Earticle

The vision of the future Internet of Things is posing new challenges and opportunities for data management and analysis technology. Gigabytes of data are generated everyday by millions of sensors, actuators, RFID tags, and other devices. As the volume of data is growing dramatically, so is the demand for performance enhancement. When it comes to this Big Data problem, much attention has been paid to cloud computing and virtualization for their unlimited resource capacity, exible resource allocation and management, and distributed processing ability that promise high scalability and availability. On the other hand, the types and nature of data are getting more and more various. Data can come in any format, structured or unstructured, ranging from text and number to audio, picture, or even video. Data are generated, stored, and transferred across multiple nodes. Data can be updated and queried in real time or on demand. Hence, the traditional and dominant relational database systems have been questioned whether they can still be the best choice for current systems with all the new requirements. It has been realized that the emphasis on data consistency and the constraint of using relational data model cannot well with the variety of modern data and their distributed trend. This led to the emergence of NoSQL databases with their support for a schema-less data model and horizontal scaling on clusters of nodes. NoSQL databases have gained much attention from the community and are increasingly considered as a viable alternative to traditional databases.

본 연구는 SQL Injection 중 Union Select 기법의 위험성과 개인정보 유출 사례를 분석하고, PDO의 Prepared, 필터링 기반 리다이렉션을 통한 방어 전략을 제안하였다. 실험 결과, 제안된 기법들은 공격 차단과 데이터 보호에 효과적임을 확인하였으며, 웹 애플리케이션의 보안성과 안정성 향상에 기여할 수 있음을 입증하였다.

현재 사회는 정보화 사회로 데이터를 활용하는 것이 필수불가결하다. 따라서 데이터베이스를 활용하여 방대한 양의 데이터를 관리하고 있다. 실생활에서 데이터베이스에 들어있는 데이터들은 대부분 한 그룹의 회원들의 개인정보 들이다. 개인정보는 민감한 데이터이기 때문에 개인정보를 관리하는 데이터베이스 관리자의 역할이 중요하다. 하지만 이런 개인정보를 악의적으로 사용하기 위해 데이터베이스를 공격하는 행위가 늘고 있다. SQL Injection은 가장 많이 알려져 있고 오래된 해킹기법 중에 하나이다. SQL Injection 공격은 공격하기 쉬운 기법으로 알려져 있으나 대응방안 또한 쉽지만 많은 로그인을 요구하는 웹페이지에서 SQL 공격을 피하기 위한 노력을 많이 하지만 일부 사이트는 여전 히 SQL 공격에 취약하다. 따라서 본 연구에서 SQL해킹 기술 사례 분석을 통하여 효과적인 방어책을 제시하여 웹 해킹 을 막고 안전한 정보통신 환경을 제공하는 데 기여한다.

At present, it is indispensable to utilize data as an information society. Therefore, the database is used to manage large amounts of data. In real life, most of the data in a database is the personal information of a group of members. Because personal information is sensitive data, the role of the database administrator who manages personal information is important. However, there is a growing number of attacks on databases to use this personal information in a malicious way. SQL Injection is one of the most known and old hacking techniques. SQL Injection attacks are known as an easy technique, but countermeasures are easy, but a lot of efforts are made to avoid SQL attacks on web pages that require a lot of logins, but some sites are still vulnerable to SQL attacks. Therefore, this study suggests effective defense measures through analysis of SQL hacking technology cases and contributes to preventing web hacking and providing a secure information communication environment.

Since XML emerged as a standard for data exchange on the web, it has been widely used for applications like e-Commerce, CRM, and BI. However, it is common that most of business data is stored in relational database systems, and it is expected that business data management would still be centered around the relational database systems. As such, the technique of viewing relational data as XML and processing XML queries against it is required. To meet such a need, in the SQL/XML standard, the functions to publish relational data as XML are provided. In this paper, we propose the techniques of providing an XML view of relational data defined by an SQL/XML statement in DTD(Document Type Definition), and of processing XPath queries against the XML view by translating them into SQL/XML statements, and describe the validation of such techniques through implementation and tests.

