Earticle

The burgeoning distribution of smartphone web applications based on various mobile environments is increasingly focusing on the performance of mobile applications implemented by JavaScript and HTML5 (Hyper Text Markup Language 5). If application software has a simple functional processing structure, then the problem is benign. However, browser loads are becoming more burdensome as the amount of JavaScript processing continues to increase. Processing time and capacity of the JavaScript in current mobile browsers are limited. As a solution, the Web Worker is designed to implement multi-threading. However, it cannot guarantee the computing ability as a native application on mobile devices, and is not sufficient to improve processing speed. The method proposed in this research overcomes the limitation of resources as a mobile client and guarantees performance by native application software by providing high computing service. It shifts the JavaScript process of a mobile device on to a cloud-based computer server. A performance evaluation experiment revealed the proposed algorithm to be up to 6 times faster in computing speed compared to the existing mobile browser's JavaScript process, and 3 to 6 times faster than Web Worker. In addition, memory usage was also less than the existing technology.

Traditional block cipher Advanced Encryption Standard (AES) is widely used in the field of network security, but it has high overhead on each operation. In the 15th international workshop on information security applications, a novel lightweight and low-power encryption algorithm named low-power encryption algorithm (LEA) was released. This algorithm has certain useful features for hardware and software implementations, that is, simple addition, rotation, exclusive-or (ARX) operations, non-Substitute-BOX architecture, and 32-bit word size. In this study, we further improve the LEA encryptions for cloud computing. The Web-based implementations include JavaScript and assembly codes. Unlike normal implementation, JavaScript does not support unsigned integer and rotation operations; therefore, we present several techniques for resolving this issue. Furthermore, the proposed method yields a speed-optimized result and shows high performance enhancements. Each implementation is tested using various Web browsers, such as Google Chrome, Internet Explorer, and Mozilla Firefox, and on various devices including personal computers and mobile devices. These results extend the use of LEA encryption to any circumstance.

Existing web applications and services have historically been implemented using JavaScript. However, new technologies such as artificial intelligence, the Internet of Things, and Big Data are being developed as part of the Fourth Industrial Revolution. With the definition of the HTML5 web standard, services (such as the technologies mentioned above) that were previously not available through the Web become available. These services, however, need to have the same performance as native applications, and implementing these services will require new technologies. Therefore, additional tools that can work on the Web with native performance are needed. In this paper, a system for branching processing was established using JavaScript and WebAssembly, a language that can operate on the Web. This system performs user requests in advance, and requests are branched in a language that produces faster results. Therefore, a service capable of quick response times can be implemented.

본 연구의 목적은 공개 소프트웨어(Open Source Software, 이하 OSS)가 운영 기간 내 주변의 행위자들과 관계를 수립하는 동안 OSS의 개발 및 확산 패턴을 확인하는 것으로, OSS 참여자들의 변화 패턴을 조사하기 위해 OSS 통과시간을 기반으로 그 변화 양상을 추적할 수 있는 온라인 데이터와 네트노그라피 방법을 이용하였다. 이를 위해 대표적인 OSS 자바스크립트 프레임워크인 jQuery, MooTools, YUI 등 이상 세 가지 사례에 대하여 블로그, 웹 서치와 함께 GitHub 공개 API(Application Programming Interface)로 수집된 데이터를 활용하였다. 본 연구에서는 OSS 변형 과정의 변화 패턴을 분류하기 위하여 행위자-네트워크 이론의 전환(translation) 과정을 적용하였으며, 관찰된 OSS 변형 과정을 살펴보면 다음과 같다. 먼저, ‘프로젝트 개시’ 단계에서 소스 코드, 프로젝트 책임자 및 관계자, 내부 참여자 등과 같은 세 가지 유형의 OSS 관련 행위자들을 확인하였고, 그들 사이의 관계성을 개념화하였다. 이후 프로젝트 책임자가 최초로 프로젝트를 착수하는 ‘프로젝트 성장’ 단계는 관계자들에 의해 소스 코드가 유지 보수되는 과정을 통해 개선된다. 마지막으로 OSS는 홍보 활동을 통해 참여자들의 관찰기를 갖고, 소스 코드 사용을 통해 학습기를 거친 사용자가 본격적으로 등장함으로써 ‘참여자의 도약’ 단계로 진입한다. 이 시기에는 기업과 외부 관계자들도 출현하는 모습도 살펴볼 수 있다. 본 연구 결과는 OSS 참여자들이 OSS를 선택하는데 있어 홍보 과정의 중요성을 강조하고, OSS의 급속한 개발 속도가 오히려 참여자의 출현을 지연시키는 구축 효과(crowding-out effec)가 발생하는 것을 확인하였다. 본 연구는 행위자-네트워크 이론을 토대로 주요 OSS 사례를 네트노그라피를 활용하여 종단적인 관점에서 분석함으로써 OSS의 발전 과정을 일반화시키기 위한 노력을 시도했다는 점에서 학술적인 의의가 있으며, OSS가 지배적인 위치에 오르기 위한 단계별 영향 요인, 세부적인 변화 양상 등을 확인함으로써 OSS 개발자와 관리자들에게 다양한 시사점을 제공할 것으로 기대된다.

