Secure Web Application Technologies Implementation through Hardening Security Headers Using Automated Threat Modelling Techniques

This paper investigates whether security headers are enforced to mitigate cyber-attacks in web-based systems in cyberspace. The security headers examined include X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Referrer-Policy, Content-Security-Policy, and Permissions-Policy. The study employed a controlled experiment using a security header analysis tool. The web-based applications (websites) were analyzed to determine whether security headers have been correctly implemented. The experiment was iterated for 100 universities in Africa which are ranked high. The purposive sampling technique was employed to understand the status quo of the security headers implementations. The results revealed that 70% of the web-based applications in Africa have not enforced security headers in web-based applications. The study proposes a secure system architecture design for addressing web-based applications’ misconfiguration and insecure design. It presents security techniques for securing web-based applications through hardening security headers using automated threat modelling techniques. Furthermore, it recommends adopting the security headers in web-based applications using the proposed secure system architecture design.

An Analysis of the Influence of Protective Films on the Inner Surfaces of CCPP Headers and Steam Pipelines on Their Thermal Stress State

At present, the main attention of researchers is paid to the deterioration of heat transfer when heating the outer surface of the pipe with the liquid or steam, flowing inside it, in the presence of films or deposits on its inner surface. However, when pipe is heating by heat carrier medium, flowing inside it, film on the inner pipe surface serve a dual protective function, protecting the pipe from corrosion and reducing its thermal stress. The article represents the results of the computational analysis of protective films influence on the thermal stressed state of headers and steam pipelines of combined-cycle power plants (CCPP) heat-recovery steam generators at different transient operating conditions particularly at startups from different initial temperature states and thermal shock. It is shown that protective films have a significant influence on the stresses magnitude and damage accumulation mainly for great temperature disturbances (for thermal shock). Calculations were carried out at various thicknesses of films and assuming that their thermal conductivity less than thermal conductivity of the steam pipelines metal.

Hopping-Aware Cluster Header Capability for Sensor Relocation in Mobile IoT Networks

Mobile sensor nodes such as hopping sensors are of critical importance in data collection.However,the occurrence of sensing holes is unavoidable due to the energy limitation of the nodes.Thus,it is evident that the relocation of mobile sensors is the most desirable method to recover the sensing holes.The previous research conducted by the authors so far demonstrated the most realistic hopping sensor relocation scheme,which is suitable for the distributed environment.In previous studies,the cluster header plays an essential role in detecting the sensing hole and requesting the neighboring cluster to recover the sensing hole that occurred in the sensor node.However,the limitations of the cluster header in the previously proposed relocation protocol are not fully considered.Because the cluster header jumps more frequently than non-header nodes,its energy con-sumption is relatively high compared to other nodes.Therefore,it is most likely to lead to header node failure and can lead to data loss on the network.In this paper,the jumping ability and energy consumption of the cluster header are seriously considered.Additional ability to replace cluster headers in case of failure is also implemented.Simulation results show that the data collection time can be further increased,which demonstrates the validity of the proposed algorithms.

Impact of Portable Executable Header Features on Malware Detection Accuracy

One aspect of cybersecurity,incorporates the study of Portable Executables(PE)files maleficence.Artificial Intelligence(AI)can be employed in such studies,since AI has the ability to discriminate benign from malicious files.In this study,an exclusive set of 29 features was collected from trusted implementations,this set was used as a baseline to analyze the presented work in this research.A Decision Tree(DT)and Neural Network Multi-Layer Perceptron(NN-MLPC)algorithms were utilized during this work.Both algorithms were chosen after testing a few diverse procedures.This work implements a method of subgrouping features to answer questions such as,which feature has a positive impact on accuracy when added?Is it possible to determine a reliable feature set to distinguish a malicious PE file from a benign one?when combining features,would it have any effect on malware detection accuracy in a PE file?Results obtained using the proposed method were improved and carried few observations.Generally,the obtained results had practical and numerical parts,for the practical part,the number of features and which features included are the main factors impacting the calculated accuracy,also,the combination of features is as crucial in these calculations.Numerical results included,finding accuracies with enhanced values,for example,NN_MLPC attained 0.979 and 0.98;for DT an accuracy of 0.9825 and 0.986 was attained.

新型SQL注入攻击的研究与防范

针对一种以HTTP Headers为途径的新型SQL注入攻击进行了深入研究.通过分析具体的SQL注入实例,揭示了该新型SQL注入攻击的原理,并提出了针对此类攻击的防范手段.通过ip过滤,数据校验,机器学习等手段建立了一套完整的防御模型,且该模型具有低侵入、易实现、高可用、强扩展等优点.

