Earticle

본 연구의 목적은 공개 소프트웨어(Open Source Software, 이하 OSS)가 운영 기간 내 주변의 행위자들과 관계를 수립하는 동안 OSS의 개발 및 확산 패턴을 확인하는 것으로, OSS 참여자들의 변화 패턴을 조사하기 위해 OSS 통과시간을 기반으로 그 변화 양상을 추적할 수 있는 온라인 데이터와 네트노그라피 방법을 이용하였다. 이를 위해 대표적인 OSS 자바스크립트 프레임워크인 jQuery, MooTools, YUI 등 이상 세 가지 사례에 대하여 블로그, 웹 서치와 함께 GitHub 공개 API(Application Programming Interface)로 수집된 데이터를 활용하였다. 본 연구에서는 OSS 변형 과정의 변화 패턴을 분류하기 위하여 행위자-네트워크 이론의 전환(translation) 과정을 적용하였으며, 관찰된 OSS 변형 과정을 살펴보면 다음과 같다. 먼저, ‘프로젝트 개시’ 단계에서 소스 코드, 프로젝트 책임자 및 관계자, 내부 참여자 등과 같은 세 가지 유형의 OSS 관련 행위자들을 확인하였고, 그들 사이의 관계성을 개념화하였다. 이후 프로젝트 책임자가 최초로 프로젝트를 착수하는 ‘프로젝트 성장’ 단계는 관계자들에 의해 소스 코드가 유지 보수되는 과정을 통해 개선된다. 마지막으로 OSS는 홍보 활동을 통해 참여자들의 관찰기를 갖고, 소스 코드 사용을 통해 학습기를 거친 사용자가 본격적으로 등장함으로써 ‘참여자의 도약’ 단계로 진입한다. 이 시기에는 기업과 외부 관계자들도 출현하는 모습도 살펴볼 수 있다. 본 연구 결과는 OSS 참여자들이 OSS를 선택하는데 있어 홍보 과정의 중요성을 강조하고, OSS의 급속한 개발 속도가 오히려 참여자의 출현을 지연시키는 구축 효과(crowding-out effec)가 발생하는 것을 확인하였다. 본 연구는 행위자-네트워크 이론을 토대로 주요 OSS 사례를 네트노그라피를 활용하여 종단적인 관점에서 분석함으로써 OSS의 발전 과정을 일반화시키기 위한 노력을 시도했다는 점에서 학술적인 의의가 있으며, OSS가 지배적인 위치에 오르기 위한 단계별 영향 요인, 세부적인 변화 양상 등을 확인함으로써 OSS 개발자와 관리자들에게 다양한 시사점을 제공할 것으로 기대된다.

The purpose of this study is to observe the spread pattern of open source software (OSS) while establishing relations with surrounding actors during its operation period. In order to investigate the change pattern of participants in the OSS, we use a netnography on the basis of online data, which can trace the change patterns of the OSS depending on the passage of time. For this, the cases of three OSSs (e.g. jQuery, MooTools, and YUI), which are JavaScript frameworks, were compared, and the corresponding data were collected from the open application programming interface (API) of GitHub as well as blog and web searches. This research utilizes the translation process of the actor-network theory to categorize the stages of the change patterns on the OSS translation process. In the project commencement stage, we identified the type of three different OSS-related actors and defined associated relationships among them. The period, when a master commences a project at first, is refined through the course for the maintenance of source codes with persons concerned (i.e. project growth stage). Thereafter, the period when the users have gone through the observation and learning period by being exposed to promotion activities and codes usage respectively, and becoming to active participants, is regarded as the ‘leap of participants’ stage. Our results emphasize the importance of promotion processes in participants’ selection of the OSS for participation and confirm the crowding-out effect that the rapid speed of OSS development retarded the emergence of participants.

With more and more consumer electronics apply multi-core chips, the traditional serialized JavaScript execution engine, which is optimized by just-in-time (JIT) compilation technology, fails to utilize multi-core advantages. This paper proposes a mathematical model to detect the dependency of serial JavaScript tasks and a parallelism execution algorithm for serial JavaScript execution engines. Moreover, the parallel JavaScript execution engine with thread-level speculation technology is implemented based on the SquirrelFish Extreme engine of WebKit. As the experiment were conducted respectively on the general test platform platform Sunspider in the industry and world top 15 websites at traffic volume, the results indicate that both in the real Web application and Sunspider platform, the parallel JavaScript execution engines with 2 to 16 threads can raise the performance dramatically compared with a SquirrelFish execution engine with or without JIT acceleration, respectively.

