AWeb Application Fingerprint Recognition Method Based on Machine Learning

Web application fingerprint recognition is an effective security technology designed to identify and classify web applications,thereby enhancing the detection of potential threats and attacks.Traditional fingerprint recognition methods,which rely on preannotated feature matching,face inherent limitations due to the ever-evolving nature and diverse landscape of web applications.In response to these challenges,this work proposes an innovative web application fingerprint recognition method founded on clustering techniques.The method involves extensive data collection from the Tranco List,employing adjusted feature selection built upon Wappalyzer and noise reduction through truncated SVD dimensionality reduction.The core of the methodology lies in the application of the unsupervised OPTICS clustering algorithm,eliminating the need for preannotated labels.By transforming web applications into feature vectors and leveraging clustering algorithms,our approach accurately categorizes diverse web applications,providing comprehensive and precise fingerprint recognition.The experimental results,which are obtained on a dataset featuring various web application types,affirm the efficacy of the method,demonstrating its ability to achieve high accuracy and broad coverage.This novel approach not only distinguishes between different web application types effectively but also demonstrates superiority in terms of classification accuracy and coverage,offering a robust solution to the challenges of web application fingerprint recognition.

Method for test case selection and execution of web application regression testing

In order to improve the efficiency of regression testing in web application,the control flow graph and the greedy algorithm are adopted.This paper considers a web page as a basic unit and introduces a test case selection method for web application regression testing based on the control flow graph.This method is safe enough to the test case selection.On the base of features of request sequence in web application,the minimization technique and the priority of test cases are taken into consideration in the process of execution of test cases in regression testing for web application.The improved greedy algorithm is also raised resulting in optimization of execution of test cases.The experiments indicate that the number of test cases which need to be retested is reduced,and the efficiency of execution of test cases is also improved.

Testing Forms in Web Applications Automatically

Forms enhance both the dynamic and interactive abilities of Web applications and the system complexity. And it is especially important to test forms completely and thoroughly. Therefore, this paper discusses how to carry out the form testing by different methods in the related testing phases. Namely, at first, automatically abstracting forms in the Web pages by parsing the HTML documents; then, ohtai ning the testing data with a certain strategies, such as by requirement specifications, by mining users＇ hefore input informarion or by recording meehanism; and next executing the testing actions automatically due to the well formed test cases; finally, a case study is given to illustrate the convenient and effective of these methods.

Model Checking-Based Testing of Web Applications

A formal model representing the navigation behavior of a Web application as the Kripke structure is proposed and an approach that applies model checking to test case generation is presented. The Object Relation Diagram as the object model is employed to describe the object structure of a Web application design and can be translated into the behavior model. A key problem of model checking-based test generation for a Web application is how to construct a set of trap properties that intend to cause the violations of model checking against the behavior model and output of counterexamples used to construct the test sequences. We give an algorithm that derives trap properties from the object model with respect to node and edge coverage criteria.

Coverage criteria and test requirement reduction for component-based web application

In order to analyze and test the component-based web application and decide when to stop the testing process, the concept of coverage criteria and test requirement reduction approach are proposed. First, four adequacy criteria are defined and subsumption relationships among them are proved. Then, a translation algorithm is presented to transfer the test model into a web application decision-to-decision graph（WADDGraph）which is used to reduce testing requirements. Finally, different sets of test requirements can be generated from WADDGraph by analyzing subsumption and equivalence relationships among edges based on different coverage criteria, and testers can select different test requirements according to different testing environments. The case study indicates that coverage criteria follow linear subsumption relationships in real web applications. Test requirements can be reduced more than 55% on average based on different coverage criteria and the size of test requirements increases with the increase in the complexity of the coverage criteria.

一种面向对象的Web Application测试模型

为了保证Web应用的质量和可靠性,需要不断加强对Web应用软件的测试研究。Web应用软件的有效测试依赖于对其进行充分的分析和理解,提出良好的测试模型,并基于测试模型提出测试策略和测试方法。提出了一种面向对象的Web应用软件测试模型WATM,并且基于WATM提出了测试用例的设计和选择的方法,从而更好地支持Web应用软件的导航测试和状态行为测试。

构建Web Application测试模型

随着W eb应用软件的飞速发展,作为保证W eb质量和可靠性的重要手段,W eb测试受到了人们越来越多的重视。分析了一些典型的W eb测试模型,提出了一种基于Petri网的W eb链接模型。

