PASSWORDLESS AUTHENTICATION USING MAGIC LINK TECHNOLOGY

The problems of authentication and identification have received wide interest in cryptographic research. However, there has been no satisfactory solution for the problem of authentication by a human recipient who does not use any trusted computational device, which arises for example in the context of smartcard-human interaction, in particular in the context of electronic wallets. The problem of identification is ubiquitous in communication over insecure networks.

The popularity of Web services within the IT industry continues to grow as the next generation Web technologies. Recently the mobile industry has started to apply Web services technologies to expose and integrate the value it holds in the mobile domain. The Web services could bring new business opportunities with seamlessly integrating mobile devices and various Internet services. In this paper, we explain what are the consideration issues for adopting Web Services to mobile domain and we propose the proper architecture model and functions based on intermediaries for MWS.

International audience

For Global Service-Oriented Architecture (GSOA), we need to make sure that the Web Services provided by the service providers are visible to all potential consumers across the globe. In this paper, we discuss about Universal Description Discovery and Integration (UDDI) and its limitations as public repository. For this, we propose using Really Simple Syndication (RSS) as a repository. RSS is indeed based on the Extensible Markup Language (XML) and hence it enables easy data transformation. It is also platform independent, lightweight and is widely used as open source technology. Due to the auto push nature of RSS, the global RSS repository will only send the recently added Uniform Resource Identifier (URI) links to the subscribed consumers. The client can maintain its local cache for supporting faster execution of most frequently used Web Services. The new URI links provided by the server will get appended to the client's local cached repository thereby reducing data traffic over the Internet. In GSOA, we discuss logic that will assign the ranks to the Web Services and will help compare Web Services providing similar functionalities; thereby it helps the Web Service consumer to dynamically select the best available Web Service depending on the user criteria. The local RSS-based repository implements the local ranking, wherein the user's relative preferences are stored. The most important thing is that the local RSS takes priority over the global RSS ranks.

In previous work we have looked at trends in vulnerabilities due to ordinary programming errors [2, 3]. This analysis focuses on two of the most widely used types of software in today's internet, web browsers and web servers. In addition to reports of vulnerabilities, we were able to consider market share to infer some information about the impact of vulnerabilities. The key questions we sought to address are:

HTTP low and slow DoS is a kind of attack wherein an attacker sends a stream of very slow HTTP requests to a web server. These slow HTTP requests are aimed at specific applications or server resources. By sending HTTP requests very slowly, these attacks waste the server’s resources as the server has to wait for the slow HTTP requests to be completed. HTTP low and slow DoS attacks are primarily used against thread-based web servers like Apache and IIS. By sending very slow requests, these attacks tie up the server threads. This results in a Denial of service for other legitimate users. Since low and slow DoS attacks do not require flooding or sending a large number of HTTP requests, they are not easily detected. Traditional network layer tools cannot detect low and slow DoS attacks and other mitigation and detection strategies are required for the detection of low and slow DoS attacks. In this paper, we propose an LSTM deep learning-based approach for detecting HTTP DoS attacks. The proposed study was conducted on the CIC DoS dataset and a synthetically generated dataset and achieved an impressive accuracy of 0.99.

DDoS attacks are pre-dominant in traditional networks, they are used to bring down the services of important servers in the network, thereby affecting its performance. One such kind of attack is HTTP GET Flood DDoS attack in which a lot of HTTP GET request messages are sent to the victim web server, overwhelming its resources and bringing down its services to the legitimate clients. The solution to such attacks in traditional networks is usually implemented at the servers, but this consumes its resources which could otherwise be used to process genuine client requests. Software Defined Network (SDN) is a new network architecture that helps to deal with these attacks in a different way. In SDN the mitigation can be done using the controller without burdening the server. In this paper, we first show how an HTTP GET Flood DDoS attack can be performed on the webserver in an SDN environment and then propose a solution to mitigate the same with the help of the SDN controller. At the server, the attack is detected by checking the number of requests arriving to the web server for a certain period of time, if the number of request is greater than a particular threshold then the hosts generating such attacks will be blocked for the attack duration.

Past few years the use of Internet and its applications has increased to a great extent. There is also an enormous growth in the establishment of computer networks by large, medium and small organizations, for data transfer and information exchange. Due to this huge growth, incidents of cyber-attacks and security breaches have also increased. Data on a network is transferred using protocols such as Hyper Text Transfer Protocol, which is very vulnerable. Many types of malicious contents are hidden in packets that are transferred over a network or system, which may can to get it slow, crash or buffer overflow etc. Thus it is very important to secure networks from such types of attacks. There are lots of mechanisms available but still they are not good enough because of dynamic environment. Such kind of attacks can be countered by applying appropriate policies on network edge devices like Adaptive Security Appliance, firewalls, web servers, router etc. Also the packets which are transferred between networks, they should deeply inspect for malicious or any insecure contents. In this paper firstly we would study Network security issues and available mechanism to counter them our focus would be on inspecting the HTTP packets deeply by applying policies on ASA. Finally we would use Graphical Network Simulator (GNS3) to test such a policy.

