检索结果-南通市图书馆

Computers, Materials & Continua 2020年第9期64卷 1555-1577页

作者： Juan R.Bermejo Higuera Javier.bermejo higuera juan A.Sicilia Montalvo Javier Cubo Villalba juan JoséNombela Pérez Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLa Rioja26006Spain

To detect security vulnerabilities in a web application,the security analyst must choose the best performance Security Analysis Static Tool(SAST)in terms of discovering the greatest number of security vulnerabilities as possible.To compare static analysis tools for web applications,an adapted benchmark to the vulnerability categories included in the known standard Open Web Application Security Project(OWASP)Top Ten project is required.The information of the security effectiveness of a commercial static analysis tool is not usually a publicly accessible research and the state of the art on static security tool analyzers shows that the different design and implementation of those tools has different effectiveness rates in terms of security performance.Given the significant cost of commercial tools,this paper studies the performance of seven static tools using a new methodology proposal and a new benchmark designed for vulnerability categories included in the known standard OWASP Top Ten project.Thus,the practitioners will have more precise information to select the best tool using a benchmark adapted to the last versions of OWASP Top Ten project.The results of this work have been obtaining using widely acceptable metrics to classify them according to three different degree of web application criticality.

关键词： Web application benchmark security vulnerability Security Analysis Static Tools assessment methodology false positive false negative precision f-measure

Systematic Approach for Web Protection runtime Tools’Effectiveness Analysis

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computer Modeling in Engineering & Sciences 2022年第12期133卷 579-599页

作者： Tomás Sureda riera juan ramón bermejo higuera Javier.bermejo higuera juan Antonio Sicilia Montalvo José Javier Martínez Herráiz Computer Science Department University of AlcaláMadrid28801Spain Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLogrono26006Spain

Web applications represent one of the principal vehicles by which attackers gain access to an organization’s network or resources.Thus,different approaches to protect web applications have been proposed to date.Of them,the two major approaches are Web Application Firewalls(WAF)and runtime Application Self Protection(rASP).It is,thus,essential to understand the differences and relative effectiveness of both these approaches for effective decisionmaking regarding the security of web applications.Here we present a comparative study between WAF and rASP simulated settings,with the aim to compare their effectiveness and efficiency against different categories of attacks.For this,we used computation of different metrics and sorted their results using F-Score index.We found that rASP tools scored better than WAF tools.In this study,we also developed a new experimental methodology for the objective evaluation ofweb protection tools since,to the best of our knowledge,nomethod specifically evaluates web protection tools.

关键词： Web Application Firewall(WAF) runtime Application Self Protection(rASP) F-Score web attacks experimental methodology

Hybrid Security Assessment Methodology for Web Applications

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computer Modeling in Engineering & Sciences 2021年第1期126卷 89-124页

作者： roddy A.Correa juan ramon bermejo higuera Javier.bermejo higuera juan Antonio SiciliaMontalvo Manuel Sanchez rubio A.Alberto Magrenan Universidad Tecnica Particular de Loja San Cayetano AltoLojaEcuador Escuela Superior de Ingenieria y Tecnologia Universidad Internacional de La RiojaLogrono26006Spain Universidad de la rioja Logrono26006Spain

This study presents a methodology to evaluate and prevent security vulnerabilities issues for web applications.The analysis process is based on the use of techniques and tools that allow to perform security assessments of white box and black box,to carry out the security validation of a web application in an agile and precise way.The objective of the methodology is to take advantage of the synergies of semi-automatic static and dynamic security analysis tools and manual checks.Each one of the phases contemplated in the methodology is supported by security analysis tools of different degrees of coverage,so that the results generated in one phase are used as feed for the following phases in order to get an optimized global security analysis result.The methodology can be used as part of other more general methodologies that do not cover how to use static and dynamic analysis tools in the implementation and testing phases of a Secure Software Development Life Cycle(SSDLC).A practical application of the methodology to analyze the security of a real web application demonstrates its effectiveness by obtaining a better optimized vulnerability detection result against the true and false positive metrics.Dynamic analysis with manual checking is used to audit the results,24.6 per cent of security vulnerabilities reported by the static analysis has been checked and it allows to study which vulnerabilities can be directly exploited externally.This phase is very important because it permits that each reported vulnerability can be checked by a dynamic second tool to confirm whether a vulnerability is true or false positive and it allows to study which vulnerabilities can be directly exploited externally.Dynamic analysis finds six(6)additional critical vulnerabilities.Access control analysis finds other five(5)important vulnerabilities such as Insufficient Protected Passwords or Weak Password Policy and Excessive Authentication Attacks,two vulnerabilities that permit brute force attacks.