Hybrid Security Assessment Methodology for Web Applications

This study presents a methodology to evaluate and prevent security vulnerabilities issues for web applications.The analysis process is based on the use of techniques and tools that allow to perform security assessments of white box and black box,to carry out the security validation of a web application in an agile and precise way.The objective of the methodology is to take advantage of the synergies of semi-automatic static and dynamic security analysis tools and manual checks.Each one of the phases contemplated in the methodology is supported by security analysis tools of different degrees of coverage,so that the results generated in one phase are used as feed for the following phases in order to get an optimized global security analysis result.The methodology can be used as part of other more general methodologies that do not cover how to use static and dynamic analysis tools in the implementation and testing phases of a Secure Software Development Life Cycle(SSDLC).A practical application of the methodology to analyze the security of a real web application demonstrates its effectiveness by obtaining a better optimized vulnerability detection result against the true and false positive metrics.Dynamic analysis with manual checking is used to audit the results,24.6 per cent of security vulnerabilities reported by the static analysis has been checked and it allows to study which vulnerabilities can be directly exploited externally.This phase is very important because it permits that each reported vulnerability can be checked by a dynamic second tool to confirm whether a vulnerability is true or false positive and it allows to study which vulnerabilities can be directly exploited externally.Dynamic analysis finds six(6)additional critical vulnerabilities.Access control analysis finds other five(5)important vulnerabilities such as Insufficient Protected Passwords or Weak Password Policy and Excessive Authentication Attacks,two vulnerabilities that permit brute force attacks.

Support for development and test of web application:A tree-oriented model

Building an abstract model of the web application is the chief task of software test based on model, which is an efficient way for testing the web application. One problem with current web application test technologies is the lack of tools for modeling the whole web software, especially the lack of support for describing web application from the view of action and function. This paper is concerned with providing the support for development and test of the web application. The presented novel model, named component-based and tree-oriented web application development model （CBTOWADM）, abstracts the web application as a tree based on its system function and business process. CBTOWADM not only simplifies the design and development of the web application, but also acts as the model middleware for software test. The basic model definition, the system framework and the application in software test of CBTOWADM is described.

Combinatorial Method with Static Analysis for Source Code Security in Web Applications

Security weaknesses in web applications deployed in cloud architectures can seriously affect its data confidentiality and integrity.The construction of the procedure utilized in the static analysis tools of source code security differs and therefore each tool finds a different number of each weakness type for which it is designed.To utilize the possible synergies different static analysis tools may process,this work uses a new method to combine several source codes aiming to investigate how to increase the performance of security weakness detection while reducing the number of false positives.Specifically,five static analysis tools will be combined with the designed method to study their behavior using an updated benchmark for OWASP Top Ten Security Weaknesses(OWASP TTSW).The method selects specific metrics to rank the tools for different criticality levels of web applications considering different weights in the ratios.The findings show that simply including more tools in a combination is not synonymous with better results;it depends on the specific tools included in the combination due to their different designs and techniques.

Automated Testing of Web Applications Using Combinatorial Strategies

Recently, testing techniques based on dynamic exploration, which try to automatically exercise every possible user interface element, have been extensively used to facilitate fully testing web applications. Most of such testing tools are however not effective in reaching dynamic pages induced by form interactions due to their emphasis on handling client-side scripting. In this paper, we present a combinatorial strategy to achieve a full form test and build an automated test model. We propose an algorithm called pairwise testing with constraints （PTC） to iraplement the strategy. Our PTC algorithm uses pairwise coverage and handles the issues of semantic constraints and illegal values. We have implemented a prototype tool ComjaxTest and conducted an empirical study on five web applications. Experimental results indicate that our PTC algorithm generates less form test cases while achieving a higher coverage of dynamic pages than the general pairwise testing algorithm. Additionally, our ComjaxTest generates a relatively complete test model and then detects more faults in a reasonable amount of time, as compared with other existing tools based on dynamic exploration.

Model-based automated testing of JavaScript Web applications via longer test sequences

JavaScript has become one of the most widely used languages for Web development.Its dynamic and event-driven features make it challenging to ensure the correctness of Web applications written in JavaScript.A variety of dynamic analysis techniques have been proposed which are,however,limited in either coverage or scalability.In this paper,we propose a simple,yet effective,model-based automated testing approach to achieve a high code-coverage within the time budget via testing with longer event sequences.We implement our approach as an open-source tool LJS,and perform extensive experiments on 21 publicly available benchmarks.On average,LJS is able to achieve 86.5%line coverage in 10 minutes.Compared with JSDEP,a state-of-the-art breadth-first search based automated testing tool enriched with partial order reduction,the coverage of LJS is 11%-19%higher than that of JSDEP on real-world large Web applications.Our empirical findings support that proper longer test sequences can achieve a higher code coverage in JavaScript Web application testing.