EPC Information Services (EPCIS) is an EPCglobal standard designed to enable EPC-related data sharing within and across supply chain. The EPCIS standard defines standard interfaces to enable EPC-related data to be captured and subsequently to be queried using a set of service operations and an associated data model. There are two kinds of EPCIS data: event data and master data. Event data is created in the process of carrying out business processes. Traceability of goods across supply chain is based on event data. Therefore, each company must have an event data. This study compared he difference between MS-SQL(DRDBMS) and ALTIBASE(MMDBMS) for data storage. We compared the difference between two database management in many respects such as insert time and select time. We come to a conclusion that ALTIBASE is more efficient than MS-SQL.

일반적으로 물류센터에서는 많은 작업이 발생하고, 처리되는 물품 또한 그 수량이 매우 많아서 작업 제품 정보들을 빠르고 정확하게 처리하기 위해서는 많은 비용이 발생한다. 이러한 오류를 줄이고, 실시간 정보처리, 객체의 가시성 확보, 제품 이력 추적 등의 이점을 얻기 위해 RFID 기술을 도입하는 기업들이 증가하는 추세이며, 최근에는 RFID를 활용하여 전 세계적으로 표준화된 단일 네트워크를 만들고자 하는 EPC Global Network에 대한 필요성이 증가하고 있다. 본 연구에서는 EPC Global Network의 게이트웨이 역할을 하는 EPCIS에서, 정보의 저장소 역할을 하는 EPCIS Repository의 최적화에 대해 연구한다. 실제 물류 센터에서 발생하는 비즈니스 프로세스를 바탕으로 시나리오를 작성하고, 물류센터의 시나리오에 따라 발생되는 EPC 데이터를 DRDBMS와 MMDBMS를 통해 각각 저장하고 검색하여 두 DBMS의 성능을 비교하였다. DRDBMS는 MS-SQL을 사용하였고, MMDBMS는 ALTIBASE를 사용하였다. 실험 결과 AlTIBASE가 MS-SQL보다 좋은 성능을 보임을 알 수 있었다.

최근 웜에 의한 사이버 위협이 증가함에 따라 웜의 확산 특성을 분석하기 위한 전파 모델이 연구되고 있다. 대표적인 예로 수학적 모델링 기법인 Epidemic(SI), KM(Kermack-MeKendrick), Two-Factor, AAWP(Analytical Active Worm Propagation)등의 모델 기법들이 제시되었다. 하 지만, 기존 모델 방법들은 대부분 코드레드와 같은 네트워크를 대상으로 하는 랜덤 스캐닝 기법 에 대해서만 모델링이 가능하다. 또한 거시적인 분석만 가능하고 특정 위협에 대해 예측하는데 한계점을 가지고 있다. 따라서 본 논문에서는 과거의 위협 발생 데이터를 근거로 하여 Mass SQL Injection 같은 사이버위협에 적용 가능한 마코브 체인(markov chain) 기반 예측 방법을 제시한다. 이를 통하여 각 위협별 발생 확률 및 발생빈도를 예측할 수 있다.

Recently, Worm epidemic models have been developed in response to the cyber threats posed by worms in order to analyze their propagation and predict their spread. Some of the most important ones involve mathematical model techniques such as Epidemic(SI), KM(Kermack-MeKendrick), Two- Factor and AAWP(Analytical Active Worm Propagation). However, most models have several inherent limitations. For instance, they target worms that employ random scanning in the network such as CodeRed worm and it was able to be applied to the specified threats. Therefore, we propose the probabilistic of worm propagation based on the Markov Chain, which can be applied to cyber threats such as Mass SQL Injection worm. Using the proposed method in this paper, we can predict the occurrence probability and occurrence frequency for each threats in the entire system.

