In today’s rapidly evolving digital landscape,web application security has become paramount as organizations face increasingly sophisticated cyber threats.This work presents a comprehensive methodology for implementi...In today’s rapidly evolving digital landscape,web application security has become paramount as organizations face increasingly sophisticated cyber threats.This work presents a comprehensive methodology for implementing robust security measures in modern web applications and the proof of the Methodology applied to Vue.js,Spring Boot,and MySQL architecture.The proposed approach addresses critical security challenges through a multi-layered framework that encompasses essential security dimensions including multi-factor authentication,fine-grained authorization controls,sophisticated session management,data confidentiality and integrity protection,secure logging mechanisms,comprehensive error handling,high availability strategies,advanced input validation,and security headers implementation.Significant contributions are made to the field of web application security.First,a detailed catalogue of security requirements specifically tailored to protect web applications against contemporary threats,backed by rigorous analysis and industry best practices.Second,the methodology is validated through a carefully designed proof-of-concept implementation in a controlled environment,demonstrating the practical effectiveness of the security measures.The validation process employs cutting-edge static and dynamic analysis tools for comprehensive dependency validation and vulnerability detection,ensuring robust security coverage.The validation results confirm the prevention and avoidance of security vulnerabilities of the methodology.A key innovation of this work is the seamless integration of DevSecOps practices throughout the secure Software Development Life Cycle(SSDLC),creating a security-first mindset from initial design to deployment.By combining proactive secure coding practices with defensive security approaches,a framework is established that not only strengthens application security but also fosters a culture of security awareness within development teams.This hybrid approach ensures that security considerations are woven into every aspect of the development process,rather than being treated as an afterthought.展开更多
Software engineering＇s lifecycle models havc proven to be very important for traditional software development. However, can these models be applied to the development of Web-based applications as well？ In recent yea...Software engineering＇s lifecycle models havc proven to be very important for traditional software development. However, can these models be applied to the development of Web-based applications as well？ In recent years, Web-based applications have become more and more complicated and a lot of efforts have been placed on introducing new technologies such as J2EE, PhP, and .NET, etc., which have been universally accepted as the development technologies for Web-based applications. However, there is no universally accepted process model for the development of Web-based applications. Moreover, shaping the process model for small medium-sized enterprises （SMEs）, which have limited resources, has been relatively neglected. Based on our previous work, this paper presents an expanded lifecycle process model for the development of Web-based applications in SMEs. It consists of three sets of processes, i.e., requirement processes, development processes, and evolution processes. Particularly, the post-delivery evolution processes are important to SMEs to develop and maintain quality web applications with limited resources and time.展开更多
Software-related security aspects are a growing and legitimate concern,especially with 5G data available just at our palms.To conduct research in this field,periodic comparative analysis is needed with the new techniq...Software-related security aspects are a growing and legitimate concern,especially with 5G data available just at our palms.To conduct research in this field,periodic comparative analysis is needed with the new techniques coming up rapidly.The purpose of this study is to review the recent developments in the field of security integration in the software development lifecycle(SDLC)by analyzing the articles published in the last two decades and to propose a way forward.This review follows Kitchenham’s review protocol.The review has been divided into three main stages including planning,execution,and analysis.From the selected 100 articles,it becomes evident that need of a collaborative approach is necessary for addressing critical software security risks(CSSRs)through effective risk management/estimation techniques.Quantifying risks using a numeric scale enables a comprehensive understanding of their severity,facilitating focused resource allocation and mitigation efforts.Through a comprehensive understanding of potential vulnerabilities and proactive mitigation efforts facilitated by protection poker,organizations can prioritize resources effectively to ensure the successful outcome of projects and initiatives in today’s dynamic threat landscape.The review reveals that threat analysis and security testing are needed to develop automated tools for the future.Accurate estimation of effort required to prioritize potential security risks is a big challenge in software security.The accuracy of effort estimation can be further improved by exploring new techniques,particularly those involving deep learning.It is also imperative to validate these effort estimation methods to ensure all potential security threats are addressed.Another challenge is selecting the right model for each specific security threat.To achieve a comprehensive evaluation,researchers should use well-known benchmark checklists.展开更多
