A survey of cloud based secured web application

International Journal of Computer Engineering and Technology (IJCET), ISSN 0976-
6367(Print), ISSN 0976 – 6375(Online) Volume 4, Issue 4, July-August (2013), © IAEME
441
A SURVEY OF CLOUD BASED SECURED WEB APPLICATION
1
Ahmed Hashim Mohammed, 2
Dr. Hanaa M. A. Salman, 3
Dr. Saad K. Majeed
Computer Science Department, University of Mustansiriya
Computer Science Department, University of Technology
Computer Science Department, University of Technology,
ABSTRACT
Cloud computing is a schema for allowingappropriate onrequest network access to a shared
pool of configurable computing resources, that can be rapidlydelivered and released by minimal
management effort or service provider.In cloud computing, you need a Web browser to access to
everything needed to run your business from the required applications, services, and infrastructure.
Many web developers are not security-aware. As a result, there exist many web sites on the
Internet that are vulnerable. More and more Web-based enterprise applications deal with sensitive
financial and medical data, which, if compromised, in addition to downtime can mean millions of
dollars in damages. It is crucial to protect these applications from malicious attacks. In this paper we
present a comprehensive survey of cloud based secure web application in the literature.The goal of
this paper is to present a comparison of various previous methods proposed in the literature and a
comparison between Python to other used programming languages.
Keywords: Web Application, Cloud computing, Security, Method Taxonomy, Programming
Language
1. INTRODUCTION
Cloud Computing is a paradigm in which information is always stored in servers on the
internet and cached temporarily on clients that include desktops, entertainment centers, table
computers, notebooks, wall computers, hand-held, etc.”. These services are generally divided into
three types: Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-
Service (SaaS). Cloud computing model advances several web applications as of its elasticity nature.
This form of computing increases the efficiency of computing anddecreases operating cost. Web
applications involve of several different and interacting technologies, these connections between
different technologies can cause vast security problems.Today’s combat zone for both ethical and
unethical hackers is the web. Rapid growth of web sites and web applications gives way to deliver
complex business applications through the web. As the web dependency increases, so do the web
hacking activities. Web applications are normally written in scripting languages like JavaScript, PHP
INTERNATIONAL JOURNAL OF COMPUTER ENGINEERING &
TECHNOLOGY (IJCET)
ISSN 0976 – 6367(Print)
ISSN 0976 – 6375(Online)
Volume 4, Issue 4, July-August (2013), pp. 441-448
© IAEME: www.iaeme.com/ijcet.asp
Journal Impact Factor (2013): 6.1302 (Calculated by GISI)
www.jifactor.com
IJCET
© I A E M E

442
embedded in HTML allowing connectivity to the databases, retrieving data and putting them in the
WWW site, As many as 70% of websites have vulnerabilities that could lead to the theft of sensitive
corporate data such as credit card information and customer lists, Accessible 24/7 from anywhere
in the world, insecure web applications provide easy access to backend corporate databases and
also allow hackers to perform illegal activities using the compromised site [1].
Cloud Web Application Security (CWAS) crawls website and automatically analyzes web
applications to discover security holes in web applications that an attacker would likely abuse to gain
illicit access to your systems and data. It looks for multiple vulnerabilities including SQL injection,
Cross Site Scripting, Broken Authentication and Session Management, Insecure Direct Object
References and Cross-Site Request Forgery.
CWAS doesn't just let see how website is vulnerable. It also consider an important tool for
web developers because provides concise reports for each weakness identified and can be used to
increase the security of the web application being tested where web applications need to be fixed;
Reporting was found to be sufficient. The reports are clean, easy to read.
In this paper we present a comprehensive survey of cloud-based Web application in the
literature.The aim of this paper is to provide a comparative study between the various previous
proposed methods in the literature, and compared between Python and other programming languages
used. This paper is organized as follows: Section 2 introduces the related works. Section 3 presents
Comparison Python to other languages, conclusions and future works are presented in section 4.
2. RELATED WORK
In this section we introduced a briefly comparison between the related work as shown in table
(1), according to the attack, algorithm, language, technique model, analysis study, and testes case no
web, for more information see,
[2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,3
7,38,39,40,41.42.43.44.45.46.47.48.49.50.51.52.53].
Table 1: Comparison of related works

443

444
3. COMPARING PYTHON TO OTHER LANGUAGES
In this section we introduced a briefly comparison for the used programming language, as
shown in Table (2), between Python,PHP, and RUBY according to Version, Purpose, Creator And
Year Release, Influenced By, Site Built Using It, Usability, and Ease Of Learning. This comparison
concentrates on language issues only. In practice, the choice of a programming language is often
dictated by other realworld constraints such as cost, availability, training, and prior investment, or
even emotional attachment. Since these aspects are highly variable, it seems a waste of time to
consider them much for this comparison.

