KR102258965B1 - Method and device for classifying range of web attack types by using information on method field of http protocol and information on content-type field of http protocol - Google Patents

Abstract

Disclosed is a method of classifying a web attack type range based on content-type field information and method field information of an HTTP protocol. In other words, a method includes a step (a) in which a web attack type range analysis apparatus, when obtaining a packet corresponding to a web attack, refers to method field information of the packet to limit a web attack type of the packet to a first attack type range when the method field information is GET (i), and to limit the web attack type of the packet to a second attack type range when the method field information is POST (ii); and a step (b) in which the web attack type range analysis apparatus, when having the web attack type of the packet limited to the second attack type range, refers to content-type field information of the packet to limit the web attack type of the packet to one of a second_1 specific attack type range to a second_n specific attack type range as a specific attack type range included in the second attack type range. Therefore, the present invention is capable of calculating the same web attack type range classification result with respect to the same web attack.

Description

Method and device for classifying the range of web attack types using method field information and content-type field information of HTTP protocol FIELD OF HTTP PROTOCOL}

The present invention relates to a method and apparatus for classifying a range of a web attack type using method field information and content-type field information of an HTTP protocol.

According to the cyber attack trends for the third quarter of 2019 published by Ahnlab, 'web-based attacks' accounted for 44% of all breaches. This is because most web services can be easily accessed by hackers (attackers) as well as general clients, and defenders use web attack defense solutions such as IDS, IPS, and WAF to detect or respond to such web attacks.

However, since the defense solutions detect web attacks and classify attack types using their own signature base rules for each manufacturer, defense solutions that cannot detect a specific web attack depending on how each manufacturer's signature base rule is set may exist, and the same web attack can be classified into different attack types depending on how the filtering keyword is set.

1 schematically shows the signature base rule 110 of the first manufacturer and the signature base rule 120 of the second manufacturer, which have different web attack type classification criteria, the first packet ( 131), a second packet 132 corresponding to a command injection attack using “||”, and a third packet 133 corresponding to a command injection using “cat” are schematically shown.

Referring to FIG. 1 , in the existing web attack type classification method, in the case of the first packet 131, both the first and second signature base rules 110 and 120 succeed in classifying them as normal packets, but the second packet ( 132), since the command injection attack type using "||" is not defined for both the first and second signature base rules 110 and 120, it not only fails to detect a web attack, but also fails to detect a web attack of the packet. It is also impossible to prepare a separate classification criterion that can be referenced when analyzing types. In addition, in the case of the third packet 133, the first signature base rule 110 classifies the web attack type as command injection because the command injection method using "cat" is included, but the second signature base rule 120 ) does not define a command injection attack type using "cat", so the problem of incorrectly classifying the web attack type as a directory indexing type web attack based on "../../../etc/passwd" may occur.

For this reason, doubts may arise about the accuracy of the attack detection result and the attack type classification result calculated by each of the defense solutions, and may cause confusion in interpreting the attack detection result and the attack type classification result.

Such a problem is that the existing attack type classification using the signature-based rule ignores the characteristics of each part, despite the fact that the HTTP protocol is composed of a request line, header, and body and each part has a different character. It simply occurs because the judgment is based only on whether a specific keyword or a specific regular expression included in the signature base rule exists.

However, since parts that are not used in any type of web attack such as User-Agent, Referrer, and Content-Length may be included in the request line and header, a more efficient solution is prepared if the attack type is classified in consideration of the characteristics of each part You can do it.

Therefore, paying attention to the fact that the type of data used for an attack varies according to the type of attack, it is transmitted from the user by referring to the method field information of the request line containing information about the actual and core data transmitted by the client to the server. It identifies whether data exists in the URL or in the body, and classifies the web attack type by identifying the type of packet data by referring to the content-type field information of the header, making it more accurate than the existing web attack type classification method. We propose a method capable of classifying the same range of web attack types in defense solutions for each manufacturer.

It is an object of the present invention to solve all of the above-described problems.

Another object of the present invention is to propose a method for classifying a web attack type using method field information and content-type field information of the HTTP protocol.

