Today the recursion code was added to allow the application to run to a schedule and monitor the usage an employee makes whilst web browsing over a period of time. Under some testing the code initially showed to have some bugs but this was ironed out up to this present time and the functionality is working properly now.

Presentation Preparation

I was in the college this evening making sure that the demo was going to run smoothly and that everything else in the room would too. I have identified a few possible problems that may arise but I plan on working on them throughout the week.

Today I had to continue on with my attempt to implement security in the form of some encryption package into my project. There was a sensitive area of the project that would need to have encryption as it would be a process of having data being sent over a network in plain text. This was identified as a key area that would need to be encrypted and protected in case the network traffic was to be intercepted. In the event this happened the attacker/interceptor  would be able to access records of employee’s activity in plain text. This would not be acceptable so to counter this it was decided that encryption of the data going across the network was a key aspect to implement. Two questions did arise though when choosing to implement security in the for of encryption.

What is it you want to encrypt and how valuable is the information if it was leaked/accessed?
The information in this case is the activities of each employee as they performed their day to day activities on the internet. This activity information contains records on things such as websites visited, ftp connections made and files downloaded from websites. This information is essential to keep secret but it is not of an extremely sensitive nature. If such information was intercepted it would not have any consequence on the organisation the employee works for it would merely  infringe on the employee’s right to privacy.

What Encryption/Decryption Algorithm should be utilised?
The situation stands as such. Encryption needs to be applied to the data that will be transferred across the network so that privacy rights are adhered to. The data itself needs to be transferred as efficiently and quickly as possible because the application will be running as a service which is triggered every specific time interval. This means that the previous process of logging must be complete before the new one starts to avoid any records being lost.

Code Implementation

The class by which the String-buffer was populated with the contents of the usage document was amended with code that would read in the contents of the usage record, pass them into an intermediate string-buffer and then encrypt the contents of this buffer and amended it to an output string buffer which would then be used to populated the message sent across the web-service.

The receiving end of the web-service also then had to be amended to include a small exertion of code to decrypt the message that was being passed by the web service.

Testing

The encryption scheme was then tested in a multiplicity of ways. The pass phrase then was changed on the decrpytion end and the test ran and without the correct pass-phrase the cipher-text could not be decrypted. The test of changing the cipher text even by one bit and then attempting to decrypt it proved that even a 1-bit change in the cipher-text would upset the plain-text generated.After performing these tests and after evaluating the risk associated with the data I opted to go with DES as my encryption algorithm.

Today I proceeded to make a last few minor aesthetic changes to the applications back end website. This was simply a task of realigning images and spelling the website. Just some basic maintenance work really. I added icons to the deletion page that I added that allowed the system administrator to clear any users web activity records from the comfort of the back end application.

In my actual bare bones implementation that was my code base I went about amending this so that it could possibly be migrated onto another computer and not have to path error issues. I removed all links to files I was using and changed them to the C:\\ drive so that it could be universally locatable. I also customised some links that went into user files. I needed to add some code to get the current user and place it into the path string so that the code would not have to be amended anytime that it changed computer.

The rest of the day say me look into encryption. I spent most of the day testing different encryption techniques and I plan to work on this for the next few coming days.

There was a lot of formatting that needed to be done today to finally polish off the JSP back end of the application. I took the day to put the finishing touches on the web application. The first task i undertook today was to format the excel reports that I was generating so that they were in a more user friendly form when downloaded onto the administrators local desktop. This involved changing some of the format and removing some unnecessary detail in the Excel file.

The layout of the application changed to a more centralized model yesterday and to reflect this some formatting needed to be done to the existing JSP pages. All of the return to home links were redirecting to a non existant page so I had to edit all of the JSP pages to now return to the employee selection screen.

Upon further testing of the navigation of the application I found myself becoming extremely frustrated with the fact that once I entered the reports screen for any employee and any of their activities I would have to navigate back to the employee selection screen. This upon reflection didn’t seem to be efficient in any sense. I tested this out on two other people and it was identified as an area of frustration amongst them also. The situation should be able to be bypassed by clicking the back button on the browser but this isn’t acceptable. Utilizing the session parameters I had been passing I made a return to previous page link passing the hidden credentials parameter allowing for the session to remain intact after clicking the back button. Upon further testing this massively reduced the frustration of navigation amongst myself and my two testers. This button was also custom designed to include the persons name the administrator is enquiring about. This is just done to promote good H.C.I and userability.

