AjaxScope: a platform for remotely monitoring the client-side behavior of web 2.0 applications

ABSTRACT

The rise of the software-as-a-service paradigm has led to the development of a new breed of sophisticated, interactive applications often called Web 2.0. While web applications have become larger and more complex, web application developers today have little visibility into the end-to-end behavior of their systems. This paper presents AjaxScope, a dynamic instrumentation platform that enables cross-user monitoring and just-in-time control of web application behavior on end-user desktops. AjaxScope is a proxy that performs on-the-fly parsing and instrumentation of JavaScript code as it is sent to users' browsers. AjaxScope provides facilities for distributed and adaptive instrumentation in order to reduce the client-side overhead, while giving fine-grained visibility into the code-level behavior of web applications. We present a variety of policies demonstrating the power of AjaxScope, ranging from simple error reporting and performance profiling to more complex memory leak detection and optimization analyses. We also apply our prototype to analyze the behavior of over 90 Web 2.0 applications and sites that use large amounts of JavaScript.

REFERENCES

• 1: String performance in Internet Explorer. http://therealcrisp.xs4all.nl/blog/2006/12/09/string-performance-in-internet-explorer/, December 2006.
• 2: Marcos K. Aguilera , Jeffrey C. Mogul , Janet L. Wiener , Patrick Reynolds , Athicha Muthitacharoen, Performance debugging for distributed systems of black boxes, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA
• 3: Richard Atterer , Monika Wnuk , Albrecht Schmidt, Knowing the user's every move: user activity tracking for website usability evaluation and implicit interaction, Proceedings of the 15th international conference on World Wide Web, May 23-26, 2006, Edinburgh, Scotland [doi>10.1145/1135777.1135811]
• 4: Paul Barham , Austin Donnelly , Rebecca Isaacs , Richard Mortier, Using magpie for request extraction and workload modelling, Proceedings of the 6th conference on Symposium on Opearting Systems Design & Implementation, p.18-18, December 06-08, 2004, San Francisco, CA
• 5: David Baron. Finding leaks in Mozilla. http://www. mozilla.org/performance/leak-brownbag.html, November 2001.
• 6: Emery D. Berger , Benjamin G. Zorn, DieHard: probabilistic memory safety for unsafe languages, ACM SIGPLAN Notices, v.41 n.6, June 2006
• 7: Adam Bosworth. How to provide a Web API. http://www.sourcelabs.com/blogs/ajb/2006/08/how_to_provide_a_web_api.html, August 2006.
• 8: Ryan Breen. Ajax performance. http://www.ajaxperformance.com, 2007.
• 9: Ramesh Chandra , Nickolai Zeldovich , Constantine Sapuntzakis , Monica S. Lam, The collective: a cache-based system management architecture, Proceedings of the 2nd conference on Symposium on Networked Systems Design & Implementation, p.259-272, May 02-04, 2005
• 10: Trishul M. Chilimbi , Ran Shaham, Cache-conscious coallocation of hot data streams, ACM SIGPLAN Notices, v.41 n.6, June 2006
• 11: David A. Cohn, Zoubin Ghahramani, and Michael I. Jordan. Active learning with statistical models. Journal of Artificial Intelligence Research, 4:129--145, 1996.
• 12: Crispin Cowan , Calton Pu , Dave Maier , Heather Hintony , Jonathan Walpole , Peat Bakke , Steve Beattie , Aaron Grier , Perry Wagle , Qian Zhang, StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks, Proceedings of the 7th conference on USENIX Security Symposium, p.5-5, January 26-29, 1998, San Antonio, Texas
• 13: ECMA. ECMAScript Language Specification 3rd Ed. http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-262.pdf, December 1999.
• 14: Vivek Haldar , Deepak Chandra , Michael Franz, Dynamic Taint Propagation for Java, Proceedings of the 21st Annual Computer Security Applications Conference, p.303-311, December 05-09, 2005 [doi>10.1109/CSAC.2005.21]
• 15: Matthias Hauswirth , Trishul M. Chilimbi, Low-overhead memory leak detection using adaptive statistical profiling, Proceedings of the 11th international conference on Architectural support for programming languages and operating systems, October 07-13, 2004, Boston, MA, USA