Another object of the present invention is to propose a method of classifying the range of a web attack type by taking advantage of the fact that the data type used for the attack varies according to the type of web attack.

Another object of the present invention is to propose a method of calculating the same web attack type range classification result for the same web attack even if the manufacturers are different.

The characteristic configuration of the present invention for achieving the object of the present invention as described above and for realizing the characteristic effects of the present invention to be described later is as follows.

According to an aspect of the present invention, in a method for classifying a web attack type range using method field information and content-type field information of an HTTP protocol, (a) a web attack type range analysis apparatus includes a packet corresponding to a web attack is obtained, referring to the method field information of the packet, (i) when the method field information is GET, limits the web attack type of the packet to the first attack type range, (ii) the method field information is in the case of POST, limiting the web attack type of the packet to a second attack type range; and (b) if the web attack type range analysis apparatus limits the web attack type of the packet to the second attack type range, it refers to the content-type field information of the packet to determine the web attack type of the packet. Disclosed is a method including limiting to any one of a 2_1 detailed attack type range to a 2_n detailed attack type range as a detailed attack type range included in a second attack type range.

As an example, a method for determining, by the apparatus for analyzing a range of a web attack type, a search target location for finding a parameter included in the packet data with reference to method field information of the packet is disclosed.

As an example, (c) when the web attack type range analysis device (i) limits the web attack type range of the packet to the first attack type range, determining the search target location as the URL of the packet data, When the parameter is searched for the URL of the packet data, the web attack type of the packet is specified with reference to the retrieved parameter, and (ii) the web attack type of the packet is limited to the second attack type range , determining the search target location as the body of the packet data, searching for the parameter targeting the body of the packet data, and specifying a web attack type of the packet by referring to the searched parameter. is initiated.

As an example, in the step (a), the web attack type range analysis device may (i) when the method field information is GET, the first attack type range is available when the method field information is GET. determining to include web attack types, and (ii) when the method field information is POST, determining that the second attack type range includes web attack types of available methods when the method field information is POST; is initiated.

As an example, in step (a), when the method field information is not GET and POST, in step (a), the web attack type of the packet is limited to a third attack type range, and the third Disclosed is a method for determining an attack type range to include web attack types of a method usable when the method field information is not GET and POST.

As an example, in the step (b), the web attack type range analysis apparatus, using the content-type field information of the packet, the data type of the packet data - the data type of the packet data, is the packet data A method of identifying - meaning the format of the data included in the body of , is disclosed.

As an example, the apparatus for analyzing the range of the web attack type refers to the data type of the packet data and specific web attack types included in the second attack type range among web attack types using the packet data of the corresponding data type. A method for limiting a web attack type of a packet to the specific web attack types as the detailed attack type range is disclosed.

As an example, (d) the web attack type range analysis device refers to which of the first attack type range and the detailed attack type range the web attack type of the packet is classified, and determines the parameters included in the packet data. For reference, the official web attack types specified by KISA (Korea Internet & Security Agency) for the web attack type of the packet - The official web attack types are: buffer overflow, format string, LDAP injection, operating system command execution, SQL injection, SSI Injection, XPath Injection, Directory Indexing, Information Leakage, Malicious Content, Cross-Site Scripting, Weak String Strength, Insufficient Authentication, Weak Password Recovery, Cross-Site Request Forgery (CSRF), Session Prediction, Insufficient Authorization, Insufficient Session Expiration, Includes at least some of session fixation, automation attack, process validation omission, file upload, file download, admin page exposure, path tracking, location disclosure, data plaintext transmission, cookie tampering - and not included in the above official web attack types Disclosed is a method further comprising classifying into one of informal web attack types, wherein the informal web attack types include XXE injection.

As an example, when the web attack type of the packet does not correspond to any of the official web attack types and the unofficial web attack types, the web attack type analysis device determines the web attack type of the packet as an unknown attack (Zero). -Day) is disclosed.