The layouts of the table were causing me a problem. Row entries that were too long were extending the table off the screen and was no favorable on the user to view. I altered the tables in the application with some C.S.S to confine the table and stop them from moving and word wrap their contents so that they would be favorable to read.

The reports themselves and in particular their titles were the next thing that I needed to look into because I wanted to be able to uniquely and clearly allow the administrator to easily identify the report that he downloaded on a user. I used the session parameter for the username and incorporated it into the title of the excel file and then I took a snapshot of the system date at the time that the report was generated and amended that to the end of the filename to stop files being overwritten upon download because each file would have a different name due to the name being related on the system time and date.

The logo on the front page of the application seemed to be repeating after the maximum screen resolution was reached so I amended the logo to drop down far below the screen so that no images would repeat. This has been implemented and is working.

The next function I incorporated was a clear option for each users details so that the system administrator would have the possibility to clear the records for any user. I felt that this was necessary to incorporate as administrator would then have the option to clear the contents of tables of users that had no suspicious activity as there is no real value in keeping legitimate usage records of users.

The jsp application I then made externally accessible once I have my laptop on at home with tomcat running. I just created a temporary domain name and attributed it to the URL address of router and then port forwarded all requests to port 80 to my computers IP Address. I have since accessed the externally available website application from a host of different types of machines such as pc’s, laptops, netbooks, and even i-phones. The fact that the website application is accessible on i-phone is a handy feature as it means that systems administrators could keep track of activity whilst on the move. I thought this was a handy feature.

Today I began to edit the jsp page that was entitled “enployeesummaryresults.jsp” . The edits made to the page allowed for the page to become more of a central control panel of the back end application of the project. I decided whilst mid editing this page that I would change the flow of the application and drafted up a new diagram of how I saw an administrator’s interaction with the page flowing. The additions made to the page was the inclusion of the valid urls that were visited, and the consequent link to the resulting page of the valid urls visited by the employee being displayed. Follow on links to pages were added for all the results. For example, for the result showing the blacklisted urls visited by frank the displayed amount of them on the summary screen had a link next to it in the form of a button that would allow you to navigate to a page that would display the blacklisted urls and then optionally download them  into an excel document. This functionality was then added for all the results. Also along with all the dynamic result page redirections added, three semi static links that merely displayed every temp file/ URL/Blacklisted recorded was added to the page.

Considering I have been developing the project for past 8 months it would seem that it would be about time that a name to realised for the project. Having discussed the theme of names with my supervisor he alerted me to the fact that the industry norm in to generally name your app in the form of  ”<FIRST LETTER OF LANGUAGE IMPLEMENTED>”-”<NAME>”. This led me down the path where I knew I was going to have a name for the application in the form of J-”<NAME>”.  I ran through a few names I could possibly use, the one I ended up selecting was J-MON.

Designing a Site Banner

I designed a logo/site banner for the back end of the application just to give it more of that application feel.The logo/site banner can be downloaded here.

Code Implementation

I continued on from where the implementation left off yesterday and began to look into providing reports for the dynamically generated jsp pages. This was a different implementation to that of the static reporting. This was due to the fact that the arguments for the dynamic jsp pages were being passed in by parameter values which were specified on the referrer page. Changing the content type of the excel display page to excel meant that the parameters were being passed in but not read. Due to this I had to amend my methods, After some time trying out different things I got it to work  and I now have site wide reporting on usage of different forms and employees.

I also rolled out the use of hidden parameters throughout the entire JSP site to promote in essence what would be one continuous consistent session for the user. This meant that the user and their options, whatever they choose as they navigate throughout the site would be remembered and passed in hidden parameters without distraction or disruption to the urls. It  just seems to make the whole session easier for the user to navigate through.

Last night I implemented a summary page of sorts whereby any employee could be selected from a drop down menu and then their credential details such as their computer name, mac_address, and quantitative activity could be displayed. Initially this was meant to be just a summary page but after implementing it there seemed to be a certain central feel to it and after sketching out a few site maps it seems better to centralise everything to the summary page. I have developed all the JSP pages, both dynamic and static now for all the functionality I envisaged and I am now going to attempt to refine down these twenty or thirty pages down to a centralized core site of under ten pages.