关键词： Web applications security vulnerability weakness security analysis white box black box interactive application security testing static application security testing dynamic application security testing

Combinatorial Method with Static Analysis for Source Code Security in Web Applications

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computer Modeling in Engineering & Sciences 2021年第11期129卷 541-565页

作者： juan ramon bermejo higuera Javier.bermejo higuera juan Antonio Sicilia Montalvo Tomas Sureda riera Christopher I.Argyros A.Alberto Magrenan Escuela Superior de Ingenierıa y Tecnologıa Universidad Internacional de La RiojaLogronoLa Rioja26006Spain Computer Science Department University of AlcalaMadrid28801Spain Department of Computing and Technology Cameron UniversityLawton73505OklahomaUSA Universidad de la rioja LogronoLa Rioja26006Spain

Security weaknesses in web applications deployed in cloud architectures can seriously affect its data confidentiality and integrity.The construction of the procedure utilized in the static analysis tools of source code security differs and therefore each tool finds a different number of each weakness type for which it is designed.To utilize the possible synergies different static analysis tools may process,this work uses a new method to combine several source codes aiming to investigate how to increase the performance of security weakness detection while reducing the number of false positives.Specifically,five static analysis tools will be combined with the designed method to study their behavior using an updated benchmark for OWASP Top Ten Security Weaknesses(OWASP TTSW).The method selects specific metrics to rank the tools for different criticality levels of web applications considering different weights in the ratios.The findings show that simply including more tools in a combination is not synonymous with better results;it depends on the specific tools included in the combination due to their different designs and techniques.

关键词： Weakness benchmark security testing analysis comparative methodology tools combination web application

MMALE—A Methodology for Malware Analysis in Linux Environments

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computers, Materials & Continua 2021年第5期67卷 1447-1469页

作者： JoséJavier de Vicente Mohino Javier.bermejo higuera juan ramón bermejo higuera juan Antonio Sicilia Montalvo Manuel Sánchez rubio JoséJavier Martínez Herraiz Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLogroño26006La RiojaSpain Departamento de Ciencias de la Computación de la Escuela Politécnica Superior Universidad de Alcaláde HenaresAlcaláde HenaresMadridSpain

In a computer environment,an operating system is prone to malware,and even the Linux operating system is not an exception.In recent years,malware has evolved,and attackers have become more qualified compared to a few years ago.Furthermore,Linux-based systems have become more attractive to cybercriminals because of the increasing use of the Linux operating system in web servers and Internet of Things(IoT)devices.Windows is the most employed OS,so most of the research efforts have been focused on its malware protection rather than on other operating systems.As a result,hundreds of research articles,documents,and methodologies dedicated to malware analysis have been reported.However,there has not been much literature concerning Linux security and protection from malware.To address all these new challenges,it is necessary to develop a methodology that can standardize the required steps to perform the malware analysis in depth.A systematic analysis process makes the difference between good and ordinary malware analyses.Additionally,a deep malware comprehension can yield a faster and much more efficient malware eradication.In order to address all mentioned challenges,this article proposed a methodology for malware analysis in the Linux operating system,which is a traditionally overlooked field compared to the other operating systems.The proposed methodology is tested by a specific Linux malware,and the obtained test results have high effectiveness in malware detection.

关键词： Malware analysis methodology analysis Linux malware IoT malware

Lighting,colour and geometry:Which has the greatest influence on students’cognitive processes?

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Frontiers of Architectural research 2023年第4期12卷 575-586页

作者： Marıa Luisa Nole Fajardo juan Luis higuera-Trujillo Carmen Llinares Instituto Universitario de Investigacio´n en Tecnologı´a Centrada en el Ser Humano(HUMAN-tech) Universitat Polite`cnica de Vale`nciaValencia 46022Spain School of Architecture Art and DesignTecnologico de MonterreyMonterrey 64849Mexico

Many studies have analysed the effects that design elements,such as lighting and colour,have on students’cognitive functions.These analyses,while providing useful information,do not allow researchers to compare the effects of multiple design elements.The objective of the present study is to analyse the relative influence of lighting,colour and geometry on attention and memory,the main cognitive functions that underlie learning,and on preference.In a controlled,virtual reality(Vr)-based experiment,200 university students(100 male/100 female)performed attention,memory and preference tests in classrooms with different configurations of lighting(colour temperature and illuminance),colour(saturation and hue)and geometry(height and width).The results identified significant gender-based differences,which demonstrates the need to segment,by gender,samples in this type of study.Lighting had the greatest influence,significantly affecting males’memories,females’attention and the preferences of both genders.Colour was also an influential element,significantly affecting females’attention,while geometry was the least influential.Finally,it should be highlighted that attention was the metric most sensitive to design variations.These results may be of interest to architects,interior designers and engineers who wish to create classrooms that satisfy students’psychological needs.

