There are many possible tools to develop mobile applications with. Choosing a development tool is done by considering many different factors, and the choice is currently done, in many cases, arbitrarily. For this project, a decision model is designed to ease the process of choosing a development tool. A survey was conducted to examine how people using different smartphone platforms discover and download applications. 94 responses were collected, showing that approximately 50% of Android-users found mobile applications by using search engines or browsers. The corresponding number was approximately 30% for iOS-users. A usability test was conducted to discover the differences in user experience between Progressive Web Applications and native applications. 18 usability tests were conducted comparing the same product developed as a Progressive Web Application and a native application. A majority of the participants had a technical background. Both Android and iOS devices were included in the tests. The results indicated that end-users notice when an application is not natively developed. The effect on the user experience is combined with other technical differences and applied to the decision model. This model was designed to predict if a native application, a Progressive Web Application or a React Native application is the most favourable to develop for a specific scenario. The final model could, according to consultants at the stakeholder Slagkryssaren AB, with good accuracy predict when the different development tools should be used. The model could be used as a discussion tool in the first stages of the development process of an application. / Det finns många möjliga verktyg för att utveckla mobila applikationer. Valet av utvecklingsverktyg görs genom att överväga många olika faktorer, och görs idag i många fall högst godtyckligt. För det här projektet designades en beslutsmodell som förenklar processen av att välja ett utecklingsverktyg. En undersökning gjordes för att undersöka hur användare av olika smartphone- plattformar upptäcker och laddar ner applikationer. 94 svar samlades, svaren visade att ungefär 50% av Android-användare hittade mobila applikationer genom internetsökningar eller webbläsare. Denna siffran var ungefär 30% för iOS-användare. Ett användarbarhetstest utfördes för att finna skillnader i användarupplevelse mellan progressiva webbapplikationer och native-applikationer. En majoritet av deltagarna hade en teknisk bakgrund. Både Android- och iOS-enheter testades. Resultatet tydde på att slutanvändare la märke till när en applikation inte utvecklades som en native-applikation. Effekten på användarvänligheten, kombinerat med tekniska skillnader mellan verktygen, tillämpades på beslutsmodellen. Modellen designades för att förutse om en native-applikation, en progressiva webbapplikation eller en React Native- applikation är mest fördelaktig att utveckla i ett specifikt scenario. Den slutgiltiga modellen kunde, enligt konsulter på uppdragsgivaren Slagkryssaren AB, med god precision avgöra när de olika utvecklingsverktygen bör nyttjas. Modellens användning blev som ett diskussionsverktyg i de första stadierna av processen med att välja utvecklingsvektyg.

Broken Access Control is the most serious web application security risk as published by Open Worldwide Application Security Project (OWASP). This category has highly complex vulnerabilities such as Broken Object Level Authorization (BOLA) and Exposure of Sensitive Information. Finding such critical vulnerabilities in large software systems requires intelligent and automated tools. State-of-the-art (SOTA) research including hybrid application security testing tools, algorithmic brute forcers, and artificial intelligence has shown great promise in detection. Nevertheless, there exists a gap in research for reliably identifying logical and context-dependant Broken Access Control vulnerabilities. We modeled the problem as text classification and proposed KARTAL, a novel method for web application vulnerability detection using a Large Language Model (LLM). It consists of 3 components: Fuzzer, Prompter, and Detector. The Fuzzer is responsible for methodically collecting application behavior. The Prompter processes the data from the Fuzzer and formulates a prompt. Finally, the Detector uses an LLM which we have finetuned for detecting vulnerabilities. In the study, we investigate the performance, key factors, and limitations of the proposed method. Our research reveals the need for a labeled Broken Access Control vulnerability dataset in the cybersecurity field. Thus, we custom-generate our own dataset using an auto-regressive LLM with SOTA few-shot prompting techniques. We experiment with finetuning 3 types of decoder-only pre-trained transformers for detecting 2 sophisticated vulnerabilities. Our best model attained an accuracy of 87.19%, with an F1 score of 0.82. By using hardware acceleration on a