模糊算法在高校教师评价系统中的应用研究

高校教师教学的评价关系到教师教学水平的提升,也关系到学校乃至整个教育事业的发展,教学评价在教育领域占据非常重要的位置。为了客观有效的做好教师教学评价工作,我们针对高校教师教学评价工作的模糊性,运用模糊数学理论,研究在高校教师教学评价中模糊算法的应用方法。

使用JavaScript脚本为某视频网站增加下载功能

通过对工作中涉及的某视频网站分析以及脚本编写,实现为该网站增加视频下载功能。

基于单片机的MIDI文件中delta-time的实现

在单片机与某些MIDI模块进行通信时,由单片机将MIDI文件发送给MIDI模块时,MIDI模块仅能执行MIDI命令,不能识别和执行MIDI文件中的delta-time,而delta-time又是MIDI文件中非常重要的部分,在这种情况下单片机就要根据delta-time的特征,完成识别并执行delta-time的任务。

Mechanical Stress Analysis of a 600MW Supercritical Boiler Superheater Outlet Header

The mechanical stress distribution and the stress concentrations of the superheater outlet header of a 600MW supercritical boiler were analyzed by the finite element method. The results showed that the stress concentrated at the inside conjunction area between the pipe and the header cylinder , and the value of the maximum mechanical stress concentration factor is 2.51.

浅谈IPv6的安全机制

目前Internet中广泛使用的IPv4协议,也就是人们常说的IP协议,已经有几十年的历史了。自20世纪90年代起,互联网和个人计算机得到广泛普及,IPv4地址资源严重不足,安全问题日益突出。1994年后IETF提出一种新IP地址解决方案,被称为IPv6。IPv6不但解决了IP地址匮乏的问题,并且由于它引入了加密和认证机制．实现了基于网络层的身份认证,确保了数据包的完整性和机密性。

AP1000核电站系统清洗方法的实践与探索

针对AP1000工艺系统冲洗过程中较多管线无法形成闭合回路的情况,采用合理的冲洗方案,以特有的高压水枪机械清洗方法配合传统的一次通过式、循环冲洗和手工擦拭等方式,针对碳钢管道使用高效的CUNO过滤器,能够在冲洗时间、质量控制方面取得良好效果。

NUMERICAL STUDY ON FLOW DISTRIBUTION IN PLATE-FIN HEAT EXCHANGERS

Objective To investigate the flow distribution in plate fin heat exchangers and optimize the design of header configuration for plate fin heat exchangers. Methods A mathematical model of header was proposed. The effects of the header configuration on the flow distribution in plate fin heat exchangers were investigated by CFD. The second header configuration with a two stage distributing structure was brought forward to improve the performance of flow distribution. Results It is found that the flow maldistribution is very serious in the direction of header length for the conventional header used in industry. The numerical predictions indicate that the improved header configurations can effectively improve the performance of flow distribution in plate fin heat exchangers. Conclusion The numerical simulation confirms that CFD should be a suitable tool for predicting the flow distribution. The method has a wide variety of applications in the design of plate fin heat exchangers.

An Automatic Test System in Robot Welding Station

ＡｎＡｕｔｏｍａｔｉｃＴｅｓｔＳｙｓｔｅｍｉｎＲｏｂｏｔＷｅｌｄｉｎｇＳｔａｔｉｏｎＬＩＲｕｉｆｅｎｇ；ＴＡＯＱｉａｎ；ＣＡＩＨｅｇａｏ；ＨＯＵＬｉｎｑｉ（李瑞峰）（陶谦）（蔡鹤皋）（候琳祺）（ＲｏｂｏｔＲｅｓｅａｒｃｈＩｎｓｔｉｔｕｔｅ，Ｈａｒｂｉ...

A Study on Control System of Robot Working Unit for Automatically Welding Nipples onto Header of Boiler

ＡＳｔｕｄｙｏｎＣｏｎｔｒｏｌＳｙｓｔｅｍｏｆＲｏｂｏｔＷｏｒｋｉｎｇＵｎｉｔｆｏｒＡｕｔｏｍａｔｉｃａｌｌｙＷｅｌｄｉｎｇＮｉｐｐｌｅｓｏｎｔｏＨｅａｄｅｒｏｆＢｏｉｌｅｒ￥ＴＡＯＱｉａｎ；ＹＵＳｈｕｆｅｎｇ；ＪＩＡＮＧＳｈａｎ；ＣＡＯＰｅｉｊｕｎ...

An Optimization of HTTP/2 for Mobile Applications

In recent years, Hyper Text Transfer Protocol （HTTP） spreads quickly and steadily in the usage of mobile applications as a common web protocol, so that the mobile applications can also benefit from HTTP/2, which is the new version of HTTP based on SPDY developed by Google to speed up the Internet transmission speed. HTTP/2 enables a more efficient use of network resources and a reduced perception of latency by in- troducing header field compression and allowing multiple concurrent exchanges on the same connection. However, what H3TP/2 focuses on is visiting websites through a browser, and mobile applications are not considered much. In this paper, firstly, mobile applications are classified based on the da- ta flow characteristics. Based on the classification, we propose an optimization of HTTP/2 for mobile applications, called HTTP/2-Advance, which uses multiple Transmission Control Protocol （TCP） connections to multiplex HTYP requests and responses. Then we build a tiny system which simulates actu- al requests and responses between mobile applications and servers. We figure out the best choice of the number of multiple TCP connections for mobile applications, and compare the performance of HTTP, HTTP/2 and HTrP/2-Advance in both simulated and in-situ experiments in our system.