关键词： Classroom design Memory Attention Preference Virtual classroom

The impact of the design of learning spaces on attention and memory from a neuroarchitectural approach:A systematic review

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Frontiers of Architectural research 2022年第3期11卷 542-560页

作者： Mar Llorens-Gamez juan Luis higuera-Trujillo Carla Sentieri Omarrementeria Carmen Llinares Department of Architectural Projects Universitat Politecnica de ValenciaValencia 46022Spain Institute for research and Innovation in Bioengineering(i3B) Universitat Politecnica de ValenciaValencia 46022Spain

Enriched environments in animal models have demonstrated that exposure to an optimal stimulus improves behavior,cognition,and genomics.However,the evidence base for the neurophysiological influence of human environment enrichment has not been extensively studied.This systematic review compiles indicators about the effect of built,indoor environments on the cognitive processes of memory and attention in humans.This work pursues two main objectives:(1)to define current knowledge and the methods that are useful and identify whether previously published studies indicate consistencies and(2)to report the approaches and strategies that can be used in evaluating cognitive processes affected by environment response.results of this systematic review show that(1)form and geometry,(2)space distribution and context,(3)color and texture,(4)height,width,and enclosure,(5)transition and circulation,and(6)light,sound,and temperature have an impact on memory and/or attention,and they can be assessed objectively.Despite all the advances in this field,methodological limitations and a lack of cross-validated standard protocols are found.Therefore,future research is necessary to provide a deep insight into how human cognition can be heightened by the environment to which it is exposed.

关键词： Built environment Neuroarchitecture Cognition Attention Memory Learning spaces

1D alignment of proteins and other nanoparticles by using reversible covalent bonds on cyclic peptide nanotubes

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Organic Chemistry Frontiers 2022年第5期9卷 1226-1233页

作者： juan M.Priegue Iria Louzao Ivan Gallego Javier Montenegro juan r.Granja Singular research Centre in Chemical Biology and Molecular Materials (CIQUS)Organic Chemistry DepartmentUniversity of Santiago de Compostela(USC)15782 Santiago de CompostelaSpain

Self-assembling cyclic peptide nanotubes are supramolecular structures whose diameter and external surface properties are precisely controlled.In this communication we describe a general strategy to align different mo... 详细信息

关键词： nanoparticles alignment surface

A System Identification-based Modeling Framework of Bidirectional DC-DC Converters for Power Grids

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Journal of Modern Power Systems and Clean Energy 2022年第3期10卷 788-799页

作者： Gabriel E.Mejia-ruiz Mario r.A.Paternina juan r.rodriguez r. juan M.ramirez Alejandro Zamora-Mendez Guillermo Bolivar-O. Department of Electrical Engineering National Autonomous University of Mexico(UNAM)Mexico CityMexico Department of Electrical Engineering Center for Research and Advanced Studies(CINVESTAV)GuadalajaraMexico Electrical Engineering Faculty Michoacan University of Saint Nicholas of Hidalgo(UMSNH)MoreliaMexico Engineering Faculty Corporacion Universitaria Minuto de Dios-UNIMINUTOBelloColombia

This paper proposes a system identification framework based on eigensystem realization to accurately model power electronic converters.The proposed framework affords an energy-based optimal reduction method to precisely identify the dynamics of power electronic converters from simulated or actual raw data measured at the converter’s ports.This method does not require any prior knowledge of the topology or internal parameters of the converter to derive the system modal information.The accuracy and feasibility of the proposed method are exhaustively evaluated via simulations and practical tests on a software-simulated and hardware-implemented dual active bridge(DAB)converter under steady-state and transient conditions.After various comparisons with the Fourier series-based generalized average model,switching model,and experimental measurements,the proposed method attains a root mean square error(rMSE)of less than 1%with respect to the actual raw data.Moreover,the computational effort is reduced to 1/8.6 of the Fourier series-based model.

关键词： Dual active bridge eigensystem realization algorithm generalized average model power electronic converter identification

Early life 1000 days: opportunities for preventing adult diseases

维普期刊数据库

同方期刊数据库评论

在线全文

学校读者我要写书评

暂无评论

Chinese Medical Journal 2022年第5期135卷 516-518页

作者： juan juan Huixia Yang Department of Obstetrics and Gynecology Peking University First HospitalBeijing 100034China

With the rapid socioeconomic development, improvements in living standards, and changes in lifestyle, adult diseases, such as cardiovascular diseases, type 2 diabetes mellitus (T2DM), hypertension, obesity, and so on, are increasing dramatically over the past decades, which have caused a huge economic and health burden at both population and individual levels in China.[1] The increased burden of adult diseases has become the main public health issue, and prevention of adult diseases in China has become a formidable task during recent years. In 2016, China has put forward the concept of whole life-course health and efforts have been made on shifting the focus from treating diseases to prevention. In view of the poor effects of prevention of diseases in adulthood, it is suggested that prevention and management of adult diseases should be extended to early life, which is the critical window for physiological programming and has profound and enduring effects on the whole life-cycle health.[2,3,4] In 2018, an article named "To Prevent Cardiovascular Disease, Pay Attention to Pregnancy Complications" published in Journal of the American Medical Association (JAMA) also illustrated that pregnancy is a window to future health[5].

关键词： diseases prevention cardiovascular