445
Table 2: Compare Python to other languages
CONCLUSIONS
There is a demand need, to presents a solution that allows users to test their Website for
vulnerabilities, and conduct quick assessments entirely in the cloud by works as a black box, scan
for vulnerability alsotests for web applications and all the security test cases, and to obtain reliable
results of those tests. In this paper we present two tables one for comparison of the previous works
and the other for comparison Python to the other used programming language.
PHP RUBY PYTHON
Current
Version
PHP: 5.3.8 AUGUST 23,
2011
RUBY: 1.9.3
OCTOBER 31, 2011
python 3.2.2
September 4,2011
Purpose Php was designed for
web development to
produce dynamic web
pages
Ruby design to make
programming fun and
flexible for the
programmer
Python was design to
emphasize
productivity and
code readability
Creator
And Year
Release
1995 RASMUS
LERDORF
1995 YUKIHIRO
“MATZ”
MATSUMOTO
1991 GUIDO VAN
ROSSUM
Influenced
By
C/TCL/PERL/JAVA/C++ ADA/C++/CLU/
DYLAN/EIFFEL/
LISP/PERL/PYTHON
ABC/
ALGOL68/
C/C++/ICON/
JAVA/LISP/PERL
Site Built
Using It
WIKIPEDIA
UDEMY
FACEBOOK
TWITTER
HULU
GROUPON
YOUTUBE/GOOGLE
Usability PHP FOLLOWS A
Classic approach and is
extensively documented
Programmers describe
ruby code as elegant,
powerful and
expressive.
It is highly usable
because
of its principle of
least
astonishment
,enforced to
minimize for users
Python uses strict
indentation
enforcements .python
is arguably the most
readable programming
language
Ease Of
Learning
Php is easy to learn for
former c programmers
Ruby is better for
programmer who
already knows a
language or two
Python is great for
beginners ,often
recommended by
programmers due to
the simplicity of its
syntax

446
REFERENCES
1. M. Auxilia and D. Tamilselvan, “Anomaly Detection Using Negative Security Model in Web
Application”, IEEE International Conference onComputer Information Systems and Industrial
Management Applications (CISIM) , pp. 481-486, 8-10 Oct. 2010.
2. Adam Barth, Collin Jackson, John C. Mitchell, “Robust Defenses for Cross-Site Request
Forgery”,Stanford University, 2008.
3. Dwen-Ren Tsai, Allen Y. Chang ,Peichi Liu, Hsuan-Chang Chen, “Optimum Tuning of
Defense Settings for Common Attacks on the Web applications”,IEEE,2009.
4. PuleiXiong, Liam Peyton, “A Model-Driven Penetration Test Framework for Web
Applications”, IEEE Eighth Annual International Conference on Privacy, Security and
Trust,2010.
5. Takanobu Watanabe,, Zixue Cheng, MizuoKansen, and Masayuki Hisada, “A New Security
Testing Method for Detecting Flash Vulnerabilities by Generating Test Patterns”,IEEE 13th
International Conference on Network-Based Information Systems,2010.
6. Jan-Min Chen,Chia-Lun Wu, “An Automated Vulnerability Scanner for Injection Attack Based
on Injection Point”,IEEE,2010.
7. DU Jing-Nong ,LU Yan-Sheng, “An Effect Evaluation Model for Vulnerability Testing of Web
Application”,IEEE,Second International Conference on Networks Security, Wireless
Communications and Trusted Computing,2010
8. Rihong Wang, Ying Xu, Ying Xiang, “Research and Realization of WEB Security auto-Testing
Tool Based on AHP”,IEEE,2010.
9. Jason Bau, ElieBursztein, Divij Gupta, John Mitchell, “State of the Art Automated Black-Box
Web Application Vulnerability Testing”,IEEE Symposium on Security and Privacy,2010.
10. José Fonseca,Marco Vieira, Henrique Madeira, “The Web Attacker Perspective – A Field
Study”,IEEE 21st International Symposium on Software Reliability Engineering, 2010.
11. SushilaMadan ,SupriyaMadan, “Security Standards Perspective to Fortify Web Database
Applications From Code Injection Attacks”,IEEE International Conference on Intelligent
Systems, Modeling and Simulation,2010.
12. XuRuzhi ,Guojian, Deng Liwu, “A Database Security Gateway to the Detection of SQL
Attacks”,IEEE 3rd International Conference on Advanced Computer Theory and Engineering
,2010
13. LijiuZh an g , Qin g Gu , Sh u sh e n Pen g , Xian g Ch e n , Haig an g Z h a o , Dao x u Ch en,
“A Web Application Vulnerabilities Detection Tool Using Characteristics of Web
Forms”,IEEE Fifth International Conference on Software Engineering Advances,2010
14. Ivano Alessandro Elia ,José Fonseca, Marco Vieira, “Comparing SQL Injection Detection
Tools Using Attack Injection”,IEEE 10 21st International Symposium on Software Reliability
Engineering,2010
15. Xin Wang, Luhua Wang, Gengyu Wei, Dongmei Zhang, YixianYang, “HIDDEN WEB
CRWLING FOR SQL INJECTION”,IEEE Proceedings of IC-BNMT,2010
16. Carlisle Adams, Jean-Pierre Levac and François Prevost, ”Lightweight protection against brute
force login”,Crown Eighth Annual International Conference on Privacy, Security and
Trust,2010
17. Helen Kapodistria, Sarandis Mitropoulos, Christos Douligeris, “An Advanced Web Attack
Detection And Prevention Tool”,Emerald Information Management & Computer Security,2011
18. Aileen G. Bacudio, 1Xiaohong Yuan, 2Bei-Tseng Bill Chu, 1Monique Jones, “AN
OVERVIEW OF PENETRATION TESTING”,International Journal of Network Security & Its
Applications (IJNSA),2011