The status and prospects of in situ grain harvesting technology and its machine system

Two main types of in situ grain harvesttng machine are introduced. The comparison of their working principles and advantages are given. The limitations and prospects for stripper header are discussed.

Security Policies for Web Service Invocation of Automotive Industry Chain Collaboration Platform

To meet the actual requirements of an automotive industry chain collaboration platform （AICCP）, this paper offers several simple but effective security policies based upon the traditional security mechanism of data transfer, including user ID verification with SOAP （simple object access protocol）, header, SOAP message encryption with SOAP extension and XML （extensible markup language） file encryption and decryption. Application of these policies to the AICCP for more than one year proves the effectiveness of the data exchange practice between the AICCP and enterprise Intranet.

A Comparative Study of Email Forensic Tools

Over the last decades, email has been the major carrier for transporting spam and malicious contents over the network. Email is also the primary source of numerous criminal activities on the Internet. Computer Forensics is a systematic process to retain and analyze saved emails for the purpose of legal proceedings and other civil matters. Email analysis is challenging due to not only various fields that can be forged by hackers or malicious users, but also the flexibility of composing, editing, deleting of emails using offline (e.g., MS Outlook) or online (e.g., Web mail) email applications. Towards this direction, a number of open source forensics tools have been widely used by the practitioners. However, these tools have been developed in an isolated manner rather than a collaborative approach. Given that email forensic tool users need to understand to what extent a tool would be useful for his/her circumstances and conducting forensic analysis accordingly. In this paper, we examine a set of common features to compare and contrast five popular open source email forensic tools. The study finds that all email forensic tools are not similar, offer diverse types of facility. By combining analysis tools, it may be possible to gain detailed information in the area of email forensic.

Gas Flare Design Debottlenecking Using Pinch Analysis

Gas flaring is concerned with the combustion of lighter ends of hydrocarbon mostly produced in association with crude oil. Flare networks are designed to handle the gas volume required to be flared. Most times, this flare networks are in close proximity but still have independent flare stacks, increasing risk to environment and cost on infrastructures. There is a need to integrate the flare networks in facilities within same area and through the application of Pinch Analysis concept, the resultant flare network can be optimized to give a system having optimal tail and header pipe sizes that will reduce cost and impact on environment. In the light of the foregoing, the concept of pinch analysis was used in debottlenecking integrated gas flare networks from a flow station and a refinery in close proximity. Both flare networks were integrated and the resultant gas flare network was optimized to obtain the optimum pipe header and tail pipe sizes with the capacity to withstand the inventory from both facilities and satisfy the set constraints such as Mach number, noise, RhoV2 and backpressure. Mach number was set at 0.7 for tail pipes and 0.5 for header pipes, noise limit was not to exceed 80 dB upstream and 115 dB downstream the sources, RhoV2 was limited to 6000 kg/m/s2 and the back pressure requirement was source dependent respectively. The fire case scenario was considered, as it is the worst-case scenario in the studies. When pinch analysis was applied in debottlenecking the combined gas flare network, it gave smaller tail and header pipe sizes which is more economical. A 20% decrease in pipe sizes was recorded at the end of the study.

Influences of harvester and weather conditions on field loss and milling quality of rough rice

A better understanding of factors affecting field losses and milling quality during harvest is needed to improve the economic value of rice.The main objective of this study was to evaluate the impact of harvester header,harvester type,and weather conditions on field loss and milling quality of rough rice.Four popular harvesters equipped with different headers:John Deere 9870 with header D60-S,John Deere 9860 with header D972-S,Hardy,and John Deere 9770 with stripper header were evaluated in this study.The header and total field losses of rice were evaluated for each harvester under regular,rainy and windy weather conditions.Tests were conducted in a rice field cultivated with medium grain rice,variety M206,at Grimes,CA.Total rice yield(TRY),head rice yield(HRY)and whiteness index(WI)were examined to evaluate the effect of weather conditions on milling quality.The obtained results revealed that the rice field loss was affected by harvester header and type,and weather conditions.Among the conventional headers,D60-S significantly reduced the rice loss compared to the D972-S and the Hardy.Harvesting with John Deere 9860 resulted in significant header and field loss compared to other tested harvesters.The average loss increased from 236.2 kg/hm^(2)and 445.2 kg/hm^(2)under regular condition to 711.1 kg/hm^(2)and 907.9 kg/hm^(2)under windy condition for John Deere 9870 and John Deere 9860,respectively.The corresponding loss percentages increased from 2.6%and 4.9%to 7.9%and 10.1%.HRY was significantly affected by weather condition at harvest time.However,the weather condition had no significant effect on TRY and WI.To minimize the rice field loss and obtain good milling quality,commercial rice harvesting during regular weather conditions is important.A proper combination of harvester type and header could be vital for reducing the rice loss.