According to another aspect of the present invention, there is provided a web attack type range analysis apparatus for classifying a web attack type range using method field information and content-type field information of an HTTP protocol, comprising: one or more memories for storing instructions; and one or more processors configured to perform the instructions, wherein (I) when the processor obtains a packet corresponding to a web attack, referring to method field information of the packet, (i) the method field information is GET , limiting the web attack type of the packet to a first attack type range, and (ii) when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and (II) if the processor limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, sets the web attack type of the packet to the second attack type range Disclosed is a web attack type range analysis apparatus that performs a process of limiting to any one of a 2_1 detailed attack type range to a 2_n detailed attack type range as a detailed attack type range included in .

As an example, a web attack type range analysis apparatus is disclosed in which the processor determines a search target location for finding a parameter included in the packet data by referring to method field information of the packet.

As an example, (III) the processor, (i) when the web attack type range of the packet is limited to the first attack type range, determines the search target location as the URL of the packet data to determine the URL of the packet data search the parameter for the target, specify the web attack type of the packet by referring to the retrieved parameter, and (ii) limit the web attack type of the packet to the second attack type range, the search target location is the body of the packet data, searches for the parameter targeting the body of the packet data, and further comprises a processor for specifying a web attack type of the packet with reference to the retrieved parameter. is initiated.

As an example, in the (I) process, the processor includes: (i) when the method field information is GET, the first attack type range includes web attack types of a method usable when the method field information is GET and (ii) when the method field information is POST, a web attack type range analysis device that determines that the second attack type range includes web attack types of available methods when the method field information is POST is initiated.

As an example, in the process (I), the processor is configured to, when the method field information is not GET and POST, limit the web attack type of the packet to a third attack type range, and the third attack type range is the A web attack type range analysis apparatus for determining to include web attack types of available methods when method field information is not GET and POST is disclosed.

As an example, in the process (II), the processor, by using the content-type field information of the packet, the data type of the packet data - the data type of the packet data, is included in the body of the packet data. A web attack type range analysis device that identifies - meaning the format of data is disclosed.

As an example, the processor may be configured to refer to a specific web attack type included in the second attack type range among web attack types using a data type of the packet data and packet data of the corresponding data type, and the web attack type of the packet. A web attack type range analysis apparatus for limiting to the specific web attack types as the detailed attack type range is disclosed.

As an example, (IV) the processor, referring to which of the first attack type range and the detailed attack type range, the web attack type of the packet is classified, and referring to the parameter included in the packet data, Official web attack types specified by KISA (Korea Internet & Security Agency) - The official web attack types are buffer overflow, format string, LDAP injection, operating system command execution, SQL injection, SSI injection, XPath injection, Directory Indexing, Information Leakage, Malicious Content, Cross-Site Scripting, Weak String Strength, Insufficient Authentication, Weak Password Recovery, Cross-Site Request Forgery (CSRF), Session Prediction, Insufficient Authorization, Insufficient Session Expiration, Session Lockout, Automation Attack , including at least some of process verification omission, file upload, file download, admin page exposure, path tracking, location disclosure, data plaintext transmission, cookie tampering - and unofficial web attack types not included in the above official web attack types - The unofficial web attack types, including XXE injection - A web attack type range analysis apparatus further comprising a process of classifying into one is disclosed.

As an example, when the web attack type of the packet does not correspond to any of the official web attack types and the unofficial web attack types, the web attack type analysis device determines the web attack type of the packet as an unknown attack (Zero). -Day), a web attack type range analysis device is disclosed.

The present invention is effective in classifying a web attack type using method field information and content-type field information of the HTTP protocol.

The present invention has the effect of classifying the range of web attack types by using the fact that the data types used for the attack vary depending on the web attack type.

The present invention has the effect of being able to calculate the same web attack type range classification result for the same web attack even if the manufacturers are different.

