Datalution: a tool for continuous schema evolution in NoSQL-backed web applications

Abstract

A NoSQL injection attack targets interactive Web applications that employ NoSQL database services. These applications accept user inputs and use them to form query statements at runtime. During NoSQL injection attack, an attacker might provide malicious query segments as user input which could result in a different database request. In this paper, a testing tool is presented to detect NoSQL injection attacks in web application which is called "NoSQL Racket". The basic idea of this tool depends on checking the intended structure of the NoSQL query by comparing NoSQL statement structure in code query statement (static code analysis) and runtime query statement (dynamic analysis). But we faced a big challenge, there is no a common query language to drive NoSQL databases like the same way in relational database using SQL as a standardized query language. The proposed tool is tested on four different vulnerable web applications and its effectiveness is compared against three different well known testers, none of them is able to detect any NoSQL Injection attacks. However, the implemented testing tool has the ability to detect the NoSQL injection attacks.

Versioning schemas of JSON-based conventional and temporal big data through high-level operations in the τJSchema framework

“…The Scherzigner's team has proposed several important contributions (Scherzinger et al, 2013Cerqueus et al, 2015aCerqueus et al, , 2015bKlettke et al, 2016;Haubold et al, 2017;Störl et al, 2015) in the field of schema evolution in JSON NoSQL databases. We survey them in the following.…”

Temporal JSON Schema Versioning in the JSchema Framework

“…Since 2013, Scherzinger and her colleagues have published interesting works on schema evolution in document-oriented NoSQL data stores. Their contributions ([9-10]; [14][15][16][17]; [31]) are presented in the following.…”

“…Scherzinger et al [17] presented a tool, named Datalution, that supports the operations previously proposed in [14].…”

“…It is used to demonstrate the difference between the two techniques of data migration/conversion, that is eager migration and lazy migration, in a JSON-based NoSQL data store, and to prove that lazy migration is more efficient than the other technique. Contrarily to [17], our approach automatically propagates schema changes to all involved instances.…”

“…Moreover, most research works on schema changes in NoSQL databases, like [9][10][11][12][13][14][15][16][17][18] have dealt with schema evolution, consisting in keeping only the last schema version with its associated instances, and, to the best of our knowledge, there is no work that has studied schema versioning [19][20] in (temporal) NoSQL databases.…”