Open Personalization: Involving Third Parties in Improving the User Experience of Websites

Traditional software development captures the user needs during the requirement analysis. The Web makes this endeavour even harder due to the difficulty to determine who these users are. In an attempt to tackle the heterogeneity of the user base, Web Personalization techniques are proposed to guide the users’ experience. In addition, Open Innovation allows organisations to look beyond their internal resources to develop new products or improve existing processes. This thesis sits in between by introducing Open Personalization as a means to incorporate actors other than webmasters in the personalization of web applications. The aim is to provide the technological basis that builds up a trusty environment for webmasters and companion actors to collaborate, i.e. "an architecture of participation". Such architecture very much depends on these actors’ profile. This work tackles three profiles (i.e. software partners, hobby programmers and end users), and proposes three "architectures of participation" tuned for each profile. Each architecture rests on different technologies: a .NET annotation library based on Inversion of Control for software partners, a Modding Interface in JavaScript for hobby programmers, and finally, a domain specific language for end-users. Proof-of-concept implementations are available for the three cases while a quantitative evaluation is conducted for the domain specific language.

Balidazio-eskemetan oinarritutako interfaze-sorkuntza dinamikoa

Gradu-amaierako proiektu hau anotazio linguistiko konplexuen testuinguruan kokatzen da. Proiektuaren helburuak hiru zatitan bereizi dira. Lehena, Armiarma web-aplikazioa eta LibiXaML liburutegia egokitzea bilaketa konplexuagoak onartu ahal izateko; horretarako Relax NG eskemen erabilpena errazten duen JavaScript liburutegia garatu da. Ondoren, LibiXaML liburutegiak bilaketarako erabiltzen dituen XPath-en sorkuntza automatizatzea, Relax NG eskematik abiatuz. Eta amaitzeko, analisi-sorkuntzako prototipoa hobetzea, hasieran sortutako liburutegia berrerabiliz eta Relax NG eskemak erabiliz.

Desarrollo de componentes para el panel de administración de GeoServicios® on-line

Panel de Administración que ofrece una solución completa a la hora de realizar visores para mapas y que permite al cliente configurar un visor en base a sus necesidades, mediante diferentes módulos. Dicho panel, se ha realizado utilizando un desarrollo basado en el prototipado. En el caso de este proyecto, se especifica el desarrollo de los dos primeros prototipos. Los módulos desarrollados son los siguientes: Panel de login: Este panel permite el acceso a la aplicación. Módulo de usuarios/grupos: Este componente permite gestionar grupos y usuarios, tanto la creación, edición de los mismos como la visualización de estos. Módulo de datos: Este componente permite gestionar las fuentes de datos del cliente. Crear plantillas a partir de datos procedentes de BBDD propias, así como la edición de dichas plantillas. Módulo GeoAsset: Este componente permite configurar aplicaciones web o visores. Un visor tendrá asociado un mapa, una lista de control de accesos, etc. Siguiendo la estructura de módulos, también es objeto del proyecto la realización de un segundo prototipo que contiene la mejora de uno de los módulos ya creados: Mejora de módulo de datos: Este componente implementa además de las funcionalidades creadas en la anterior versión, una funcionalidad para permitir la subida de datos a la aplicación.

Sistema de classificação da gestão ambiental pública municipal baseado em lógica nebulosa