The accompanying drawings for use in the description of the embodiments of the present invention are only a part of the embodiments of the present invention, and for those of ordinary skill in the art to which the present invention pertains (hereinafter referred to as "those skilled in the art"), the invention Other drawings may be obtained based on these drawings without any work being done.
1 schematically shows the signature base rule of the first manufacturer and the signature base rule of the second manufacturer, which have different web attack type classification criteria, using the first packet "||" The second packet corresponding to the command injection attack and the third packet corresponding to the command injection using "cat" are schematically shown.
2 schematically shows a web attack type range classification apparatus for classifying web attack types using method field information and content-type field information of the HTTP protocol according to an embodiment of the present invention;
3 schematically illustrates a method for classifying a web attack type using method field information and content-type field information according to an embodiment of the present invention;
4 schematically shows the contents of a packet for example according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The following detailed description of the present invention refers to the accompanying drawings, which show by way of illustration a specific embodiment in which the present invention may be practiced, in order to clarify the objects, technical solutions and advantages of the present invention. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention.

Also, throughout this description and claims, the word "comprise" and variations thereof are not intended to exclude other technical features, additions, components or steps. Other objects, advantages and characteristics of the present invention will appear to a person skilled in the art, in part from this description, and in part from practice of the present invention. The following illustrations and drawings are provided by way of illustration and are not intended to limit the invention.

Moreover, the invention encompasses all possible combinations of the embodiments indicated herein. It should be understood that the various embodiments of the present invention are different from each other, but need not be mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the present invention in relation to one embodiment. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description to be described below is not intended to be taken in a limiting sense, and the scope of the present invention, if appropriately described, is limited only by the appended claims, along with all ranges equivalent to those claimed by the claims. Like reference numerals in the drawings refer to the same or similar functions over several aspects.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art to which the present invention pertains can easily practice the present invention.

2 schematically shows a web attack type range classification apparatus for classifying web attack types using method field information and content-type field information of the HTTP protocol according to an embodiment of the present invention. Referring to FIG. 2 , The web attack type range classification apparatus 2000 includes a memory 2100 in which instructions for classifying a web attack type using method field information and content-type field information of the HTTP protocol are stored, and method field information of the HTTP protocol according to the stored instructions. and a processor 2200 that performs an operation for classifying a range of a web attack type using the content-type field information.

Specifically, the web attack type scope classification device 2000 is a typical computing device (eg, a device that may include a computer processor, memory, storage, input device and output device, other components of a conventional computing device; a router; electronic communication devices such as switches; electronic information storage systems such as network attached storage (NAS) and storage area networks (SANs)) and computer software (i.e., instructions that cause the computing device to function in a particular way). may be used to achieve the desired system performance.

In addition, the processor of the computing device may include a hardware configuration such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. In addition, the computing device may further include an operating system and a software configuration of an application for performing a specific purpose.

However, a case in which the computing device includes an integrated processor in which a medium, a processor, and a memory are integrated for implementing the present invention is not excluded.

A method of classifying a web attack type using method field information and content-type field information according to an embodiment of the present invention configured as described above will be schematically described with reference to FIG. 3 as follows.

First, when the web attack type range classification device 2000 obtains a packet corresponding to a web attack, referring to the method field information of the packet (S300), if the method field information is GET, the web attack type of the packet is the first It may be determined that the packet is included in the first attack type range (S310), and if the method field information is POST, it may be determined that the web attack type of the packet is included in the second attack type range (S320).

In this case, when the method field information is GET, the first attack type range includes web attack types of available methods when the method field information is GET, and when the method field information is POST, the second attack type range The attack type range may include web attack types of available methods when the method field information is POST.

In addition, although not shown, when the method field information is not GET and POST, the web attack type range classification apparatus 2000 limits the web attack type of the packet to a third attack type range, and the third attack type It may be determined that the scope includes web attack types of available methods when the method field information is not GET and POST.

Specifically, if the method field information of a specific packet is GET, a web attack type of requesting a resource corresponding to a URL to the server may be included in the first attack type range, but a web attack of uploading a file to the server The type cannot be included in the first attack type range. That is, among the official web attack types, web attack types that upload files to the server such as 'file upload' are excluded, and URL parameters such as 'file download' are modulated to prevent visitors from accessing files other than the allowed files. The web attack type of the attempted type may be included in the range of the first attack type.

