检索结果-南通市图书馆

Hybrid Security Assessment Methodology for Web Applications

Computer Modeling in Engineering & Sciences 2021年第1期126卷 89-124页

作者： Roddy A.Correa juan ramon bermejo higuera Javier bermejo higuera juan Antonio SiciliaMontalvo Manuel Sanchez Rubio A.Alberto Magrenan Universidad Tecnica Particular de Loja San Cayetano AltoLojaEcuador Escuela Superior de Ingenieria y Tecnologia Universidad Internacional de La RiojaLogrono26006Spain Universidad de la Rioja Logrono26006Spain

This study presents a methodology to evaluate and prevent security vulnerabilities issues for web applications.The analysis process is based on the use of techniques and tools that allow to perform security assessments of white box and black box,to carry out the security validation of a web application in an agile and precise way.The objective of the methodology is to take advantage of the synergies of semi-automatic static and dynamic security analysis tools and manual checks.Each one of the phases contemplated in the methodology is supported by security analysis tools of different degrees of coverage,so that the results generated in one phase are used as feed for the following phases in order to get an optimized global security analysis result.The methodology can be used as part of other more general methodologies that do not cover how to use static and dynamic analysis tools in the implementation and testing phases of a Secure Software Development Life Cycle(SSDLC).A practical application of the methodology to analyze the security of a real web application demonstrates its effectiveness by obtaining a better optimized vulnerability detection result against the true and false positive metrics.Dynamic analysis with manual checking is used to audit the results,24.6 per cent of security vulnerabilities reported by the static analysis has been checked and it allows to study which vulnerabilities can be directly exploited externally.This phase is very important because it permits that each reported vulnerability can be checked by a dynamic second tool to confirm whether a vulnerability is true or false positive and it allows to study which vulnerabilities can be directly exploited externally.Dynamic analysis finds six(6)additional critical vulnerabilities.Access control analysis finds other five(5)important vulnerabilities such as Insufficient Protected Passwords or Weak Password Policy and Excessive Authentication Attacks,two vulnerabilities that permit brute force attacks.

关键词： Web applications security vulnerability weakness security analysis white box black box interactive application security testing static application security testing dynamic application security testing

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Combinatorial Method with Static Analysis for Source Code Security in Web Applications

引用

Computer Modeling in Engineering & Sciences 2021年第11期129卷 541-565页

作者： juan ramon bermejo higuera Javier bermejo higuera juan Antonio Sicilia Montalvo Tomas Sureda Riera Christopher I.Argyros A.Alberto Magrenan Escuela Superior de Ingenierıa y Tecnologıa Universidad Internacional de La RiojaLogronoLa Rioja26006Spain Computer Science Department University of AlcalaMadrid28801Spain Department of Computing and Technology Cameron UniversityLawton73505OklahomaUSA Universidad de la Rioja LogronoLa Rioja26006Spain

Security weaknesses in web applications deployed in cloud architectures can seriously affect its data confidentiality and integrity.The construction of the procedure utilized in the static analysis tools of source code security differs and therefore each tool finds a different number of each weakness type for which it is designed.To utilize the possible synergies different static analysis tools may process,this work uses a new method to combine several source codes aiming to investigate how to increase the performance of security weakness detection while reducing the number of false positives.Specifically,five static analysis tools will be combined with the designed method to study their behavior using an updated benchmark for OWASP Top Ten Security Weaknesses(OWASP TTSW).The method selects specific metrics to rank the tools for different criticality levels of web applications considering different weights in the ratios.The findings show that simply including more tools in a combination is not synonymous with better results;it depends on the specific tools included in the combination due to their different designs and techniques.

关键词： Weakness benchmark security testing analysis comparative methodology tools combination web application

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Systematic Approach for Web Protection Runtime Tools’Effectiveness Analysis

引用

Computer Modeling in Engineering & Sciences 2022年第12期133卷 579-599页

作者： Tomás Sureda Riera juan Ramón bermejo higuera Javier bermejo higuera juan Antonio Sicilia Montalvo José Javier Martínez Herráiz Computer Science Department University of AlcaláMadrid28801Spain Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLogrono26006Spain

Web applications represent one of the principal vehicles by which attackers gain access to an organization’s network or resources.Thus,different approaches to protect web applications have been proposed to date.Of them,the two major approaches are Web Application Firewalls(WAF)and Runtime Application Self Protection(RASP).It is,thus,essential to understand the differences and relative effectiveness of both these approaches for effective decisionmaking regarding the security of web applications.Here we present a comparative study between WAF and RASP simulated settings,with the aim to compare their effectiveness and efficiency against different categories of attacks.For this,we used computation of different metrics and sorted their results using F-Score index.We found that RASP tools scored better than WAF tools.In this study,we also developed a new experimental methodology for the objective evaluation ofweb protection tools since,to the best of our knowledge,nomethod specifically evaluates web protection tools.

