KR101803841B1 - Method for determining maliciousness of file being transmitted into web server and network device using the same - Google Patents

Abstract

The present invention relates to a method for determining maliciousness of a file transmitted/ received to/from a web server, and a network apparatus for performing the same. Specifically, the network device that relays transmission/reception between a client terminal and the web server extracts the extension of a weak file from the configuration information of the web server or learns the extension of the weak file through the profiling of the web server, stores a clue list including the extracted extension in a database and determines a blocking condition that determines whether the extension of a file transmitted/received to/from the web server corresponds to the clue list, based on the clue list stored in the database.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a method for determining maliciousness of a file transmitted / received to / from a web server,

The present invention relates to a method for determining maliciousness of a file transmitted to and / or received from a web server, and a network device for performing the method. More particularly, the present invention relates to a network device for relaying transmission / reception between a client terminal and the web server, Extracting an extension of a weak file from information or learning an extension of the vulnerable file through profiling of the web server, storing a list of clues including the extracted extension in a database, And a network device for performing the method and a method for determining a blocking condition that determines whether an extension of a file transmitted to and / or received from the web server corresponds to the list of clues.

The Web server accepts a Hyper-Text Transfer Protocol (HTTP) request from an entity requesting a World Wide Web service (hereinafter referred to as " Web ") service to a client, that is, a Web server, Means a server for providing content to the client. Also, a web application server (WAS) refers to a server that performs an application to a client through HTTP in a network in cooperation with a web server.

In a web application server (WAS) environment in which a web application server and a web server are interlocked to provide a web service, a malicious code is executed when a file of an executable extension written in malicious code is uploaded. And a cracker using malicious code can perform various attacks such as server manipulation, DB information acquisition, backdoor installation, and malicious file upload through the use of the malicious code.

SUMMARY OF THE INVENTION The present invention has been made to solve all the problems described above.

Particularly, the present invention aims to block the uploading of a file extension that is executable or vulnerable through a configuration file of a web server to prevent the upload from proceeding.

To this end, the present invention aims to block executable or weak file extensions on the web server for extensions learned by profiling the server.

In order to accomplish the above object, a representative structure of the present invention is as follows.

According to an aspect of the present invention, there is provided a method of determining maliciousness of a file transmitted to and / or received from a web server, the method comprising: (a) determining whether a network device relaying transmission / performing at least one of the following: i) extracting an extension of a weak file from the configuration information of the web server; and ii) learning the extension of the weak file through profiling of the web server. (b) the network device storing a list of clues including the extracted extension in a database; And (c) determining, based on the list of clues stored in the database, whether or not the extension of the file transmitted and received to the web server corresponds to the list of clues based on the list of clues stored in the database.

According to another aspect of the present invention, there is provided a network apparatus for performing a method of determining maliciousness of a file transmitted to and / or received from a web server, the network apparatus comprising: a communication unit for relaying transmission / reception between the client terminal and the web server; And a processor for performing at least one of the following: (i) extracting an extension of a weak file from configuration information of the web server; and (ii) a process of learning an extension of the weak file through profiling of the web server (Iii) a process of storing a list of clues including the extracted extension in a database, and (iv) a process of extracting the extension of the file transmitted to and received from the web server based on the list of clues stored in the database And further judges whether a blocking condition is included in the list of clues.

The present invention has the following effects.

The present invention can prevent a malicious code from being uploaded, which may be a means by which a cracker can perform various attacks such as server manipulation, DB information acquisition, backdoor installation, and malicious file upload.

In particular, according to the present invention, when an attempt is made to upload an executable or weak file extension determined through a configuration file of a web server, the upload is blocked.

The present invention has the effect of blocking executable or weak file extensions on the web server for extensions learned by profiling the server.

Specifically, according to the present invention, profiling is performed by comparing, comparing, or determining signature values of a file extension, a content-type, and a body, and based on the results of such profiling, It has the effect of blocking the upload of files with possibility of code.

