Dissertação (mestrado) - Universidade Federal de Santa Catarina, Centro Tecnológico. Programa de Pós -Graduação em Computação. / Made available in DSpace on 2012-10-20T07:09:31Z (GMT). No. of bitstreams: 0Bitstream added on 2014-09-26T01:46:38Z : No. of bitstreams: 1 181725.pdf: 1778200 bytes, checksum: 6ccf2b95aafafa09fb744a0ef753afe0 (MD5) / Este trabalho apresente as várias pesquisas realizadas em Lógica Fuzzy integrada ao SGBD (Sistemas Gerenciadores de Banco de Dados), expondo os métodos e práticas utilizadas para integração das duas tecnologias. Através da inclusão de uma máquina de inferência fuzzy interna ao SGBD, permite consultar dados em forma nebulosa. Este procedimento utiliza entradas e saídas convencionais, e regras definidas no modelo, possibilitando que uma consulta seja feita sem alterar os padrões estabelecidos na linguagem SQL.

Berghs Företagshotell i Ockelbo hyr bland annat ut övernattningsrum och lägenheter likt ett vandrarhem. Problemet är att de använder sig av ett enkelt ”excel-ark” och enstaka ”post-it” lappar för att hålla koll på sina bokningar och är i behov av ett bättre system. Ägaren har länge funderat på att ordna detta själv då han har gott om databas- och programmeringskunskaper, men precis som alla andra småföretagare har han tyvärr för lite tid. Av den anledningen tyckte vi att detta skulle vara ett perfekt examensarbete för oss. Vi skapar helt enkelt ett webbaserat bokningssystem med en applikation att knyta till hotellets befintliga webbplats. Till detta skapar vi även en ett administrationsgränssnitt där all hantering av bokningar och rum sker. Som databashanterare använder vi oss av MS SQL Server 2000 med lagrade procedurer och som utvecklingsmiljö väljer vi MS Visual Studio.NET 2003 vilket resulterat i ett antal ASP.NET webbformulär. Till skillnad från traditionella hotell (där de flesta rum ser likadana ut) kan man här iordningställa rum och lägenheter helt efter kundens behov. Detta beror på att hotellet ligger i en f.d. hyresfastighet med 14 lägenheter, där varje lägenhet lätt kan bli uppdelade i ett antal rum. Detta flexibla system överförde vi till datorn på så vis att man får ”bygga” och ”bygga om” lägenheterna till bokningsbara rum direkt i applikationen. Det finns också en funktion som ”döljer” rummet i databasen, vilket kan komma till nytta eftersom han även kan hyra ut rummen som kontor. Rummen blir på så vis inte bokningsbara i hotellverksamheten.

Att ha ett väl fungerande automatiskt testsystem är allt viktigare inom mjukvaruutveckling. Tyvärr är det fortfarande vanligt med företag som framförallt förlitar sig på manuell testning i olika former vilket för med sig en rad problem. Extra svårt blir det för de ovanligare programmeringsspråken, som inte har samma historia av automatisk testning som andra språk. Genom att implementera enhetstestning på liten skala på ett riktigt system i PL/SQL och mäta resultaten, kan flera slutsatser dras om enhetstestnings duglighet. Enhetstestning tar betydligt kortare tid att exekvera än motsvarande tester manuellt och kan lätt återupprepas. De kan även testa kombinationer som är omöjliga eller mycket svåra att utföra manuellt, och de minskar tiden det tar att rätta buggar. Att skriva enhetstester tar initialt mycket tid och kräver en viss kunskap. Det kan även dröja innan enhetstester börjar ge resultat och de behöver underhållas allt eftersom att koden ändras.

Context. Many applications today use databases to store user informationor other data for their applications. This information can beaccessed through various different languages depending on what typeof database it is. Databases that use SQL can maliciously be exploitedwith SQL injection attacks. This type of attack involves inserting SQLcode in the query parameter. The injected code sent from the clientwill then be executed on the database. This can lead to unauthorizedaccess to data or other modifications within the database. Objectives. In this study we investigate if a system can be builtwhich prevents SQL injection attacks from succeeding on web applicationsthat is connected with a MySQL database. In the intendedmodel, a proxy is placed between the web server and the database.The purpose of the proxy is to hash the SQL query parameter dataand remove any characters that the database will interpret as commentsyntax. By processing each query before it reaches its destination webelieve we can prevent vulnerable SQL injection points from being exploited. Methods. A literary study is conducted the gain the knowledgeneeded to accomplish the objectives for this thesis. A proxy is developedand tested within a system containing a web server and database.The tests are analyzed to arrive at a conclusion that answers ours researchquestions. Results. Six tests are conducted which includes detection of vulnerableSQL injection points and the delay difference on the system withand without the proxy. The result is presented and analyzed in thethesis. Conclusions. We conclude that the proxy prevents SQL injectionpoints to be vulnerable on the web application. Vulnerable SQL injectionpoints is still reported even with the proxy deployed in thesystem. The web server is able to process more http requests that requiresa database query when the proxy is not used within the system.More studies are required since there is still vulnerable SQL injectionspoints.