A partir da Lei n. 6.938 de 31 de agosto de 1981, que constituiu o Sistema Nacional do Meio Ambiente, criou-se o Conselho Nacional do Meio Ambiente e instituiu-se o Cadastro Técnico Federal de Atividades e Instrumentos de Defesa Ambiental, a gestão ambiental pública ganhou um espaço cada vez maior nas administrações municipais, com a implementação de instrumentos de gestão ambiental propiciando aos municípios a possibilidade de ações efetivas que contribuam para uma melhor qualidade de vida a população. Esse trabalho propõe a criação de um método de classificação municipal que indicará qual o nível da gestão ambiental do município. Verificando o número de instrumentos de gestão ambiental constituído e o número de problemas ambientais ocorridos em cada município na visão do gestor local nos anos de 2006/2008. E ainda qual a influência do IDH tanto na implementação de tais instrumentos de gestão ambiental, como nas ocorrências dos problemas ambientais. Tal classificação tem a intenção de verificar se o município encontra-se bem aparelhado no que se refere à gestão ambiental, auxiliando para futuras decisões nas ações da política ambiental local. O foco desse trabalho serão os municípios dos estados de Minas Gerais, Piauí e Rio de Janeiro. Os resultados serão processados via o software MATLAB utilizando lógica nebulosa (fuzzy) e apresentados em um website utilizando as linguagens de programação JSP, HTML, JavaScript e esse website armazenado em um servidor TomCat e tais resultados serão apresentados nas formas de valores alfanuméricos em tabelas e espaciais através de mapas temáticos em uma solução sig-web. Os dados estão armazenados em um Sistema Gerenciador de Banco de Dados PostgreSQL com sua extensão espacial PostGIS, e o acesso aos mapas será feito através do servidor de mapas MapServer.

ExerClick: aplicación móvil para el seguimiento de ejercicios en clase

Se ha implementado la aplicación para el seguimiento de ejercicios en el aula llamada exerClick. Es una aplicación multiplataforma para móviles, evaluada en Android y en iOS y adaptada a esos sistemas gracias a la plataforma Apache Cordova. En su implementación se han utilizado las tecnologías web HTML5, CSS3 y Javascript, además de PHP para el servidor. La aplicación permite que los profesores añadan ejercicios y los alumnos le envíen feedback sobre su realización mediante dos opciones: marcar una duda en el ejercicio o marcar el ejercicio como finalizado.

Babelium, migración a HTML5

El proyecto consiste en migrar una aplicación web existente (Babelium) implementada mediante flash a una que utilice HTML5 y un Framework basado en Javascript para programar la funcionalidad de la aplicación. Se parte de un prototipo que contiene gran parte de contenido de la aplicación web Flash migrado a HTML5 pero que no utiliza ningún Framework.(http://mintzabel.com) El idioma del proyecto es el Español.

Complemento práctico en la enseñanza de lenguajes formales usando las expresiones regulares en el contexto de aplicaciones web

Tradicionalmente la enseñanza de los autómatas y lenguajes formales basa su principal aplicación práctica en la construcción de compiladores. Sin embargo, las tareas de diseño y programación necesarias son excesivamente complejas como para que los estudiantes, que están cursando el tercer cuatrimestre de la Ingeniería, puedan abordarlas con el rigor necesario. Es posible incorporar otro enfoque práctico, real y más actual de las expresiones regulares en estas asignaturas, aprovechando su frecuente uso como herramienta de especificación de patrones a la hora de diseñar formularios de entrada de datos en diferentes contextos y, particularmente, en aplicaciones web de tres capas. El hecho de trabajar esta competencia junto con el desarrollo teórico de las expresiones regulares permite a los estudiantes ser conscientes de la importante utilidad práctica de este concepto, sin restringirlo a otros usos más clásicos relacionados con el diseño de procesadores de textos o analizadores léxicos. Durante el curso 2006-07 se ha propuesto a los estudiantes de Ingeniería Técnica en Informática de Sistemas de la Universidad del País Vasco desarrollar fragmentos de código basados en una notación formal para resolver problemas de reconocimiento de patrones. La experiencia se ha llevado a cabo utilizando concretamente la notación, inspirada en las expresiones regulares, de JavaScript, resultando viable, efectiva y bien valorada por parte de los estudiantes.

多语言Web网站的结构与实现方法

简化多语言Web网站服务的管理与开发。在实践中，管理与开发多语言网站的大部分工作是保持网站的各种信息之间相互独立。在开发与管理多语言网站的过程中有许多与人相关的角色，如设计人员、实施人员（如程序员）、系统管理员、翻译人员与用户等角色。按照这些不同的角色对网站的各种信息进行严格分类，并保持在同一个网站中这些分类后的信息相互独立，也就是说负责翻译的人员不需要看到脚本语言，如JavaScript。同样，图形设计人员也不需要精通多种语言，也不必在多种语言环境中工作。从以上方面论述如何设计及实现多语言网站．

