The thesis describes a comprehensive solution of a web application for administration of extensive LAN and WAN networks, which are based on nodes by MikroTik . There is a feasibility study, which says, what modules and what functionality should be included. Also a database structure is clarified and technical procedures of solution of the whole assignment are outlined with an emphasis on universality and maximal simplicity.

Allt fler organisationer väljer att förbättra och förnya sin verksamhet genom att använda informationssystem. Verksamheter idag har blivit allt mer beroende av IT- stöd i form av system samt webbapplikationer, eftersom det automatiserar och effektiviserar arbetsprocessen. Verksamheter med ett fullt fungerande IT-stöd leder, lyfter och styr företaget framåt i utvecklingen. Nyttan av ett IT system kan mätas då systemet är anskaffat och befinns i en förvaltningssituation. I förvaltningssituationer används IT system vilket kräver att dessa underhålls och omskapas efter verksamhetens utveckling. Studien syftar till att kartlägga alla IT-system och webbapplikationer för Tele2 Butikerna AB samt för varje system identifiera användare, accessroller, funktioner, förvaltningsresurser och förbättringsområden. Detta har utförts genom att skapa en nulägesanalys och en behovsanalys av verksamheten med hjälp av flera olika metoder. I examensarbetet har dokumenterade metoder använts för skapande av nulägesanalys och behovsanalys, vilka har stått i grund för de metoder som behärskar genom uppsatsens gång. Kartläggningen bestod främst av datainsamling via intervjuer med de anställda ute i butikerna samt på huvudkontoret. Slutligen har en rapport överlämnats till Tele2 som motsvarar önskemålen från uppdragsgivaren. / Increasing numbers of organizations are choosing to improve and innovate through the use of information systems. Businesses today have become more dependent on IT support such as systems and web applications as it automates and streamlines the work process. Organizations with a fully functional IT support leads, lifts and controls the company forward in development. The benefits of an IT system can be measured when the system is acquired and placed in a management situation. IT systems are used in management situations which require maintaining and re-engineering for business development. The study aims to identify all IT systems and web applications for Tele2 Butikerna AB and also for each system identify users, access roles, system functions, management recourses and possible improvements. This has been done by creating a situation analysis and a needs analysis of the business with help from different methods. The thesis contains documented methods that has been used for the creation of the situation and needs analysis. These have been the basis during the thesis approach. The survey consists of data collection through interviews with the employees in the stores and at headquarters. Finally, a report has been submitted to Tele2 corresponding to the wishes of the client.

User behavior analysis in web applications is currently mainly performed by analysis of statistical measurements based on user interactions or by creation of personas to better understand users. Both of these methods give great insights in how the users utilize a web site, but do not give any additional information about what they are actually doing. This thesis attempts to use eye tracking data for analysis of user activities in web applications. Eye tracking data has been recorded, labeled and analyzed for 25 test participants. No data source except eye tracking data has been used and two different approaches are attempted where the first relies on a gaze map representation of the data and the second relies on sequences of features. The results indicate that it is possible to distinguish user activities in web applications, but only at a high error-rate. Improvement are possible by implementing a less subjective labeling process and by including features from other data sources. / I nuläget utförs analys av användarbeteende i webbapplikationer primärt med hjälp av statistiska mått över användares beteenden på hemsidor tillsammans med personas förökad förståelse av olika typer av användare. Dessa metoder ger stor insikt i hur användare använder hemsidor men ger ingen information om vilka typer av aktiviteter användare har utfört på hemsidan. Denna rapport försöker skapa metoder för analys av användaraktiviter på hemsidor endast baserat på blickdata fångade med eye trackers. Blick data från 25 personer har samlats in under tiden de utför olika uppgifter på olika hemsidor. Två olika tekniker har utvärderats där den ena analyserar blick kartor som fångat ögonens rörelser under 10 sekunder och den andra tekniken använder sig av sekvenser av händelser för att klassificera aktiviteter. Resultaten indikerar att det går att urskilja olika typer av vanligt förekommande användaraktiviteter genom analys av blick data. Resultatet visar också att det är stor osäkerhet i prediktionerna och ytterligare arbete är nödvändigt för att finna användbara modeller.