The purpose of this study is to observe the spread pattern of open source software (OSS) while establishing relations with surrounding actors during its operation period. In order to investigate the change pattern of participants in the OSS, we use a netnography on the basis of online data, which can trace the change patterns of the OSS depending on the passage of time. For this, the cases of three OSSs (e.g. jQuery, MooTools, and YUI), which are JavaScript frameworks, were compared, and the corresponding data were collected from the open application programming interface (API) of GitHub as well as blog and web searches. This research utilizes the translation process of the actor-network theory to categorize the stages of the change patterns on the OSS translation process. In the project commencement stage, we identified the type of three different OSS-related actors and defined associated relationships among them. The period, when a master commences a project at first, is refined through the course for the maintenance of source codes with persons concerned (i.e. project growth stage). Thereafter, the period when the users have gone through the observation and learning period by being exposed to promotion activities and codes usage respectively, and becoming to active participants, is regarded as the ‘leap of participants’ stage. Our results emphasize the importance of promotion processes in participants’ selection of the OSS for participation and confirm the crowding-out effect that the rapid speed of OSS development retarded the emergence of participants.

With more and more consumer electronics apply multi-core chips, the traditional serialized JavaScript execution engine, which is optimized by just-in-time (JIT) compilation technology, fails to utilize multi-core advantages. This paper proposes a mathematical model to detect the dependency of serial JavaScript tasks and a parallelism execution algorithm for serial JavaScript execution engines. Moreover, the parallel JavaScript execution engine with thread-level speculation technology is implemented based on the SquirrelFish Extreme engine of WebKit. As the experiment were conducted respectively on the general test platform platform Sunspider in the industry and world top 15 websites at traffic volume, the results indicate that both in the real Web application and Sunspider platform, the parallel JavaScript execution engines with 2 to 16 threads can raise the performance dramatically compared with a SquirrelFish execution engine with or without JIT acceleration, respectively.

When a data file is shared through various methods on the Internet, the data file may be damaged in various cases. To prevent this, some websites provide the checksum value of the download target file in text data type. The checksum value provided in this way is then compared with the checksum value of the downloaded file and the published checksum value. If they are the same, the file is regarded as the same. However, the checksum value provided in text form is easily tampered with by an attacker. Because of this, if the correct checksum cannot be verified, the reliability and integrity of the data file cannot be ensured. In this paper, a checksum value is generated to ensure the integrity and reliability of a data file, and this value and related file information are stored in the blockchain. After that, we will introduce the research contents for designing and implementing a system that provides a function to share the checksum value stored in the block chain and compare it with other people's files.

This paper presents a new domain-specific language (DSL) and its interpreter. The purpose of the language is to be a tool for software developers and administrators that allows them to easily specify how configuration files in INI format should look like and what rules should their contents comply with. The interpreter of the language then takes a specification of a configuration file written in the DSL and verifies whether configuration files given as an input match the specification. The requirement for the language emerged at CERN (European Organization for Nuclear Research). The reason is that CERN, one of the biggest research organizations in the world, heavily uses SCADA (Supervisory Control and Data Acquisition) software for their industrial and scientific machines and SCADA developers needed to be able to verify that configuration files used by CERN's SCADA (WinCC Open Architecture) software are correct and comply with CERN standards. The newly designed DSL is primarily based on declarative paradigm and its core capabilities can be extended by JavaScript code injection. The language syntax is also a superset of INI files syntax so it feels familiar to people who want to use it for simple verification use cases. As for the interpreter, it uses Xtext-based parser to create abstract syntax trees and to integrate with the Eclipse Platform. The execution of the DSL code then uses a hybrid architecture which combines AST interpretation, translation of certain parts of AST into a JavaScript code and running JavaScript code on top of the Java Virtual Machine.