关键词： Web Application Firewall(WAF) Runtime Application Self Protection(RASP) F-Score web attacks experimental methodology

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Benchmarking Approach to Compare Web Applications Static Analysis Tools Detecting OWASP Top Ten Security Vulnerabilities

引用

Computers, Materials & Continua 2020年第9期64卷 1555-1577页

作者： juan R.bermejo higuera Javier bermejo higuera juan A.Sicilia Montalvo Javier Cubo Villalba juan JoséNombela Pérez Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLa Rioja26006Spain

To detect security vulnerabilities in a web application,the security analyst must choose the best performance Security Analysis Static Tool(SAST)in terms of discovering the greatest number of security vulnerabilities as possible.To compare static analysis tools for web applications,an adapted benchmark to the vulnerability categories included in the known standard Open Web Application Security Project(OWASP)Top Ten project is required.The information of the security effectiveness of a commercial static analysis tool is not usually a publicly accessible research and the state of the art on static security tool analyzers shows that the different design and implementation of those tools has different effectiveness rates in terms of security performance.Given the significant cost of commercial tools,this paper studies the performance of seven static tools using a new methodology proposal and a new benchmark designed for vulnerability categories included in the known standard OWASP Top Ten project.Thus,the practitioners will have more precise information to select the best tool using a benchmark adapted to the last versions of OWASP Top Ten project.The results of this work have been obtaining using widely acceptable metrics to classify them according to three different degree of web application criticality.

关键词： Web application benchmark security vulnerability Security Analysis Static Tools assessment methodology false positive false negative precision f-measure

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

MMALE—A Methodology for Malware Analysis in Linux Environments

引用

Computers, Materials & Continua 2021年第5期67卷 1447-1469页

作者： JoséJavier de Vicente Mohino Javier bermejo higuera juan Ramón bermejo higuera juan Antonio Sicilia Montalvo Manuel Sánchez Rubio JoséJavier Martínez Herraiz Escuela Superior de Ingeniería y Tecnología Universidad Internacional de La RiojaLogroño26006La RiojaSpain Departamento de Ciencias de la Computación de la Escuela Politécnica Superior Universidad de Alcaláde HenaresAlcaláde HenaresMadridSpain

In a computer environment,an operating system is prone to malware,and even the Linux operating system is not an exception.In recent years,malware has evolved,and attackers have become more qualified compared to a few years ago.Furthermore,Linux-based systems have become more attractive to cybercriminals because of the increasing use of the Linux operating system in web servers and Internet of Things(IoT)devices.Windows is the most employed OS,so most of the research efforts have been focused on its malware protection rather than on other operating systems.As a result,hundreds of research articles,documents,and methodologies dedicated to malware analysis have been reported.However,there has not been much literature concerning Linux security and protection from malware.To address all these new challenges,it is necessary to develop a methodology that can standardize the required steps to perform the malware analysis in depth.A systematic analysis process makes the difference between good and ordinary malware analyses.Additionally,a deep malware comprehension can yield a faster and much more efficient malware eradication.In order to address all mentioned challenges,this article proposed a methodology for malware analysis in the Linux operating system,which is a traditionally overlooked field compared to the other operating systems.The proposed methodology is tested by a specific Linux malware,and the obtained test results have high effectiveness in malware detection.

关键词： Malware analysis methodology analysis Linux malware IoT malware

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Lighting,colour and geometry:Which has the greatest influence on students’cognitive processes?