consumer-grade laptop, our fastest model can make up to 539 predictions per second. The experiments on varying the training sample size demonstrated the great learning capabilities of our model. Every 400 samples added to training resulted in an average MCC score improvement of 19.58%. Furthermore, the dynamic properties of KARTAL enable inferencetime adaption to the application domain, resulting in reduced false positives. / Brutet åtkomstkontroll är den allvarligaste säkerhetsrisken för webbapplikationer enligt Open Worldwide Application Security Project (OWASP). Denna kategori har mycket komplexa sårbarheter såsom Brutet behörighetskontroll på objektnivå (BOLA) och exponering av känslig information. Att hitta sådana kritiska sårbarheter i stora programvarusystem kräver intelligenta och automatiserade verktyg. Senaste tekniken (SOTA)-forskning, inklusive hybridverktyg för säkerhetstestning av applikationer, algoritmiska bruteforcers och artificiell intelligens, har visat stor potential för upptäckt. Trots detta finns det en lucka i forskningen när det gäller tillförlitlig identifiering av logiska och kontextberoende sårbarheter relaterade till Brutet åtkomstkontroll. Vi modellerade problemet som textklassificering och föreslog KARTAL, en ny metod för att upptäcka sårbarheter i webbapplikationer med hjälp av en stor språkmodell (LLM). Den består av 3 komponenter: Fuzzer, Prompter och Detector. Fuzzer ansvarar för att systematiskt samla in applikationsbeteende. Prompter bearbetar data från Fuzzer och formulerar en förfrågan. Slutligen använder Detector en LLM som vi har finjusterat för att upptäcka sårbarheter. I studien undersöker vi prestanda, nyckelfaktorer och begränsningar hos den föreslagna metoden. Vår forskning visar behovet av en märkt dataset för sårbarheter relaterade till Brutet åtkomstkontroll inom cybersäkerhetsområdet. Därför genererar vi anpassade dataset med hjälp av en auto-regressiv LLM med SOTA few-shot-prompting-tekniker. Vi experimenterar med att finjustera 3 typer av endast avkodare transformers som är förtränade för att upptäcka 2 sofistikerade sårbarheter. Vår bästa modell uppnådde en noggrannhet på 87.19% med en F1-poäng på 0.82. Genom att använda hårdvaruacceleration på en bärbar dator för konsumenter kan vår snabbaste modell göra upp till 539 förutsägelser per sekund. Experimenten med varierande storlek på träningsprovet visade på vår modells stora förmåga att lära sig. Varje 400 prover som lades till träningen resulterade i en genomsnittlig förbättring av MCC-poängen med 19.58%. Dessutom möjliggör de dynamiska egenskaperna hos KARTAL anpassning vid inferringstid till applikationsdomänen, vilket resulterar i färre falska positiva resultat.

Skogsbränder är kraftfulla naturfenomen kapabla att åstakomma omfattande skada över stora ytor och medföra omfattande kostnader för sammhället både humanitärt, ekonomiskt och miljömässigt. Det finns därför ett starkt incitament att övervaka och förutspå skogsbränders utveckling och spridning. Traditionellt används kraftfulla skrivbordsklienter för att köra den simulerings-mjukvara som förutspår skogsbränder, vilket begränsar användningsområdet för simuleringar. Webbklienter är naturligt mobila och lättanvända. Genom att flytta bearbetningen till en server överförs majoriteten av arbetet från klienten. Det här projektet utvecklar ett server-klient baserat ramverk för att simulera skogsbränder, visualisera resultatet och hantera data för användning i skogsbrandsbekämpnings och -analys arbetsflöde. Både parametrarna som skickas till servern och simuleringsresultatet som returneras till klienten. Ramverket använder en kombination av HTTPS-kommunikation och websocket-teknologi för att kommunicera data mellan klienten och server i real-time genom Django-ramverket. Brandmodellen på den Kanadensiska empiriska brandmodellen Prometheus som är implementerad i programmeringsspråket Python. Det är optimerat för det svenska klimated för att enkelt kunnas fältsättas i en webbapplikation för svenska myndigheter. Webb-applikationen är tillgänglig genom mobila och stationära enheter där ramverket beräknar och visualiserar förutspådd fortspridning av skogsbrand i realtid. Skogsbrands moduleringsmodellen av applikationen är jämförd med skogsbränderna i Enskogen och Ängra närastaden Kårböle under sommaren 2018. Noggrannhetsbedömningen av modellen påvisar att den simulerade branden tenderar att innehålla den egentliga elden men är benägen att överskatta eldspridningen. Applikationen utvärderades även genom ett formulär om applikationens funktionallitet som skickades till en provgrupp av personer som arbetar med skogsbränder eller annat relevant område. Provgruppen var nöjd med applikationen och såg ett anvädningsområde för applikationen i sitt arbetsflöde. Mycket arbete återstår för att göra applikationen fältduglig genom integration av myndigheters datatjänster och andra databaser som innehåller riskobjekt, byggnader, kraftledningar