This note introduces elliptic curve cryptosystems and related algorithms and gives an elliptic curve cryptosystems practice program made with Javascript. We can find the practice program at author′s homepage "http://my.dreamwiz.com/math88". It is useful for students to study about elliptic curve cryptosystems.

Recently, most of malicious web pages include obfuscated codes in order to circumvent the detection of signature-based detection systems .It is difficult to decide whether the sting is obfuscated because the shape of obfuscated strings are changed continuously. In this paper, we propose a novel methodology that can detect obfuscated strings in the malicious web pages. We extracted three metrics as rules for detecting obfuscated strings by analyzing patterns of normal and malicious JavaScript codes. They are N-gram, Entropy, and Word Size. N-gram checks how many each byte code is used in strings. Entropy checks distributed of used byte codes. Word size checks whether there is used very long string. Based on the metrics, we implemented a practical tool for our methodology and evaluated it using read malicious web pages. The experiment results showed that our methodology can detect obfuscated strings in web pages effectively.

The traditional static detection method for malicious JavaScript detection has high efficiency without the need of code executing, but it cannot detect new malicious script. While the dynamic method usually needs to execute code and extract features, which lead to low efficiency and highly difficulty. In this paper, we propose a half-dynamic detection method for classification, which can solve the problem of obfuscated malicious JavaScript. The proposed method starts with obtaining the intermediate-state machine code using the JavaScript interpreter to compile the JavaScript. After extracting the function calling sequence of machine code, the feature model of the sequence is built using N-gram. Then we use k-NN classifier for training and detecting the malicious script. N-gram can directly be used to statically analyze the sequence of the obfuscated JavaScript, but not available to recognize the maliciousness. Then N-gram on the call function sequence of the compiled machine code is proposed as an efficient half-dynamic malicious script detection method. Finally, the efficiency and effectiveness of the proposed method is demonstrated through the experiments.

The cyber attacks using web sites for a personal information sale or break down the infrastructures are increasing. To prevent cyber attacks, virtual computer systems are hired and dynamic malicious web site analysis systems are used. However the dynamic analysis systems have to setting up a targeted environment and have a threat of real attack. Unlikely the dynamic analysis system, a static malicious web site analysis system can download a web page source and analysis the web page. The static analysis algorism also has problem, the analysis time is longer than dynamic systems and need a human checking. For this reason, this journal suggest new analysis system reducing the dynamic and static system's problems using suspicious malicious web site detection with strength analysis of a JavaScript obfuscation for new hybrid analysis system.

자바스크립트는 웹 페이지를 제어하기 위한 표준적인 스크립트 언어로 오랫동안 사용되어 왔다. 최근 웹 앱이나 서버사이드 응용 프로그램을 자바스크립트로 작성하게 되면서, 자바스크립트 프로그램을 더욱 빠르게 동작하도록 만드는 것이 중요한 이슈가 되었다. 본 논문에서는 암시적인 동적 타입 시스템을 사용하는 자바스크립트 언어에 Cartesian Product Algorithm을 적용하여 타입을 추론하고, 이 정보를 바탕으로 정적 타입 시스템인 C++ 코드로 변환하는 컴파일러의 구조와 알고리즘을 제시한다.

최근 웹 변조 공격은 대형 포탈, 은행, 학교 등 접속자가 많은 홈페이지에 악성 URL을 불법 삽입하여 해당 URL을 통해 접속자 PC에 자동으로 악성코드 유포하고 대규모 봇넷(botnet)을 형성한 후 DDoS 공격을 수행하거나 감염 PC들의 정보를 지속적으로 유출하는 형태로 수행된다. 이때, 홈페이지에 삽입되는 악성 URL은 탐지가 어렵도록 Javascript 난독화 기법(obfuscation technique) 등으로 은밀히 삽입된다. 본 논문에서는 웹 소스코드에 은닉된 악성 Javascript URL들에 대한 일괄 점검체계를 제안하며, 구현된 점검체계의 prototype을 활용하여 점검성능에 대한 시험결과를 제시한다.

