SHF: Small: Inter-Request Workflow and Dataflow in Web Applications: a Modeling Framework and its Applications

Web应用程序已经成为向公众提供各种服务的主要平台，这主要是由于用于托管Web应用程序的云服务和用于访问Web应用程序的手持设备的日益普及。质量差的Web应用程序可能会导致严重的问题，包括用户不满和经济损失。Web应用程序带来的一个关键挑战是由于它们的请求驱动特性;它们向用户公开服务，并使用应用程序定义的请求处理程序方法来处理请求。在这种请求驱动的范例下，尽管每个请求都是独立服务的，但请求间的控制和数据依赖性仍然存在。然而，由于实现Web应用程序的语言和框架的多样性和复杂性，跨请求跟踪这些依赖关系具有挑战性。针对Web应用程序的现有技术缺乏任何请求间分析能力，他们可能会错过性能优化的机会和安全问题，只能在请求间的上下文中暴露。为了为请求间分析奠定坚实的基础，该项目设计和开发了能够有效和高效地捕获和表达跨请求的控制和数据依赖关系的技术。所提出的技术联合收割机统计挖掘方法与静态和动态分析的混合。生成的工作流和流程模型为各种分析提供必要的请求间知识，以扩展范围。通过请求间工作流和工作流建模框架，该项目探索了性能优化和工作流监控，以提高Web应用程序在性能，正确性和安全性方面的质量。从以前对处理过程和线程抽象的过程间和线程间分析的成功研究来看，请求间分析的概念可以极大地有益于web应用和其它请求，该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的智力价值和更广泛的影响进行评估来支持审查标准。

Web applications have become a major platform to deliver various services to the general public, largely due to the increasing popularity of cloud services for hosting web applications and handheld devices for accessing web applications. Poor-quality web applications can lead to significant problems, including user dissatisfaction and financial losses. A key challenge imposed by web applications is due to their request-driven nature; they expose services to users and serve requests with application-defined request-handler methods. Under this request-driven paradigm, inter-request control and data dependencies exist although each request is served independently. However, tracking these dependencies across requests is challenging because of the diversity and complexity of languages and frameworks for implementing web applications. Existing techniques targeting web applications lack any inter-request analysis capability, and they may miss performance-optimization opportunities and security issues that can only be exposed in the inter-request context.This project promotes inter-request analysis to handle the problems just cited. To build a solid foundation for inter-request analysis, this project designs and develops techniques that can effectively and efficiently capture and express control and data dependencies across requests. The proposed techniques combine statistical mining approaches with a hybrid of static and dynamic analyses. The generated workflow and dataflow models provide necessary inter-request knowledge for various analyses to extend the scope. With the inter-request workflow- and dataflow-modeling framework, this project explores performance optimization and workflow monitoring to improve the quality of web applications regarding performance, correctness, and security. From the success of previous research on inter-procedural and inter-thread analyses for handling the abstraction of procedures and threads, the concept of inter-request analysis can greatly benefit web applications and other request-driven applications through both technique development and student education.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.