A Study of Apache-Based Web Application Security and Protection

ZHOU Jing-li,WANG Jian,XIA Hong-tao

DOI: https://doi.org/10.3969/j.issn.1007-130x.2006.04.001

2006-01-01

Abstract:Apache is one of the most widely used Web servers in the Internet and we can easily extend it in favor of the new features of Apache 2. This paper discusses how to implement Web application security and protection based on Apache using the Apache Filter.

What problem does this paper attempt to address?

Research on security extensions based on Java 2 security architecture

TIAN Yu-hong,WANG Ze-bing,FENG Yan

DOI: https://doi.org/10.3969/j.issn.1000-7024.2006.24.029

2006-01-01

Abstract:The Java virtual machine(JVM)is used more frequently as the basic engine behind dynamic web services.With the proliferation of network attacks on these network resources,much work are done to provide security for the network environment.Little effort has been placed on securing a Java web server where the attacker has a valid login to the host machine.After describing the vulnerabilities in Java's security mechanisms,an extended security system based on Java 2 security architecture is introduced.It also explains the runtime status of system.The increased assurance of correct system operation and the integrity of Java application server are provided.
Construction of security architecture of web services based EAI

Di Wu,Yabo Dong,Jian Lin,Miaoliang Zhu

DOI: https://doi.org/10.1007/11563952_52

2005-01-01

Abstract:The fast development of E-Commerce and information technology brings much higher requirements for enterprise informationization. Because of the differences in platforms, development languages and standards etc, enterprise application integration (EAI) has become the important form of enterprise informationization to support complex business processes. Web services have emerged as the next generation of integration technology which provides the power to support interoperability. However EAI doesn’t just present new interoperability challenges; it also presents serious privacy and security challenges. This paper presents security architecture of Web Services based EAI which uses distributed Single Sign On authentication and distributed Role-based Access Control authorization. The basic concept and prototype system of the security architecture are described in detail.
Network Safeguard System Based on IDXP

WANG Xiaodong,ZHU Miaoliang

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.07.055

2005-01-01

Abstract:This paper puts forward an intellective network safe guard system based on a multi-agent system structure. The purpose of the system is to defend the intrusion of campus-wide network. It is based on IDXP and the focus is blackboard. This system can deal with multi-levels and many ways of anti-intrusions, which has self-determination. It is proved to have a good performance by spot tests.
Soap Security Extension Based on Apache Cxf

Kun Ma,Chengping Fang,Bo Yang,Zhenxiang Chen

DOI: https://doi.org/10.1109/carpi.2012.6356412

2012-01-01

Abstract:Web Service is a popular technology for the development of distributed system, and its security becomes more and more important. The security of Web Service depends on the security of Simple Object Access Protocol (SOAP) message crucially. In this paper, not only the security extension of SOAP protocol is proposed, but also the architecture, syntax rule, work theory and the implementation method of the protocol based on the Open-Source Services Framework-Apache (CXF) are described in detail. Finally, an example of this application based on the protocol proves that our approach is feasible in practice. The properties added to the SOAP header are more comprehensive, you can choose one or two properties to use in different occasions. And the paper will be helpful to the developers who need to add security extension based on SOAP.
On the Research of Apache Server Monitor

Bo Liu,Yafei Dai,Fei Wu

DOI: https://doi.org/10.3321/j.issn:1002-0470.2001.02.006

2001-01-01

Abstract:A monitor of Apache server is introduced to supervise the events happened on the server and alert administrato rs to an emergency. Moreover it is based on a secure communication mechanism to make the server and the monitor run in different places so that the monitor cann ot affect the server's performance obviously. A friendly GUI is also proposed t o release administrators from the command lines, which makes managing server a p leasant thing.
Integrative Security Management for Web-Based Enterprise Applications

