Informatics Publishing Limited

Supriya Gupta ¹, Lalitsen Sharma ¹

Affiliations
1 Dept. of Com Sc & IT, University of Jammu, IN

Abstract

Web applications are popular targets of security attacks. One common type of such attacks is SQL injection, where an attacker using specially crafted inputs, causes a web application to generate and send a query that functions differently than the programmer intended. Thus a diagnostic feature of SQL injection attacks is that they change the intended syntactic structure of queries issued. This paper presents a query intent evaluation technique to detect possible SQL Injection attacks by tracing the queries in which the input substrings modify the syntactic structure of the rest of the query. This approach has been implemented in a tool which takes an SQL query as input and detects if it is a command injection attack.

Full Text

   

Syed Mutahar Aaqib ¹, Lalitsen Sharma ¹

Affiliations
1 University of Jammu, IN

Abstract

This paper presents some web server benchmarking techniques and tools that can be used to evaluate the performance of standalone as well as cluster web server systems. Various qualities and properties that should be provided by benchmarking tools are discussed. The focus is on comparing properties of some popular open source benchmarking tools which are readily available. This paper highlights the drawbacks in existing tools with respect to web clusters as currently no tool provides functionality to efficiently evaluate the performance of cluster web server systems.

Keywords

Benchmarking, Performance Analysis, Web Server Clusters.

Full Text

   

Syed Mutahar Aaqib ¹, Lalitsen Sharma ¹

Affiliations
1 Department of Computer Science & IT, University of Jammu, Jammu-180006, J&K, IN

Abstract

The World Wide Web (WWW) has undergone remarkable change over the past few years, placing substantially heavy load on Web servers. Today’s web servers host web applications that demand high computational resources. Also some applications require heavy database retrieval processing, making server load even more critical. In this paper, performance of Apache web server running compute and retrieve-intensive web workloads is analyzed. Workload files implemented in three dynamic web programming technologies: PERL, PHP and Java Servlets are used with MySQL acting as a data source. Measurements are performed with the intent to analyze the impact of application workloads on the overall performance of the web server and determine which web technology yields better performance on Windows and Linux platforms. Experimental results depict that for both compute and retrieve intensive applications, PHP exhibits better performance than PERL and Java Servlets. A multiple linear regression model was also developed to predict the web server performance and to validate the experimental results. This regression model showed that for compute and retrieve intensive web applications, PHP exhibits better performance than Perl and Java Servlets.

Keywords

Web Performance Analysis, Web Servers, Compute and Retrieve Intensive.

Full Text

   

Supriya Gupta ¹, Lalitsen Sharma ¹

Affiliations
1 Dept. of Computer Sc. & IT, University of Jammu, Jammu-180006, IN

Abstract

Most of the applications now-a-days are developed web based. The applications of public access are highly exposed to security threats. The increasing number of web based attacks which result in loss of data and unauthorized access to application has drawn the attention of organizations toward web application security. The most commonly employed defense mechanism is to use solutions that rely on security service tools like firewalls, intrusion detection and prevention systems etc. Most of the commonly used tools such as SNORT are based upon the payload inspection that detects an attack by searching for the occurrence of known signature patterns in the packet. But using these devices for protecting web applications against common input based attacks is an inefficient process. It consumes a significant amount of time, memory and CPU cycles for each packet while scanning through a list of rules. Implementing security features within applications’ logic is an effective alternative. In this paper we analyzed the performance of two experimental web applications, one with security implemented within the code and the other checked by external security system called SNORT using a web application testing tool (WAPT 3.0). Our experiment showed that the application with secure code showed better performance statistics in terms of response time. The paper also discusses various issues regarding the use of security devices as protection against application layer attacks.

Keywords

Webapplications, Security, Intrusion Detection and Prevention, Snort.

Full Text