引用

Frontiers of Architectural Research 2023年第4期12卷 575-586页

作者： Marıa Luisa Nole Fajardo juan Luis higuera-Trujillo Carmen Llinares Instituto Universitario de Investigacio´n en Tecnologı´a Centrada en el Ser Humano(HUMAN-tech) Universitat Polite`cnica de Vale`nciaValencia 46022Spain School of Architecture Art and DesignTecnologico de MonterreyMonterrey 64849Mexico

Many studies have analysed the effects that design elements,such as lighting and colour,have on students’cognitive functions.These analyses,while providing useful information,do not allow researchers to compare the effects of multiple design elements.The objective of the present study is to analyse the relative influence of lighting,colour and geometry on attention and memory,the main cognitive functions that underlie learning,and on preference.In a controlled,virtual reality(VR)-based experiment,200 university students(100 male/100 female)performed attention,memory and preference tests in classrooms with different configurations of lighting(colour temperature and illuminance),colour(saturation and hue)and geometry(height and width).The results identified significant gender-based differences,which demonstrates the need to segment,by gender,samples in this type of study.Lighting had the greatest influence,significantly affecting males’memories,females’attention and the preferences of both genders.Colour was also an influential element,significantly affecting females’attention,while geometry was the least influential.Finally,it should be highlighted that attention was the metric most sensitive to design variations.These results may be of interest to architects,interior designers and engineers who wish to create classrooms that satisfy students’psychological needs.

关键词： Classroom design Memory Attention Preference Virtual classroom

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Temporal stability and directional change in a color cline of a marine snail from NW Spain

引用

Current Zoology 2024年第2期70卷 163-173页

作者： juan Gefaell ramon Vigo A.Honorato Gonzalez-Vazquez juan Galindo Emilio Rolan-Alvarez Centro de Investigacion Marina Universidade de VigoDepartamento de BioquimicaGenetica e Inmunologia36310 VigoSpain

The evolution and maintenance of color clines is a classic topic of research in evolutionary ecology.However,studies analyzing the temporal dynamics of such clines are much less frequent,due to the difficulty of obtaining reliable data about past color distributions along environmen-tal gradients.In this article,we describe a case of decades-long temporal stability and directional change in a color cline of the marine snail Littorina saxatilis along the coastal inlet of the Ria de Vigo(NW Spain).L.saxatilis from this area shows a clear color cline with 3 distinct areas from the innermost to the more wave-exposed localities of the Ria:the inner,protected localities show an abundance of fawn-like individuals;the intermediate localities show a high diversity of colors;and the outer,wave-exposed localities show populations with a high frequency of a black and lineated morph.We compare data from the 1970s and 2022 in the same localities,showing that the cline has kept relatively stable for at least over half a century,except for some directional change and local variability in the frequency of certain morphs.Multiple regression analyses and biodiversity measures are presented to provide clues into the selective pressures that might be involved in the maintenance of this color cline.Future research avenues to properly test the explanatory power of these selective agents as well as the possible origins of the cline are discussed.

关键词： clinal variation color polymorphism ecological gradient Littorina saxatilis natural selection wave exposure.

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

The impact of the design of learning spaces on attention and memory from a neuroarchitectural approach:A systematic review

引用

Frontiers of Architectural Research 2022年第3期11卷 542-560页

作者： Mar Llorens-Gamez juan Luis higuera-Trujillo Carla Sentieri Omarrementeria Carmen Llinares Department of Architectural Projects Universitat Politecnica de ValenciaValencia 46022Spain Institute for Research and Innovation in Bioengineering(i3B) Universitat Politecnica de ValenciaValencia 46022Spain

Enriched environments in animal models have demonstrated that exposure to an optimal stimulus improves behavior,cognition,and genomics.However,the evidence base for the neurophysiological influence of human environment enrichment has not been extensively studied.This systematic review compiles indicators about the effect of built,indoor environments on the cognitive processes of memory and attention in humans.This work pursues two main objectives:(1)to define current knowledge and the methods that are useful and identify whether previously published studies indicate consistencies and(2)to report the approaches and strategies that can be used in evaluating cognitive processes affected by environment response.Results of this systematic review show that(1)form and geometry,(2)space distribution and context,(3)color and texture,(4)height,width,and enclosure,(5)transition and circulation,and(6)light,sound,and temperature have an impact on memory and/or attention,and they can be assessed objectively.Despite all the advances in this field,methodological limitations and a lack of cross-validated standard protocols are found.Therefore,future research is necessary to provide a deep insight into how human cognition can be heightened by the environment to which it is exposed.