447
19. BirhanuEshete, Adolfo Villafiorita, KomministWeldemariam, “Early Detection of Security
Misconfiguration Vulnerabilities in Web Applications”,IEEE Sixth International Conference on
Availability, Reliability and Security,2011
20. Dominic Letarte, François Gauthier and Ettore Merlo, ”Security Model Evolution of PHP
Web Applications”,Fourth IEEE International Conference on Software Testing, Verification
and Validation,2011
21. Boris Rozenberg,YaronGonen, Ehud Gudes, and Nurit Gal-Oz , “Tracking End-Users in Web
Databases”,IEEE,2011
22. Ben Smith and Laurie Williams, “Using SQL Hotspots in a Prioritization Heuristic for
Detecting All Types of Web Application Vulnerabilities”,Fourth IEEE International
Conference on Software Testing, Verification 2011and Validation,2011
23. Andrea Avancini , M arianoCeccat o, “Security Testing of Web Applications a Search Based
Approach for Cross-Site Scripting Vulnerabilities”,2011 International Working Conference on
Source Code Analysis and Manipulation,2011
24. William G . J. H alfond 1 ,Shauvik Roy Choudhary and Alessandro Orso , “Improving
penetration testing through static and dynamic analysis”,John Wiley & S ons, L td.,2011
25. Lijo Thomas ,WeifengXu ,DianxiangXu, “Mutation Analysis of Magento for Evaluating Threat
Model-Based Security Testing”,35th IEEE Annual Computer Software and Applications
Conference Workshops,2011
26. Fang Yu,Muat h Alkhalaf,TevfikBult an, “Patching Vulnerabilities with Sanitization
Synthesis”,ICSE ’11,2011
27. Sven Türpe, ”Search-based Application Security Testing Towards a Structured Search
Space”,Fourth International Conference on Software Testing, Verification and Validation
Workshops,2011
28. FahadAlanazi,MohamedSarrab, “The History of Web Application Security Risks”,(IJCSIS)
International Journal of Computer Science and Information Security,2011
29. Xiaoh u Yang , Yixi Chen , Wen yu Zhang &Shuai Zhang, “Exploring injection prevention
technologies for security-aware distributed collaborative manufacturing on the Semantic
Web”,Springer Int J AdvManuf Technol,2011
30. Yi Yan, Su Zhengyuan, Dai Zucheng, “The Database Protection System Against SQL
Attacks”,IEEE,2011
31. Jeom-Goo Kim, “Injection Attack Detection using the Removal of SQL Query Attribute
Values”,IEEE,2011
32. Nikita Patel , Fahim Mohammed ,SantoshSoni ,”SQL Injection Attacks Techniques and
Protection Mechanisms”,International Journal on Computer Science and Engineering
(IJCSE),2011
33. P. Naresh Kumar et al, “The Image Level Tainting A New Approach For Preventing Sql
Injection Attacks”,International Journal of Engineering Science and Technology (IJEST),2011
34. RomilRawat ,Chandrapal Singh Dangi ,JagdishPatil, “Safe Guard Anomalies against SQL
Injection Attacks”,International Journal of Computer Applications (0975 – 8887),2011
35. IndraniBalasundaram ,E. Ramaraj, “An Authentication Mechanism to prevent SQL Injection
Attacks”,International Journal of Computer Applications (0975 – 8887),2011
36. AfonsoAraújoNeto, Marco Vieira, “Trustworthiness Benchmarking of Web Applications Using
Static Code Analysis”,Sixth International Conference on Availability, Reliability and
Security,2011
37. Yi Wang, Zhoujun Li ,Tao Guo, “Program Slicing Stored XSS Bugs in Web Application”,Fifth
IEEE International Conference on Theoretical Aspects of Software Engineering,2012
38. Vina M. Lomte 1 , Prof. D. R. Ingle 2, Prof. B. B. Meshram3, “A Secure Web Application E-
Tracking System”,International Journal of UbiComp (IJU), Vol.3, No.4,2012

