Mobile applications can be developed using a variety of different techniques and technologies. One of the most recent of these techniques is the Progressive Web Application (PWA), a cross-platform solution that is built exclusively using common web technologies. The technique has great potential to become a major competitor to native applications but is currently held back by a few rather significant limitations. This project was initiated because of a significant lack of academic research on the topic of PWA, and a perceived poor level of knowledge in the industry about the technique. The goal of the project was to determine if PWA deserved broader utilization or if the current low level of adoption was justified. During the project, two surveys were conducted. The first survey asked mobile application developers from companies in different countries about things such as their knowledge of, experience with, and opinions of PWA. The second survey asked similar questions but was instead answered by lecturers in higher education in Sweden only. The results of this project show that the average level of knowledge of PWAis very low and that developers’ opinions of the technique are quite negative. The limitations of PWA were found to be few but crippling to its potential to achieve widespread adoption.

Detta examensarbete tar upp digitala hot mot webbapplikationer och kategoriserar allmänhetens uppfattning om dem. Digitala hot är oftast kopplade till ekonomiska konsekvenser varvid även dessa kommer att studeras. Målet med detta arbete är att bidra till en vetenskaplig artikel i framtiden, som kan vara värdefull för allmänheten, samt för framtida arbete och sysselsättning. För att analysera samlade uppfattningar användes konstant jämförande metoden. Resultatet avslöjar flera spännande fynd för teori och praktik, där uppfattningar om cybervärlden presenteras för att kunna förstå mer hur andra ser på cybersäkerhet idag. Det visar även betydande variationer bland deltagarnas uppfattningar och att informationssäkerhet, även om den gradvis utvecklas, har en lång väg tills den blir en obruten del av affärsverksamheten och arbetskraftens verklighet.  Denna studie kan även fungera som en guide för de olika uppfattningarna om cyberattacker eftersom den ger en översikt över de idag mest relevanta cyberattackerna. Arbetet kompletterades med en studie som belyser ekonomiska konsekvenser av cyberattacker. Utöver detta studerades även cyberattacken mot Coop under sommaren 2021. / This thesis presents a categorization of conceptions about digital threats on web applications with a study showing the economic consequences of cyber-attacks. The aim of this thesis is to contribute to a scientific article, which can be valuable to the public, as well as for future work and employment. Constant comparison method was used to analyse aggregate perceptions. The results reveal several exciting findings for theory and practice, where perceptions of the cyber world were presented in order to understand more how others see cybersecurity today. It also shows significant variations among the participants' perceptions. This shows that information security, even if it is gradually developed, has a long way to go until it becomes an unbroken part of the business.  This study can also serve as a guide for the different perceptions of cyber-attacks as it provides an overview of the most relevant cyber-attacks today. This thesis was supplemented with a study that highlights the economic consequences of cyberattacks. In addition to this, the cyber-attack on Coop during the summer of 2021 was also studied.

Computer security attacks take place due to the presence of vulnerabilities and bugs in software applications. Bugs and vulnerabilities are the result of weak software architecture and lack of standard software development practices. Despite the fact that software companies are investing millions of dollars in the research and development of software designs security risks are still at large. In some cases software applications are found to carry vulnerabilities for many years before being identified. A recent such example is the popular Heart Bleed Bug in the Open SSL/TSL. In today’s world, where new software application are continuously being developed for a varied community of users; it’s highly unlikely to have software applications running without flaws. Attackers on computer system securities exploit these vulnerabilities and bugs and cause threat to privacy without leaving any trace. The most critical vulnerabilities are those which are related to the integrity of the software applications. Because integrity is directly linked to the credibility of software application and data it contains. Here I am giving solution of maintaining web applications integrity running on RADIUM by using daikon. Daikon generates invariants, these invariants are used to maintain the integrity of the web application and also check the correct behavior of web application at run time on RADIUM architecture in case of any attack or malware. I used data invariants and program flow invariants in my solution to maintain the integrity of web-application against such attack or malware. I check the behavior of my proposed invariants at run-time using Lib-VMI/Volatility memory introspection tool. This is a novel approach and proof of concept toward maintaining web application integrity on RADIUM.