Next, when it is determined that the web attack type of the packet is included in the second attack type range, the web attack type range classification apparatus 2000 refers to the content-type field information of the packet (S321), The web attack type of the packet may be classified into any one of a 2_1 detailed attack type range to a 2_n detailed attack type range as a detailed attack type range included in the second attack type range ( S322 ). In this case, the web attack type range classification apparatus 2000 determines the data type by referring to the body of the packet data using the content-type field information of the packet, and then the web attack type included in the second attack type range. Among them, specific web attack types using data of the data type may be included in the detailed attack type range.

For example, referring to FIG. 4 , the web attack type range classification apparatus 2000 determines the web attack type of the example packet 401 as the second attack type because the method field information of the example packet 401 is POST. can be considered to be within the scope. At this time, the web attack type range classification apparatus 2000 selects, as the second attack type range, web attack types in which the environment to be used has a method field type of POST among the web attack types included in Table 1 below. The web attack type range of the packet 401 for example may be extracted primarily.

Vulnerability type data type directory indexing File path (raw data) SQL Injection SQL query statement (raw data) file upload file (file) XXE Injection XML data cross site scripting javascript ... ...

In more detail, web attack types used when the method field type is GET, such as directory indexing and file download using URL addresses, are excluded, and web attack types using data included in body when the field type is POST (for example, , SQL Injection, file upload, XXE Injection, cross-site script, etc.) as the second attack type range, the web attack type range of the packet for example 401 can be extracted primarily. Since it is determined that the web attack type of 401) is included in the second attack type range, the web attack type range classification apparatus 2000 refers to the content-type field information of the packet 401 for example, and provides packet data for example. It can be seen that the data type of the body of ' is text/xml. In this case, the web attack type range classification apparatus 2000 details a data type using the data type of the body of the packet data for example among web attack types included in the second attack type range with reference to Table 1 By culling with the attack type range, the web attack type range of the packet for example 401 may be secondarily extracted.

In more detail, web attack types that use other types of data such as SQL Injection using SQL query type data, Command Injection using system commands, and cross-site script using java script are excluded, and text/xml type The range of the web attack type of the packet for example 401 may be secondarily extracted by culling the web attack types (eg, XXE injection) using data as the detailed attack type range.

In addition, the web attack type range classification apparatus 2000 may identify information such as whether the data of the body of the packet data is a file format or a raw data format with reference to content-type, and if the file format is a compressed file format, If it is in pdf format or raw data format, information such as json format or xml format can also be identified.

In more detail, depending on the data type included in the packet, the content-type may have information as shown in Table 2 below, and the web attack type range classification apparatus 2000 refers to this to determine information on the format of body data. can

Content-type data type Application/json json file Application/msword Microsoft word file Application/pdf PDF file application/zip compressed file image/jpeg jpeg image Multipart/formed-data file uploaded by the client text/css Cascading Style Sheets (CSS) Text/javascript Java script Text/xml XML document ... ...

Meanwhile, the web attack type range classification apparatus 2000 may determine a search target location for finding a parameter by specifying a location of a parameter included in the packet data with reference to the method field information of the packet. When it is determined that the web attack type range of the packet is included in the first attack type range, the type range classification apparatus 2000 searches for the parameter by selecting a URL as the search target location and targeting the URL, and If it is determined that the range of the web attack type of the packet is included in the range of the second attack type, the parameter may be searched for the body by selecting the body as the search target location, and referring to the parameter, the web of the packet You can specify the type of attack.

In this case, the web attack type range classification apparatus 2000 may specify the web attack type of the packet using the parameter and the signature base rule, but is not limited thereto.

Also, the web attack type range classification apparatus 2000 may specify the web attack type of the packet by referring to which type range the web attack type of the packet is included in together with the parameter.

