KR102134898B1 - System and method for providing integrated security service for web server based on cloud - Google Patents

Abstract

The present invention relates to a system for providing a cloud-based integrated web server security service. The system includes: an input unit receiving service type selection information and billing type selection information from a user terminal managing a web server; a security service providing unit providing a web server security service corresponding to the service type selection information among a plurality of web server security services; and a billing unit calculating a billing history based on the usage of the web server security service and the billing type selection information and transmitting the billing history to the user terminal. The service providing unit includes: a malware detection module detecting malware by real-time monitoring of a web page provided by the web server in a case where the service type selection information is a malware detection service; a web shell detection module detecting a web shell by real-time monitoring of a preset designated folder of the web server in a case where the service type selection information is a web shell detection service; a homepage forgery detection module detecting whether a homepage has been forged by real-time monitoring of content of the web page provided by the web server in a case where the service type selection information is a homepage forgery detection service; and a web firewall module detecting a web attack by monitoring the HTTP protocol traffic of the web server in a case where the service type selection information is a security vulnerability detection service.

Description

System and method for providing a cloud-based integrated web server security service {SYSTEM AND METHOD FOR PROVIDING INTEGRATED SECURITY SERVICE FOR WEB SERVER BASED ON CLOUD}

The present invention relates to a security service providing system and method, and more particularly, to a cloud-based integrated web server security service providing system and method.

Most companies maintain security by blocking the back office with a firewall or operating internal services through a separate network.

The web server for customer service has to be opened to the outside, and thus the security vulnerability of the web server or the security vulnerability of the web application can be a target for hackers.

Recently, cloud services sharing physical storage (resources) among cloud enterprise subscribers are expanding, resulting in data leakage, insufficient ID authentication information and access management, unsafe interfaces and APIs, system vulnerabilities, account hijacking, and malicious insiders New security threats are emerging, including Advanced Persistent Threats (APTs), data loss, insufficient due diligence, misuse and exploitation of cloud services, denial of service (DoS), and shared technology vulnerabilities.

Accordingly, there is a need for a technology capable of detecting and blocking security threats of a web server that must be opened for customer service.

The technical problem to be achieved by the present invention is to provide a system and method for providing a cloud-based integrated web server security service capable of detecting and blocking security threats of a web server that must be opened for customer service.

According to one embodiment, a system for providing a cloud-based integrated web server security service is provided. The web server security service providing system includes an input unit for receiving service type selection information and charging type selection information from a user terminal managing a web server, and a web server security service corresponding to the service type selection information among a plurality of web server security services. A security service providing unit provided, and a billing unit for calculating a billing history based on usage of the web server security service and the billing type selection information, and transmitting the billing history to the user terminal, wherein the service provider includes: When the service type selection information is a malicious code detection service, a malicious code detection module for real-time monitoring of a web page provided by the web server to detect malicious code, and when the service type selection information is a web shell detection service, the web Well-shell detection module that detects a web shell by real-time monitoring a preset folder of a server, and if the service type selection information is a homepage forgery detection service, monitors forgery of the homepage by real-time monitoring the content of the webpage provided by the web server Homepage forgery detection module for detecting, and a web firewall module for detecting a web attack by monitoring HTTP protocol traffic of the web server when the service type selection information is a security vulnerability detection service.

The malicious code detection module may detect a malicious code distribution site or a destination URL included in the web page using a machine learning model previously learned.

The web server security service providing system receives monitoring results from the malicious code detection module, well shell detection module, homepage forgery detection module, and web firewall module, generates detection result details against the monitoring results, and records the detection result details It may further include a notification unit for transmitting to the user terminal.

According to one embodiment, a method of providing a cloud-based integrated web server security service is provided. The web server security service providing method includes receiving service type selection information and charging type selection information from a user terminal managing a web server, and providing a web server security service corresponding to the service type selection information among a plurality of web server security services. Providing, and calculating a billing history based on the usage amount of the web server security service and the billing type selection information, and transmitting the billing history to the user terminal, and providing the web server security service Step, if the service type selection information is a malicious code detection service, detecting the malicious code by monitoring the web page provided by the web server in real time, if the service type selection information is a web shell detection service, the web Detecting a web shell by real-time monitoring a predetermined folder of a server in real time, and when the service type selection information is a homepage forgery detection service, monitors forgery of the homepage by real-time monitoring the content of the webpage provided by the web server. And detecting the web attack by monitoring the HTTP protocol traffic of the web server when the service type selection information is a security vulnerability detection service.