SQL Injections are still a prominent threat on the web. Using a custom built tool, BlindCanSeeQL (BCSQL), we will explore how to automate Blind SQL attacks to discover database schema using fewer requests than the standard methods, thus helping avoid detection from overloading a server with hits. This tool uses a web crawler to discover keywords that assist with autocompleting schema object names, along with improvements in ASCII bisection to lower the number of requests sent to the server. Along with this tool, we will discuss ways to prevent and protect against such attacks.

Injection attacks, including SQL injection, cross-site scripting, and operating system command injection, rank the top two entries in the MITRE Common Vulnerability Enumeration (CVE) [1]. Under this attack model, an application (e.g., a web application) uses some untrusted input to produce an output program (e.g., a SQL query). Applications may be vulnerable to injection attacks because the untrusted input may alter the output program in malicious ways. Recent work has established a rigorous definition of injection attacks. Injections are benign iff they obey the NIE property, which states that injected symbols strictly insert or expand noncode tokens in the output program. Noncode symbols are strictly those that are either removed by the tokenizer (e.g., insignificant whitespace) or span closed values in the output program language, and code symbols are all other symbols. This thesis demonstrates that such attacks are possible on applications for Android—a mobile device operating system—and Bash—a common Linux shell—and shows by construction that these attacks can be detected precisely. Specifically, this thesis examines the recent Shellshock attacks on Bash and shows how it widely differs from ordinary attacks, but can still be precisely detected by instrumenting the output program’s runtime. The paper closes with a discussion of the lessons learned from this study and how best to overcome the practical challenges to precisely preventing these attacks in practice.

o aid the software and database developer in the development process, specialised software is needed, known as CASE-tools. To form a productive work environment, multiple CASE-tools should be able to cooperate with each other, as it is likely that a single tool cannot give full support for the whole development process. An aid in the integration of tools is that information is stored in a central repository, available for any tool that needs it. A problem which arises is that not all tools are capable of directly accesing the contents of the repository. Thus export procedures are needed that transforms the repository contents into a format that an external tool can read and understand. If these transformation procedures are specified directly in the implementation language, modification can be difficult or even impossible. This work proposes a general transformation model for storing rules in a repository. These rules operate on the information in a source model and transform it to a textual representation ready for export to external tools. An example ruleset is given that transforms an example relational model into SQL code.

This thesis work is a comparative study of technical features between three distinctivemethods for database access. A web store which offers software components to download,for registered users has been built with three different database access methods to drawcomparisons. 1. SQL Server 2005 with stored procedures 2. LINQ to SQL 3. Db4o Working in Visual Studio with three different methods for database access was not difficult.SQL Server with Stored procedures is efficient in performance and offers maintainability ofthe database access logic. LINQ to SQL makes queries to database as first-class languageconstruct providing type-safety and Intellisense. LINQ to SQL has relatively lowperformance compared to Stored procedures because of the translation of LINQ queries toSQL Queries to communicate with the database. Db4o solves the problem of impedancemismatch and making the development of Database model much simpler and similar to theapplication domain model. Although Db4o has its own drawbacks with database size andconcurrency. Db4o can be considered as an alternative to Relational Database ManagementSystems. Db4o works particularly well with applications which have a small data footprint.

No description available.

Databaser är vanligt förekommande i vardagen på företag och organisationer. De mer objektorinterade krav som idag ställs på vad en databas bör klara av att hantera, har med ökad datakapacitet gjort att mer komplexa dataobjekt måste kunna hanteras i databasen. 1990 skrevs ett manifest av den tidens ledande databasforskare om vad de ansåg att den tredje generationens databaser borde ha för funktionalitet. I detta arbete undersöks det huruvida dagens moderna relationsdatabasprodukter klarar av att hantera de krav som ställdes i manifestet på vad den tredje generationens databaser borde klara av. Arbetet utgår ifrån manifestets krav och utförs med hjälp av en kombination av metoderna litteraturstudie och implementation. Fokus har lagts på att hitta en lösning i litteraturen för att om möjligt visa med kodexempel hur det kan se ut i en praktisk lösning.