Modern enterprise systems can be composed of many web services (e.g., SOAP and RESTful). Users of such systems might not have direct access to those services, and rather interact with them through a single-entry point which provides a GUI (e.g., a web page or a mobile app). Although the interactions with such entry point might be secure, a hacker could trick such systems to send malicious inputs to those internal web services. A typical example is XML injection targeting SOAP communications. Previous work has shown that it is possible to automatically generate such kind of attacks using search-based techniques. In this paper, we improve upon previous results by providing more efficient techniques to generate such attacks. In particular, we investigate four different algorithms and two different fitness functions. A large empirical study, involving also two industrial systems, shows that our technique is effective at automatically generating XML injection attacks.

Owing to the efficient resource management, accessibility, and high service availability, cloud computing has been leveraged by several intensive-data processing applications such as big data analytics, social media applications. These applications are typically based on the development of web service and web application. Even though web-based technology offers effective communication and implementation, it has been susceptible to various kinds of attack. In this paper, we investigate possible attacks on REST which is a commonly used protocol for the web service implementation. In REST, HTTP requests are mapped to GET, POST, PUT, and DELETE that have been proven to be prone to common attacks including Automated Brute Forcing on web-based login, HTTP flood attacks, SQL injections (SQLi), and Cross-Site Scripting (XSS). To this end, we propose a design and implementation of the cloud-based IDS to detect such attacks by employing Apache Kafka and Spark streaming to classify and process the high volume of user inputs in REST HTTP communication. To detect the anomalous inputs, we apply the signature-based approach to construct an IDS engine based on a set of known attack patterns that will be leveraged by the Spark Streaming. Specifically, we introduce a new string comparison collection that improves the False Positive (FP) rate in SQL injection detection, which has been a major issue in most proposed IDS currently available. In our experiment, the system is able to determine malicious patterns with high performance as well as to generate SMS alerts and log the event in a Google Cloud Storage Bucket in an efficient manner.

This paper describes a generalized web-based framework for VBI pathosystems informatics & bioinformatics web services. The framework provides a universal mechanism for accessing web services through web browsers. A web service can be configured to the framework easily. The framework is designed using object-oriented methodology and implemented using Java 2 Enterprise Edition, relational databases, XML technology and various other open source technologies. It is designed to conform to a n-tiered architecture that includes several layers: a web-based graphical user interface built using Apache Struts web framework running on Apache Jakarta Tomcat; a business object layer, server and web service components that process the queries and manipulate the result sets; and a robust data access layer. The system provides an extensible, flexible, and user-friendly framework for any generic bioinformatics projects, including genome curation, micro-array gene expression profiles, pathogen information curation and pathway analysis, etc.

Web of shadows: Investigating malware abuse of internet services

With the increasing use of web services in everyday tasks, we are entering an era of Internet of Services (IoS). Service discovery and selection has become critical issue in the area of web services. Traditional service discovery approaches are often supported by centralized registries that could suffer from single point failure, performance bottleneck, and scalability issues in large scale systems. To address these issues, in this paper we propose a context-aware service discovery and selection approach in a decentralized peer-to-peer environment. In the approach homophily similarity was used for bootstrapping and distribution of nodes. The discovery process is based on the similarity of nodes, previous interaction and behaviour of the nodes, which will help the discovery process in a dynamic environment. Our approach is not only considering service discovery, but also the selection of the best available web service by taking into account the QoS properties of the web services. Experimental results were based on real world semantic web service dataset, the results showed that the approach achieved better performance and efficiency in both discovery and selection processes.

The use of LED lights in smart street lighting to save energy is efficient and very common in many developed cities. However, such a system results in higher initial costs, which may discourage smaller towns and villages from its purchasing. This paper therefore deals with the design and development of a smart street lighting control system for smaller cities and villages. Such a system is required to be economical from the perspective of development and production. Considering other requirements such as platform independence, high availability and broad support, we proposed to build a system as a web application using a custom light control service component. The result is a web application that consists of a user interface served by a web server and an application server used to communicate with light control service. In addition, the system is designed as a geographical information system to be easy to use for managing street lights in groups or individually, while displaying them on the map. The system allows automatic sensor-based light intensity modulation by default with the possibility of manual adjustment or override of the illumination. It also includes a device error notification system with a tool to navigate faulty devices. The presented system is a low-cost solution for intelligent street lighting control designed for smaller cities or villages. They can apply the designed architecture of the system and the specific technologies suitable because of their low-cost implementation.

QoS prediction is the most important step in web service selection and service recommendation. In the field of service computing, the most frequently method that adopted to predict the web service QoS is collaborative filtering. The existing studies usually focus on the prediction of the exact QoS values, and never prediction about its fluctuation range which is caused by the random dynamic nature of the internet and web server payload. In fact, the web service QoS(such as response time, throughput, etc.)invoked by clients are dynamic range, they are not a exactly value. In this paper with the help of non-parametric statistical bootstrap technique, we proposed a approach to predict the confidence interval of web services QoS and then compared the performance of web services according to the method. In the first phase, we take use of the the method of Shapiro-Wilk normal test to analysis the distribution of web services QoS(response time) and use the method of non parametric hypothesis test kruskal-Wallis to analysis the dynamic nature of interval respectively. In the second phase we adopted the bootstrap techniques in Nonparametric statistical and collaborative filtering algorithm to propose a method which could predict the confidence interval of web service response time when the client invoking the web service, and then compared the performance of web services accordingly.