...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Future generation computer systems >An approach for benchmarking the security of web service frameworks
【24h】

An approach for benchmarking the security of web service frameworks

机译：基准测试Web服务框架安全性的方法

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Web services are a popular technology for deploying applications on the Web. They are supported by frameworks, the middleware that handles most communication aspects. Security in the Web is a key concern as the exposure to attacks is high and may result in catastrophic consequences for the deployed services. Selecting the most secure framework is challenging, especially considering their diversity and the complexity involved in any security assessment. This paper is an initial contribution aiming at the definition of a security benchmark for assessing and comparing the security of web service frameworks. The proposed benchmark is based on two phases: Security Qualification and Trustworthiness Assessment. In the first phase, state-of-the-art techniques are used to detect vulnerabilities in the frameworks. If vulnerabilities are found, the framework is disqualified. In the second phase, the qualified frameworks are analyzed for evidences of potentially unsecure aspects, being the observed behavior used to compute a score using the Logic Score of Preferences technique. Such score allows comparing frameworks from a trustworthiness perspective. We applied our approach for the case of DoS Attacks and benchmarked ten frameworks. Results show that six frameworks fail in qualifying for the second phase and that the remaining ones can be ranked using the computed score, allowing developers to make informed decisions about their deployments.
机译：Web服务是一种用于部署Web上应用程序的流行技术。它们由框架支持，中间件处理大多数通信方面。 Web中的安全性是关键问题，因为攻击攻击很高，可能导致部署服务的灾难性后果。选择最安全的框架是具有挑战性的，特别是考虑到他们的多样性和任何安全评估所涉及的复杂性。本文是针对评估和比较Web服务框架的安全性的安全基准定义的初步贡献。拟议的基准基于两阶段：安全资格和可信度评估。在第一阶段，最先进的技术用于检测框架中的漏洞。如果发现漏洞，则框架被取消资格。在第二阶段，分析了合格的框架以证明可能的不安全方面的证据，是使用偏好技术的逻辑评分来计算分数的观察到的行为。此类分数允许将框架与值得信赖的角度来看。我们将我们的方法应用于DOS攻击和基准十个框架。结果表明，六个框架在排位赛中失败，第二阶段，剩余的框架可以使用计算的分数排列，允许开发人员对其部署进行明智的决策。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号