I also developed a new “index.jsp” page to be the starting point of the site where users are greeted upon entering the site. The reason being that although I don’t plan to do “much if any” graphic design on the back-end application due to the fact that it is largely irrelevant and time consuming, it is nice to have some sort of logo greet you as you initiate your contact with any site.

]]> http://danieljordanac4.wordpress.com/2010/04/02/april-1st-%e2%80%93-project-update/feed/ 0 danieljordanac4 http://danieljordanac4.wordpress.com/2010/04/01/march-31st-%e2%80%93-project-update/ http://danieljordanac4.wordpress.com/2010/04/01/march-31st-%e2%80%93-project-update/#comments Thu, 01 Apr 2010 16:14:23 +0000 danieljordanac4 http://danieljordanac4.wordpress.com/?p=189 ]]> Code Implementation

I spent the whole of today immersed studying into JSP pages in detail and their utilization alongside Oracle. I needed to be able to insert, automatically query and also dynamically query the database of the employees activity. I spent a lot of time reading through tutorials online about what to do and how to do it.

Having successfully implemented the functionality to be able to log the temporary internet files that are downloaded during an employees internet connectivity session I further went on to develop a JSP page that could display the temporary internet files downloaded by all employees as a whole in an effort to ensure I had connectivity for this new functionality.

Reporting is a major piece of functionality that is essential is an logging application. The ability to export excel reports was on the list of functionalities that I wanted to very much incorporate into this application and I did just that. I incorporated into my JSP query result-set pages the ability to export them as an “.xls” file.

Testing

After testing the functionality of my system and manually (for the purpose of the tests solely!) inserting different users activities into the database I was alerted to the fact that I had a serious primary key issue that would cause me to loose important information. Initially prior to discovering the bug upon testing I had the URL  address as the primary key of each entry but if two different users registered the same URL one of them would lose their record thus meaning that their activity wouldn’t be stored. To solve this problem I made the primary key into a composite primary key made up of the URL address and the user it is attributed to.

Current Problem

I can’t get the JSP pages to pass parameters!

These two weeks I need to get the application implemented and configured in such a way that it actually will gather all the information I outlined in the scope in the very first iteration and successfully matriculate that information from the client side of things, over to the administrator’s server side of the application. This will allow the administrator to successfully and more importantly accurately monitor the web usage that takes place on any of their clients laptops.

Today I implemented the functionality to log any of the downloaded files that are generally cached on the clients machine once they request a website. These files known as temporary internet files are files that allow you to cache various parts of a website that are not likely to change by the next time you visit the website hence meaning that a “lighter” request is sent to the server, thus meaning the server doesn’t come under to heavy a load and as a result performance doesn’t suffer. But more on the focus of my project, websites can generally be attacked by hackers with malicious intent towards future visitors to the website and can embed temporary files on the website that visitors to the site will download upon visiting it. The other thing is that by gathering evidence of temporary internet files on the client computer,  yes you are checking to see were malicious temporary files downloaded but you are also providing a form of non repudiation as to the fact that your employee did visit and website and did download a file from it at a certain time.

Implementation took quiet a while to get done correctly, At first I had to use the EMF model again to generate another one of my usage documents in order to be able to persist locally the temporary internet file data. This then allows me to have a point where as to generate a data string for my web service client to transmit to the web service which will then in turn take the string and persist it’s elements into the database.

I now have all the data I required being logged into the database. A few minor test scenarios for the overall application have been run but more tests need to be conducted.

I searched online for ages and found a blacklist repository that provided the URL’s that were regarded as a whole to be blacklisted among a range of censorship providers, such as websense, etc. http://www.shallalist.de/ was the website from which I obtained the extensive repository.  I looked at the whole thing and decided that I would only implement three of the blacklisted categories from this repository which were, humour/chat, torrents, and pornography. This cut down list I had picked still contained over 700,000 website domain entries which doubled because I had to cater for people who type urls as “http://” and people who type urls as “http://www.” So in effect I populated the database with over 1.5 million records of blacklisted urls.