Chen Zhao,Yang Chen,Dawei Xu,NuerMaimaiti Heilili,Zuoquan Lin

DOI: https://doi.org/10.1007/11563952_54

2005-01-01

Abstract:In enterprise environment, security becomes increasingly important and costly. Enterprises are struggling to protect the increasing amount of disparate resources. Simple patchwork of security controls no longer suffices. Enterprises require a comprehensive solution that provides centralized security management, from authentication, to authorization and to auditing. To this end, we present a design and implementation of an integrative security management solution for Web-based enterprise applications, WebDaemon. It provides Single Sign-On to multiple Web applications. It also provides restricted access to Web-based content, portals, and Web applications based on Role-Based Access Control (RBAC) policies. The WebDaemon can help enterprises secure all Web resources with consistency of policy management and reduced administrative costs.
Architecture of Multi-Dimension Web Application Security Based on OWASP and WASC

WU Zhen,CUI Jian,ZHOU Chang-ling,ZHANG Bei

DOI: https://doi.org/10.3969/j.issn.1001-7445.2011.z1.030

2011-01-01

Abstract:By means of researching and analyzing the reports of multiple security organizations,consortiums and corporations,we discover that web application security is becoming more vital in campus network.Based on the OWASP and the WASC,we designed a multidimension web application security architecture,and used the firewall,web application firewall,intrusion detection system,intrusion prevention system,vulnerability scan system,bastion host and auditing system to implement the architecture.We chose 50 representative web applications from Peking University campus network to study and analyze the logs from these web applications and security devices,and the results prove the validity of the multidimension web application security architecture.
Security Analyzing and Defending of PHP Injection on the Database Server

Zhu Yun,Xue Zhi,Li Jianhua

DOI: https://doi.org/10.3969/j.issn.1009-8054.2006.11.038

2006-01-01

Abstract:With the popularity of open source software, more and more web servers prefer to choose LAMP mode, so their network security problems will be paid more attention to. This paper gives emphasis on describing and analyzing PHP injection leaks existed in LAMP mode based on LAMP, and presents defending measures about various injection leaks
Prototype Implementation and Performance Evaluation of a QoS-based Web Server

ZG Shan,C Lin,YY Wei

DOI: https://doi.org/10.1109/sose.2005.29

2005-01-01

Abstract:With the evolvement of the e-commerce, the Internet is undergoing substantial changes from a communication and browsing infrastructure to a medium for conducting business and selling services. These changes place the Web server at the center of the e-commerce infrastructure with increasing requirements for providing service differentiation and performance assurance. To that end, Web servers must have mechanisms and policies for establishing and supporting quality of service (QoS). In this paper, a Web server prototype with priority based QoS control mechanisms, called QoS Apache, is implemented. A performance testing platform is established, and the performance measurement software httperf is used to test the popular Apache and the QoS Apache. The performance evaluation results show that the QoS Apache server can provide different types of requests with differentiated Web QoS, in comparison with the popular QoS-unaware Apache.
Design and implementation of a web application vulnerability detection system

Yongzhen Li,Gaolong Wang

DOI: https://doi.org/10.1109/ISAIEE57420.2022.00089

2022-12-01

Abstract:With the rapid development of the internet in China, we are dealing with web sites all the time, but with this comes the increasing vulnerability of various web applications. The vulnerability of web applications can be used to steal information, account theft and fraud, threatening the security of web applications. Therefore, the security detection of web applications is particularly important. This paper introduces the background of today's web application scanning technology, analyses the importance of securing web sites, and focuses on the history and future development trends of web application vulnerability scanning at home and abroad. The system is based on the OWASP Top 10 vulnerabilities of SQL injection and XSS, which have a large impact. By analysing the risks and principles of these two vulnerabilities, a scanning system is designed to run on the Windows platform.

Computer Science
Research in the Integration of Application Server and Message Middleware Based on Asynchronous Communication Mechanism

Nenggan Zheng

2009-01-01

Abstract:Based on the application Server-Websphere,this paper describes in detail the design and implementation of the Java message service and J2EE Connector Architecture,which makes the integration of Web sphere and Tonglink/Q.It will have a very good application prospect in the area of middleware conformity.
Web application security gateway with java non-blocking IO