BRIEF DESCRIPTION OF THE DRAWINGS [0029] The drawings, which need to be used for explaining embodiments in order to more clearly illustrate a technical solution in embodiments of the present invention, will be briefly described below. Of course, the drawings presented below are only a few of the embodiments of the present invention, and those skilled in the art will be able to obtain other drawings based on these drawings without any inventive work being done.
FIG. 1 is a conceptual diagram schematically illustrating a network device that performs a method of determining maliciousness of a file transmitted to and / or received from a web server according to an embodiment of the present invention.
FIG. 2 is a conceptual diagram schematically illustrating a network device performing a method of determining maliciousness of a file transmitted to and / or received from a web server according to an embodiment of the present invention, and the interaction between the web server and the user terminal.
3 is a flowchart schematically illustrating a method of determining maliciousness of a file transmitted to and / or received from a web server according to an embodiment of the present invention.
FIG. 4 is a diagram illustrating exemplary HTTP request information to be performed according to an exemplary embodiment of the present invention. Referring to FIG.

The following detailed description of the invention refers to the accompanying drawings, which illustrate, by way of example, specific embodiments in which the invention may be practiced in order to clarify the objects, technical solutions and advantages of the invention. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention.

Throughout the description and claims of the present invention, the word " vulnerable " and its variations are intended to mean a vulnerability in terms of network security, a vulnerability is a cracker Refers to a weakness that can be used to exploit a target system as an intended attacker. Typically, a vulnerable file is an executable file, as the security vulnerability of such code can be exploited by the execution of code contained in executable files.

It should be noted that in the detailed description and claims of the present invention, 'learning' is a term referring to performing machine learning in accordance with a procedure, and it is not intended to refer to a mental operation such as a human educational activity, You will understand.

Also, throughout the description and claims of this invention, the word 'comprise' and variations thereof are not intended to exclude other technical features, additions, elements or steps. Other objects, advantages and features of the present invention will become apparent to those skilled in the art from this description, and in part from the practice of the invention. The following examples and figures are provided by way of illustration and are not intended to limit the invention.

Moreover, the present invention encompasses all possible combinations of embodiments shown herein. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is to be limited only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly explained. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Unless otherwise indicated herein or clearly contradicted by context, items referred to in the singular are intended to encompass a plurality unless otherwise specified in the context. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention.

FIG. 1 is a conceptual diagram schematically showing a network device for performing a method of determining maliciousness of a file transmitted to and / or received from a web server according to an embodiment of the present invention. FIG. 3 is a conceptual diagram schematically illustrating the interaction between the web server and the user terminal.

Referring to FIG. 1, a network device 100 according to an embodiment of the present invention includes a communication unit 110 and a processor 120, and includes a web server, And can indirectly or directly communicate with a user terminal that is a terminal of a user.

In particular, the network device 100, web server, user terminal, and the like may be a conventional computing device (e.g., a computer processor, memory, storage, input device and output device, Electronic information storage systems such as network attached storage (NAS) and storage area network (SAN)) and computer software (i.e., instructions that cause the computing device to function in a particular manner) Lt; RTI ID = 0.0 > desired system performance. ≪ / RTI >

In addition, the communication unit 110 of the network device may send and receive requests and responses to and from other interworking computing devices. As an example, such requests and responses may be made by the same TCP session, For example, as a UDP datagram.

The processor 120 of the network device may include a hardware configuration such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. It may further include a software configuration of an operating system and an application that performs a specific purpose.

In FIG. 2, for convenience of explanation, the network device shown in the center is shown relaying transmission / reception between one user terminal and one web server (1: 1 relay) It will be understood by those of ordinary skill in the art that N repeating is also possible. In short, the number of user terminals and web servers to be relayed by the network device according to the present invention is not limited.

Now, a method for determining maliciousness of a file transmitted to and / or received from a web server according to the present invention will be described.

3 is a flowchart schematically illustrating a method of determining maliciousness of a file transmitted to and / or received from a web server according to an embodiment of the present invention.

Referring to FIG. 3, a method for determining maliciousness of a file transmitted to and / or received from a web server according to the present invention includes the steps of (i) (S310a; not shown) for extracting the extension of the vulnerable file from the setting information of the vulnerable file (S310b: not shown) through the profiling of the web server (S310).