The demand for higher education has increased dramatically in the last decade. At the same time, institutions have faced continual pressure to reduce costs and increase quality of education, while delivering that education to greater numbers of students. The introduction of software systems such as virtual learning environments, online learning resources and centralised student record systems has become routine in attempts to address these demands. However, these approaches suffer from a variety of limitations: They do not take all stakeholders' needs into account. They do not seek to reduce administrative overheads in academic processes. They do not reflect institution-specific academic policies. They do not integrate readily with other information systems. They are not capable of adequately modelling the complex authorisation roles and organisational structure of a real institution. They are not well suited to rapidly changing policies and requirements. Their implementation is not informed by sound software engineering practises or data architecture design. Crucially, as a consequence of these drawbacks such systems can increase administrative workload for academic staff. This thesis describes the research, development and deployment of a system which seeks to address these limitations, the Module Management System (MMS). MMS is a collaborative web application targeted at streamlining and minimising administrative tasks. MMS encapsulates a number of user-facing tools for tasks including coursework submission and marking, tutorial attendance tracking, exam mark recording and final grade calculation. These tools are supported by a framework which acts as a form of “university operating system”. This framework provides a number of different services including an institution abstraction layer, role-based views and privileges, security policy support integration with external systems.

Avec le développement croissant d’Internet, les applications Web sont devenues de plus en plus vulnérables et exposées à des attaques malveillantes pouvant porter atteinte à des propriétés essentielles telles que la confidentialité, l’intégrité ou la disponibilité des systèmes d’information. Pour faire face à ces malveillances, il est nécessaire de développer des mécanismes de protection et de test (pare-feu, système de détection d’intrusion, scanner Web, etc.) qui soient efficaces. La question qui se pose est comment évaluer l’efficacité de tels mécanismes et quels moyens peut-on mettre en oeuvre pour analyser leur capacité à détecter correctement des attaques contre les applications web.Dans cette thèse nous proposons une nouvelle méthode, basée sur des techniques de clustering de pages Web, qui permet d’identifier les vulnérabilités à partir de l’analyse selon une approche boîte noire de l’application cible. Chaque vulnérabilité identifiée est réellement exploitée ce qui permet de s’assurer que la vulnérabilité identifiée ne correspond pas à un faux positif. L’approche proposée permet également de mettre en évidence différents scénarios d’attaque potentiels incluant l’exploitation de plusieurs vulnérabilités successives en tenant compte explicitement des dépendances entre les vulnérabilités.Nous nous sommes intéressés plus particulièrement aux vulnérabilités de type injection de code, par exemple les injections SQL. Cette méthode s’est concrétisée par la mise en oeuvre d’un nouveau scanner de vulnérabilités et a été validée expérimentalement sur plusieurs exemples d’applications vulnérables. Nous avons aussi développé une plateforme expérimentale intégrant le nouveau scanner de vulnérabilités, qui est destinée à évaluer l’efficacité de systèmes de détection d’intrusions pour des applications Web dans un contexte qui soit représentatif des menaces auxquelles ces applications seront confrontées en opération. Cette plateforme intègre plusieurs outils qui ont été conçus pour automatiser le plus possible les campagnes d’évaluation. Cette plateforme a été utilisée en particulier pour évaluer deux techniques de détection d’intrusions développées par nos partenaires dans le cadre d’un projet de coopération financé par l’ANR, le projet DALI. / With the increasing development of Internet, Web applications have become increasingly vulnerable and exposed to malicious attacks that could affect essential properties such as confidentiality, integrity or availability of information systems. To cope with these threats, it is necessary to develop efficient security protection mechanisms and testing techniques (firewall, intrusion detection system,Web scanner, etc..). The question that arises is how to evaluate the effectiveness of such mechanisms and what means can be implemented to analyze their ability to correctly detect attacks against Webapplications.This thesis presents a new methodology, based on web pages clustering, that is aimed at identifying the vulnerabilities of a Web application following a black box analysis of the target application. Each identified vulnerability is actually exploited to ensure that the identified vulnerability does not