448
39. Ingle and B. B. Meshram, “Attacks On Web Based Software And
ModelingDefenseMechanisms”, International Journal of UbiComp (IJU), Vol.3, No.3,2012
40. SreenivasaRaoBasavala,Narendra Kumar ,AlokAgarrwal , “Finding Vulnerabilities in Rich
Internet Applications (FlexAS3) Using Static Techniques”MECS I.J. Modern Education and
Computer Science,2012
41. Katkar Anjali S., Kulkarni Raj B, “Web Vulnerability Detection and Security”,International
Journal of Soft Computing and Engineering (IJSCE),2012
42. Shakti Kundu, ”Web Testing Tool, Challenges and Methods”,IJCSI International Journal of
Computer Science Issues, Vol. 9, Issue 2, No 3,2012
43. Rajiv chopra1,Sushila Madan,Testing Websites by P3R2”,IJCSI International Journal of
Computer Science Issues, Vol. 9, Issue 4, No 2,2012
44. Yu-Chi Chu ng a ,Ming-Chuan Wu ,, Yih-Chang Chen, Wen-Kui Chang , “A Hot Query Bank
approach to improve detection performance against SQL injection attacks”,Elsevier computers
&securi ty,2012
45. InyongLeea,SoonkiJeongb,SangsooYeoc,JongsubMoond, “A novel method for SQL injecton
attack detection based on removing SQL query attribute values”,Elsevier
MathematicalandComputerModelling,2012
46. Neha Patwari1, ParvatiBhurani, “Framework of SQL Injection Attack”,IJASCSE Vol 1,2012
47. Atul S. Choudhary ,M. L. Dhore, “CIDT Detection of Malicious Code Injection Attacks on
Web Application”,International Journal of Computer Applications (0975 – 8887) Volume 52–
No.2,2012
48. AtefehTajpour , Suhaimi Ibrahim, Mohammad Sharifi , “Web Application Security by SQL
Injection DetectionTools”,IJCSI International Journal of Computer Science Issues, Vol. 9,
Issue 2, No 3,2012
49. RomilRawat, Shailendra Kumar Shrivastav, “SQL injection attack Detection using
SVM”,International Journal of Computer Applications (0975 – 8887) Volume 42– No.13,2012
50. Rupali D. Kombade, B. Meshram, “CSRF Vulnerabilities and Defensive Technique”s,
Computer Network and Information Security,2012
51. LwinKhinShar , HeeBengKuan Tan, “Automated removal of cross site scripting vulnerabilities
in web applications”,Elsevier ,Information and Software Technology,2012
52. Matthew Van Gundy, Hao Chen, “Noncespaces Using randomization to defeat cross-site
scripting attacks”, Elsevier, computers & security,2012
53. Abdul Razz,zaq, Ali Hur, H, Farooq Ahmad, Muddassar Masood , “Semantic Architecture for
Web application Security”, IJCSI International Journal of Computer Science Issues, Vol. 9,
Issue 2, No 3,2012.
54. Prof. S B Patil, Sachin Chavan, Dr. Preeti Patil and Prof. Sunita R Patil, “High Quality Design
to Enhance and Improve Performance of Large Scale Web Applications”, International Journal
of Computer Engineering & Technology (IJCET), Volume 3, Issue 1, 2012, pp. 198 - 205,
ISSN Print: 0976 – 6367, ISSN Online: 0976 – 6375.
55. Sachin J.Pukale and M. K.Chavan, “A Review of Anomaly Based Intrusions Detection in
Multi-Tier Web Applications”, International Journal of Computer Engineering & Technology
(IJCET), Volume 3, Issue 3, 2012, pp. 233 - 244, ISSN Print: 0976 – 6367, ISSN Online:
0976 – 6375.
56. Dr. Hanaa M. A. Salman, “Information Hiding in Edge Location of Video using Amalgamate
FFT and Cubic Spline”, International Journal of Computer Engineering & Technology
(IJCET), Volume 4, Issue 4, 2013, pp. 240 - 247, ISSN Print: 0976 – 6367, ISSN Online:
0976 – 6375.

A survey of cloud based secured web application

More Related Content

What's hot (20)

Viewers also liked (8)

Similar to A survey of cloud based secured web application (20)

More from IAEME Publication (20)

Recently uploaded (20)

A survey of cloud based secured web application