For example, the extension of the vulnerable file may be php, asp, aspx, jsp, or the like, but the present invention is not limited thereto. The ordinary descriptor can be a file will be.

In an embodiment, the process S310a comprises the step (S311a; not shown) of the network device 100 extracting the extension of the vulnerable file from the configuration information of the web server; And extracting an extension of a file executable for each directory from the setting information of the web server (S312a; not shown).

Specifically, an example of a typical web server is an Apache server. The configuration file containing Apache configuration information includes an " AddType " directive, and an " application / x- httpd-php .php .php5 ", you can extract" php "and" php5 "as executable extensions from within the web server.

Extensions of executable files can also be extracted from the directory or file directive options in the configuration file of the Apache server, or from the contents of the "AddType" directive.

For example, the directives that can be included in the Apache server configuration information for "php" include "AddType application / x-httpd-php.php", "AddType application / x-httpd-php-source. jkMount / * / servlet / * worker1 ", etc. The directives relating to" jsp "may include" LoadModule jk_modules / mod_jk.so "," JkMount /*.jsp worker1 " In addition, directives related to "asp" may include "LoadModule asp_module modules / apasp136.dll" and "text / x-asp asp".

As another example, in the case of an engine (nginx) server which is one of representative web servers, it is possible to extract the extension of the executable file by analyzing the location block of http and server of the engine application (nginx) The technician will understand.

For example, for "php" related information, "location ~ \ .php $", "fastcgi_pass unix: / dev / shm / php5-fpm.sock; ", and the" jsp "related information may include" location ~ \ .jsp $ {"," location ^ ~ / servlets / "," location ~ \ .do $ " .

By analyzing the setting information of the web server as described above, executable extensions can be extracted for each directory or file, and the step of storing the extracted information in the database will be described later.

In an embodiment, the process S310b comprises: a process (S311b; not shown) of learning the file extension from the URL information included in the HTTP request information for the web server; an HTTP response a process S312b (not shown) for learning server information included in a header of response information and a link included in a body of HTTP response information from the web server, And a process of learning (S313b; not shown) to learn the extension of the vulnerable file.

Specifically, the HTTP protocol specification (see the web page https://tools.ietf.org/html/rfc2616#page-35) that defines HTTP request information in the HTTP protocol The request-URI can be extracted from the line (start line), and the learning can be performed by extracting the extension based on the last period (.) In the Request-URI. The static extension (for example, ) Are excluded and only executable file extensions can be extracted.

For example, the HTTP request information may typically be as shown in Table 1 below.

GET /books/search.asp HTTP / 1.1
Accept: image / gif, image / xxbitmap, image / jpeg, image / pjpeg,
application / xshockwaveflash, application / vnd.msexcel,
application / vnd.mspowerpoint, application / msword, * / *
Referer: http://wahh-app.com/books/default.asp
Accept-Language: en-gb, en-us; q = 0.5
Accept-Encoding: gzip, deflate
User-Agent: Mozilla / 4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Host: wahh-app.com
Cookie: lang = en; JSESSIONID = 0000tI8rk7joMx44S2Uu85nSWc_: vsnlc502

The URL information included in this example is "/books/search.asp" and "http://wahh-app.com/books/default.asp", and according to the process S311b, the network device 100 , And the file extensions " asp " and " asp " can be learned from the respective URL information.

In addition, the HTTP response information in the HTTP protocol may typically be as shown in Table 2 below.

HTTP / 1.1 200 OK
Date: Sat, 19 Mar 2007 13:49:37 GMT
Server: IBM_HTTP_SERVER / 1.3.26.2 Apache / 1.3.26 (Unix)
Set-Cookie: tracking = tI8rk7joMx44S2Uu85nSWc
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text / html; charset = ISO-8859-1
Content-Language: en-US
Content-Length: 24246
... (body) ...

In this example, the server information refers to the information displayed in the line beginning with " Server ", whose server information is " IBM_HTTP_SERVER / 1.3.26.2 Apache / 1.3.26 (Unix) ". This indicates an IBM server using Apache 1.3.26.