e.g. Trots detta ansågs brandingejörer inom räddningstjänster en möjlighet att använda verktygen i dess nuvarande tillstånd om simuleringsresultatet anses korrekt nog för att fungera som underlag för beslut. Detta understryker behovet av en liknande applikation, med vidare funktionalitet och integration med data-system. / Wildfires are powerful natural forces capable of causing extensive damage to large areas of lands and induce a high societal cost in both humanitarian, economic and environmental terms. As such there is a strong incentive to track and predict wildfires' development and spread. Traditionally heavy desktop clients are required to run the simulation-software required to perform wildfire spread predictions, which limits their use and versatility. Conversely, web-based clients are lightweight and versatile by design. By moving the processing of the simulation to a server the bulk of the workload is removed from the client. This project aims to produce a server-client framework for simulating wildfires, visualising the result and handling the fire data for use in the workflow of wildfire suppression and analysis. Both the parameters sent to the server and the simulation result returned to the client. It utilises a combination of HTTPS-requests and websockets-technology to communicate data and information between the client and server in real-time through the Django framework. The fire simulation is based upon the Canadian empirical fire-model Prometheus. The implementation of the algorithm were adopted in the programming language python and optimized for the Swedish climate to be easily deployed in a web-application to be used by Swedish organisations. The web-application was accessible though mobile and stationary devices where the framework calculated and visualised the progression of the wildfire in real-time. The wildfire progression model of the application was compared to the wildfires Enskogen and Ängra, close to the town of Kårböle during the summer of 2018. The accuracy assessment of the fire progression model found that the simulated wildfire progression tend to contain the observed fire and prone to overestimate the wildfires progression. The application was evaluated though a questionnaire which was answered by a sample group composed of persons working with wildfires or wildfire related fields. The sample group were satisfied by the application and broadly found that the application could be implemented into their workflow.  Much work remain to operationalise the application, such as integration of municipal data sources and other databases containing resources, risk-objects, buildings, power-lines. In spite of this Fire-engineers in emergency services state a possibility for use of the application as is, if the simulations are deemed accurate enough and provide a better basis for decision making and measures. This underlines the need of an application such as this in the field, and with further functionalities and integration's with data-systems.

The subject of iterative prototyping with data is still in its infancy and problems arise when people with low programming skills aim to build a full-stack interactive web application on their own. This research attempts to evaluate how providing a framework with predefined notations and data structures can improve this process for novice developers. The work consists of an initial reimplementation of a model website and the evaluation of study participants with little experience in the frontend development field through the application of the Cognitive Dimensions and the Think-aloud methods. We have found that by eliminating the requirement of dealing with back-end queries through the offering of such a framework, the process of designing an interactive web application can be facilitated and hastened. There are, nevertheless, some improvements that can be made to further refine their programming experience. / Ämnet kring att framställa iterativa prototyper med data är fortfarande i sin begynnelse och problem uppstår när personer med låg kunskap i programmering har som mål att bygga en full-stack interaktiv webbapplikation. Denna forskning utvärderar hur utvecklingsprocessen kan förbättras för nya utvecklare genom att erbjuda ett ramverk med fördefinierade beteckningar och datastrukturer. Denna studie består av en implementerad modell av en webbapplikation samt utvärdering av studiedeltagare med begränsad erfarenhet inom front-end-utveckling. Utvärderingen gjordes genom användning av ramverket “Cognitive Dimensions” med tillhörande “Think-aloud”-metod. Resultatet visar att genom att eliminera krav för att hantera back-end-anrop har processen att designa en interaktiv webbapplikation kunnat underlättats och påskyndats med hjälp av ett ramverk. Resultatet identifierade även förbättringspunkter som kan implementeras för att vidare underlätta ramverkets programmeringsupplevelse för användare.

