当前位置：文档之家 › 外文翻译

外文翻译

  • 格式：pdf
  • 大小：644.59 KB
  • 文档页数：23

AtestingframeworkforWebapplicationsecurityassessmentq

Yao-WenHuanga,b,*,Chung-HungTsaib,Tsung-PoLinb,Shih-KunHuanga,c,D.T.Leea,b,c,Sy-YenKuoa,b

aDepartmentofElectricalEngineering,NationalTaiwanUniversity,Taipei106,TaiwanbInstituteofInformationScience,AcademiaSinica,Taipei115,TaiwancDepartmentofComputerScienceandInformationEngineering,NationalChiao-TungUniversity,Hsinchu300,TaiwanAvailableonline12February2005

AbstractTherapiddevelopmentphasesandextremelyshortturnaroundtimeofWebapplicationsmakeitdifficulttoelim-inatetheirvulnerabilities.HerewestudyhowsoftwaretestingtechniquessuchasfaultinjectionandruntimemonitoringcanbeappliedtoWebapplications.WeimplementedourproposedmechanismsintheWebApplicationVulnerabilityandErrorScanner(WAVES)—ablack-boxtestingframeworkforautomatedWebapplicationsecurityassessment.Real-worldsituationsareusedtotestWAVESandtocompareitwithothertools.OurresultsshowthatWAVESisafeasibleplatformforassessingWebapplicationsecurity.Ó2005ElsevierB.V.Allrightsreserved.Keywords:Webapplicationtesting;Securityassessment;Faultinjection;Black-boxtesting;Completecrawling

1.Introduction

OnFeb2,2000,CERTissuedanadvisory[16]on‘‘cross-sitescripting’’(XSS)attacksonWebapplications.Thishard-to-eliminatethreatsoondrewtheattentionandspawnedactivediscussionsamongsecurityresearchers[40].DespitetheeffortsofresearchersintheprivatesectorandacademiatopromotedeveloperawarenessandtodeveloptoolstoeliminateXSSattacks,hackersarestillusingthemtoexploitWebapplications.Astudy

1389-1286/$-seefrontmatterÓ2005ElsevierB.V.Allrightsreserved.

doi:10.1016/j.comnet.2005.01.003qSupportedbytheNCERTproject(No.910444)ofInstituteforInformationIndustry,sponsoredbyMinistryofEconomicAffairs,andbytheNationalScienceCouncilunderthegrantsNo.NSC92-2422-H-001-004,NSC-93-2213-E-002-122,NSC-93-2213-E-001-013,NSC-93-2422-H-001-0001,andNSC-93-2752-E-002-005-PAE.*Correspondingauthor.Address:DepartmentofElectricalEngineering,NationalTaiwanUniversity,Taipei106,Taiwan.E-mailaddresses:ywhuang@openwaves.net(Y.-W.Huang),chtsai@openwaves.net(C.-H.Tsai),lancelot@iis.sinica.edu.tw(T.-P.Lin),skhuang@iis.sinica.edu.tw(S.-K.Huang),dtlee@iis.sinica.edu.tw(D.T.Lee),sykuo@cc.ee.ntu.edu.tw(S.-Y.

Kuo).ComputerNetworks48(2005)

739–761www.elsevier.com/locate/comnetbyOhmaki[43]foundthatalmost80%ofalle-commercesitesinJapanwerestillvulnerabletoXSS.AsearchonGoogleNewsforXSSadvisoriesonnewlydiscoveredXSSvulnerabilitieswithinthemonthofMarch2004aloneyielded24reports,amongthesewereconfirmedvulnerabilitiesinMicrosoftHotmail[70]andYahoo!Mail[32],bothofwhicharepopularweb-basedemailservices.ScottandSharp[58,59]haveassertedthatWebapplicationvulnerabilitiesare(a)inherentinWebapplicationcodes;and(b)independentofthetech-nologyinwhichtheapplicationinquestionisimplemented,thesecurityoftheWebserver,andtheback-enddatabase.Currenttechnologiessuchasanti-virussoftwareprogramsandnetworkfire-wallsoffercomparativelysecureprotectionatthehostandnetworklevels,butnotattheapplicationlevel[18].However,whennetworkandhost-levelentrypointsarerelativelysecure,thepublicinter-facesofWebapplicationsbecomethefocusofattacks[18].Recently,effortsonautomatedsecurityverifica-tionofCprogramshaveyieldedpromisingresults.InourprojectWebSSARIv.1(WebapplicationSecurityAnalysisandRuntimeInspection)[24],weadoptedatypestate-basedalgorithmforidenti-fyingvulnerabilitiesinPHPcode.InWebSSARIv.2[25],weshowedhowthisstrategycanbeim-provedusingboundedmodelchecking.Thoughourresultsshowthatsuchwhite-boxverificationcanbesuccessfullyusedforautomatedWebappli-cationsecurityassessment,theyhaveseveraldraw-backs.Onemajordrawbackistheirneedforsourcecodewhichinmanycasesmaynotbeeasilyavailable.Anotheristhattheyverifyagainstsimu-latedruntimebehaviorsbasedonprogramabstraction,whilewhetherornottheabstractioncorrectlyreflectstheactualprogramisleftinques-tion.Therefore,whilethesetechniquesfailtoade-quatelyconsidertheruntimebehaviorofWebapplications,itisgenerallyagreedthatthemassivenumberofruntimeinteractionsbetweenvariouscomponentsiswhatmakesWebapplicationsecu-ritysuchachallengingtask[28,58].Inthispaper,wedescribeourblack-boxtestingframeworkforWebapplicationsecurityassess-ment.ThemaindifficultyindesigningaWebapplicationtestingframeworkliesinprovidingefficientinterfacemechanisms.SinceWebapplica-tionsinteractwithusersbehindbrowsersandactaccordingtouserinput,suchinterfacesmusthavetheabilitytomimicboththebrowserandtheuser.Inotherwords,theinterfacemustprocesscontentthatismeanttoberenderedbybrowsersandlaterinterpretedbyhumans.Ourinterfacetakestheformofacrawler,whichallowsforablack-box,dynamicanalysisofWebapplications.Usingacompletecrawlingmechanism,areverseengineer-ingofaWebapplicationisperformedtoidentifyalldataentrypoints.Then,withthehelpofaself-learninginjectionknowledgebase,faultinjec-tiontechniquesareappliedtodetectSQLinjectionvulnerabilities.UsingourproposedTopicModel,theknowledgebaseselectsthebestinjectionpat-ternsaccordingtoexperienceslearnedthroughpreviousinjectionfeedback,andthenexpandstheknowledgebaseasmorepagesarecrawled.Bothpreviousexperiencesandknowledgeexpan-sioncontributetothegenerationofbetterinjec-tionpatterns.Wealsoproposeanovelreplyanalysisalgorithminordertohelpthecrawlerinterpretinjectionreplies.Byimprovingtheobservability[72]oftheWebapplicationbeingtested,thealgorithmhelpsfacilitateadeepinjec-tionmechanismthateliminatesfalsenegatives.Toimitatereal-worldinteractionswithWebapplications,ourcrawlerisequippedwiththesamecapabilitiesasafull-fledgedbrowser,thusmakingitvulnerabletomaliciousscriptsthatmayhavebeeninsertedintoaWebapplicationviacross-sitescripting.Sinceamaliciousscriptthatiscapableofattackinganinteractingbrowserisalsocapableofattackingthecrawler,asecureexecutionenvironment(SEE)thatenforcesananomalydetectionmodelwasbuiltaroundthecrawler.Duringthereverseengineeringphase,allpagesofaWebapplicationareloadedintothecrawlerandexecuted.Inputstimuli(i.e.,simulateduserevents)aregeneratedbythecrawlertotestthebehaviorofthepageÕsdynamiccomponents.AnyabnormalbehaviorwillcausetheSEEtoimmedi-atelyhaltthecrawlerandaudittheinformation.Thus,whileofferingself-protection,thislayeralsodetectsmaliciousscriptshiddeninsideWebapplications.740Y.-W.Huangetal./ComputerNetworks48(2005)739–761