关键词： Built environment Neuroarchitecture Cognition Attention Memory Learning spaces

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Occult hepatitis B virus infection:A complex entity with relevant clinical implications

引用

World Journal of Gastroenterology 2011年第12期17卷 1529-1530页

作者： juan-ramon Larrubia Translational Hepatology Unit Guadalajara University Hospital University of Alcalá

Occult hepatitis B virus(HBV) infection is a world-wide entity,following the geographical distribution of detectable hepatitis B.This entity is defined as the persistence of viral genomes in the liver tissue and in some instances also in the serum,associated to negative HBV surface antigen serology.The molecular basis of the occult infection is related to the life cycle of HBV,which produces a covalently closed circular DNA that persists in the cell nuclei as an episome,and serves as a template for gene transcription.The mechanism responsible for the HBsAg negative status in occult HBV carriers is a strong suppression of viral replication,probably due to the host’s immune response,co-infection with other infectious agents and epigenetic factors.There is emerging evidence of the potential clinical relevance of occult HBV infection,since this could be involved in occult HBV transmission through orthotopic liver transplant and blood transfusion,reactivation of HBV infection during immunosuppression,impairing chronic liver disease outcome and acting as a risk factor for hepatocellular carcinoma.Therefore it is important to bear in mind this entity in cryptogenetic liver diseases,hepatitis C virus/ HIV infected patients and immunosupressed individuals.It is also necessary to increase our knowledge in this fascinating field to define better strategies to diagnose and treat this infection.

关键词：肝炎 B 病毒秘密感染坚持的感染

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Enhancement of the CO_(2)adsorption and hydrogenation to CH_(4)capacity of Ru–Na–Ca/γ–Al_(2)O_(3)dual function material by controlling the Ru calcination atmosphere

引用

Journal of Environmental Sciences 2024年第6期140卷 292-305页

作者： Alejandro bermejo-López Beñat Pereda-Ayo Jon A.Onrubia-Calvo JoséA.González-Marcos juan R.González-Velasco Department of Chemical Engineering Faculty of Science and TechnologyUniversidad del País Vasco UPV/EHUBarrio Sarrienas/n48940 LeioaBizkaiaSpain

Integrated CO_(2)capture and utilization(ICCU)technology requires dual functional materials(DFMs)to carry out the process in a single reaction system.The influence of the calcination atmosphere on efficiency of 4%Ru-8%Na_(2)CO_(3)-8%CaO/γ-Al_(2)O_(3)DFM is studied.The adsorbent precursors are first co-impregnated onto alumina and calcined in air.Then,Ru precursor is impregnated and four aliquotes are subjected to different calcination protocols:static air in muffle or under different mixtures(10%H_(2)/N_(2),50%H_(2)/N_(2)and N_(2))streams.Samples are characterized by XRD,N_(2)adsorption-desorption,H_(2)chemisorption,TEM,XPS,H_(2)-TPD,H_(2)-TPR,CO_(2)-TPD and TPSR.The catalytic behavior is evaluated,in cycles of CO_(2)adsorption and hydrogenation to CH_(4),and temporal evolution of reactants and products concentrations is analyzed.The calcination atmosphere influences the physicochemical properties and,ultimately,activity of DFMs.Characterization data and catalytic performance discover the acccomodation of Ru nanoparticles disposition and basic sites is mostly influencing the catalytic activity.DFM calcined under N_(2)flow(RuNaCa-N_(2))shows the highest CH_(4)production(449μmol/g at 370℃),because a well-controlled decomposition of precursors which favors the better accomodation of adsorbent and Ru phases,maximizing the specific surface area,the Ru-basic sites interface and the participation of different basic sites in the CO_(2)methanation reaction.Thus,the calcination in a N_(2)flow is revealed as the optimal calcination protocol to achieve highly efficient DFM for integrated CO_(2)adsorption and hydrogenation applications.

关键词： CO_(2)methanation Integrated CO_(2)capture and utilization(ICCU) Dual functional material(DFM) Ru calcination atmosphere

来源：

维普期刊数据库

同方期刊数据库评论

在线全文

学校读者我要写书评

暂无评论

欢迎您,

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

请选择保存的检索档案：

请选择收藏分类：

通借通还

欢迎您,

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

在线全文

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：