<p><strong>The Energy Monitoring Framework</strong>, designed and developed by IAC, IUPUI, aims to provide a cloud-based solution that combines business analytics with sensors for real-time energy management at the plant level using wireless sensor network technology.</p> <p>The project provides a platform where users can analyze the functioning of a plant using sensor data. The data would also help users to explore the energy usage trends and identify any energy leaks due to malfunctions or other environmental factors in their plant. Additionally, the users could check the machinery status in their plant and have the capability to control the equipment remotely.</p> <p>The main objectives of the project include the following:</p> <ul> <li>Set up a wireless network using sensors and smart implants with a base station/ controller.</li> <li>Deploy and connect the smart implants and sensors with the equipment in the plant that needs to be analyzed or controlled to improve their energy efficiency.</li> <li>Set up a generalized interface to collect and process the sensor data values and store the data in a database.</li> <li>Design and develop a generic database compatible with various companies irrespective of the type and size.</li> <li> Design and develop a web application with a generalized structure. Hence the database can be deployed at multiple companies with minimum customization. The web app should provide the users with a platform to interact with the data to analyze the sensor data and initiate commands to control the equipment.</li> </ul> <p>The General Structure of the project constitutes the following components:</p> <ul> <li>A wireless sensor network with a base station.</li> <li>An Edge PC, that interfaces with the sensor network to collect the sensor data and sends it out to the cloud server. The system also interfaces with the sensor network to send out command signals to control the switches/ actuators.</li> <li>A cloud that hosts a database and an API to collect and store information.</li> <li>A web application hosted in the cloud to provide an interactive platform for users to analyze the data.</li> </ul> <p>The project was demonstrated in:</p> <ul> <li>Lecture Hall (https://iac-lecture-hall.engr.iupui.edu/LectureHallFlask/).</li> <li>Test Bed (https://iac-testbed.engr.iupui.edu/testbedflask/).</li> <li>A company in Indiana.</li> </ul> <p>The above examples used sensors such as current sensors, temperature sensors, carbon dioxide sensors, and pressure sensors to set up the sensor network. The equipment was controlled using compactable switch nodes with the chosen sensor network protocol. The energy consumption details of each piece of equipment were measured over a few days. The data was validated, and the system worked as expected and helped the user to monitor, analyze and control the connected equipment remotely.</p> <p><br></p>

O design de interação é uma disciplina de design relativamente nova que pode ser compreendida como o design dos aspectos subjetivos e qualitativos de tudo o que é digital e também interativo. Já o esboço é uma prática muito comum nas disciplinas de design e consiste em um tipo de desenho feito à mão no papel para testar alternativas e comunicá-las para outros profissionais. O design de interação traz novos desafios para a prática de esboços, pois além das telas é necessário representar as ações do usuário e as modificações do sistema ao longo do tempo. Um levantamento da situação atual mostra que as técnicas que existem apresentam limitações importantes e que o assunto ainda é pouco explorado. Portanto o objetivo deste trabalho foi procurar aprimorar os esboços no design de interação, com quatro linhas de ação: analisar as especificidades da prática de esboços no design de interação para compreender as oportunidades de melhoria; desenvolver uma técnica, a ActionSketch, para buscar aproveitar estas oportunidades; verificar se a ActionSketch auxilia no processo de fazer esboços no design de interação; analisar o uso da técnica para procurar compreender como auxilia ou não o processo. Para atingir estes objetivos, adotamos o plano de ação descrito a seguir. Realizamos uma extensa revisão da literatura. Desenvolvemos propostas de técnicas e as refinamos através de iterações de exercícios e de entrevistas com profissionais. Apresentamos a ActionSketch em oficinas para grupos de profissionais da área, onde coletamos resultados do uso da técnica para em seguida analisá-los. A versão da técnica utilizada neste trabalho (v0.8) é composta