合集下载

外文翻译

外文翻译

Response of a reinforced concrete infilled-frame structure to

removal of two adjacent columns

Abstract

The response of Hotel San Diego, a six-story reinforced concrete infilled-frame structure, is

evaluated following the simultaneous removal of two adjacent exterior columns. Analytical

models of the structure using the Finite Element Method as well as the Applied Element Method

are used to calculate global and local deformations. The analytical results show good agreement

with experimental data. The structure resisted progressive collapse with a measured maximum

vertical displacement of only one quarter of an inch (6.4 mm). Deformation propagation over the

height of the structure and the dynamic load redistribution following the column removal are

experimentally and analytically evaluated and described. The difference between axial and

外文翻译 2

外文翻译 2

Regenerative Compression Braking—A Low Cost Alternative to Electric

Hybrids

"蓄热压缩制动¬-油电混合动力的低成本替代"

Abstract （）

Introduction 引言

The U.S. automobile industry under intense pressure to reduce exhaust emissions and

improve fuel economy of the vehicles it produces. In addition to much tougher limits

on nitrogen oxides, a prospect of government imposed restriction on carbon dioxide

emission is looming in not too distant future. In contrast to dealing with other harmful

exhaust components, there is no viable aftertreatment for carbon dioxide. The only

way to restrict the quantity of carbon dioxide emitted is to reduce the amount of

hydrocarbon fuel consumed.

美国的汽车产业在巨大的压力，致力于降低尾气排放和提高汽车的燃油经济性。除了对氮氧化合物更加强硬的限制，在不久的将来政府对二氧化碳排放量的限制前景也不容乐观。与处理其他有害废气成分相比，二氧化碳没有可行的后处理方案。限制二氧化碳排放量的唯一途径就是减少碳氢燃料的消费量。

The prospect of further significant tightening of fuel economy standards carries

外文翻译 3

外文翻译 3

Ⅲ.外文翻译

外文翻译之一

Destination brand positions of a competitive set of

near-home destinations

作者：Steven Pike

国籍：Australia

出处：Tourism Management, In Press, Corrected Proof, Available online 24

January 2009

原文正文：

Abstract:Although the branding literature commenced during the 1940s, the

first publications related to destination branding did not emerge until half a

century later. A review of 74 destination branding publications by 102 authors

from the first 10 years of destination branding literature (1998–2007) found at

least nine potential research gaps warranting attention by researchers. In

particular, there has been a lack of research examining the extent to which

brand positioning campaigns have been successful in enhancing brand equity

in the manner intended in the brand identity. The purpose of this paper is to

外文翻译 4

外文翻译 4

1 附录一 外文原文

Introduction

MATLAB is a high-level technical computing language and

interactive environment for algorithm development, data visualization,

data analysis, and numeric computation. Using MATLAB, you can

solve technical computing problems faster than with traditional

programming languages, such as C, C++, and Fortran.

You can use MATLAB in a wide range of applications, including

signal and image processing, communications, control design, test and

measurement, financial modeling and analysis, and computational

biology. Add-on toolboxes (collections of special-purpose MATLAB

functions, available separately) extend the MATLAB environment to

solve particular classes of problems in these application areas.

MATLAB provides a number of features for documenting and

sharing your work. You can integrate your MATLAB code with other