Moodle은 Web 기반의 Open source LMS이다. Moodle은 사용자가 쉽게 다양한 유형의 퀴즈를 출제할 수 있게 도와준다. 그러나 Cloze형만은 사용자에게 문항을 편리하게 작성하기 위한 아무런 인터페이스를 제공하지 않는다. 본 논문에서는 사용자가 Cloze 유형의 문제를 손쉽게 작성할 수 있도록 하는 프로그램을 개발하였다. 본 프로그램은 사용이 불편했던 Cloze형 문항 컨텐츠에 보다 사용하기 편리한 인터페이스를 제공함으로써 Cloze형 문항을 제작하는데 소요되는 시간 비용의 절약과 작성의 편리성을 달성하였다. 따라서 Moodle 상에서 Cloze형 문항을 이용하여 다양한 퀴즈를 출제 하고자하는 사용자들에게 많은 도움이 될 것이다.

Moodle is a web-based open-source LMS. This system provides the effective functions for making a various types of quizzes easily. Any interface for making a Cloze-type quiz conveniently, however, are not provided in the Moodle. In this paper, a web-based program has been developed which helps users make the Cloze-type quizzes easily. The program provides a convenient interface and achieved the considerable reduction in time-cost of making the Cloze-type quiz. The program is very helpful for users to try to make a variety of quizzes by using the Cloze-type.

JavaScript의 활용이 웹 개발을 넘어 내장형 기기 내부의 응용 애플리케이션까지 확장되고 있는 가운데, 이를 지원하기 위한 웹 브라우저 및 JavaScript 엔진 등의 개발에 산학의 다양한 노력이 이어지고 있다. 하지만 이러한 도구들의 대다수가 체계적으로 문서화되어 있지 않기 때문에 이를 응용한 개발 혹은 연구가 힘들고, 소스코드가 공개되어 있지 않은 경우도 많아 사용 자체가 불가능하기도 하다. 한편, JavaScript가 차세대 언어로 각광을 받고 있는 반면 언어 자체의 보안 취약성에 대한 문제 또한 끊임없이 불거짐에 따라 신뢰도 높은 응용 애플리케이션 개발에 대한 개발자들의 욕구가 점점 거세지고 있다. 본 논문에서는 이러한 한계점들의 대안으로써 개발한 확장 가능한 JavaScript 분석 프레임워크인 SAFE(Scalable Analysis Framework for ECMAScript)에 대해 소개하고, 이에 기반한 산학연구의 사례로 JavaScript 분석기의 정확도를 높이는 기법을 기술함으로써 다양한 분석기를 지원하는 SAFE의 확장성을 보인다.

While the applications of JavaScript have covered from web developments to applications embedded in smart appliances, many researchers from both academia and industry are actively working on developments of web browsers and JavaScript engines. However, unfortunately, such developments are not well-documented nor available to the public, which make the researchers struggle to pursue aggressive research on JavaScript applications. At the same time, while JavaScript has been the most widely used programming language in recent years, its vulnerability to security attacks has been reported and the demands for the JavaScript analyzers and safe development tools are ever increasing. In this paper, we introduce SAFE (Scalable Analysis Framework for ECMAScript) as a solution to the above mentioned problems. SAFE is an extensible and pluggable analysis framework for JavaScript analyzers, which is formally described and developed, and open to the public. As an example of pluggable analyses, we describe a mechanism to enhance the analysis precision by using assertions on branches supported in SAFE.