[Objective] The research aimed to study design and development of system platform of 'study on relationship between natural phenology and climate change' based on WEB and GIS. [Method] Relied on the technologi...[Objective] The research aimed to study design and development of system platform of 'study on relationship between natural phenology and climate change' based on WEB and GIS. [Method] Relied on the technologies of WEB and GIS, a set of system platform of 'study on relationship between natural phenology and climate change' was developed based on the hybrid architecture of C/S (Client/Server) and B/S (Browser/Server). Moreover, its establishing process and functional module were detailedly introduced. [Result] The natural phenology and climate change in Guangxi were research objects of system platform of 'study on relationship between natural phenology and climate change'. By combining WEB and GIS with database, the primary application of 'study on relationship between natural phenology and climate change' was realized. The system used hybrid architecture of C/S and B/S. The four-layer architectures were independent to improve security, stability and maintainability of system. The visual interface on the foreground was simply, clear and easy to use. The generating program of GIS three-dimensional graph on the background was real-time and high-efficiency, providing powerful guarantee for stable and safe operation of phenology research work process. The system had functions of inquiry, analysis, statistical diagram, GIS three-dimensional graph and data export. Through the analysis of natural phenology observation data, the system could find variation rule of natural phenology as three-dimensional space (longitude, latitude and altitude) and its relationship with climate change. [Conclusion] The research laid good foundation for further deeply carrying out application of 'study on relationship between natural phenology and climate change', and also provided reference basis for recognizing nature and using change rule of phenology to execute production scheduling and strategic decision (seed-introduction and regionalization).展开更多
Impedance mismatch of data flow is the major problem in the relational database when one is using the web based application development on the computer system. It effects the development of scalable and reusable web a...Impedance mismatch of data flow is the major problem in the relational database when one is using the web based application development on the computer system. It effects the development of scalable and reusable web application. Due to this, the research cost of development and maintenance increases. Therefore the present work is an attempt towards an object-oriented database system by using Db4o to overcome the impedance mismatch problem. In the current work, the development of web application for Indian Postal Services by using Db4o is demonstrated on dot NET platform. Before developing the application, the authors used a Unified Modeling Language (UML) model in the form of UML class, sequence and use-case diagrams. The Db4o is used to store the object-oriented database and the performance of Db4o is observed through several object-oriented queries and corresponding results are demonstrated.展开更多
The emerging Model-Driven Engineering (MDE) paradigm advocates the use of models as first-class citizens in the software development process, while artifacts such as documentation and source-code can be quickly produc...The emerging Model-Driven Engineering (MDE) paradigm advocates the use of models as first-class citizens in the software development process, while artifacts such as documentation and source-code can be quickly produced from those models by using automated transformations. Even though many MDE-oriented approaches, languages and tools have been developed in the recent past, there is no standard that concretely defines a specific sequence of steps to obtain a functional software system from a model. Thus, the existing approaches present numerous differences among themselves, because each one handles the problems inherent to software development in its own way. This paper presents and discusses a reference model for the comparative study of current MDE approaches in the scope of web-application development. This reference model focuses on relevant aspects such as modeling language scope (domain, business-logic, user-interface), usage of patterns, separation of concerns, model transformations, tool support, and deployment details like web-platform independence and traditional programming required. The ultimate goal of this paper is to determine the aspects that will be of greater importance in future web-oriented MDE languages.展开更多
Inferring the fully qualified names(FQNs)of undeclared receiving objects and non-fully-qualified type names(non-FQNs)in partial code is critical for effectively searching,understanding,and reusing partial code.Existin...Inferring the fully qualified names(FQNs)of undeclared receiving objects and non-fully-qualified type names(non-FQNs)in partial code is critical for effectively searching,understanding,and reusing partial code.Existing type inference tools,such as COSTER and SNR,rely on a symbolic knowledge base and adopt a dictionary-lookup strategy to map simple names of undeclared receiving objects and non-FQNs to FQNs.However,building a symbolic knowledge base requires parsing compilable code files,which limits the collection of APIs and code contexts,resulting in out-of-vocabulary(OOV)failures.To overcome the limitations of a symbolic knowledge base for FQN inference,we implemented Ask Me Any Type(AMAT),a type of inference plugin embedded in web browsers and integrated development environment(IDE).Unlike the dictionary-lookup strategy,AMAT uses a cloze-style fill-in-the-blank strategy for type inference.By treating code as text,AMAT leverages a fine-tuned large language model(LLM)as a neural knowledge base,thereby preventing the need for code compilation.Experimental results show that AMAT outperforms state-of-the-art tools such as COSTER and SNR.In practice,developers can directly reuse partial code by inferring the FQNs of unresolved type names in real time.展开更多