correspond to a false positive. The proposed approach can also highlight different potential attack scenarios including the exploitation of several successive vulnerabilities, taking into account explicitly the dependencies between these vulnerabilities. We have focused in particular on code injection vulnerabilities, such asSQL injections. The proposed method led to the development of a new Web vulnerability scanner and has been validated experimentally based on various vulnerable applications.We have also developed an experimental platform integrating the new web vulnerability scanner, that is aimed at assessing the effectiveness of Web applications intrusion detection systems, in a context that is representative of the threats that such applications face in operation. This platform integrates several tools that are designed to automate as much as possible the evaluation campaigns. It has been used in particular to evaluate the effectiveness of two intrusion detection techniques that have been developed by our partners of the collaborative project DALI, funded by the ANR, the French National Research Agency

Este trabalho faz parte de um projeto maior, o electronic Physician Annotation Device (ePAD). O ePAD permite a criação de uma base de conhecimento médico usando anotações semânticas sobre lesões em imagens radiológicas, usando uma plataforma Web. Essas anotações servirão para identificar, acompanhar e reason sobre lesões tumorais em pesquisas médicas (especialmente sobre câncer). A informação adquirida e persistida pelo sistema permite avaliação automática por computadores; recuperação de imagens hospitalares e outros serviços relacionados a exames médicos. O ePAD é um desenvolvimento conjunto de grupos de pesquisas do ICMC-USP e do Department of Radiology da Stanford University. O principal trabalho, apresentado neste texto, é um novo conjunto de funcionalidades na Web para adicionar a marcação de lesões em imagens radiológicas em três dimensões ao ePAD. Elas permitirão a obtenção de dados mais precisos acerca de medidas tridimensionais de lesões como volume, posição e cálculo de maior diâmetro. O objetivo é facilitar o trabalho dos profissionais de radiologia na análise de diagnósticos e acompanhamento de lesões produzindo um acompanhamento mais acurado da evolução de doenças como o câncer. Anotações podem ser conectadas a lesões e conter informações semânticas, usando termos biomédicos da ontologia RadLex. Essas novas funcionalidades são baseadas em HTML5, com o auxílio de WebGL para visualização e manipulação de objetos 3D. As maiores contribuições deste trabalho são o software para visualização de séries de imagens radiológicas em 3D usando planos ortogonais, os protótipos de vídeo mostrando as três possíveis interfaces para marcação de lesões em 3D, a pesquisa com radiologistas (usando os protótipos de vídeo) para determinar que o cursor esférico era a melhor interface para marcar lesões em 3D e o protótipo dessa interface no ePAD. Este trabalho contou com a ajuda de usuários do Department. of Radiology da Stanford University e do Hospital das Clínicas da Universidade de São Paulo em Ribeirão Preto. / This work is part of a larger project, the electronic Physician Annotation Device (ePAD) project. The ePAD allows the creation of a medical knowledge base using semantic annotation on lesions found on radiological images using the Web platform. The annotation will serve to identify, follow-up and reason about tumor lesions in medical research projects (specially about cancer). The information acquired and persisted by the system allows automatic evaluation by computers; retrieval of hospital images and other services related to medical exams. ePAD is a joint development of the ICMC-USP and the Department of Radiology of the Stanford University research groups. The main work, presented here, is a new set of functionalities on the Web to add recording of lesions on radiological images in three dimensions to ePAD. They will lead to more accurate data about three dimensional lesion measurements, such as volume, position and longest diameter calculations. The objective is to ease the work of radiology professionals doing diagnostic analysis and lesion tracking producing more accurate follow-ups of disease evolution, such as of cancer. Annotation can be attached to lesions and hold semantic information, using biomedical ontology terms from RadLex. These new functionalities are based on HTML5 with the help of WebGL for visualization and manipulation of 3D objects. The main contributions of this work are the software for visualization of radiological image series in 3D using orthogonal planes, the video prototypes showing the three possible interfaces to mark lesions in 3D, the survey with radiologists (using the video prototypes) to determine that the spherical cursor was the best interface to mark lesions in 3D and the prototype of this interface in ePAD. This work received help from users of the Department of Radiology of the Stanford University and the Clinics Hospital of Ribeirão Preto of the University of São Paulo.