As another example, the server information may be "Server", "X-Powered-by", "Microsoft Office Web Server", "X-AspNet-version", "X-AspNetMvc-version" In the case of "X-AspNet-version" which is an example, the file extension "asp" can be learned according to the process S312b since "asp" is set as an extension of the executable file in the web server.

For example, if the server information is "Server: Microsoft-IIS / 6.0", it indicates that the server is using iis server 6.0, "Server: nginx / 1.9.6" indicates that the server uses nginx, Indicates that the version is 1.9.6, "Server: Apache / 2.4.9 (Unix) PHP / 5.5.12" uses Apache 2.4.9, and PHP uses version 5.5.12. You can also find server information by "X-Powered-by" item, "X-Powered-By: PHP / 5.12-1 + b1" X-Powered-By: ASP.NET "lets you know that you are using ASP, and" X-Powered-By: Servlet / 2.5 JSP / 2.1 " The server information can be confirmed by an item of "Microsoft office website", for example, there can be "Microsoft office website: 5.0_Pub" as an example of such an item, and the use version of ASP by "X-AspNet-version" Bar, "X-AspNet-Version: 2.0.50727" may be an example of such an item. Other "X-AspNetMvc-version" item will be able to know server information.

According to the process S313b, when the body included in the HTTP response information is in the form of text, the file extension can be obtained from the information of the internal link included in the text. If the HTTP response information is to return a typical HTML file, you can use the "<a href = ... > "HTML tag may be obtained, so that the file extension can be learned from the information of the link.

Referring again to FIG. 3, the method for determining malicious nature of a file according to the present invention further includes a step S320 of storing the list of clues including the extracted extension in the database by the network device 100 (S320).

Since the database is implemented by a technique well known to those skilled in the art, unnecessary detail thereof will be omitted. It will be appreciated that the database may be implemented by the network device 100, but not limited thereto, by other devices associated with the network device 100.

In one embodiment, the clue list may include a triplet of the vulnerable file's extension, content-type, and body signature values, More specifically, it will be described.

FIG. 4 is a diagram illustrating exemplary HTTP request information to be performed according to an exemplary embodiment of the present invention. Referring to FIG. The file extension "ppt" can be extracted from filename = "autotools.ppt" from the information that can be seen in this drawing and the content type "application / vnd.ms-powerpoint" from Content-Type: application / vnd.ms- Quot; can be extracted. Herein, the body signature value refers to binary data in the HTTP request information body which enables identification of the file "ppt" of the content type "application / vnd.ms-powerpoint".

When uploading a file, the body refers to the data of the actual file. The data of the actual file corresponds to the actual file uploaded by the user terminal, and the body signature value corresponds to the signature of the file.

More specifically, the signature of the file is characteristic information corresponding to a specific content type, a particular file extension, and by obtaining the signature of such a file from the binary data of the actual file, the content type and the file extension . An example of the function of acquiring the signature of a file is found in a command file in the Linux operating system, for example. In the case of a normal descriptor, binary data of the actual file is obtained through the file command of the Linux operating system. It is possible to check whether the content type corresponds to the content type and the file extension.

The triplet including the extension of the file, the content type, and the body signature value, that is, the combination of the three types, is used to block the file to be transmitted / received in the future if the file has potential potential to be malicious code .

In this embodiment, where the list of clues includes the triplet, step S311a of the above-described process S310a further comprises, from the configuration information of the web server, the network device to the extension of the vulnerable file and the content type Extracting at least one of the extension of the executable file and the content type for each directory from the setting information of the web server, and more particularly, the step (S312a) .

Also, in this embodiment in which the list of clues includes the triplet, the above-described process S311b may further include, from Uniform Resource Locator (URL) information included in HTTP request information for the web server, And the content type, and the process S312b may be a process of learning at least one of the HTTP response and the content type by learning server information contained in a header of HTTP response information from the web server, (S313b) may be a process of learning at least one of the file extension, the content type, and the body signature value from the information, and the process (S313b) may be a process of learning a link included in the body of the HTTP response information from the web server, And at least one of the file extension and the content type. In this case, the above-described process 310b may be a process of learning the list of clues through at least one of these processes S311b through S313b.