In this case, the web attack type of the packet may be specified as one of official web attack types designated by KISA (Korea Internet & Security Agency) and unofficial web attack types not included in the official web attack types, and the official web attack type Types include: Buffer Overflow, Format String, LDAP Injection, Operating System Command Execution, SQL Injection, SSI Injection, XPath Injection, Directory Indexing, Information Leakage, Malicious Content, Cross-Site Script, Weak String Strength, Insufficient Authentication, Weak Password Recovery , Cross-Site Request Forgery (CSRF), Session Prediction, Insufficient Authorization, Insufficient Session Expiration, Session Fixation, Automation Attacks, Missing Process Validation, File Upload, File Download, Admin Page Exposure, Path Tracking, Location Disclosure, Data Plaintext Transmission , cookie tampering may be included, and the unofficial web attack types may include XXE injection and the like.

On the other hand, the web attack type range classification apparatus 2000, if the packet includes an attack (not detected: False Negative) that is not detected by the existing solution, the packet is extracted using at least a part of data of the method field and body. The web attack type of the packet can be inferred or provided for analysis using the web attack type range of the packet, and when the web attack type of the packet does not correspond to any of the official web attack types and the unofficial web attack types, The web attack type of the packet may be classified as an unknown attack (Zero-Day).

In addition, the embodiments according to the present invention described above may be implemented in the form of program instructions that can be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, and the like alone or in combination. The program instructions recorded on the computer-readable recording medium may be specially designed and configured for the present invention, or may be known and used by those skilled in the computer software field. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floptical disks. media), and a hardware device specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform the processing according to the present invention, and vice versa.

In the above, the present invention has been described with specific matters such as specific components and limited embodiments and drawings, but these are provided to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , those of ordinary skill in the art to which the present invention pertains can devise various modifications and variations from these descriptions.

Therefore, the spirit of the present invention should not be limited to the above-described embodiments, and not only the claims described below but also all modifications equivalently or equivalently to the claims described below belong to the scope of the spirit of the present invention. will do it

Claims (18)