支持JSR286规范的Portlet协作框架的设计与实现

Portlet是具有用户界面的可与用户多次交互的Web组件。随着Portal和Portlet在企业中的广泛应用，仅仅将各种应用和数据通过Portlet集成到Portal中已经不能满足用户的需求。用户希望这些应用之间能够相互协作，以利用现有应用组建新的业务流程。Portlet协作是指两个或多个Portlet进行信息交换并使用这些信息的能力。目前协作功能的实现方式可以分为两种：基于后端(back-end)的实现方式与基于前端(front-end)的实现方式。在这两种协作实现方式的基础上，本文提出了两种Portlet协作框架。 本文提出一种基于事件的Portlet前端协作模型，通过引入此模型，解决了Portlet前端协作中客户端与服务器端无法交互的困难，使协作动作由客户端和服务器端共同完成。基于此模型提供给开发者一种可扩展的协作框架，利用JavaScript技术使得协作的Portlet在客户端“相知”，协作的行为在客户端触发，Portlet获得协作数据后使用Ajax技术请求服务器端的资源，服务器端使用JSR286规范定义的资源服务接口响应用户的请求，进而动态更新界面。 当前的Portlet后端协作方式依赖于特定的Portal产品，针对这点不足，本文在JSR286规范定义的事件及共享渲染参数协作机制基础上，实现了一个Portlet后端协作框架。在该框架中协作服务使用消息队列保存待处理的消息，Portlet 容器作为中介实现发布事件的Portlet和订阅事件的Portlet之间松散耦合。Portlet监听协作事件，事件触发后调用事件协作服务发布事件，为了提高协作的并发性，事件协作服务使用多线程处理协作事件。该协作框架与JSR286规范兼容，具有良好的可移植性。 本文对这两种Portlet协作框架进行了实现，并将其应用于中科院软件所自主开发的门户产品OncePortal中。本文重构了OncePortal系统，给出了框架的体系结构与系统接口，描述了框架的各功能模块，并详细讨论了Portlet协作框架中的关键技术，包括事件协作流程的描述、事件处理过程、多级事件流等。

Ajax与WebGIS的集成研究

WebGIS是利用互联网来扩展和完善地理信息系统的一项应用技术,是GIS发展的一个重要方向。Ajax是异步JavaScript和XML技术的组合。本文介绍了地理空间信息网络服务,探讨了Ajax与WebGIS的集成模式,并以Google Maps为例,详细分析了Ajax与WebGIS集成的具体方法。

Design and implementation of robust systems for secure malware detection

Malicious software (malware) have significantly increased in terms of number and effectiveness during the past years. Until 2006, such software were mostly used to disrupt network infrastructures or to show coders’ skills. Nowadays, malware constitute a very important source of economical profit, and are very difficult to detect. Thousands of novel variants are released every day, and modern obfuscation techniques are used to ensure that signature-based anti-malware systems are not able to detect such threats. This tendency has also appeared on mobile devices, with Android being the most targeted platform. To counteract this phenomenon, a lot of approaches have been developed by the scientific community that attempt to increase the resilience of anti-malware systems. Most of these approaches rely on machine learning, and have become very popular also in commercial applications. However, attackers are now knowledgeable about these systems, and have started preparing their countermeasures. This has lead to an arms race between attackers and developers. Novel systems are progressively built to tackle the attacks that get more and more sophisticated. For this reason, a necessity grows for the developers to anticipate the attackers’ moves. This means that defense systems should be built proactively, i.e., by introducing some security design principles in their development. The main goal of this work is showing that such proactive approach can be employed on a number of case studies. To do so, I adopted a global methodology that can be divided in two steps. First, understanding what are the vulnerabilities of current state-of-the-art systems (this anticipates the attacker’s moves). Then, developing novel systems that are robust to these attacks, or suggesting research guidelines with which current systems can be improved. This work presents two main case studies, concerning the detection of PDF and Android malware. The idea is showing that a proactive approach can be applied both on the X86 and mobile world. The contributions provided on this two case studies are multifolded. With respect to PDF files, I first develop novel attacks that can empirically and optimally evade current state-of-the-art detectors. Then, I propose possible solutions with which it is possible to increase the robustness of such detectors against known and novel attacks. With respect to the Android case study, I first show how current signature-based tools and academically developed systems are weak against empirical obfuscation attacks, which can be easily employed without particular knowledge of the targeted systems. Then, I examine a possible strategy to build a machine learning detector that is robust against both empirical obfuscation and optimal attacks. Finally, I will show how proactive approaches can be also employed to develop systems that are not aimed at detecting malware, such as mobile fingerprinting systems. In particular, I propose a methodology to build a powerful mobile fingerprinting system, and examine possible attacks with which users might be able to evade it, thus preserving their privacy. To provide the aforementioned contributions, I co-developed (with the cooperation of the researchers at PRALab and Ruhr-Universität Bochum) various systems: a library to perform optimal attacks against machine learning systems (AdversariaLib), a framework for automatically obfuscating Android applications, a system to the robust detection of Javascript malware inside PDF files (LuxOR), a robust machine learning system to the detection of Android malware, and a system to fingerprint mobile devices. I also contributed to develop Android PRAGuard, a dataset containing a lot of empirical obfuscation attacks against the Android platform. Finally, I entirely developed Slayer NEO, an evolution of a previous system to the detection of PDF malware. The results attained by using the aforementioned tools show that it is possible to proactively build systems that predict possible evasion attacks. This suggests that a proactive approach is crucial to build systems that provide concrete security against general and evasion attacks.