One problem that has been plaguing software development is the multitude of platforms that are available to users. Consequentially, a company needs to provide its service on multiple devices, running different operating systems, in order to reach as many end-users as possible. This leads to increased development complexity and costs. To solve this issue, multiple cross-platform solutions have been proposed throughout the years. One such solution is Progressive Web Application, a set of techniques that aim to create web applications with features that have traditionally only been available to native applications. In recent years WebAssembly, a compilation target that allows languages other than JavaScript to run on the browser, has been introduced. With its compact binary format and compiled nature, its goal is to bring speed and performance enhancement to web applications. This thesis analyzes WebAssembly in the context of building a Progressive Web Application, particularly the impacts it has on the performance and memory usage. A comparison is made with the JavaScript library ReactJS. The results indicate that a Progressive Web Application built with WebAssembly achieves similar performance results as one built using ReactJS when it comes to computers, but performs worse on mobile platforms. The results also indicate that using a programming language such as Rust, although still introducing memory overhead, minimizes the bundle size and runtime memory consumption of the application. / Ett problem som har plågat mjukvaruutveckling är mängdenplattformar som är tillgängliga för användare. Följaktligen måste ett företagtillhandahålla sin tjänst på flera enheter, som kör olika operativsystem,för att nå så många slutanvändare som möjligt. Detta leder till ökadutvecklingskomplexitet och kostnad. För att lösa detta problem har flera plattformsoberoendelösningar föreslagits genom åren. En sådan lösning är Progressiva Webapplikationer, en samling tekniker som syftar till att skapa webbapplikationer med funktioner som traditionellt bara varit tillgängliga förmobilapplikationer. Under de senaste åren har ett verktyg som ger andra språk än JavaScript möjligheten att köras i webbläsaren introducerats. Detta verktyg är WebAssembly. Med sitt kompakta format och kompilerade natur, har den som mål att förbättra prestanda för webbapplikationer. Detta arbete analyserar WebAssembly i samband med utvecklingen av en Progressiv Webapplikation, specifikt inverkan den har på prestanda och minnesanvändning. En jämförelse görs med JavaScriptbiblioteket ReactJS. Resultaten tyder på att en Progressiv Webapplikation byggd med WebAssembly uppnår liknanderesultat som en byggd med ReactJS när det kommer till datorer, men presterar sämre på mobila plattformar. Resultaten visar också att användningen av ett programmeringsspråk som Rust minimerar paketstorleken och minnesanvändningen av applikationer även om det fortfarande introducerar minneskostnader.

Background. Web applications are a more significant part of our digital experience, and the number of users keeps continuously growing. Social media alone accounts for more than half of the world’s population. Therefore these applications have become a lucrative target for attackers, and we have seen several attacks against them. One such example saw attackers manage to compromise a twitter account [15], leading to false information being published, causing the New York stock exchange to drop 150 points, erasing 136 billion dollars in equity market value. There are methods to protect web applications, such as web application firewalls or content security policies. Still, another candidate for defending these applications is Host-based Intrusion Detection Systems (HIDS). This study aims to assess the efficiency of these HIDS when defending against web applications. Objectives. The main objective of the thesis is to create an efficiency evaluating model for a HIDS when protecting web applications. Additionally, we will test two open-source HIDS against web applications built to emulate a vulnerable environment and measure these HIDS efficiencies with the model mentioned above. Methods. To reach the objectives of our thesis, a literature review regarding what metrics to evaluate the efficiency of a HIDS was conducted. This allowed us to construct a model for which we evaluated the efficiency of our selected HIDS. In this model, we use 3 categories, each containing multiple metrics. Once completed, the environment hosting our vulnerable applications and their HIDS was set up, followed by the attacks of the applications. The data generated by the HIDS gave us the data required to make our efficiency evaluation which was performed through the lens of the previously mentioned model. Results. The result shows a low overall efficiency from the two HIDS when regarding the category attack detection. The most efficient of the two could be determined. Of the two evaluated, Wazuh and Samhain; we determined Wazuh to be the more efficient HIDS. We identified several components required to improve their attack detection. Conclusions. Through the use of our model, we concluded that the HIDS Wazuh had higher efficiency than the HIDS Samhain. However both HIDS had low performances regarding their ability to detect attacks. Some specific components need to be implemented within these systems before they can reliably be used for defending web applications.

