More Like this

1. Interactive hydrological modelling and simulation on client-side web systems: an educational case study

   https://doi.org/10.2166/hydro.2022.061  

   Ewing, Gregory; Mantilla, Ricardo; Krajewski, Witold; Demir, Ibrahim (November 2022, Journal of Hydroinformatics)

   Abstract Computational hydrological models and simulations are fundamental pieces of the workflow of contemporary hydroscience research, education, and professional engineering activities. In support of hydrological modelling efforts, web-enabled tools for data processing, storage, computation, and visualization have proliferated. Most of these efforts rely on server resources for computation and data tasks and client-side resources for visualization. However, continued advancements of in-browser, client-side compute performance present an opportunity to further leverage client-side resources. Towards this end, we present an operational rainfall-runoff model and simulation engine running entirely on the client side using the JavaScript programming language. To demonstrate potential uses, we also present an easy-to-use in-browser interface designed for hydroscience education. Although the use case presented here is self-contained, the core technologies can extend to leverage multi-core processing on single machines and parallelization capabilities of multiple clients or JavaScript-enabled servers. These possibilities suggest that client-side hydrological simulation can play a central role in a dynamic, interconnected ecosystem of web-ready hydrological tools. 

   more » « less
2. JSMBox—A Runtime Monitoring Framework for Analyzing and Classifying Malicious JavaScript

   https://doi.org/10.1007/978-3-031-75201-8_8  

   Phung, Phu H; Varghese, Allen; Wang, Bojue; Zhao, Yu; Yu, Chong (October 2024, Springer Nature Switzerland)

   In recent years, there has been a notable increase in the prevalence of malicious websites, leading to a majority of cyber-attacks and data breaches. Malicious websites often incorporate JavaScript code to execute attacks on web browsers. Despite existing methodologies documented in the literature, the analysis and detection of malicious JavaScript pose significant challenges due to the dynamic nature of JavaScript and the use of advanced evasion techniques. These challenges motivate the need for an innovative and efficient approach to comprehensively analyze the code to identify its malicious intent. In this paper, we introduce a monitoring approach for analyzing JavaScript code, which can capture all of the code’s features at runtime. Our method leverages the security reference monitor technique to mediate JavaScript security-sensitive executions, including function calls and property accesses. Therefore, the proposed method can capture behaviors at runtime regardless of how the code is written, even with recent advanced evasion techniques like WebAssembly diversification. We have implemented our approach as a JavaScript dynamic analysis framework called JSMBox in a Chromium-based browser extension. Our experiments demonstrated that JSMBox is capable of effectively countering sophisticated evasion techniques found in modern malicious JavaScript code, including WebAssembly diversification. We have also evaluated the framework’s ability to classify malicious behaviors based on a large-scale raw dataset comprising about 20,000 malicious and benign webpages. Our developed tool automatically launches the browser to execute these webpages, records JavaScript code execution events, and captures their execution frequency as extracted features. We have tested the extracted dataset with various machine-learning models, yielding promising experimental results that confirm the effectiveness of our approach and achieve a high accuracy rate. 

   more » « less
3. Sparse-view Pose Estimation and Reconstruction via Analysis by Generative Synthesis

   Zhao, Qitao; Tulsiani, Shubham (December 2024, Conference and Workshop on Neural Information Processing Systems)

   Inferring the 3D structure underlying a set of multi-view images typically requires solving two co-dependent tasks -- accurate 3D reconstruction requires precise camera poses, and predicting camera poses relies on (implicitly or explicitly) modeling the underlying 3D. The classical framework of analysis by synthesis casts this inference as a joint optimization seeking to explain the observed pixels, and recent instantiations learn expressive 3D representations (e.g., Neural Fields) with gradient-descent-based pose refinement of initial pose estimates. However, given a sparse set of observed views, the observations may not provide sufficient direct evidence to obtain complete and accurate 3D. Moreover, large errors in pose estimation may not be easily corrected and can further degrade the inferred 3D. To allow robust 3D reconstruction and pose estimation in this challenging setup, we propose SparseAGS, a method that adapts this analysis-by-synthesis approach by: a) including novel-view-synthesis-based generative priors in conjunction with photometric objectives to improve the quality of the inferred 3D, and b) explicitly reasoning about outliers and using a discrete search with a continuous optimization-based strategy to correct them. We validate our framework across real-world and synthetic datasets in combination with several off-the-shelf pose estimation systems as initialization. We find that it significantly improves the base systems' pose accuracy while yielding high-quality 3D reconstructions that outperform the results from current multi-view reconstruction baselines. 