[pt] Essa dissertação propõe um modelo para o desenvolvimento de aplicações hipermídia na Web Semântica estendendo o método SHDM (Semantic Hypermedia Design Method), e apresenta uma arquitetura de implementação deste modelo. Na extensão proposta, as aplicações são visões navegacionais especificadas sobre modelos conceituais definidos por quaisquer ontologias da Web Semântica. As classes navegacionais são caracterizadas por um padrão para recuperação de dados da ontologia conceitual a partir de um recurso específico, podendo incorporar regras para filtragem de instâncias. Estruturas de acesso passam a se distinguir quanto à origem de seus dados, podendo ser arbitrárias, derivadas de consultas, derivadas de contextos ou facetadas. Elos especializam um relacionamento com base nos tipos de sua origem e destino, e podem ser definidos a partir de uma composição de relacionamentos conceituais. A especificação do modelo navegacional é dada através de um vocabulário definido como uma ontologia, tornando-a independente do ambiente de inferência e consulta empregado em qualquer implementação do modelo. Os modelos propostos são utilizados como dados para a geração de aplicações, com suporte na arquitetura de implementação definida e implementada. / [en] This dissertation proposes a development model for hypermedia applications on the Semantic Web extending the Semantic Hypermedia Design Method (SHDM), and presents an implementation architecture for this model. In the proposed extension applications are seen as navigational views over conceptual models defined by any Semantic Web ontology. Navigational classes are characterized by a retrieval pattern of conceptual ontology data from a specific resource, and can also incorporate rules for instances filtering. Access structures are now distinguished by their data source, and are categorized as arbitrary, query based, context based or faceted. Links specialize conceptual relationships based on the data types of its origin and destination, and can also map relationship compositions. A vocabulary defined as an ontology is used for the specification of the navigational model, making it independent from the query and inference environment used by any implementation of the model. The implementation architecture specified and implemented generates applications directly from the data contained in the proposed models.

[pt] Essa dissertação propõe um modelo de processamento da informação baseado em conjuntos, que pode ser visto como uma generalização do modelo de grafos clássico para hipertextos. Este modelo pressupõe um modelo semântico de um domínio de aplicação, e a partir deste são definidos conjuntos de objetos. Tarefas de processamento da informação que os usuários devem executar, com apoio da aplicação, são descritas como composições funcionais de operações realizadas sobre os itens de informação e sobre os conjuntos definidos. Este tipo de modelo permite a construção de aplicações com interfaces de manipulação direta sobre os itens e conjuntos, e inclui, entre outras, as interfaces de navegação facetada, atualmente, encontradas na Web. Neste tipo de interface, o usuário constrói a composição funcional que representa a computação desejada de forma incremental, através da manipulação direta de elementos na interface. Esta dissertação especifica este modelo, e apresenta uma implementação no ambiente .Net. Além da definição dos itens e conjuntos, é também gerada uma Linguagem Específica de Domínio (Domain Specific Language, DSL) que permite a expressão direta das operações sobre itens e conjuntos. O modelo proposto, e sua implementação, é integrado a um framework para geração de interfaces para manipulação direta de conjuntos, objeto de outra dissertação. É apresentado um estudo de caso, utilizando o modelo, a sua implementação e a integração com a interface, ilustrando como a abordagem facilita diversos tipos de tarefas comumente realizadas por usuários de aplicações Web. / [en] This dissertation proposes an information processing model based on sets that can be seen as a generalization of the classic model of graphs for hypertexts. This model estimates a semantic model of an application domain, and the sets of objects are defined from this. Information processing tasks that the users should execute, with support of the application, are described as functional compositions of operations applied over the information items and over the defined sets. This model type allows the application construction with interfaces of direct manipulation on items and sets, and includes, among others, the faceted navigation interfaces that are currently found in the Web. In this type of interface, the user builds the functional composition that represents