No description available.

Mobile applications can be developed using a variety of different techniques and technologies. One of the most recent of these techniques is the Progressive Web Application (PWA), a cross-platform solution that is built exclusively using common web technologies. The technique has great potential to become a major competitor to native applications but is currently held back by a few rather significant limitations. This project was initiated because of a significant lack of academic research on the topic of PWA, and a perceived poor level of knowledge in the industry about the technique. The goal of the project was to determine if PWA deserved broader utilization or if the current low level of adoption was justified. During the project, two surveys were conducted. The first survey asked mobile application developers from companies in different countries about things such as their knowledge of, experience with, and opinions of PWA. The second survey asked similar questions but was instead answered by lecturers in higher education in Sweden only. The results of this project show that the average level of knowledge of PWAis very low and that developers’ opinions of the technique are quite negative. The limitations of PWA were found to be few but crippling to its potential to achieve widespread adoption.

Detta examensarbete tar upp digitala hot mot webbapplikationer och kategoriserar allmänhetens uppfattning om dem. Digitala hot är oftast kopplade till ekonomiska konsekvenser varvid även dessa kommer att studeras. Målet med detta arbete är att bidra till en vetenskaplig artikel i framtiden, som kan vara värdefull för allmänheten, samt för framtida arbete och sysselsättning. För att analysera samlade uppfattningar användes konstant jämförande metoden. Resultatet avslöjar flera spännande fynd för teori och praktik, där uppfattningar om cybervärlden presenteras för att kunna förstå mer hur andra ser på cybersäkerhet idag. Det visar även betydande variationer bland deltagarnas uppfattningar och att informationssäkerhet, även om den gradvis utvecklas, har en lång väg tills den blir en obruten del av affärsverksamheten och arbetskraftens verklighet.  Denna studie kan även fungera som en guide för de olika uppfattningarna om cyberattacker eftersom den ger en översikt över de idag mest relevanta cyberattackerna. Arbetet kompletterades med en studie som belyser ekonomiska konsekvenser av cyberattacker. Utöver detta studerades även cyberattacken mot Coop under sommaren 2021. / This thesis presents a categorization of conceptions about digital threats on web applications with a study showing the economic consequences of cyber-attacks. The aim of this thesis is to contribute to a scientific article, which can be valuable to the public, as well as for future work and employment. Constant comparison method was used to analyse aggregate perceptions. The results reveal several exciting findings for theory and practice, where perceptions of the cyber world were presented in order to understand more how others see cybersecurity today. It also shows significant variations among the participants' perceptions. This shows that information security, even if it is gradually developed, has a long way to go until it becomes an unbroken part of the business.  This study can also serve as a guide for the different perceptions of cyber-attacks as it provides an overview of the most relevant cyber-attacks today. This thesis was supplemented with a study that highlights the economic consequences of cyberattacks. In addition to this, the cyber-attack on Coop during the summer of 2021 was also studied.

The demand for higher education has increased dramatically in the last decade. At the same time, institutions have faced continual pressure to reduce costs and increase quality of education, while delivering that education to greater numbers of students. The introduction of software systems such as virtual learning environments, online learning resources and centralised student record systems has become routine in attempts to address these demands. However, these approaches suffer from a variety of limitations: They do not take all stakeholders' needs into account. They do not seek to reduce administrative overheads in academic processes. They do not reflect institution-specific academic policies. They do not integrate readily with other information systems. They are not capable of adequately modelling the complex authorisation roles and organisational structure of a real institution. They are not well suited to rapidly changing policies and requirements. Their implementation is not informed by sound software engineering practises or data architecture design. Crucially, as a consequence of these drawbacks such systems can increase administrative workload for academic staff. This thesis describes the research, development and deployment of a system which seeks to address these limitations, the Module Management System (MMS). MMS is a collaborative web application targeted at streamlining and minimising administrative tasks. MMS encapsulates a number of user-facing tools for tasks including coursework submission and marking, tutorial attendance tracking, exam mark recording and final grade calculation. These tools are supported by a framework which acts as a form of “university operating system”. This framework provides a number of different services including an institution abstraction layer, role-based views and privileges, security policy support integration with external systems.