When a data file is shared through various methods on the Internet, the data file may be damaged in various cases. To prevent this, some websites provide the checksum value of the download target file in text data type. The checksum value provided in this way is then compared with the checksum value of the downloaded file and the published checksum value. If they are the same, the file is regarded as the same. However, the checksum value provided in text form is easily tampered with by an attacker. Because of this, if the correct checksum cannot be verified, the reliability and integrity of the data file cannot be ensured. In this paper, a checksum value is generated to ensure the integrity and reliability of a data file, and this value and related file information are stored in the blockchain. After that, we will introduce the research contents for designing and implementing a system that provides a function to share the checksum value stored in the block chain and compare it with other people's files.

This paper presents a new domain-specific language (DSL) and its interpreter. The purpose of the language is to be a tool for software developers and administrators that allows them to easily specify how configuration files in INI format should look like and what rules should their contents comply with. The interpreter of the language then takes a specification of a configuration file written in the DSL and verifies whether configuration files given as an input match the specification. The requirement for the language emerged at CERN (European Organization for Nuclear Research). The reason is that CERN, one of the biggest research organizations in the world, heavily uses SCADA (Supervisory Control and Data Acquisition) software for their industrial and scientific machines and SCADA developers needed to be able to verify that configuration files used by CERN's SCADA (WinCC Open Architecture) software are correct and comply with CERN standards. The newly designed DSL is primarily based on declarative paradigm and its core capabilities can be extended by JavaScript code injection. The language syntax is also a superset of INI files syntax so it feels familiar to people who want to use it for simple verification use cases. As for the interpreter, it uses Xtext-based parser to create abstract syntax trees and to integrate with the Eclipse Platform. The execution of the DSL code then uses a hybrid architecture which combines AST interpretation, translation of certain parts of AST into a JavaScript code and running JavaScript code on top of the Java Virtual Machine.

This note introduces elliptic curve cryptosystems and related algorithms and gives an elliptic curve cryptosystems practice program made with Javascript. We can find the practice program at author′s homepage "http://my.dreamwiz.com/math88". It is useful for students to study about elliptic curve cryptosystems.

Recently, most of malicious web pages include obfuscated codes in order to circumvent the detection of signature-based detection systems .It is difficult to decide whether the sting is obfuscated because the shape of obfuscated strings are changed continuously. In this paper, we propose a novel methodology that can detect obfuscated strings in the malicious web pages. We extracted three metrics as rules for detecting obfuscated strings by analyzing patterns of normal and malicious JavaScript codes. They are N-gram, Entropy, and Word Size. N-gram checks how many each byte code is used in strings. Entropy checks distributed of used byte codes. Word size checks whether there is used very long string. Based on the metrics, we implemented a practical tool for our methodology and evaluated it using read malicious web pages. The experiment results showed that our methodology can detect obfuscated strings in web pages effectively.

The traditional static detection method for malicious JavaScript detection has high efficiency without the need of code executing, but it cannot detect new malicious script. While the dynamic method usually needs to execute code and extract features, which lead to low efficiency and highly difficulty. In this paper, we propose a half-dynamic detection method for classification, which can solve the problem of obfuscated malicious JavaScript. The proposed method starts with obtaining the intermediate-state machine code using the JavaScript interpreter to compile the JavaScript. After extracting the function calling sequence of machine code, the feature model of the sequence is built using N-gram. Then we use k-NN classifier for training and detecting the malicious script. N-gram can directly be used to statically analyze the sequence of the obfuscated JavaScript, but not available to recognize the maliciousness. Then N-gram on the call function sequence of the compiled machine code is proposed as an efficient half-dynamic malicious script detection method. Finally, the efficiency and effectiveness of the proposed method is demonstrated through the experiments.

The cyber attacks using web sites for a personal information sale or break down the infrastructures are increasing. To prevent cyber attacks, virtual computer systems are hired and dynamic malicious web site analysis systems are used. However the dynamic analysis systems have to setting up a targeted environment and have a threat of real attack. Unlikely the dynamic analysis system, a static malicious web site analysis system can download a web page source and analysis the web page. The static analysis algorism also has problem, the analysis time is longer than dynamic systems and need a human checking. For this reason, this journal suggest new analysis system reducing the dynamic and static system's problems using suspicious malicious web site detection with strength analysis of a JavaScript obfuscation for new hybrid analysis system.