the desired computation in the incremental form, through the direct manipulation of elements in the interface.This dissertation specifies this model, and presents an implementation in the .Net environment. Beyond the definition of items and sets, it generates a Domain Specific Language (DSL) that allows the direct expression of operations on items and sets. The proposed model, and its implementation, is integrated with a framework for generating direct manipulation interfaces on sets, that is the focus of another dissertation. A study case is presented, using the model, its implementation and the integration with the interface, illustrating how the approach facilitates different types of tasks that are frequently executed by Web application users.

Este trabalho faz parte de um projeto maior, o electronic Physician Annotation Device (ePAD). O ePAD permite a criação de uma base de conhecimento médico usando anotações semânticas sobre lesões em imagens radiológicas, usando uma plataforma Web. Essas anotações servirão para identificar, acompanhar e reason sobre lesões tumorais em pesquisas médicas (especialmente sobre câncer). A informação adquirida e persistida pelo sistema permite avaliação automática por computadores; recuperação de imagens hospitalares e outros serviços relacionados a exames médicos. O ePAD é um desenvolvimento conjunto de grupos de pesquisas do ICMC-USP e do Department of Radiology da Stanford University. O principal trabalho, apresentado neste texto, é um novo conjunto de funcionalidades na Web para adicionar a marcação de lesões em imagens radiológicas em três dimensões ao ePAD. Elas permitirão a obtenção de dados mais precisos acerca de medidas tridimensionais de lesões como volume, posição e cálculo de maior diâmetro. O objetivo é facilitar o trabalho dos profissionais de radiologia na análise de diagnósticos e acompanhamento de lesões produzindo um acompanhamento mais acurado da evolução de doenças como o câncer. Anotações podem ser conectadas a lesões e conter informações semânticas, usando termos biomédicos da ontologia RadLex. Essas novas funcionalidades são baseadas em HTML5, com o auxílio de WebGL para visualização e manipulação de objetos 3D. As maiores contribuições deste trabalho são o software para visualização de séries de imagens radiológicas em 3D usando planos ortogonais, os protótipos de vídeo mostrando as três possíveis interfaces para marcação de lesões em 3D, a pesquisa com radiologistas (usando os protótipos de vídeo) para determinar que o cursor esférico era a melhor interface para marcar lesões em 3D e o protótipo dessa interface no ePAD. Este trabalho contou com a ajuda de usuários do Department. of Radiology da Stanford University e do Hospital das Clínicas da Universidade de São Paulo em Ribeirão Preto. / This work is part of a larger project, the electronic Physician Annotation Device (ePAD) project. The ePAD allows the creation of a medical knowledge base using semantic annotation on lesions found on radiological images using the Web platform. The annotation will serve to identify, follow-up and reason about tumor lesions in medical research projects (specially about cancer). The information acquired and persisted by the system allows automatic evaluation by computers; retrieval of hospital images and other services related to medical exams. ePAD is a joint development of the ICMC-USP and the Department of Radiology of the Stanford University research groups. The main work, presented here, is a new set of functionalities on the Web to add recording of lesions on radiological images in three dimensions to ePAD. They will lead to more accurate data about three dimensional lesion measurements, such as volume, position and longest diameter calculations. The objective is to ease the work of radiology professionals doing diagnostic analysis and lesion tracking producing more accurate follow-ups of disease evolution, such as of cancer. Annotation can be attached to lesions and hold semantic information, using biomedical ontology terms from RadLex. These new functionalities are based on HTML5 with the help of WebGL for visualization and manipulation of 3D objects. The main contributions of this work are the software for visualization of radiological image series in 3D using orthogonal planes, the video prototypes showing the three possible interfaces to mark lesions in 3D, the survey with radiologists (using the video prototypes) to determine that the spherical cursor was the best interface to mark lesions in 3D and the prototype of this interface in ePAD. This work received help from users of the Department of Radiology of the Stanford University and the Clinics Hospital of Ribeirão Preto of the University of São Paulo.