3, the file maliciousness determination method according to the present invention is characterized in that the network device 100 determines whether the malicious file is malicious or not based on the list of clues stored in the database, (S330) a blocking condition that determines whether the extension corresponds to the list of clues.

In step S330, the network device determines whether the file to be transmitted / received corresponds to the extension, the content type, and the body signature value included in the list of clues (S331) . &Lt; / RTI &gt;

The network device 100 determines whether the content type of the file to be transmitted and received matches the data of the file to be transmitted / received, if it is determined in step S330 that the correspondence is made by performing step S331 (S332a). In this case, if it is determined that the matching is not made, the network device 100 may determine (S333a) that the blocking condition is true

In step S330, if it is determined in step S331 that the correspondence does not correspond, the network device 100 determines whether the signature value obtained from the data of the transmitted / (S333b) determining whether the network device 100 matches the body signature value of the triplet (S332b). If the network device 100 determines that the matching is true, )can do.

In another embodiment, the step (S330) may be such that, when the blocking condition is true, the network device 100 blocks transmission / reception of a file transmitted / received to / from the web server.

It is possible to prevent the uploading of malicious code which may be a means for performing various attacks such as server operation, DB information acquisition, backdoor installation and malicious file upload, etc., over all the embodiments of the present invention described above .

An advantage of the techniques described herein as the above embodiments is that the security of the web server system can be improved by preventing the uploading of files corresponding to the list of learned cues extracted from the configuration file of the web server or profiling of the server It is greatly strengthened.

Based on the description of the above embodiments, one of ordinary skill in the art can clearly understand that the present invention can be accomplished through a combination of software and hardware, or achieved by hardware alone. Objects of the technical solution of the present invention or portions contributing to the prior art can be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, etc., alone or in combination. The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for performing the processing according to the present invention, and vice versa. The hardware device may include a processor, such as a CPU or a GPU, coupled to a memory, such as ROM / RAM, for storing program instructions, and configured to execute instructions stored in the memory, And a communication unit. In addition, the hardware device may include a keyboard, a mouse, and other external input devices for receiving commands generated by the developers.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, Those skilled in the art will appreciate that various modifications, additions and substitutions are possible, without departing from the scope and spirit of the invention as disclosed in the accompanying claims.

Therefore, the spirit of the present invention should not be construed as being limited to the above-described embodiments, and all of the equivalents or equivalents of the claims, as well as the following claims, I will say.

100: Network device
110:
120: Processor

Claims (20)