   more » « less
4. Leibniz International Proceedings in Informatics (LIPIcs):37th European Conference on Object-Oriented Programming (ECOOP 2023)

   https://doi.org/10.4230/LIPIcs.ECOOP.2023.26  

   Rumsevicius, Ugnius; Venkateshwaran, Siddhanth; Kidane, Ellen; Pina, Luís (January 2023, 37th European Conference on Object-Oriented Programming (ECOOP 2023))

   Ali, Karim; Salvaneschi, Guido (Ed.)

   Browsers are the main way in which most users experience the internet, which makes them a prime target for malicious entities. The best defense for the common user is to keep their browser always up-to-date, installing updates as soon as they are available. Unfortunately, updating a browser is disruptive as it results in loss of user state. Even though modern browsers reopen all pages (tabs) after an update to minimize inconvenience, this approach still loses all local user state in each page (e.g., contents of unsubmitted forms, including associated JavaScript validation state) and assumes that pages can be refreshed and result in the same contents. We believe this is an important barrier that keeps users from updating their browsers as frequently as possible. In this paper, we present the design, implementation, and evaluation of Sinatra, which supports instantaneous browser updates that do not result in any data loss through a novel Multi-Version eXecution (MVX) approach for JavaScript programs, combined with a sophisticated proxy. Sinatra works in pure JavaScript, does not require any browser support, thus works on closed-source browsers, and requires trivial changes to each target page, that can be automated. First, Sinatra captures all the non-determinism available to a JavaScript program (e.g., event handlers executed, expired timers, invocations of Math.random). Our evaluation shows that Sinatra requires 6MB to store such events, and the memory grows at a modest rate of 253KB/s as the user keeps interacting with each page. When an update becomes available, Sinatra transfer the state by re-executing the same set of non-deterministic events on the new browser. During this time, which can be as long as 1.5 seconds, Sinatra uses MVX to allow the user to keep interacting with the old browser. Finally, Sinatra changes the roles in less than 10ms, and the user starts interacting with the new browser, effectively performing a browser update with zero downtime and no loss of state. 

   more » « less
5. Artifact for SINATRA: Stateful Instantaneous Updates for Commercial Browsers through Multi-Version eXecution

   https://doi.org/10.5281/zenodo.7647069  

   Rumsevicius, Ugnius; Venkateshwaran, Siddhanth; Kidane, Ellen; Pina, Luís (January 2023, Zenodo)

   This is the artifact for the paper titled SINATRA: Stateful Instantaneous Updates for Commercial Browsers through Multi-Version eXecution published at ECOOP'23. This artifact was reviewed and obtained the available and functional badges. The source is included in this artifact, and can be downloaded on https://github.com/bitslab/sinatra Abstract below: Browsers are the main way in which most users experience the internet, which makes them a prime target for malicious entities. The best defense for the common user is to keep their browser always up-to-date, installing updates as soon as they are available. Unfortunately, updating a browser is disruptive as it results in loss of user state. Even though modern browsers reopen all pages (tabs) after an update to minimize inconvenience, this approach still loses all local user state in each page (e.g., contents of unsubmitted forms, including associated JavaScript validation state) and assumes that pages can be refreshed and result in the same contents. We believe this is an important barrier that keeps users from updating their browsers as frequently as possible. In this paper, we present the design, implementation, and evaluation of SINATRA, which supports instantaneous browser updates that do not result in any data loss through a novel Multi-Version eXecution (MVX) approach for JavaScript programs. SINATRA works in pure JavaScript, does not require any browser support, thus works on closed-source browsers, and requires trivial changes to each target page, that can be automated. First, SINATRA captures all the non-determinism available to a JavaScript program (e.g., event handlers executed, expired timers, invocations of Math.random). Our evaluation shows that SINATRA requires 6MB to store such events, and the memory grows at a modest rate of 256KB/s as the user keeps interacting with each page. When an update becomes available, SINATRA transfer the state by re-executing the same set of non-deterministic events on the new browser. During this time, which can be as long as 1.5 seconds, SINATRA uses MVX to allow the user to keep interacting with the old browser. Finally, SINATRA changes the roles in less than 10ms, and the user starts interacting with the new browser, effectively performing a browser update with zero downtime and no loss of state. 

   more » « less