por quatro partes: quadros, cores, símbolos e regras. Os quadros são uma forma para lidar com a questão temporal, as cores buscam separar as ações do usuário e do sistema, os símbolos são notações para deixar o desenho mais ágil e as regras são boas práticas para orientar o uso da técnica. Esta versão foi apresentada para 24 profissionais em quatro oficinas, seguidas de um período de uso continuado de 18 dias em média e fechado com entrevistas individuais para coletar comentários. Para atingir nosso objetivos a análise dos dados foi feita em dois níveis: um nível mais pragmático, para avaliar a adequação da técnica na sua aplicação prática, e um outro nível mais conceitual, onde pudemos investigar os aspectos mais gerais da prática de esboços, com foco no design de interação. De maneira sucinta os resultados obtidos indicam que a ActionSketch: auxilia o processo cognitivo; facilita a comunicação quando ao menos um designer conhece a técnica; pode ser modificada ou aplicada parcialmente; tem um aprendizado inicial rápido, que pode evoluir de maneira modular; é particularmente adequada para detalhes da interação. Em termos práticos a técnica se mostrou suficientemente adequada para uso e apontou possíveis melhorias. Já no aspecto teórico pudemos verificar a importância da representação da interação nos esboços, que trouxe diversos benefícios para o processo. O trabalho também aponta algumas direções futuras, como uma nova versão da ActionSketch e sua divulgação online de maneira modular e colaborativa. / Interaction design is a relatively new discipline which can be understood as the design of the subjective and qualitative aspects of everything that is both digital and interactive. Sketching is a common practice in design and consists of freehand drawings made on paper to test alternatives and communicate them to other professionals. Interaction design brings new challenges to the practice of sketches, because of the need to represent the interaction as well as the visual layout of the interface. A survey of current practices shows significant limitations and that the subject is still little explored. Therefore the aim of this work was to improve sketching in interaction design, with four lines of action: to analyze the specifics of practice in interaction design sketches to understand the opportunities for improvement; to develop a technique, called ActionSketch, to try to take advantage of these opportunities; to verify if ActionSketch improves the process of sketching in interaction design; to analyze the use of the technique to try to identify how it helps or hinders the process. To achieve these objectives, we adopted the following plan of action. We conducted an extensive literature review. We developed proposals of the technique and refined them through iterations of exercises and interviews with professionals. We then presented ActionSketch in workshops for groups of professionals, from where we collected the results. The version of the technique used in this work (v0.8) consists of four parts: frames, colors, symbols and rules. Frames are a way to deal with the question of representing time, the colors try to evidence the user and system actions, symbols are notations to improve the speed of drawing and rules are good practices that guide the use of the technique. This version was presented to 24 professionals in four workshops, followed by a period of continuous use of 18 days on average and closed with individual interviews to gather feedback. To achieve our objective data analysis was done on two levels: a more pragmatic level, to assess the adequacy of the technique in practical application, and another more conceptual level, where we investigate the more general aspects of the practice of sketches, with focus on interaction design. Briefly the results obtained indicate that ActionSketch: assists the cognitive process; facilitates communication when at least one designer knows the technique; may be modified or partially applied; has a smooth learning curve, which can evolve in a modular way; is particularly adequate for details of the interaction. In practical terms the technique seemed adequate enough for use and indicated some points for improvement. In the theoretical aspect we could verify the importance of representing the interaction in sketches, which brought many benefits to the process. The study also points to some interesting future directions, such as a new version of ActionSketch and the creation of a collaborative site for it\'s publication.