Avec le développement croissant d’Internet, les applications Web sont devenues de plus en plus vulnérables et exposées à des attaques malveillantes pouvant porter atteinte à des propriétés essentielles telles que la confidentialité, l’intégrité ou la disponibilité des systèmes d’information. Pour faire face à ces malveillances, il est nécessaire de développer des mécanismes de protection et de test (pare-feu, système de détection d’intrusion, scanner Web, etc.) qui soient efficaces. La question qui se pose est comment évaluer l’efficacité de tels mécanismes et quels moyens peut-on mettre en oeuvre pour analyser leur capacité à détecter correctement des attaques contre les applications web.Dans cette thèse nous proposons une nouvelle méthode, basée sur des techniques de clustering de pages Web, qui permet d’identifier les vulnérabilités à partir de l’analyse selon une approche boîte noire de l’application cible. Chaque vulnérabilité identifiée est réellement exploitée ce qui permet de s’assurer que la vulnérabilité identifiée ne correspond pas à un faux positif. L’approche proposée permet également de mettre en évidence différents scénarios d’attaque potentiels incluant l’exploitation de plusieurs vulnérabilités successives en tenant compte explicitement des dépendances entre les vulnérabilités.Nous nous sommes intéressés plus particulièrement aux vulnérabilités de type injection de code, par exemple les injections SQL. Cette méthode s’est concrétisée par la mise en oeuvre d’un nouveau scanner de vulnérabilités et a été validée expérimentalement sur plusieurs exemples d’applications vulnérables. Nous avons aussi développé une plateforme expérimentale intégrant le nouveau scanner de vulnérabilités, qui est destinée à évaluer l’efficacité de systèmes de détection d’intrusions pour des applications Web dans un contexte qui soit représentatif des menaces auxquelles ces applications seront confrontées en opération. Cette plateforme intègre plusieurs outils qui ont été conçus pour automatiser le plus possible les campagnes d’évaluation. Cette plateforme a été utilisée en particulier pour évaluer deux techniques de détection d’intrusions développées par nos partenaires dans le cadre d’un projet de coopération financé par l’ANR, le projet DALI. / With the increasing development of Internet, Web applications have become increasingly vulnerable and exposed to malicious attacks that could affect essential properties such as confidentiality, integrity or availability of information systems. To cope with these threats, it is necessary to develop efficient security protection mechanisms and testing techniques (firewall, intrusion detection system,Web scanner, etc..). The question that arises is how to evaluate the effectiveness of such mechanisms and what means can be implemented to analyze their ability to correctly detect attacks against Webapplications.This thesis presents a new methodology, based on web pages clustering, that is aimed at identifying the vulnerabilities of a Web application following a black box analysis of the target application. Each identified vulnerability is actually exploited to ensure that the identified vulnerability does not correspond to a false positive. The proposed approach can also highlight different potential attack scenarios including the exploitation of several successive vulnerabilities, taking into account explicitly the dependencies between these vulnerabilities. We have focused in particular on code injection vulnerabilities, such asSQL injections. The proposed method led to the development of a new Web vulnerability scanner and has been validated experimentally based on various vulnerable applications.We have also developed an experimental platform integrating the new web vulnerability scanner, that is aimed at assessing the effectiveness of Web applications intrusion detection systems, in a context that is representative of the threats that such applications face in operation. This platform integrates several tools that are designed to automate as much as possible the evaluation campaigns. It has been used in particular to evaluate the effectiveness of two intrusion detection techniques that have been developed by our partners of the collaborative project DALI, funded by the ANR, the French National Research Agency