Replicación Activa en NodeJS con 0MQ

Mi trabajo final de grado se centra en el aprendizaje, desarrollo y divulgación del entorno de programación NodeJS, un entorno orientado a eventos que está basado en el lenguaje de programación JavaScript en el lado del servidor. El enfoque de NodeJS es el desarrollo de aplicaciones de red altamente escalables. La escalabilidad se proporciona por la eficiencia obtenida a lo largo de los años en la optimización de código en los motores de JavaScript por la delegación asíncrona a tareas propias del sistema operativo. Aprovechando estas cualidades, desarrollo la implementación de un algoritmo basado en el modelo de replicación activa consistente en mantener copias de objetos de datos en distintos almacenes de datos. Con este modelo se constituye un sistema distribuido tolerante a fallos y de alta disponibilidad. Para los protocolos de comunicación se utilizan de los socket 0MQ y se desarrollan algunos ejemplos del uso de cada tipo de ellos.

Making DSpace your own

PDF file

Deanonymizing Users of the SafeWeb Anonymizing Service

The SafeWeb anonymizing system has been lauded by the press and loved by its users; self-described as "the most widely used online privacy service in the world," it served over 3,000,000 page views per day at its peak. SafeWeb was designed to defeat content blocking by firewalls and to defeat Web server attempts to identify users, all without degrading Web site behavior or requiring users to install specialized software. In this article we describe how these fundamentally incompatible requirements were realized in SafeWeb's architecture, resulting in spectacular failure modes under simple JavaScript attacks. These exploits allow adversaries to turn SafeWeb into a weapon against its users, inflicting more damage on them than would have been possible if they had never relied on SafeWeb technology. By bringing these problems to light, we hope to remind readers of the chasm that continues to separate popular and technical notions of security.

RAGE Architecture for Reusable Serious Gaming Technology Components

For seizing the potential of serious games, the RAGE project - funded by the Horizon-2020 Programme of the European Commission - will make available an interoperable set of advanced technology components (software assets) that support game studios at serious game development. This paper describes the overall software architecture and design conditions that are needed for the easy integration and reuse of such software assets in existing game platforms. Based on the component-based software engineering paradigm the RAGE architecture takes into account the portability of assets to different operating systems, different programming languages and different game engines. It avoids dependencies on external software frameworks and minimizes code that may hinder integration with game engine code. Furthermore it relies on a limited set of standard software patterns and well-established coding practices. The RAGE architecture has been successfully validated by implementing and testing basic software assets in four major programming languages (C#, C++, Java and Typescript/JavaScript, respectively). A demonstrator implementation of asset integration with an existing game engine was created and validated. The presented RAGE architecture paves the way for large scale development and application of cross-engine reusable software assets for enhancing the quality and diversity of serious gaming.