Although the WEB software development has some difficulty,but as long as the programming skills to find,in the practice ofoperation will find programming fun,this will stimulate the enthusiasm of students programming....Although the WEB software development has some difficulty,but as long as the programming skills to find,in the practice ofoperation will find programming fun,this will stimulate the enthusiasm of students programming.Exploration of interesting skills programmingof WEB software development is aimed at developers who initial contact with WEB software,through the practice of operation to make themget some fun of WEB programming,from simple to difficult gradually let students master WEB programming skills,improve students＇ interestin programming.By adding some special effects of webpages to enhance the students＇ interest in programming,through the key practice ofdatabase,let the students out of fear of programming of database connection.展开更多
This paper presents a reference methodology for process orchestration that accelerates the development of Large Language Model (LLM) applications by integrating knowledge bases, API access, and deep web retrieval. By ...This paper presents a reference methodology for process orchestration that accelerates the development of Large Language Model (LLM) applications by integrating knowledge bases, API access, and deep web retrieval. By incorporating structured knowledge, the methodology enhances LLMs’ reasoning abilities, enabling more accurate and efficient handling of complex tasks. Integration with open APIs allows LLMs to access external services and real-time data, expanding their functionality and application range. Through real-world case studies, we demonstrate that this approach significantly improves the efficiency and adaptability of LLM-based applications, especially for time-sensitive tasks. Our methodology provides practical guidelines for developers to rapidly create robust and adaptable LLM applications capable of navigating dynamic information environments and performing effectively across diverse tasks.展开更多
As the population of the Internet grows rapidly the development of web technologies becomes extremely important. For the evolvement of Web 2.0, web services are essential. Web services are programs that allow computer...As the population of the Internet grows rapidly the development of web technologies becomes extremely important. For the evolvement of Web 2.0, web services are essential. Web services are programs that allow computers of different platforms on the web to interactively communicate without the need of extra data for human reading interfaces and formats such as web page structures. Since web service is a future trend for the growth of internet, the tools that are used for development is also important. Although there are many choices of web service frameworks to choose from, developers should choose the framework that fits best to their application based on performance, time and effort for the framework. In this project, we chose four common frameworks to compare them in both qualitative and quantitative metrics. After running the tests, the results are statistically analyzed by SAS.展开更多
Quality is a key factor to ensuring success of e-government websites. Therefore, a definition for high-quality e-government website is required, as well as, an e-government system’s quality evaluation methodology. Th...Quality is a key factor to ensuring success of e-government websites. Therefore, a definition for high-quality e-government website is required, as well as, an e-government system’s quality evaluation methodology. This paper identifies quality attributes that are required to assess the quality of an e-government website, which should be considered by developers during the development of e-government applications. The primary goals are identifying, qualifying, categorizing, and ranking these factors, and then defining the interrelations among these quality factors.展开更多
文摘In today’s rapidly evolving digital landscape,web application security has become paramount as organizations face increasingly sophisticated cyber threats.This work presents a comprehensive methodology for implementing robust security measures in modern web applications and the proof of the Methodology applied to Vue.js,Spring Boot,and MySQL architecture.The proposed approach addresses critical security challenges through a multi-layered framework that encompasses essential security dimensions including multi-factor authentication,fine-grained authorization controls,sophisticated session management,data confidentiality and integrity protection,secure logging mechanisms,comprehensive error handling,high availability strategies,advanced input validation,and security headers implementation.Significant contributions are made to the field of web application security.First,a detailed catalogue of security requirements specifically tailored to protect web applications against contemporary threats,backed by rigorous analysis and industry best practices.Second,the methodology is validated through a carefully designed proof-of-concept implementation in a controlled environment,demonstrating the practical effectiveness of the security measures.The validation process employs cutting-edge static and dynamic analysis tools for comprehensive dependency validation and vulnerability detection,ensuring robust security coverage.The validation results confirm the prevention and avoidance of security vulnerabilities of the methodology.A key innovation of this work is the seamless integration of DevSecOps practices throughout the secure Software Development Life Cycle(SSDLC),creating a security-first mindset from initial design to deployment.By combining proactive secure coding practices with defensive security approaches,a framework is established that not only strengthens application security but also fosters a culture of security awareness within development teams.This hybrid approach ensures that security considerations are woven into every aspect of the development process,rather than being treated as an afterthought.