近年來隨著網路的發達，網頁應用程式也跟著快速且普遍化地發展。網頁應用程式快速盛行卻忽略程式設計時的安全性考量，進而成為網路駭客的攻擊目標。因此，網頁應用程式的安全議題日益重要。目前已有許多網頁應用程式安全弱點的相關研究，以程式分析的技術找出弱點，主要分成靜態分析與動態分析兩大類。但無論是使用靜態或是動態的分析方法，仍有其不完美的地方。其中靜態分析結果完備但會產生過多弱點誤報；動態分析結果準確率高但會因為測試案例的不完備而造成弱點的漏報。因此，本論文研究結合了動靜態分析，利用靜態分析方法發展一套測試案例產生工具；再結合動態分析方法隨著測試案例的執行來追蹤測試資料並作弱點的驗證，以達到沒有弱點漏報的產生以及改善弱點誤報的目標。 本論文研究的重點集中在以靜態分析技術產生涵蓋目標程式中所有可執行路徑的測試案例。我們應用測試案例產生常見的符號化執行技巧，利用程式的路徑限制蒐集與解決來達成測試案例產生。實作上我們利用跨程序性路徑分析找出目標程式中所有潛在弱點的路徑，再以反向路徑限制蒐集將限制資訊完整蒐集；最後交給限制分析器解限制並產生測試案例。接著利用剖面導向程式語言AspectJ的程式插碼技術實現動態的汙染資料流分析，配合產生的測試案執行程式觸發動態的汙染資料流分析並產生可信賴的弱點分析結果。 / Due to the rapid development of the internet in recent years, web applications have become very popular and ubiquitous. However, developers may neglect the issues of security while designing a program so that web applications become the targets of attackers. Hence, the issue of web application vulnerabilities has become very crucial. There have been many research results of web application security vulnerabilities and many of them exploit the technique of program analysis to detect vulnerabilities. These analysis approaches can be can basically be categorized into dynamic analysis and static analysis. However, both of them still have their own problems to be improved. Specifically static analysis supports high coverage of vulnerabilities, but causes too many false positives. As for the dynamic analysis, although it produces high confident results, yet it may cause false negatives without complete test cases. In this thesis, we integrate both static analysis and dynamic analysis to achieve the objectives that no false negatives are produced and reduce false positives. We develop a test case generation tool by the static analysis approach and a program execution tool that dynamically track the execution of the target program with those test data to detect its vulnerabilities. Our test case generation tool first employs both intra- and inter-procedural analysis to cover all vulnerable paths in a program, and then apply the symbolic execution technique to collect all path constraints. With these collected constraints, we use a constraint solver to solve them and finally generate the test cases. As to the execution tool, it utilizes the instrumentation mechanism provided by the aspect-oriented programming language AspectJ to implement a dynamic taint analysis that tracks the flow of tainted data derived from those generated test cases. As a result, all vulnerable program paths will be detected by our tools.

No description available.

In the emerging Web of Data, publishing stable and unique identifiers promises great potential in using the web as common platform to discover and enrich data in the ecologic sciences. With our collaborative e-Science platform “BEFdata”, we generated and published unique identifiers for the data repository of the Biodiversity – Ecosystem Functioning Research Unit of the German Research Foundation (BEF-China; DFG: FOR 891). We linked part of the identifiers to two external data providers, thus creating a virtual common platform including several ecological repositories. We used the Global Biodiversity Facility (GBIF) as well the International Plant Name Index (IPNI) to enrich the data from our own field observations. We conclude in discussing other potential providers for identifiers for the ecological research domain. We demonstrate the ease of making use of existing decentralized and unsupervised identifiers for a data repository, which opens new avenues to collaborative data discovery for learning, teaching, and research in ecology.

New approaches are needed to manage and analyze the enormous quantity of biological data generated by modern technologies. Existing solutions are often fragmented and uncoordinated and, thus, they require considerable bioinformatics skills from users. Three applications have been developed illustrating different strategies to help users without extensive IT knowledge to take maximum profit from their data. SNPator is an easy-to-use suite that integrates all the usual tools for genetic association studies: from initial quality control procedures to final statistical analysis. CHAVA is an interactive visual application for CNV calling from aCGH data. It presents data in a visual way that helps assessing the quality of the calling and assists in the process of optimization. Haplotype Association Pattern Analysis visually presents data from exhaustive genomic haplotype associations, so that users can recognize patterns of possible associations that cannot be detected by single-SNP tests. / Calen noves aproximacions per la gestió i anàlisi de les enormes quantitats de dades biològiques generades per les tecnologies modernes. Les solucions existents, sovint fragmentaries i descoordinades, requereixen elevats nivells de formació bioinformàtica. Hem desenvolupat tres aplicacions que il•lustren diferents estratègies per ajudar als usuaris no experts en informàtica a aprofitar al màxim les seves dades. SNPator és un paquet de fàcil us que integra les eines usades habitualment en estudis de associació genètica: des del control de qualitat fins les anàlisi estadístiques. CHAVA és una aplicació visual interactiva per a la determinació de CNVs a partir de dades aCGH. Presenta les dades visualment per ajudar a valorar la qualitat de les CNV predites i ajudar a optimitzar-la. Haplotype Pattern Analysis presenta dades d’anàlisi d’associació haplotípica de forma visual per tal que els usuaris puguin reconèixer patrons de associacions que no es possible detectar amb tests de SNPs individuals.