In the method of classifying the range of web attack types using method field information and content-type field information of HTTP protocol,
(a) When the web attack type range analysis device obtains a packet corresponding to a web attack, referring to the method field information of the packet, (i) when the method field information is GET, the web attack type of the packet limiting to a first attack type range, (ii) when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and
(b) if the web attack type range analysis device limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, determines the web attack type of the packet as the second attack type range limiting the detailed attack type range included in the second attack type range to any one of the 2_1th detailed attack type range to the 2_nth detailed attack type range;
Including,
The web attack type range analysis device determines a search target location for finding a parameter included in the packet data with reference to the method field information of the packet,
(c) when the web attack type range analysis apparatus (i) limits the web attack type range of the packet to the first attack type range, determines the search target location as the URL of the packet data to determine the packet data search the parameter for the URL of , specify the web attack type of the packet by referring to the retrieved parameter, and (ii) limit the web attack type of the packet to the second attack type range. determining a target location as the body of the packet data, searching for the parameter based on the body of the packet data, and specifying a web attack type of the packet by referring to the retrieved parameter;
How to further include. delete delete In the method of classifying the range of web attack types using method field information and content-type field information of HTTP protocol,
(a) When the web attack type range analysis device obtains a packet corresponding to a web attack, referring to the method field information of the packet, (i) when the method field information is GET, the web attack type of the packet limiting to a first attack type range, (ii) when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and
(b) if the web attack type range analysis device limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, determines the web attack type of the packet as the second attack type range limiting the detailed attack type range included in the second attack type range to any one of the 2_1th detailed attack type range to the 2_nth detailed attack type range;
Including,
In step (a),
The web attack type range analysis device is, (i) when the method field information is GET, determines that the first attack type range includes web attack types of available methods when the method field information is GET, ( ii) When the method field information is POST, determining that the second attack type range includes web attack types of available methods when the method field information is POST. In the method of classifying the range of web attack types using method field information and content-type field information of HTTP protocol,
(a) When the web attack type range analysis device obtains a packet corresponding to a web attack, referring to the method field information of the packet, (i) when the method field information is GET, the web attack type of the packet limiting to a first attack type range, (ii) when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and
(b) if the web attack type range analysis device limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, determines the web attack type of the packet as the second attack type range limiting the detailed attack type range included in the second attack type range to any one of the 2_1th detailed attack type range to the 2_nth detailed attack type range;
Including,
In step (a),
The web attack type range analysis device is, when the method field information is not GET and POST, limits the web attack type of the packet to a third attack type range, and the third attack type range indicates that the method field information is GET and a method for determining to include types of web attacks in non-POST available methods. delete In the method of classifying the range of web attack types using method field information and content-type field information of HTTP protocol,
(a) When the web attack type range analysis device obtains a packet corresponding to a web attack, referring to the method field information of the packet, (i) when the method field information is GET, the web attack type of the packet limiting to a first attack type range, (ii) when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and
(b) if the web attack type range analysis device limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, determines the web attack type of the packet as the second attack type range limiting the detailed attack type range included in the second attack type range to any one of the 2_1th detailed attack type range to the 2_nth detailed attack type range;
Including,
In step (b),
The web attack type range analysis apparatus uses the content-type field information of the packet, and the data type of the packet data - The data type of the packet data means the type of data included in the body of the packet data. to understand -
The apparatus for analyzing the range of the web attack type refers to the data type of the packet data and specific web attack types included in the second attack type range among web attack types using the packet data of the corresponding data type, A method of limiting an attack type to the specific web attack types as the detailed attack type range. In the method of classifying the range of web attack types using method field information and content-type field information of HTTP protocol,
(a) When the web attack type range analysis device obtains a packet corresponding to a web attack, referring to the method field information of the packet, (i) when the method field information is GET, the web attack type of the packet limiting to a first attack type range, (ii) when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and
(b) if the web attack type range analysis device limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, determines the web attack type of the packet as the second attack type range limiting the detailed attack type range included in the second attack type range to any one of the 2_1th detailed attack type range to the 2_nth detailed attack type range;
Including,
(d) the web attack type range analysis device refers to which of the first attack type range and the detailed attack type range the web attack type of the packet is classified, and refers to the parameter included in the packet data; Official web attack types designated by KISA (Korea Internet & Security Agency) for the web attack type of the packet - The official web attack types are: Buffer Overflow, Format String, LDAP Injection, Operating System Command Execution, SQL Injection, SSI Injection, XPath Injection, directory indexing, information leak, malicious content, cross-site scripting, weak string strength, insufficient authentication, weak password recovery, cross-site request tampering (CSRF), session prediction, insufficient authorization, insufficient session expiration, session locking, including at least some of automated attacks, process validation omission, file upload, file download, admin page exposure, path tracking, location disclosure, data plaintext transmission, cookie tampering - and unofficial web attacks not included in the above official web attack types classifying as one of types, the informal web attack types including XXE injection;
How to further include. The method of claim 8,
When the web attack type of the packet does not correspond to any of the official web attack types and the unofficial web attack types, the web attack type analysis device determines the web attack type of the packet as an unknown attack (Zero-Day) how to classify it as A web attack type range analysis device for classifying a web attack type range using method field information and content-type field information of HTTP protocol,
one or more memories storing instructions; and
