KR102280774B1 - Automated web firewall policy establishment apparatus and method through profiling log analysis - Google Patents

Abstract

The present invention relates to an apparatus and method for establishing an automated web firewall policy through profiling log analysis. The method according to the present invention provides a profile-based security policy established by learning a normal request URL profile based on normal response data during a learning period. and analyzing a request URL that does not violate the profile attribute of the profile-based security policy from the detection log detected according to the method, and generating an exception rule for the profile-based security policy based on the result of analyzing the request URL. According to the present invention, by statistically analyzing the detection log through the initial learning profile-based security policy, automatically establishing and applying exception rules by automatically classifying each detection type, or providing policy suggestions to help the administrator to apply them. It can help to establish a security policy for each URL.

Description

Automated web firewall policy establishment apparatus and method through profiling log analysis}

The present invention relates to an automated web firewall policy establishment apparatus and method, and more particularly, to an automated web firewall policy establishment apparatus and method through profiling log analysis.

The most difficult problem in operation of the existing web application firewall (hereinafter referred to as 'web firewall') is to modify the security policy and handle exceptions in order to respond to false positives that occur for each individual website (hereinafter referred to as 'false false positives'). .

Web firewalls have detection patterns according to various attack types, and are designed to block attacks that violate them. However, the usage method is different for each individual web page. And sometimes, repeated normal behavior is regarded as an attack and detected or blocked. In order to solve this problem, policy revision work by experts is usually required several times, and in some cases, the web page itself needs to be revised and supplemented.

For example, the data for learning in the prior art "Profiling-based web service security system and its method (10-2005-0048558)" is based on a normal response to a request, but even when a response to an abnormal request occurs, the data can be learned. There are limits to what can be done.

Korean Patent Publication No. 10-2005-0048558 (published date: May 24, 2005)

The technical problem to be solved by the present invention is to provide an apparatus and method for establishing an automated web firewall policy through profiling log analysis.

In the method according to an embodiment of the present invention for solving the above technical problem, the profile from the detection log detected according to the profile-based security policy established by learning the normal request URL profile based on the normal response data during the learning period analyzing a request URL that does not violate a profile attribute of a base security policy, and generating an exception rule for the profile-based security policy based on a result of analyzing the request URL.

The request URL that does not violate the profile attribute of the profile-based security policy may be a request URL in which the parameter name and parameter value of the request URL in the detection log do not violate the profile attribute of the profile-based security policy.

The analyzing step is to obtain a detection rate for each source IP by classifying a request URL that contains a special character or does not contain a single parameter without a delimiter as an exception processing candidate among the request URLs that do not violate the profile property. The method may further include checking whether a detection frequency satisfies a predetermined condition for a source IP whose detection rate is less than a predetermined criterion.

The detection ratio may be obtained by the equation R = N / T.

Here, N may be the number of request URLs having a corresponding source IP among the exception processing candidate classification request URLs, and T may be the total number of URLs included in the detection log.

If the detection frequency of the detected source IP does not satisfy a predetermined condition, an exception rule may be generated to process a request URL having the detected source IP from among the extracted request URLs as a normal request.

The predetermined condition for the detection frequency may be determined to be equal to or greater than the first detection frequency criterion or greater than or equal to the second detection frequency criterion.

The first detection frequency criterion may be determined as that the source IP is detected a first reference number of times during a first time period, and the second detection frequency criterion may be determined as a second reference number of detection times during a second time period.

The first time period may be set longer than the second time period, and the second detection frequency criterion may be set higher than the first detection frequency criterion.

It is possible to create an exception rule for processing a request URL including a single parameter without a delimiter as a normal request without including special characters among the extracted request URLs.

The profile-based security policy may be determined for each URL page.

The system according to an embodiment of the present invention for solving the above technical problem, the profile from the detection log detected according to the profile-based security policy established by learning the normal request URL profile based on the normal response data during the learning period and an analysis unit that analyzes a request URL that does not violate a profile attribute of a base security policy, and an exception rule generator that generates an exception rule for the profile-based security policy based on a result of analyzing the request URL.

According to the present invention, by statistically analyzing the detection log through the initial learning profile-based security policy, automatically establishing and applying exception rules by automatically classifying each detection type, or providing policy suggestions to help the administrator to apply them. It can help to establish a security policy for each URL.

1 is a configuration diagram of an automated web firewall policy establishment device through profiling log analysis according to an embodiment of the present invention.
2 is a flowchart of an automated web firewall policy establishment method through profiling log analysis according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings, the embodiments of the present invention will be described in detail so that those of ordinary skill in the art can easily implement them. However, the present invention may be embodied in various different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated.

In addition, the terms “…unit” and “…module” described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software.