In the step of detecting the malicious code, the URL of the malicious code distribution or stoppage included in the web page may be detected using a machine learning model previously learned.

Integrated web security for web servers such as malicious code detection, web shell detection, homepage forgery detection, and web vulnerability detection is possible.

In addition, it is possible to provide a customized comprehensive web security service to SMEs that are difficult to manage through various security equipment and solutions due to lack of budget.

1 is a block diagram of a web server security service providing system according to an embodiment.
2 is a block diagram of a security service providing unit of a web server security service providing system according to an embodiment.
3 to 7 are diagrams for explaining a web shell detection method according to an embodiment.
8 and 9 are flowcharts of a method for providing a web server security service according to an embodiment.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art to which the present invention pertains may easily practice. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. In addition, in order to clearly describe the present invention in the drawings, parts irrelevant to the description are omitted, and like reference numerals are assigned to similar parts throughout the specification.

Throughout the specification, when a part “includes” a certain component, it means that the component may further include other components, not to exclude other components, unless otherwise specified.

1 is a block diagram of a web server security service providing system according to an embodiment. 2 is a block diagram of a security service providing unit of a web server security service providing system according to an embodiment. 3 to 7 are diagrams for explaining a web shell detection method according to an embodiment.

1, the web server security service providing system according to an embodiment includes an input unit 110, a security service providing unit 120, a billing unit 130, a notification unit 140, a storage unit 150, and It includes a communication unit 160.

The input unit 110 receives service type selection information and charging type selection information from the user terminal 10. The input unit 110 may receive subscriber agreement agreement information, service type selection information, and billing type selection information, which are online membership information, from the user terminal 10 of the subscriber managing the web server 30. The service type selection information may include at least one of a malicious code detection service, a web shell detection service, a homepage forgery detection service, and a security vulnerability detection service. The billing type selection information may include at least one of billing according to weekly usage, billing according to monthly usage, and billing according to the number of service selection items. The user terminal 10 is, as one embodiment, a mobile communication terminal, a desktop computer, a laptop computer, a workstation, a palmtop (palmtop) computer, a personal digital assistant (Personal Digital Assistant, PDA), and a memory means such as a web pad And it may be a digital device equipped with a microprocessor equipped with computing power.

The security service providing unit 120 provides a web server security service corresponding to service type selection information received from the user terminal 10 among a plurality of web server security services to a subscriber.

Referring to FIG. 2, the security service providing unit 120 includes, as an embodiment, a malicious code detection module 121, a well shell detection module 122, a homepage forgery detection module 123, and a web firewall module 124. It can contain.

The malicious code detection module 121 detects malicious code by monitoring the web page provided by the web server 30 in real time when the service type selection information is a malicious code detection service. The malicious code detection module 121 may detect a malicious code distribution site or a destination URL included in a web page using a machine learning model previously learned. The malware detection module 121 is an embodiment, using a pre-trained machine learning model, viruses, worms, Trojans, hybrids and exotic forms, ransomware, fileless ) It can detect malicious codes such as malware, adware, and spyware. The malicious code detection module 121 can extract the malicious code characteristic information by performing static analysis and dynamic analysis on the malicious code, and learn the machine learning model using the malicious code characteristic information. can do. The malicious code detection module 121 can detect the URL of the malicious code distribution site or the destination via the meta attribute information such as the type of malware, collection method, exploit type, propagation method, generation method, and execution method as input variables of the machine learning model. have.

The malicious code detection module 121 may detect malicious codes based on the PE module as an embodiment. The malicious code detection module 121 may monitor the payload of the http protocol transmitted in/out in real time through the web server 30 and detect the intrusion type, as an embodiment. .

When the service type selection information is a web shell detection service, the well shell detection module 122 detects a web shell by real-time monitoring a predetermined designated folder of the web server 30. The well shell detection module 122 may detect web shells in units of files, such as HTML and Java Script, as an embodiment. The well shell detection module 122 may detect script languages such as PHP, JSP, and ASP, as an embodiment. The well shell detection module 122 is an embodiment, and may detect a web shell using a pre-trained machine learning model.

Referring to FIG. 3, the wellshell detection module 122, as an embodiment, calculates the similarity between the original file and the webshell samples using a fuzzy hash algorithm, and detects the webshell based on the similarity of each sample. Can be.