delete A method for determining whether a file transmitted to and / or received from a web server is malicious,
(a) a network device that relays transmission / reception between a client terminal and the web server, comprising: (i) a process of extracting a vulnerable file extension from configuration information of the web server; and (ii) Performing at least one of a process of learning the extension of the vulnerable file through profiling;
(b) the network device storing a list of clues including the extracted extension in a database; And
(c) determining, based on the list of clues stored in the database, the blocking condition that the network device determines whether an extension of a file transmitted to and / or received from the web server corresponds to the clue list;
, &Lt; / RTI &
The process (i) of the step (a)
(i-1) the network device extracting the extension of the vulnerable file from the setting information of the web server; And
(i-2) extracting an extension of a file executable for each directory from the setting information of the web server
&Lt; / RTI &gt; A method for determining whether a file transmitted to and / or received from a web server is malicious,
(a) a network device that relays transmission / reception between a client terminal and the web server, comprising: (i) a process of extracting a vulnerable file extension from configuration information of the web server; and (ii) Performing at least one of a process of learning the extension of the vulnerable file through profiling;
(b) the network device storing a list of clues including the extracted extension in a database; And
(c) determining, based on the list of clues stored in the database, the blocking condition that the network device determines whether an extension of a file transmitted to and / or received from the web server corresponds to the clue list;
, &Lt; / RTI &
The process (ii) of the step (a)
(ii-1) a process of learning the file extension from URL (Uniform Resource Locator) information included in HTTP request information for the web server,
(ii-2) a process of learning server information contained in a header of HTTP response information from the web server, and
(ii-3) a process of learning the file extension from a link included in a body of HTTP response information from the web server
And the extension of the vulnerable file is learned through at least one of the following. 3. The method of claim 2,
The step (c)
And if the blocking condition is true, the network device blocks transmission / reception of a file transmitted / received to / from the web server. A method for determining whether a file transmitted to and / or received from a web server is malicious,
(a) a network device that relays transmission / reception between a client terminal and the web server, comprising: (i) a process of extracting a vulnerable file extension from configuration information of the web server; and (ii) Performing at least one of a process of learning the extension of the vulnerable file through profiling;
(b) the network device storing a list of clues including the extracted extension in a database; And
(c) determining, based on the list of clues stored in the database, the blocking condition that the network device determines whether an extension of a file transmitted to and / or received from the web server corresponds to the clue list;
, &Lt; / RTI &
The above-
And a triplet of the extension, content-type and body signature value of the vulnerable file. 6. The method of claim 5,
The process (i) of the step (a)
(i-1 ') extracting at least one of the extension of the vulnerable file and the content type from the setting information of the web server; And
(i-2 ') extracting at least one of an extension of a file executable for each directory and the content type from the setting information of the web server
&Lt; / RTI &gt; 6. The method of claim 5,
The process (ii) of the step (a)
(ii-1 ') learning at least one of the file extension and the content type from URL information included in HTTP request information for the web server,
(ii-2 ') at least one of the file extension, the content type, and the body signature value from the HTTP response information by learning server information contained in a header of HTTP response information from the web server , &Lt; / RTI &gt; and
(ii-3 ') a process of learning at least one of the file extension and the content type from a link contained in a body of HTTP response information from the web server
And the list of clues is learned through at least one of the list of clues. 6. The method of claim 5,
The step (c)
(c1) determining whether the network device corresponds to the extension, the content type, and the body signature value of the transmitted / received file included in the list of clues;
(c2) if the corresponding correspondence is determined, the network device determining whether the content type of the file to be transmitted and received matches the data of the file to be transmitted / received; And
(c3) if it is determined that the match does not match, the network device determines that the cutoff condition is true
&Lt; / RTI &gt; 6. The method of claim 5,
The step (c)
(c1) determining whether the network device corresponds to the extension, the content type, and the body signature value of the transmitted / received file included in the list of clues;
(c2 ') determining that the network device does not match the signature value obtained from the data of the file to be transmitted / received, if the signature value is not matched with the body signature value of the specific triplet stored in the database; And
(c3 ') if said match is found, said network device determines that said cutoff condition is true
&Lt; / RTI &gt; A method for determining whether a file transmitted to and / or received from a web server is malicious,
(a) a network device that relays transmission / reception between a client terminal and the web server, comprising: (i) a process of extracting a vulnerable file extension from configuration information of the web server; and (ii) Performing at least one of a process of learning the extension of the vulnerable file through profiling;
(b) the network device storing a list of clues including the extracted extension in a database; And
(c) determining, based on the list of clues stored in the database, the blocking condition that the network device determines whether an extension of a file transmitted to and / or received from the web server corresponds to the clue list;
, &Lt; / RTI &