1 is a block diagram of an automated web firewall policy establishment device through profiling log analysis according to an embodiment of the present invention.

Referring to FIG. 1 , an apparatus 100 according to the present invention may include a profiling-based security module 110 and an exception rule generation module 120 . According to an embodiment, the device 100 may include only the exception rule generating module 120 .

The profiling-based security module 110 may establish a profile-based security policy by learning the normal request URL profile based on the normal response data during the learning period. In more detail, the profiling-based security module 110 may detect an unknown attack that is not detected by a signature-based detection technique. To this end, the profiling-based security module 110 receives normal web service response data provided from a web service system (not shown) in response to a URL request from a client during a predetermined learning period (eg, the initial period of web service provision). By analyzing, profile data including host, path, parameter name, parameter value, etc. for a normal URL request are learned, and a profile-based security policy can be established based on this to detect whether the request URL is normal or abnormal. .

The profile-based security policy may be determined for each URL page.

The profiling-based security module 110 may detect and/or block an abnormal URL request according to a profile-based security policy. And the profiling-based security module 110 may record a log detected according to the profile-based security policy.

On the other hand, if the profiling-based security module 110 analyzes the detection log and determines that the corresponding URL page has been updated, the profile-based security policy can be reestablished by learning the normal requested URL profile after the corresponding URL page update.

The exception rule creation module 120 may receive and analyze a log detected according to the profile-based security policy from the profiling-based security module 110 , and may generate an exception rule according to the analysis result.

The exception rule generation module 120 may include a parsing preprocessor 121 , an analyzer 123 , and an exception rule generator 125 .

The parsing preprocessor 121 parses the log detected by the profiling-based security module 110 . The parsing preprocessor 121 may normalize the request URL for each URL page (per web page) and preprocess it so that the parsing unit 123 may extract and analyze the parameter name, parameter value, etc. included in the URL.

In addition, the parsing preprocessor 121 performs parsing on the log detected by the profiling-based security module 110, and when it is determined that the URL page corresponding to the detection log is updated, the profiling-based security module 110 ) learns the normal request URL profile for the corresponding URL page again, so that the profile-based security policy can be established again.

The analyzer 123 may check whether the requested URL detected according to the normal request URL profile-based security policy violates the attribute of the normal request URL profile. For example, the analyzer 123 may check whether the parameter name and parameter value in the detected request URL log violate the properties of the normal request URL profile.

When the parameter name, parameter value, etc. of the request URL detected by the profiling-based security module 110 are in violation of the properties of the normal request URL profile, the profiling-based security module 110 is deemed to have detected the request URL normally can do. On the other hand, when the parameter name, parameter value, etc. of the request URL detected by the profiling-based security module 110 do not violate the properties of the normal request URL profile, the analysis unit 123 determines that the profiling-based security module 110 is We can determine that the request URL is likely a false positive and perform further analysis.

The analysis unit 123 may classify a request URL that contains a special character or does not include a single parameter without a separator among the extracted request URL as an exception processing candidate to obtain a detection rate for each source IP.

The detection rate (R) for each source IP can be obtained by the following equation.

[Equation 1]

R = N/T

Here, N is the number of request URLs having a corresponding source IP among the exception processing candidate classification URLs, and T is the number of total URLs included in the detection log.

Request URLs with a source IP whose detection rate is greater than or equal to a predetermined standard are considered to be normally detected and excluded from the creation of exception rules.

The analysis unit 123 may check whether a detection frequency satisfies a predetermined condition with respect to a source IP whose detection rate is less than a predetermined criterion.

One detection frequency criterion may be set, or a plurality of detection frequency criteria may be set. For example, only one criterion for the detection frequency may be set, or two or more criteria may be set. When two or more detection frequency criteria are set, the first detection frequency criterion is determined that the source IP is detected the first reference number of times during the first time, and the second detection frequency criterion is the second reference number of times during the second time period. can be determined to be detected. In this case, the first time period may be set longer than the second time period, but the second detection frequency criterion may be set higher than the first detection frequency criterion. For example, the first detection frequency reference may be set to 60 times per minute, and the second detection frequency reference may be set to 20 times per second.

If the detection frequency of the detected source IP does not satisfy a predetermined condition, the exception rule generator 125 considers that a request URL having the detected source IP among the extracted request URLs is false, and returns the request URL as a normal request. You can create a detection exception rule to handle with .

The exception rule generator 125 may generate an exception rule for processing a request URL including a single parameter without a delimiter as a normal request without including special characters among the extracted request URLs.

The exception rule generator 125 may generate an exception rule not to detect the corresponding request URL itself having the detected source IP, or the parameter name or parameter value of the corresponding request URL.