One of serious security threats is a botnet-based attack. A botnet in general consists of numerous bots, which are computing devices with networking function, such as personal computers, smartphones, or tiny IoT sensor devices compromised by malicious codes or attackers. Such botnets can launch various serious cyber-attacks like DDoS attacks, propagating mal-wares, and spreading spam e-mails over the network. To establish a botnet, attackers usually inject malicious URLs into web source codes stealthily by using data hiding methods like Javascript obfuscation techniques to avoid being discovered by traditional security systems such as Firewall, IPS(Intrusion Prevention System) or IDS(Intrusion Detection System). Meanwhile, it is non-trivial work in practice for software developers to manually find such malicious URLs which are hidden in numerous web source codes stored in web servers. In this paper, we propose a security defense system to discover such suspicious, malicious URLs hidden in web source codes, and present experiment results that show its discovery performance. In particular, based on our experiment results, our proposed system discovered 100% of URLs hidden by Javascript encoding obfuscation within sample web source files.

미국은 왜 세계의 민주주의 전파의 수사를 반복해 온 것일까? 또 미국은 왜 그럼에도 불구하고 종종 독재지원에 나서는 등 자신이 천명하는 목표에서 벗어나는 정책적 모순을 보여 왔는가? 이러한 질문에 답하기 위해 본 논문은 윌슨주의 외교이념의 특징과 한계를 검토한다. 윌슨주의 외교이념에 따른 대외적 민주주의 전파 정책은 미국 스스로의 정치체제와 가치가 위협받고 있다고 인식되는 상황에서 그러한 위협에 장기적 차원에서 적극 대응하는 안보이념으로서의 성격이 강하다. 그러나 윌슨주의에 내재해 있는 기본적인 안보중심성은 민주주의 전파를 어렵게 하는 요인이다. 즉각적이고 직접적인 안보 이해와 상충될 경우 민주주의 전파의 목표는 대체로 포기된다. 또한 윌슨주의에 입각한 대외정책은 대외적 위기가 존재할 경우를 전제로 하는 것이므로 대외적 위기가 해소되어 더 이상 안보위협이 존재하지 않거나 약화될 경우에는 미국의 안전을 확보하기 위한 대외적 개입의 의지 자체가 약화된다.

Why has the US government repeatedly the rhetoric of democracy promotion? Despite this pro-democracy rhetoric, however, why has the US government often supported dictatorship, and thereby defying its own declared goal. In order to answer these questions, this article examines the Wilsonian foreign policy ideology.

본 연구에서는 JavaScript와 Node.js를 활용하여 대용량 트래픽을 처리하는 웹 에러 모니터링 시스템을 개발했다. Node.js의 비동기식 I/O 처리와 이벤트 기반 아키텍처를 활용하여 높은 처리량과 확장성을 제공하며, Express 프레임워크를 사용하여 개발 편의성을 높였다. 에러 내용은 MySQL 데이터베이스에 저장되고, 클라이언트에서 요청할 때 JavaScript를 삽입하여 에러 정보를 전송한다. 이를 통해 웹 에러 모니터링 시스템은 실시간으로 에러를 분석하고 모니터링할 수 있다. 또한, Chart.js를 활용하여 시각화된 에러 현황을 사용자에게 제공한다. 이를 통해 개발자들은 웹사이트의 안정성을 향상시키고 사용자들에게 원활한 경험을 제공할 수 있게 되었다.

웹 플렛폼이 계속해서 발전하고 기술이 고도화 됨에 따라 이를 사용하기 위한 다양한 지원 기술과 프레임워크가 제안되고 있다. 그 중 최근 가장 관심이 집중되고 있는 브라우저 기반의 웹 어플리케이션 기법이 AJAX(Asynchronous JavaScript and XML)이다. AJAX를 구현하는 데에는 JavaScript가 중요한 기술적 요소라 하겠다. 본 논문에서는 사용 규모와 기능의 확대가 예상되는 JavaScript의 시험을 위한 도구를 개념적으로 제안했다. 기존에 제안된 도구나 수동적인 시험은 HTML에 시험을 위한 JavaScript를 삽입하여 브라우저를 통한 시험이 위주였다. 브라우저를 통한 방법은 스크립트를 삽입한 후 HTML을 불러와야 한다는 번거로움이 있고 시험을 위해 삽입된 JavaScript를 제거하는 과정에서 다른 오류가 유입될 수도 있다. 또한 브라우저에서 보여주는 결과만으로는 시험의 확인이 어렵다. 이에 본 논문은 AJAX 환경에서 더욱 사용이 확대되고 있는 자바스크립트를 시험하기 위한 자동 시험 도구 시스템을 제안한다.