Zhenxing Luo,Nuermaimaiti Heilili,Dawei XU,Chen Zhao,Zuoquan Lin

DOI: https://doi.org/10.1007/11780991_9

2006-01-01

Abstract:We present the design and implementation of the WebDaemon Security Gateway (WDSG) with the techniques of event-driving, non-blocking IO multiplexing, secure cookies, SSL and caches based on PKI framework and role-based access control (RBAC) policy. It not only supports massive concurrency and avoids the pitfalls of traditional block I/O based design, but also is able to secure all the resources of an enterprise and reduce the cost and complexity of administration.
The Design and Implementation of Security Protection System for Website in University

JIANG Kai-da,LI Xiao,SHEN Hai-yun,BAI Wei

DOI: https://doi.org/10.3969/j.issn.1671-1122.2012.12.025

2012-01-01

Abstract:The university's website has been one of the most popular attack targets by hackers for a long time,facing various types of rampant scan and attacks,as well as the threat of information leakage of sensitive data.A complete security protection system can discover vulnerability and help find the site which was already hacked.Information security staff in university need to adopt new security strategy and methods,facing the rapid changing security situation.This paper introduces a number of depth exploration and practice in the security protection system of the university's website in Shanghai Jiao Tong University recently years.
Analysis and Improvement of a Typical Web Security Assessment Tool

SONG Hai-Ling,WEN Wei-Ping

DOI: https://doi.org/10.3969/j.issn.1671-1122.2011.08.024

2011-01-01

Abstract:This paper makes a comprehensive analysis and summary of the existing Web loophole mining technology and tools, to open source Web vulnerability scanning tool Paros Proxy as the research object, the Paros Proxy crawler module and a detection module for in-depth research and analysis, and its improvement. After the test, the improved Paros crawler module supports the JavaScript URLs analytical and crawling, can extract more webpage link, and the improved detection module, the vulnerability detection performance and efficiency can be improved significantly.
Design and Implementation of a Low-interaction Honeypot Based on Apache

WU Xin,HUANG Hao

DOI: https://doi.org/10.3969/j.issn.1002-137x.2006.04.027

2006-01-01

Computer Science

Abstract:Honeypot is a new tool for network defence.The difficulty of designing a Honeypot lies in the success dis- guise and deception.Many Honeypots use scripts to simulate services,and put static deception into practice to protect network.But they could expose themselves easily.This paper designs and implements a low-interaction Honeypot based on the Apache server,named Honeyweb.It has four functions:http protocol detection,dynamic deception, working with other network security devices and log.It can dynamicly response to different http requests.The expri- ment indicates that depolying the Honeyweb will influence hackers' judgement,consume their resources,even stop at- tack.So Honeyweb can reach its purpose of active defence and preventing Web servers from attack.
Research and Implementation of Security Vulnerability Detection in Application System of WEB Static Source Code Analysis Based on JAVA

Hui Yuan,Lei Zheng,Liang Dong,Xiangli Peng,Yan Zhuang,Guoru Deng

DOI: https://doi.org/10.1007/978-3-030-15235-2_66

2019-04-25

Abstract:With the rapid development of Internet technology, Web applications are widely used in all walks of life, and their security requirements are increasing. Unfortunately, at present, the development of Web security technology still lags behind the development of Web application technology itself. The Web application itself and its operating environment are still relatively fragile, and its operating environment is easily forged or modified, making Web applications gradually become malicious. The object of the attack is frequently attacked. This paper investigates and analyzes the common vulnerabilities in web applications, deeply studies the basic characteristics of these vulnerabilities, and understands the principles and solutions of vulnerabilities. The static analysis method is used to analyze the vulnerabilities, and the static analysis methods are used to solve the security vulnerabilities in the Java web project.
Preliminary Study of the Security of Web Application Program

李钢,张仁斌

DOI: https://doi.org/10.3969/j.issn.1003-5060.2003.z1.016

2003-01-01

Abstract:Distributed multilayer computing architecture has gradually become the main mode of computing,and the security of this mode is usually confined to the protection at systematic level, which depends on inbreak test, firewall, etc .Some issues on the security of Web application program, the important element of the multilayer architecture, are discussed. It is pointed out that the lack of security measures means “opening the door” for hackers' attacks. The security measures for the Web application program should be carried on at the levels of program and code. And practical plans and strategies for composing safe code are put forward, and the safety evaluation is also discussed.
Research of XML Engine Security Model on Web Services