文摘Software engineering＇s lifecycle models havc proven to be very important for traditional software development. However, can these models be applied to the development of Web-based applications as well？ In recent years, Web-based applications have become more and more complicated and a lot of efforts have been placed on introducing new technologies such as J2EE, PhP, and .NET, etc., which have been universally accepted as the development technologies for Web-based applications. However, there is no universally accepted process model for the development of Web-based applications. Moreover, shaping the process model for small medium-sized enterprises （SMEs）, which have limited resources, has been relatively neglected. Based on our previous work, this paper presents an expanded lifecycle process model for the development of Web-based applications in SMEs. It consists of three sets of processes, i.e., requirement processes, development processes, and evolution processes. Particularly, the post-delivery evolution processes are important to SMEs to develop and maintain quality web applications with limited resources and time.
文摘Software-related security aspects are a growing and legitimate concern,especially with 5G data available just at our palms.To conduct research in this field,periodic comparative analysis is needed with the new techniques coming up rapidly.The purpose of this study is to review the recent developments in the field of security integration in the software development lifecycle(SDLC)by analyzing the articles published in the last two decades and to propose a way forward.This review follows Kitchenham’s review protocol.The review has been divided into three main stages including planning,execution,and analysis.From the selected 100 articles,it becomes evident that need of a collaborative approach is necessary for addressing critical software security risks(CSSRs)through effective risk management/estimation techniques.Quantifying risks using a numeric scale enables a comprehensive understanding of their severity,facilitating focused resource allocation and mitigation efforts.Through a comprehensive understanding of potential vulnerabilities and proactive mitigation efforts facilitated by protection poker,organizations can prioritize resources effectively to ensure the successful outcome of projects and initiatives in today’s dynamic threat landscape.The review reveals that threat analysis and security testing are needed to develop automated tools for the future.Accurate estimation of effort required to prioritize potential security risks is a big challenge in software security.The accuracy of effort estimation can be further improved by exploring new techniques,particularly those involving deep learning.It is also imperative to validate these effort estimation methods to ensure all potential security threats are addressed.Another challenge is selecting the right model for each specific security threat.To achieve a comprehensive evaluation,researchers should use well-known benchmark checklists.
基金Supported by Guangxi Natural Science Fund Item in China ( Guikezi 0991023Z)
文摘[Objective] The research aimed to study design and development of system platform of 'study on relationship between natural phenology and climate change' based on WEB and GIS. [Method] Relied on the technologies of WEB and GIS, a set of system platform of 'study on relationship between natural phenology and climate change' was developed based on the hybrid architecture of C/S (Client/Server) and B/S (Browser/Server). Moreover, its establishing process and functional module were detailedly introduced. [Result] The natural phenology and climate change in Guangxi were research objects of system platform of 'study on relationship between natural phenology and climate change'. By combining WEB and GIS with database, the primary application of 'study on relationship between natural phenology and climate change' was realized. The system used hybrid architecture of C/S and B/S. The four-layer architectures were independent to improve security, stability and maintainability of system. The visual interface on the foreground was simply, clear and easy to use. The generating program of GIS three-dimensional graph on the background was real-time and high-efficiency, providing powerful guarantee for stable and safe operation of phenology research work process. The system had functions of inquiry, analysis, statistical diagram, GIS three-dimensional graph and data export. Through the analysis of natural phenology observation data, the system could find variation rule of natural phenology as three-dimensional space (longitude, latitude and altitude) and its relationship with climate change. [Conclusion] The research laid good foundation for further deeply carrying out application of 'study on relationship between natural phenology and climate change', and also provided reference basis for recognizing nature and using change rule of phenology to execute production scheduling and strategic decision (seed-introduction and regionalization).
文摘Impedance mismatch of data flow is the major problem in the relational database when one is using the web based application development on the computer system. It effects the development of scalable and reusable web application. Due to this, the research cost of development and maintenance increases. Therefore the present work is an attempt towards an object-oriented database system by using Db4o to overcome the impedance mismatch problem. In the current work, the development of web application for Indian Postal Services by using Db4o is demonstrated on dot NET platform. Before developing the application, the authors used a Unified Modeling Language (UML) model in the form of UML class, sequence and use-case diagrams. The Db4o is used to store the object-oriented database and the performance of Db4o is observed through several object-oriented queries and corresponding results are demonstrated.
