mobilization in neurons, risks cell viability and could be the cause of neurodegenerative diseases. The role of STIM1 in neurodegeneration and the molecular basis of cell death triggered by low levels of STIM1 are discussed in this review.

关键词： Calcium Neurodegeneration Parkinson's disease Alzheimer's disease STIM1 Voltage-operated Ca2+ channels

Nanoparticles embedded into glass matrices:glass nanocomposites

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Frontiers of Materials Science 2022年第3期16卷 1-81页

作者： javier FONSECA Department of Chemical Engineering Northeastern UniversityBoston 02115USA

Research on glass nanocomposites(GNCs)has been very active in the past decades.GNCs have attracted—and still do—great interest in the fields of optoelectronics,photonics,sensing,electrochemistry,catalysis,biomedicine,and art.In this review,the potential applications of GNCs in these fields are briefly described to show the reader the possibilities of these materials.The most important synthesis methods of GNCs(melt-quenching,sol-gel,ion implantation,ion-exchange,staining process,spark plasma sintering,radio frequency sputtering,spray pyrolysis,and chemical vapor deposition techniques)are extensively explained.The major aim of this review is to systematize our knowledge about the synthesis of GNCs and to explore the mechanisms of formation and growth of NPs within glass matrices.The size-controlled preparation of NPs within glass matrices,which remains a challenge,is essential for advanced applications.Therefore,a thorough understanding of GNC synthesis techniques is expected to facilitate the preparation of innovative GNCs.

关键词： glass nanocomposites melt-quenching sol-gel ion implantation ion-exchange