SQL Injection 기법은 공개된지 수년이 지났지만 웹해킹 공격중 가장 위험한 공격으로 분류되어 있다. 웹 프로그래밍은 자료의 효율적인 저장 및 검색을 위해 DBMS를 필수적으로 사용하고 있다. 주로 PHP,JSP,ASP 등의 스크립트 언어를 이용하여 DBMS와 연동한다. 이러한 웹 어플리케이션에서 클라이언트의 잘못된 입력값을 검증하지 않으므로 비정상적인 SQL 쿼리가 발생할 수 있다. 이러한 비정상적 쿼리는 사용자 인증을 우회하거나 데이터베이스에 저장된 데이터를 노출시킬 수 있다. 공격자는 SQL Injection 취약점을 이용하여 아이디와 암호를 몰라도 웹기반 인증을 통과할 수 있고 데이터베이스에 저장된 데이터를 열람해 볼 수 있다. SQL Injection에 대한 대책으로 다수의 방법이 발표되었다. 그러나 어느 한 가지 방법에 의존할 경우 많은 보안 공백이 발생할 수 있다. 단계적 대응모델은 사고 예방적 측면에서 소스코드 작성 단계, 서버 운용단계, 데이터베이스 핸드링 단계, 사용자 입력값 검증 활용 단계 등 대책을 프레임워크로 구성하여 적용하는 방법이다. 이 대응모델 을 적용할 경우 운용과정을 통해 존재하는 SQL Injection의 공격가능성을 보다 효과적으로 차단이 가능하다.

SQL Injection techniques disclosed web hacking years passed, but these are classified the most dangerous attacks. Recent web programming data for efficient storage and retrieval using a DBMS is essential. Mainly PHP, JSP, A SP, and scripting language used to interact with the DBMS. In this web environments application does not validate the client's invalid entry may cause abnormal SQL query. These unusual queries to bypass user authentication or data that is stored in the database can be exposed. SQL Injection vulnerability environment, an attacker can pass the web-based authentication using username and password and data stored in the database. Measures against SQL Injection on has been announced as a number of methods. But if you rely on any one method of many security hole ca n occur. The proposal of four levels leverage is composed with the source code, operational phases, database, server management side and the user input validation. This is a way to apply the measures in terms of why the accident preventive steps for creating a phased step-by-step response nodel, through the process of management measures, if applied, there is the possibility of SQL Injection attacks can be

In recent years, pair programming has become a widely used approach for development of information systems. According to a worldwide survey, 35 percent of 104 development projects reported using pair programming. However, previous studies have shown rather mixed results in terms of the effectiveness of pair programming, comparing to individual or independent programming. This paper, therefore, uses a lab setting to control some of the variables that appear to have caused conflicting results in earlier studies. Writing SQL queries for given problem statements is selected as the task the subjects to solve. One key issue addressed is the distribution of work load among the pair programmers and the independent programmers. Another is communication among co-workers as would occur in a real-world system development environment. The results of this study indicate there is no significant difference in task performance pair programming and independent programming.

Typical Text-to-SQL research copes with the problem of parsing natural language questions into executable SQL queries. While new datasets emerge progressively, most are committed to exploring the robustness and generalizability of models, leaving the research of model's capability in solving geography-specific questions blank. To this end, in this work, we approach this problem by proposing an improved abstract syntax tree to represent spatial SQL queries. Following this proposition, we build SpatialSpider, a new Text-to-SQL dataset in the geography domain. Our dataset introduces the following challenges: 1) Understanding of geographical semantics. 2) Prediction of spatial functions. In summary, we propose an improved abstract syntax tree and a dataset to tackle the spatial Text-to-SQL problem and obtain promising experimental results.

As the use of open source databases grows, so does need to evaluate, the performance of search queries for these databases. This paper compares the search query performance of SQL-based open source databases with commercial databases through experiments. The targets are MySql, MariaDB, and MS-SQL Server. In this study, the execution time of various types of search queries are measured. Also, search query performance was experimented according to change of index and number of tuples. Experimental results show that SQL-based open source databases have the potential to replace commercial databases when indexes are used and the number of tuples is not very large.

Recently, we have witnessed the emergence of new data stream management systems that can scale up to a large number of machines for the real-time processing of big data. These systems typically provide a procedural programming interface with their own APIs. However, to enable the rapid development of applications, it is desirable to support a declarative interface with clear processing semantics, such as window SQL. This paper examines the programming interfaces of the state-of-the-art data stream management systems and discusses the necessity of SQL support to help users write stream queries easily and in an integrated manner.