Referring to FIG. 4, the well shell detection module 122 may detect a web shell using a POSIX, RE2 pattern regular expression pattern detection engine as an embodiment. The wellshell detection module 122 is an embodiment, and may include a YARA module.

Referring to FIG. 5, the wellshell detection module 122 is an embodiment, and in the case of a previously found webshell, the webshell may be detected by comparing hash values of the corresponding files.

Referring to FIG. 6, the well-shell detection module 122 may detect abnormal source codes such as encoding, compression, obfuscation, etc. in addition to the normal source code, as an embodiment. The well-shell detection module 122 may detect source codes to which Base64, VbScript, XOR, Gzip, Zend, etc. are applied as one embodiment.

Referring to FIG. 7, the well-shell detection module 122 may detect a web shell using malicious code URL hash information collected from a C-TAS server of a domestic information sharing analysis institution, as an embodiment.

When the service type selection information is the homepage forgery detection service, the homepage forgery detection module 123 detects the forgery of the homepage by monitoring the content of the webpage provided by the web server 30 in real time. The homepage forgery detection module 123 is an embodiment, and may detect whether the homepage is forged or not by using the tag signature of the content. The homepage forgery detection module 123 may detect, for example, homepage forgery in the unit of a subscriber registration service URL. The homepage forgery detection module 123, as an embodiment, may detect homepage forgery based on fixed homepage text or variable text.

The web firewall module 124 detects a web attack by monitoring HTTP protocol traffic of the web server 30 when the service type selection information is a security vulnerability detection service. The web firewall module 124, as an embodiment, inspects HTTP protocol traffic entering the web server 30 by using a common rule including an attack pattern stored in the storage unit 150, and blocks packets determined as attacks. Can be.

The billing unit 130 calculates billing details based on the usage amount of the web server security service and billing type selection information received from the user terminal 10 (or selected by the subscriber), and calculates the billing details on the user terminal 10 To send.

The notification unit 140 receives the monitoring results from the malicious code detection module 121, the well shell detection module 122, the homepage forgery detection module 123, and the web firewall module 124, and detects the detection result details against the monitoring results. It generates, and transmits the detection result details to the user terminal 10. The notification unit 140 generates a detection and blocking history by the malicious code detection module 121, the well shell detection module 122, the homepage forgery detection module 123, and the web firewall module 124 as an embodiment, The detection and blocking details may be transmitted to the user terminal 10. The notification unit 140 is a malicious code detection module 121, a well-shell detection module 122, a homepage forgery detection module 123, a web firewall module 124 for malicious code, webshell, homepage forgery, When a web attack is detected, a notification message may be sent to the user terminal 10.

As an embodiment, the storage unit 150 may store subscriber agreement agreement information, service type selection information, and billing type selection information, which are online membership information received from the user terminal 10. The storage unit 150 may store pattern signature, file hash, fuzzy hash, and malicious code URL information as an embodiment.

The communication unit 160 may transmit and receive data to and from the user terminal 10 and the web server 30, and may transmit billing details to the user terminal 10 according to an instruction of the charging unit 130, and a notification unit ( According to the command of 140), it is possible to transmit the detection result details, detection and blocking details, and a notification message to the user terminal 10.

8 and 9 are flowcharts of a method for providing a web server security service according to an embodiment.

8 and 9, a method for providing a web server security service according to an embodiment includes receiving service type selection information and charging type selection information from a user terminal managing a web server (S100), a plurality of web servers Providing a web server security service corresponding to the service type selection information among the security services (S200), and calculating a billing history based on the usage and billing type selection information of the web server security service, and transmitting the billing history to the user terminal Step (S300), and providing a web server security service (S200), when the service type selection information is a malicious code detection service, detects malicious code by monitoring the web page provided by the web server in real time Step (S210), if the service type selection information is a web shell detection service, detecting a web shell by monitoring a preset folder of a web server in real time (S220), if the service type selection information is a homepage forgery detection service, the web Step of detecting the forgery of the homepage by real-time monitoring the content of the web page provided by the server (S230), and, if the service type selection information is a security vulnerability detection service, by monitoring the HTTP protocol traffic of the web server And detecting a web attack (S240).

In the step of detecting the malicious code (S210 ), the URL of the malicious code distribution or stoppage included in the web page may be detected using a machine learning model that has been previously learned.