文摘The emerging Model-Driven Engineering (MDE) paradigm advocates the use of models as first-class citizens in the software development process, while artifacts such as documentation and source-code can be quickly produced from those models by using automated transformations. Even though many MDE-oriented approaches, languages and tools have been developed in the recent past, there is no standard that concretely defines a specific sequence of steps to obtain a functional software system from a model. Thus, the existing approaches present numerous differences among themselves, because each one handles the problems inherent to software development in its own way. This paper presents and discusses a reference model for the comparative study of current MDE approaches in the scope of web-application development. This reference model focuses on relevant aspects such as modeling language scope (domain, business-logic, user-interface), usage of patterns, separation of concerns, model transformations, tool support, and deployment details like web-platform independence and traditional programming required. The ultimate goal of this paper is to determine the aspects that will be of greater importance in future web-oriented MDE languages.
基金Supported by the Key Scientific and Technological Research Projects of the Jiangxi Provincial Department of Education(GJJ2200303)the National Social Science Foundation Major Bidding Project(20&ZD068)。
文摘Inferring the fully qualified names(FQNs)of undeclared receiving objects and non-fully-qualified type names(non-FQNs)in partial code is critical for effectively searching,understanding,and reusing partial code.Existing type inference tools,such as COSTER and SNR,rely on a symbolic knowledge base and adopt a dictionary-lookup strategy to map simple names of undeclared receiving objects and non-FQNs to FQNs.However,building a symbolic knowledge base requires parsing compilable code files,which limits the collection of APIs and code contexts,resulting in out-of-vocabulary(OOV)failures.To overcome the limitations of a symbolic knowledge base for FQN inference,we implemented Ask Me Any Type(AMAT),a type of inference plugin embedded in web browsers and integrated development environment(IDE).Unlike the dictionary-lookup strategy,AMAT uses a cloze-style fill-in-the-blank strategy for type inference.By treating code as text,AMAT leverages a fine-tuned large language model(LLM)as a neural knowledge base,thereby preventing the need for code compilation.Experimental results show that AMAT outperforms state-of-the-art tools such as COSTER and SNR.In practice,developers can directly reuse partial code by inferring the FQNs of unresolved type names in real time.
文摘Although the WEB software development has some difficulty,but as long as the programming skills to find,in the practice ofoperation will find programming fun,this will stimulate the enthusiasm of students programming.Exploration of interesting skills programmingof WEB software development is aimed at developers who initial contact with WEB software,through the practice of operation to make themget some fun of WEB programming,from simple to difficult gradually let students master WEB programming skills,improve students＇ interestin programming.By adding some special effects of webpages to enhance the students＇ interest in programming,through the key practice ofdatabase,let the students out of fear of programming of database connection.
文摘This paper presents a reference methodology for process orchestration that accelerates the development of Large Language Model (LLM) applications by integrating knowledge bases, API access, and deep web retrieval. By incorporating structured knowledge, the methodology enhances LLMs’ reasoning abilities, enabling more accurate and efficient handling of complex tasks. Integration with open APIs allows LLMs to access external services and real-time data, expanding their functionality and application range. Through real-world case studies, we demonstrate that this approach significantly improves the efficiency and adaptability of LLM-based applications, especially for time-sensitive tasks. Our methodology provides practical guidelines for developers to rapidly create robust and adaptable LLM applications capable of navigating dynamic information environments and performing effectively across diverse tasks.
文摘As the population of the Internet grows rapidly the development of web technologies becomes extremely important. For the evolvement of Web 2.0, web services are essential. Web services are programs that allow computers of different platforms on the web to interactively communicate without the need of extra data for human reading interfaces and formats such as web page structures. Since web service is a future trend for the growth of internet, the tools that are used for development is also important. Although there are many choices of web service frameworks to choose from, developers should choose the framework that fits best to their application based on performance, time and effort for the framework. In this project, we chose four common frameworks to compare them in both qualitative and quantitative metrics. After running the tests, the results are statistically analyzed by SAS.
文摘Quality is a key factor to ensuring success of e-government websites. Therefore, a definition for high-quality e-government website is required, as well as, an e-government system’s quality evaluation methodology. This paper identifies quality attributes that are required to assess the quality of an e-government website, which should be considered by developers during the development of e-government applications. The primary goals are identifying, qualifying, categorizing, and ranking these factors, and then defining the interrelations among these quality factors.