张艳,周明天,佘堃

DOI: https://doi.org/10.3969/j.issn.1001-3695.2008.07.074

2008-01-01

Abstract:Web services provide interface access to the software.And the interface realizes the calls of services on the Internet.Web services are based on XML.They make use of XML-based protocols to describe operations to be performed and data to exchange with one another regardless of location and operating systems.SOAP is a transfer protocol of Web services whose messages have universally adopted XML as the mechanism for encoding data.XML is located at message layer in the whole Web services application.XML engine deals with XML data in the Web services,therefore it is named the message layer gateway.On the XML Engine platform,with the help of DSO mechanism,it can dynamically load the encryption,decryption,digital signature,validation,and filtrtion modules into the Apache server.XML Engine can filter the XML data to make sure the safety of Web services.Meanwhile,it is not only applied to SOAP package,but also to any situation relating to XML filtration.
Design and Implementation of Mimic Defense Web Server

Qing TONG,Zheng ZHANG,Wei-Hua ZHANG,Jiang-Xing WU

DOI: https://doi.org/10.13328/j.cnki.jos.005192

2017-01-01

Abstract:The Web server system,being the most important platform of supporting and providing network services,is facing serious security problem.The existing defending technologies mainly deal with the known attacking methods or the known vulnerabilities,and therefore are not effective in case of the unknown threats and do not provide overall defense.This paper first proposes an attacking model to analyze the shortcomings of existing defending technologies.Next,a dynamic heterogeneous redundancy structure based mimic defending model is proposed,and its defending principles and the characteristics are interpreted.Then,the mimic defending Web server is designed on the mimic defending model,and the structure and the implementation principles in the Web server design are introduced.The results of security and performance tests show that the presented mimic defending Web server can defend against all kinds of attacks in the tests with little performance loss,which verifies the effectiveness and the practicability of the mimic defending technology.Finally a perspective of the future work and challenges of mimic defending technology is discussed.
KUBERA: A security model for Web Applications

Qiang Wang,Zhiguang Qin

DOI: https://doi.org/10.1109/ICCCAS.2010.5581993

2010-01-01

Abstract:Web Applications have changed significantly since the World Wide Web was introduced, facing a shift in web content from simple hyperlinked documents to active programs. However, the prevailing web protection model, the same origin policy, is an imperfect approach to identify web applications and govern their behavior. As a result, web applications have become attractive targets of exploitation, especially web plug-ins. In this paper, we present KUBERA, a new web browser security model that adapts lessons from OS to make the browser a more suitable platform for web applications. Using system call interposition, KUBERA is responsible for uniformly specifying and enforcing security policies on not just HTML and JavaScript, but plug-in media and browser extensions as well. We describe our implementation of a prototype of KUBERA, and illustrate how browsers can use KUBERA for securing their resources.

A Study of Apache-Based Web Application Security and Protection

Research on security extensions based on Java 2 security architecture

Construction of security architecture of web services based EAI

Network Safeguard System Based on IDXP

Soap Security Extension Based on Apache Cxf

On the Research of Apache Server Monitor

Integrative Security Management for Web-Based Enterprise Applications

Architecture of Multi-Dimension Web Application Security Based on OWASP and WASC

Security Analyzing and Defending of PHP Injection on the Database Server

Prototype Implementation and Performance Evaluation of a QoS-based Web Server

Design and implementation of a web application vulnerability detection system

Research in the Integration of Application Server and Message Middleware Based on Asynchronous Communication Mechanism

Web application security gateway with java non-blocking IO

The Design and Implementation of Security Protection System for Website in University

Analysis and Improvement of a Typical Web Security Assessment Tool

Design and Implementation of a Low-interaction Honeypot Based on Apache

Research and Implementation of Security Vulnerability Detection in Application System of WEB Static Source Code Analysis Based on JAVA

Preliminary Study of the Security of Web Application Program

Research of XML Engine Security Model on Web Services

Design and Implementation of Mimic Defense Web Server

KUBERA: A security model for Web Applications