one or more processors configured to perform the instructions,
(I) When the processor obtains a packet corresponding to a web attack, referring to the method field information of the packet, when the method field information is GET, the web attack type of the packet is limited to the first attack type range and, when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and (II) if the processor limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, sets the web attack type of the packet to the second attack type range A process of limiting to any one of the 2_1 detailed attack type range to the 2_n detailed attack type range as the detailed attack type range included in the
The processor determines a search target position for finding a parameter included in the packet data with reference to the method field information of the packet,
(III) when the processor limits the range of the web attack type of the packet to the range of the first attack type, the search target location is determined as the URL of the packet data, and the parameter is set to the URL of the packet data search, specify the web attack type of the packet by referring to the retrieved parameter, and determine the search target location as the body of the packet data when the web attack type of the packet is limited to the second attack type range and a processor for retrieving the parameter from the body of the packet data and specifying a web attack type of the packet with reference to the retrieved parameter. delete delete A web attack type range analysis device for classifying a web attack type range using method field information and content-type field information of HTTP protocol,
one or more memories storing instructions; and
one or more processors configured to perform the instructions,
(I) When the processor obtains a packet corresponding to a web attack, referring to the method field information of the packet, when the method field information is GET, the web attack type of the packet is limited to the first attack type range and, when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and (II) if the processor limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, sets the web attack type of the packet to the second attack type range A process of limiting to any one of the 2_1 detailed attack type range to the 2_n detailed attack type range as the detailed attack type range included in the
In the process (I), the processor determines that, when the method field information is GET, the first attack type range includes web attack types of available methods when the method field information is GET, When the field information is POST, the apparatus for analyzing a web attack type range determines that the second attack type range includes web attack types of available methods when the method field information is POST. A web attack type range analysis device for classifying a web attack type range using method field information and content-type field information of HTTP protocol,
one or more memories storing instructions; and
one or more processors configured to perform the instructions,
(I) When the processor obtains a packet corresponding to a web attack, referring to the method field information of the packet, when the method field information is GET, the web attack type of the packet is limited to the first attack type range and, when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and (II) if the processor limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, sets the web attack type of the packet to the second attack type range A process of limiting to any one of the 2_1 detailed attack type range to the 2_n detailed attack type range as the detailed attack type range included in the
In the process (I), when the method field information is not GET and POST, the processor limits the web attack type of the packet to a third attack type range, and the third attack type range is the method field information A web attack type range analysis device that determines to include web attack types of available methods when is not GET and POST. delete A web attack type range analysis device for classifying a web attack type range using method field information and content-type field information of HTTP protocol,
one or more memories storing instructions; and
one or more processors configured to perform the instructions,
(I) When the processor obtains a packet corresponding to a web attack, referring to the method field information of the packet, when the method field information is GET, the web attack type of the packet is limited to the first attack type range and limiting the web attack type of the packet to a second attack type range when the method field information is POST; and (II) if the processor limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, sets the web attack type of the packet to the second attack type range performing a process of limiting to any one of the 2_1 detailed attack type range to 2_n detailed attack type range
In the process (II), the processor, by using the content-type field information of the packet, the data type of the packet data - the data type of the packet data is a data type included in the body of the packet data means - to understand,
The processor is configured to refer to the specific web attack types included in the second attack type range among the data types of the packet data and the web attack types using the packet data of the corresponding data types to determine the detailed web attack type of the packet. A web attack type range analysis device that limits to the specific web attack types as an attack type range. A web attack type range analysis device for classifying a web attack type range using method field information and content-type field information of HTTP protocol,
one or more memories storing instructions; and
one or more processors configured to perform the instructions,
(I) When the processor obtains a packet corresponding to a web attack, referring to the method field information of the packet, when the method field information is GET, the web attack type of the packet is limited to the first attack type range and, when the method field information is POST, limiting the web attack type of the packet to a second attack type range; and (II) if the processor limits the web attack type of the packet to the second attack type range, referring to the content-type field information of the packet, sets the web attack type of the packet to the second attack type range A process of limiting to any one of the 2_1 detailed attack type range to the 2_n detailed attack type range as the detailed attack type range included in the
(IV) the processor refers to which of the first attack type range and the detailed attack type range the web attack type of the packet is classified, and refers to the parameter included in the packet data, Official web attack types specified by KISA (Korea Internet & Security Agency) - The official web attack types are: buffer overflow, format string, LDAP injection, operating system command execution, SQL injection, SSI injection, XPath injection, directory indexing, Information leakage, malicious content, cross-site scripts, weak string strength, insufficient authentication, weak password recovery, cross-site request tampering (CSRF), session prediction, insufficient authorization, insufficient session expiration, session fixation, automation attacks, process validation including at least some of omission, file upload, file download, admin page exposure, path tracking, location disclosure, data plaintext transmission, cookie tampering - and unofficial web attack types not included in the above official web attack types - the unofficial Web attack types, including XXE injection - Web attack type range analysis apparatus further comprising a process of classifying into one. The method of claim 17,
When the web attack type of the packet does not correspond to any of the official web attack types and the unofficial web attack types, the web attack type analysis device determines the web attack type of the packet as an unknown attack (Zero-Day) Web attack type scope analysis device to classify as.

Images