• 16: Internet Explorer development team. IE+JavaScript performance recommendations part 2: JavaScript code inefficiencies. http://therealcrisp.xs4all.nl/blog/2006/12/09/string-performance-in-internet-explorer/.
• 17: Ben Liblit , Mayur Naik , Alice X. Zheng , Alex Aiken , Michael I. Jordan, Scalable statistical bug isolation, Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation, June 12-15, 2005, Chicago, IL, USA
• 18: Chao Liu , Long Fei , Xifeng Yan , Jiawei Han , Samuel P. Midkiff, Statistical Debugging: A Hypothesis Testing-Based Approach, IEEE Transactions on Software Engineering, v.32 n.10, p.831-848, October 2006 [doi>10.1109/TSE.2006.105]
• 19: Chao Liu , Jiawei Han, Failure proximity: a fault localization-based approach, Proceedings of the 14th ACM SIGSOFT international symposium on Foundations of software engineering, November 05-11, 2006, Portland, Oregon, USA [doi>10.1145/1181775.1181782]
• 20: Michael Martin , Benjamin Livshits , Monica S. Lam, Finding application errors and security flaws using PQL: a program query language, Proceedings of the 20th annual ACM SIGPLAN conference on Object oriented programming, systems, languages, and applications, October 16-20, 2005, San Diego, CA, USA
• 21: Michael Martin, Benjamin Livshits, and Monica S. Lam. SecuriFly: Runtime vulnerability protection for Web applications. Technical report, Stanford University, October 2006.
• 22: Barton P. Miller , Mark D. Callaghan , Jonathan M. Cargille , Jeffrey K. Hollingsworth , R. Bruce Irvin , Karen L. Karavanic , Krishna Kunchithapadam , Tia Newhall, The Paradyn Parallel Performance Measurement Tool, Computer, v.28 n.11, p.37-46, November 1995 [doi>10.1109/2.471178]
• 23: Anh Nguyen-Tuong, Salvatore Guarnieri, Doug Greene, Jeff Shirley, and David Evans. Automatically hardening Web applications using precise tainting. In Proceedings of the IFIP International Information Security Conference, June 2005.
• 24: Charles Reis , John Dunagan , Helen J. Wang , Opher Dubrovsky , Saher Esmeir, BrowserShield: vulnerability-driven filtering of dynamic HTML, Proceedings of the 7th USENIX Symposium on Operating Systems Design and Implementation, p.5-5, November 06-08, 2006, Seattle, WA
• 25: Steve Rider. Recent changes that may break your gadgets. http://microsoftgadgets.com/forums/1438/ShowPost.aspx, November 2005.
• 26: Martin Rinard , Cristian Cadar , Daniel Dumitran , Daniel M. Roy , Tudor Leu , William S. Beebee, Jr., Enhancing server availability and security through failure-oblivious computing, Proceedings of the 6th conference on Symposium on Opearting Systems Design & Implementation, p.21-21, December 06-08, 2004, San Francisco, CA
• 27: Shai Rubin , Rastislav Bodík , Trishul Chilimbi, An efficient profile-analysis framework for data-layout optimizations, ACM SIGPLAN Notices, v.37 n.1, p.140-153, Jan. 2002
• 28: Isaac Z. Schlueter. Memory leaks in Microsoft Internet Explorer. http://isaacschlueter.com/2006/10/msie-memory-leaks/, October 2006.
• 29: Ran Shaham , Elliot K. Kolodner , Mooly Sagiv, Estimating the impact of heap liveness information on space consumption in Java, Proceedings of the 3rd international symposium on Memory management, June 20-21, 2002, Berlin, Germany
• 30: Joseph Tucek , Shan Lu , Chengdu Huang , Spiros Xanthos , Yuanyuan Zhou, Automatic on-line failure diagnosis at the end-user site, Proceedings of the 2nd conference on Hot Topics in System Dependability, p.4-4, November 08, 2006, Seattle, WA
• 31: Larry Wall , Randal L. Schwartz, Programming perl, O'Reilly & Associates, Inc., Sebastopol, CA, 1991
• 32: Dachuan Yu , Ajay Chander , Nayeem Islam , Igor Serikov, JavaScript instrumentation for browser security, Proceedings of the 34th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, January 17-19, 2007, Nice, France
• 33: Nicholas C. Zakas, Jeremy McPeak, and Joe Fawcett. Professional Ajax. Wrox, 2006.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.5 Testing and Debugging
          Subjects: Distributed debugging

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.7 Organization and Design
          Subjects: Distributed systems

General Terms:
Languages, Management, Measurement, Performance, Reliability

Keywords:
software instrumentation, software monitoring, web applications