With the development of mobile internet and social network, the scale of structured data have been increasing to PB level and above rapidly, while the query performance is greatly reduce. The efficiency of query optimization on large-scale datasets is currently a research focus in both academia and industry. In this paper, we present a distributed data management method, designed to improve query performance, called KCSQ. KCSQ analyses historical SQL commands, deduces statistics using frequency and the coupling degree of tables and table columns, and confirms the key column based on statistical evidence. When importing new tables into the HDFS, the data are divided into different blocks according to their key column. Any query on these columns can reduce the amount of data to be queried and the number of working nodes and thus effectively improves the throughput rate of the system.

Big Data era is changing people’s way of thinking and working, urban residential landscape industry needs to absorb the production methods development outcomes of big data techniques. People need to build landscape environment like which more suitable for their material and spiritual life based on big data. In this paper, the urban residential landscape information database system architecture has been designed, focusing on the data source analysis, conceptual design, logical design and physical design. And further to the database techniques, such as data dictionary, ER model, SQL, and Web publishing platform, network applications techniques were introduced. Development and application of urban residential landscape database is a significant way to expand urban landscape environment construction.

Because of the traditional Apriori algorithm in data mining in the process of operation for a long time, and produce a large number of unrelated item sets, caused great waste of data space, so this article puts forward an improved Apriori algorithm based on SQL, increase degree by calculation method, for pruning association rules and is independent of item sets.

통합 정보시스템의 도입과 구축에 있어 가장 중요한 성공요소중의 하나가 성능 최적화이다. 본 연구에서는 정보시스템의 성능향상을 위해 비용도 저렴하고 단시간에 효과를 나타낼 수 있는 관계형 데이터베이스의 SQL 튜닝 기법을 제안하고, 이를 중소규모의 회사에 실제 운용되고 있는 데이터베이스 시스템에 적용하여 그 효율성을 분석하였다.

One of the most critical success factor in introducing and operating an integrated information system is the performance management. In this study, we propose some SQL tuning techniques, applicable to optimize the performance of relational database systems. We showed effectiveness of the techniques by applying to a database system of a medium scale company.

본 논문에서는 현재 운영되는 수강신청 시스템에서의 데이터베이스 성능을 향상시키기 위하여 SQL문 분석을 하였다. 수강신청 업무와 관련된 트랜잭션들에서 사용 중인 SQL문장들을 실행계획을 통하여 현행 데이터베이스 성능 을 측정하였으며, SQL 분석을 통하여 보완한 SQL문장들이 성능이 향상된 결과를 확인하였다. 전반적으로 실행계획 분석을 통하여 수강신청 데이터베이스 시스템의 성능을 향상시켰으며, 수강신청 SQL 의 일부 개선방법을 시험결과로 보였다. 개선된 방법은 데이터베이스 튜닝 작업을 통하여 수강신청과 관련된 테이블들과 인덱스 테이블들을 재조정하 고, SQL의 기능을 활용함으로서 성능이 향상된 수강신청 데이터베이스 시스템으로 진화한 최적화된 시스템을 구현할 수 있게 되었다. 제안된 방법으로 재조정된 수강신청 시스템은 이전에 운영하던 수강신청시스템에 비하여 성능적 측 면에서 우수한 결과를 나타내었으며, 통합 성능 시험 결과 1.8배 ~ 18배의 응답시간 단축을 가져왔다.

In this paper, SQL statements are analyzed to improve database performance in the current course registration system. The performance of the current database was measured through the execution plan of the SQL statements used in the transactions related to the course registration. Through the SQL analysis, the complemented SQL statements confirmed the improved performance. Overall, the performance of the course registration database system was improved through the analysis of the execution plan, and some improvement methods of the course registration SQL were shown as test results. The improved method is to reorganize the tables and index tables related to the course registration through database tuning, and utilize the SQL function to implement an optimized system that has evolved into a course database system with improved performance. The enrollment system re-adjusted by the proposed method showed excellent results in terms of performance compared to the previous enrollment system, and the integrated performance test result reduced the response time by 1.8 to 18 times.