Web applications offering real-time collaboration support (e.g. Google Docs) allow geographically dispersed users to edit the very same document simultaneously, which is appealing to end-users mainly because of two application characteristics. On the one hand, provided real-time capabilities supersede traditional document merging and document locking techniques that distract users from the content creation process. On the other hand, web applications free end-users from lengthy setup procedures and allow for instant application access. However, implementing collaborative web applications is a time-consuming and complex endeavor since offering real-time collaboration support requires two specific collaboration services. First, a concurrency control service has to ensure that documents are synchronized in real-time and that emerging editing conicts (e.g. if two users change the very same word concurrently) are resolved automatically. Second, a workspace awareness service has to inform the local user about actions and activities of other participants (e.g. who joined the session or where are other participants working). Implementing and integrating these two collaboration services is largely ine cient due to (1) the lack of necessary collaboration functionality in existing libraries, (2) incompatibilities of collaboration frameworks with widespread web development approaches as well as (3) the need for massive source code changes to anchor collaboration support. Therefore, we propose a Generic Collaboration Infrastructure (GCI) that supports the e cient development of web-based groupware in various ways. First, the GCI provides reusable concurrency control functionality and generic workspace awareness support. Second, the GCI exposes numerous interfaces to consume these collaboration services in a exible manner and without requiring invasive source code changes. And third, the GCI is linked to a development methodology that e ciently guides developers through the development of web-based groupware. To demonstrate the improved development e ciency induced by the GCI, we conducted three user studies encompassing developers and end-users. We show that the development e ciency can be increased in terms of development time when adopting the GCI. Moreover, we also demonstrate that implemented collaborative web applications satisfy end-user needs with respect to established software quality characteristics (e.g. usability, reliability, etc.). / Webbasierte, kollaborative Echtzeitanwendungen (z.B. Google Docs) erlauben es geografisch verteilten Nutzern, Dokumente gemeinschaftlich und simultan zu bearbeiten. Die Implementierung kollaborativer Echtzeitanwendungen ist allerdings aufwendig und komplex, da einerseits eine Nebenläufigkeitskontrolle von Nöten ist und andererseits die Nachvollziehbarkeit von nicht-lokalen Interaktionen mit dem gemeinsamen virtuellen Arbeitsraum gewährleistet sein muss (z.B. wer editiert wo). Um die Entwicklung kollaborativer Echtzeitanwendungen effizient zu gestalten, wurde eine Generische Kollaborationsinfrastruktur (GKI) entwickelt. Diese GKI stellt sowohl eine Nebenläufigkeitskontrolle als auch Komponenten zur Nachvollziehbarkeit von nicht-lokalen Interaktionen auf eine wiederverwendbare und nicht-invasive Art und Weise zur Verfügung. In drei dedizierten Studien, die sowohl Entwickler als auch Endanwender umfassten, wurde die Entwicklungseffizienz der GKI nachgewiesen. Dabei wurde die Entwicklungszeit, der Umfang des Quelltextes als auch die Gebrauchstauglichkeit analysiert.