Explosion resistance performance of reinforced concrete box girder coated with polyurea:Model test and numerical simulation

To study the anti-explosion protection effect of polyurea coating on reinforced concrete box girder,two segmental girder specimens were made at a scale of 1:3,numbered as G(without polyurea coating)and PCG(with polyurea coating).The failure characteristics and dynamic responses of the specimens were compared through conducting explosion tests.The reliability of the numerical simulation using LS-DYNA software was verified by the test results.The effects of different scaled distances,reinforcement ratios,concrete strengths,coating thicknesses and ranges of polyurea were studied.The results show that the polyurea coating can effectively enhance the anti-explosion performance of the girder.The top plate of middle chamber in specimen G forms an elliptical penetrating hole,while that in specimen PCG only shows a very slight local dent.The peak vertical displacement and residual displacement of PCG decrease by 74.8% and 73.7%,respectively,compared with those of specimen G.For the TNT explosion with small equivalent,the polyurea coating has a more significant protective effect on reducing the size of fracture.With the increase of TNT equivalent,the protective effect of polyurea on reducing girder displacement becomes more significant.The optimal reinforcement ratio,concrete strength,thickness and range of polyurea coating were also drawn.

基于Concolic Testing的动态Web页面测试研究

传统的软件测试技术对于动态Web程序并不完全适用,针对动态Web程序的特性,探讨适合的测试方法十分必要。文章分析了动态Web应用的特点与测试现状,简要介绍了Concolic Testing思想,并把Concolic Testing测试技术应用于Web应用动态内容页的测试,给出了具体的、具有针对性的测试算法,并以实例进行了验证。

Testing and Analysis of VoIPv6 (Voice over Internet Protocol V6) Performance Using FreeBSD

This study focuses on testing and quality measurement and analysis of VoIPv6 performance. A client, server codes were developed using FreeBSD. This is a step before analyzing the Architectures of VoIPv6 in the current internet in order for it to cope with IPv6 traffic transmission requirements in general and specifically voice traffic, which is being attracting the efforts of research, bodes currently. These tests were conducted in the application level without looking into the network level of the network. VoIPv6 performance tests were conducted in the current tunneled and native IPv6 aiming for better end-to-end VoIPv6 performance. The results obtained in this study were shown in deferent codec's for different bit rates in Kilo bits per second, which act as an indicator for the better performance of G.711 compared with the rest of the tested codes.

An Agent-Based Framework for Automated Testing of Web-Based Systems

Parallel to the considerable growth in applications of web-based systems, there are increasing demands for methods and tools to assure their quality. Testing these systems, due to their inherent complexities and special characteristics, is complex, time-consuming and challenging. In this paper a novel multi-agent framework for automated testing of web-based systems is presented. The main design goals have been to develop an effective and flexible framework that supports different types of tests and utilize different sources of information about the system under test to automate the test process. A prototype of the proposed framework has been implemented and is used to perform some experiments. The results are promising and prove the overall design of the framework.

Web Testing Generation: A Stream <i>X-Machine</i>Based Approach

To ensure the quality of Web applications, Web testing is one of the effective methods. The testing is a process of revealing errors that is used to give confidence that the implementation of a Web application meets its original specification. This work proposes a Web testing framework based on Stream X-Machines (SXMs), which provides a way to derive test cases for a Web application. It starts from constructing the SXM model, from which a test translator is employed to extract the test paths and then translates them into an XML-style test specification, which is the input of test engine. The test engine generates test cases and then executes them, and finally produces test report. This testing method is a significant contribution to informed research.

基于LoadRunner的Web考试系统性能测试与优化

Web系统性能测试以验船师考试系统作为测试对象,结合系统性能测试复杂、多用户负载模拟难度较高的现状,重点针对该系统应用的实时性、稳定性和容错性特点,设计了一种基于LoadRunner的面向验船师考试系统的性能测试方案,对考试系统的关键环节、资源分布情况、硬件性能进行测试。在对测试结果分析的基础上,找出影响系统性能的关键性因素,提出了系统性能优化方案,并对系统进行调优。通过对验船师考试系统的性能测试及优化方法的研究,解决了该系统的性能问题,为Web应用的性能测试提供了有效的测试及优化方法。