Receiving service type selection information and charging type selection information from a user terminal (S100), providing a web server security service (S200), detecting a malicious code (S210), and detecting a web shell (S220) , The step of detecting the forgery of the homepage (S230), the step of detecting a web attack (S240), and the step of transmitting the billing details to the user terminal (S300) are the input unit 110 and the security service provider 120 described above , It is the same as the operation contents of the charging unit 130, the notification unit 140, the storage unit 150, and the communication unit 160, and detailed description thereof will be omitted.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concept of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

Claims (5)

A system that provides a cloud-based integrated web server security service,
Input unit for receiving subscriber agreement agreement information, service type selection information, and billing type selection information from a user terminal managing a web server,
A security service providing unit that provides a web server security service corresponding to the service type selection information among a plurality of web server security services, and
A billing unit that calculates billing details based on the usage of the web server security service and the billing type selection information, and transmits the billing details to the user terminal
Including,
The security service providing unit,
When the service type selection information is a malicious code detection service, a malicious code detection module that detects malicious code by real-time monitoring a web page provided by the web server,
When the service type selection information is a web shell detection service, a well shell detection module that detects a web shell by real-time monitoring a preset folder of the web server,
When the service type selection information is a homepage forgery detection service, a homepage forgery detection module for real-time monitoring of the content of the webpage provided by the web server to detect whether the homepage is forged, and
If the service type selection information is a security vulnerability detection service, and includes a web firewall module for detecting a web attack by monitoring the HTTP protocol traffic of the web server,
When the malicious code detection module, well shell detection module, homepage forgery detection module, web firewall module detects malicious code, webshell, homepage forgery, web attack, a notification unit to send a notification message to the user terminal, and
Further comprising a storage unit for storing the subscriber agreement information, service type selection information, and billing type selection information, file hash, fuzzy hash, and malware URL information,
The billing type selection information includes billing according to weekly usage, billing according to monthly usage, and billing according to the number of service selection items,
The well shell detection module,
The fuzzy hash algorithm is used to calculate the similarity between the original file and the webshell samples, detect the webshell based on the similarity of each sample, and in the case of the previously found webshell, detect the webshell through hash value comparison and information Detects the web shell using the hash information of the malicious code URL collected from the server of the shared analysis institution,
The homepage forgery detection module,
A web server security service providing system that detects the forgery of the homepage using the tag signature of the content, detects the forgery of the homepage in the URL of the subscriber registration service, and detects the forgery of the homepage based on the fixed text or variable text of the homepage. In claim 1,
The malicious code detection module,
A web server security service providing system that detects a malicious code distribution site or a destination URL included in the web page using a pre-trained machine learning model. In claim 1,
The notification unit,
Web that receives monitoring results from the malicious code detection module, well shell detection module, homepage forgery detection module, and web firewall module, generates detection result details against the monitoring results, and transmits the detection result details to the user terminal. Server security service providing system. As a method of providing a cloud-based integrated web server security service,
Receiving subscriber agreement agreement information, service type selection information, and billing type selection information from a user terminal managing a web server,
Providing a web server security service corresponding to the service type selection information among a plurality of web server security services, and
Calculating a billing history based on the usage amount of the web server security service and the billing type selection information, and transmitting the billing history to the user terminal
Including,
Providing the web server security service,
If the service type selection information is a malicious code detection service, detecting the malicious code by monitoring the web page provided by the web server in real time,
When the service type selection information is a web shell detection service, detecting a web shell by monitoring a preset folder of the web server in real time,
If the service type selection information is a homepage forgery detection service, detecting the forgery of the homepage by real-time monitoring the content of the webpage provided by the web server, and
When the service type selection information is a security vulnerability detection service, comprising: detecting a web attack by monitoring HTTP protocol traffic of the web server,
The billing type selection information includes billing according to weekly usage, billing according to monthly usage, and billing according to the number of service selection items,
In the detecting of the web shell, a fuzzy hash algorithm is used to calculate the similarity between the original file and the web shell samples, detect the web shell based on the similarity of each sample, and compare the hash values in the case of the previously found web shell To detect the web shell, and to detect the web shell using the malicious code URL hash information collected from the server of the information sharing analysis institution,
The step of detecting the forgery of the homepage detects the forgery of the homepage using the tag signature of the content, detects the forgery of the homepage in the unit of the subscriber registration service URL, and the forgery of the homepage based on the fixed text or variable text of the homepage. How to detect and provide web server security services. In claim 4,
The step of detecting the malicious code,
A method for providing a web server security service using a pre-trained machine learning model to detect a malicious code distribution site or a destination URL included in the web page.

Images