Wherein the extension of the vulnerable file is selected from the group consisting of php, asp, aspx, jsp. delete A network device for performing a method for determining whether a file transmitted to and / or received from a web server is malicious,
A communication unit for relaying transmission and reception between the client terminal and the web server; And
(i) a process of extracting a vulnerable file extension from configuration information of the web server and (ii) a process of learning the extension of the vulnerable file through profiling of the web server Comprising:
The processor comprising:
(iii) a step of storing a list of clues including the extracted extension in a database, and (iv) an extension of a file transmitted to and received from the web server based on the list of clues stored in the database, And a determination is made as to whether or not the blocking condition is satisfied,
The process (i)
(i-1) extracting an extension of the weak file from the setting information of the web server; And
(i-2) extracting an extension of a file executable for each directory from the setting information of the web server
&Lt; / RTI &gt; A network device for performing a method for determining whether a file transmitted to and / or received from a web server is malicious,
A communication unit for relaying transmission and reception between the client terminal and the web server; And
(i) a process of extracting a vulnerable file extension from configuration information of the web server and (ii) a process of learning the extension of the vulnerable file through profiling of the web server Comprising:
The processor comprising:
(iii) a step of storing a list of clues including the extracted extension in a database, and (iv) an extension of a file transmitted to and received from the web server based on the list of clues stored in the database, And a determination is made as to whether or not the blocking condition is satisfied,
The process (ii)
(ii-1) a process of learning the file extension from URL information included in HTTP request information for the web server,
(ii-2) a process of learning server information contained in a header of HTTP response information from the web server, and
(ii-3) a process of learning the file extension from a link included in a body of HTTP response information from the web server
And the extension of the weak file is learned through at least one of the following. 13. The method of claim 12,
The processor comprising:
And if the blocking condition is true, blocking transmission / reception of a file transmitted / received to / from the web server. A network device for performing a method for determining whether a file transmitted to and / or received from a web server is malicious,
A communication unit for relaying transmission and reception between the client terminal and the web server; And
(i) a process of extracting a vulnerable file extension from configuration information of the web server and (ii) a process of learning the extension of the vulnerable file through profiling of the web server Comprising:
The processor comprising:
(iii) a step of storing a list of clues including the extracted extension in a database, and (iv) an extension of a file transmitted to and received from the web server based on the list of clues stored in the database, And a determination is made as to whether or not the blocking condition is satisfied,
The above-
And a triplet of the extension, content-type and body signature value of the vulnerable file. 16. The method of claim 15,
The process (i)
(i-1 ') the network device extracting at least one of the extension of the vulnerable file and the content type from the setting information of the web server; And
(i-2 ') extracting at least one of an extension of a file executable for each directory and the content type from the setting information of the web server
&Lt; / RTI &gt; 16. The method of claim 15,
The process (ii)
(ii-1 ') a process of learning at least one of the file extension and the content type from URL (Uniform Resource Locator) information included in HTTP request information for the web server,
(ii-2 ') at least one of the file extension, the content type, and the body signature value from the HTTP response information by learning server information contained in a header of HTTP response information from the web server , &Lt; / RTI &gt; and
(ii-3 ') a process of learning at least one of the file extension and the content type from a link contained in a body of HTTP response information from the web server
And the list of clues is learned through at least one of the list of clues. 16. The method of claim 15,
The processor comprising:
(iii-1) determining whether the file to be transmitted and received corresponds to the extension, the content type, and the body signature value included in the list of clues;
(iii-2) determining whether the content type of the file to be transmitted and received matches the data of the file to be transmitted / received, if it is determined that the corresponding file is received; And
(iii-3) judging that the cutoff condition is true if it is determined not to match
To the network device. 16. The method of claim 15,
The processor comprising:
(iii-1) determining whether the file to be transmitted and received corresponds to the extension, the content type, and the body signature value included in the list of clues;
(iii-2 ') determining whether the signature value obtained from the data of the file to be transmitted and received matches the body signature value of the specific triplet stored in the database, if it is determined that the file does not correspond; And
(iii-3 ') judging that the cutoff condition is true
To the network device. A network device for performing a method for determining whether a file transmitted to and / or received from a web server is malicious,
A communication unit for relaying transmission and reception between the client terminal and the web server; And
(i) a process of extracting a vulnerable file extension from configuration information of the web server and (ii) a process of learning the extension of the vulnerable file through profiling of the web server Comprising:
The processor comprising:
(iii) a step of storing a list of clues including the extracted extension in a database, and (iv) an extension of a file transmitted to and received from the web server based on the list of clues stored in the database, And a determination is made as to whether or not the blocking condition is satisfied,
Wherein the extension of the vulnerable file is selected from the group comprising php, asp, aspx, jsp.

Images