According to an embodiment, the exception rule generated by the exception rule generator 125 may be directly applied to the security policy of the profiling-based security module 110 . Alternatively, the exception rule may be output and applied after receiving a selection from the operator whether to apply or not.

2 is a flowchart of an automated web firewall policy establishment method through profiling log analysis according to an embodiment of the present invention.

1 and 2 , first, the parsing preprocessor 121 parses the log detected by the profiling-based security module 110 ( S210 ). In step S210, the parsing preprocessor 121 may normalize the request URL for each URL page (per web page), extract the parameter name, the parameter value, etc. included in the request URL, and pre-process it so that it can be analyzed.

Next, as a result of parsing the detection log detected by the profiling-based security module 110, the parsing preprocessor 121 determines that the URL page corresponding to the detection log is updated (S220-Y), The profiling-based security module 110 may again re-establish a profile-based security policy by performing normal request URL profile learning for the corresponding URL page (S230).

If it is determined that the URL page is not updated (S220-N), the analysis unit 123 may check whether the requested URL detected according to the normal request URL profile-based security policy violates the attribute of the normal request URL profile (S240) .

If the request URL violates the attribute of the normal request URL profile (S240-Y), the analysis unit 123 may consider that the request URL is normally detected and may not extract it as an exception processing target.

On the other hand, the analysis unit 123 determines whether the request URL does not violate the attribute of the normal request URL profile (S240-N), the analysis unit 123 determines whether the request URL contains special characters (S251) and/or the request It can be checked whether a single parameter without a separator is included in the URL (S253).

If the request URL does not contain special characters (S251-N) and the request URL includes a single parameter without a separator (S253-Y), the exception rule generator 125 processes the request URL as a normal request. It is possible to create an exception rule to do so (S260).

On the other hand, if the request URL contains special characters or does not include a single parameter without a delimiter (S251-Y, S253-N), the analysis unit 123 classifies the URL as a candidate for exception handling and selects the source IP. A star detection rate can be obtained (S255). In step S255, the detection rate R for each source IP can be obtained by Equation 1 above.

A request URL having a source IP whose detection rate is greater than or equal to a predetermined criterion may be regarded as normally detected and excluded from the exception rule creation target (S255-Y).

In step S255, the source IP detection rate criterion may be predetermined as 0.5 or the like.

The analysis unit 123 may check whether a detection frequency satisfies a predetermined condition for a source IP whose detection rate is less than a predetermined criterion (S257).

A request URL having a source IP whose detection frequency is equal to or greater than a predetermined criterion may be regarded as normally detected and excluded from the exception rule creation target (S257-Y).

Conversely, the request URL having a source IP whose detection frequency is less than a predetermined criterion by the analysis unit 123 may be regarded as a false positive and may be included in the exception rule generation target (S257-N).

In step S257, if the detection frequency of the source IP is equal to or greater than the first detection frequency criterion (S2571-Y) or greater than or equal to the second detection frequency criterion (S2573-Y), as described above, the request URL having the corresponding source IP is normal. It may be regarded as detected and excluded from the exception rule creation target (S257-Y).

On the other hand, when the detection frequency of the source IP is less than the first detection frequency criterion (S2571-N) and less than the second detection frequency criterion (S2573-N), the exception rule generator 125 determines that the request URL having the corresponding source IP is An exception rule may be generated by considering it to be a false positive (S260).

The embodiments described above may be implemented by a hardware component, a software component, and/or a combination of a hardware component and a software component. For example, the apparatus, methods and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate (FPGA). array), a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that can include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

The software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. , or may be permanently or temporarily embody in a transmitted signal wave. The software may be distributed over networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and carry out program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with reference to the limited drawings, those skilled in the art may apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Claims (15)

delete delete Analyze the request URL that does not violate the profile attribute of the profile-based security policy in the detection log for the abnormal request URL detected according to the profile-based security policy established by learning the normal request URL profile based on the normal response data during the learning period step, and
and generating an exception rule for the profile-based security policy based on the analysis result of the request URL, wherein the exception rule is to process a request URL falsely detected by the profile-based security policy as a normal request URL, and ,
The request URL that does not violate the profile attribute of the profile-based security policy is a request URL in which the parameter name and parameter value of the request URL in the detection log do not violate the profile attribute of the profile-based security policy,
The analyzing step is
Classifying a request URL that contains a special character or does not include a single parameter without a separator among request URLs that does not violate the profile attribute as an exception processing candidate to obtain a detection rate for each source IP, and
The method further comprises the step of confirming whether the detection frequency satisfies a predetermined condition for a source IP whose detection rate is less than a predetermined criterion,
The detection rate is
It is obtained by the formula R = N / T,
Here, N is the number of request URLs having a corresponding source IP among the exception processing candidate classification request URLs, and T is the number of total URLs included in the detection log. An automated web firewall policy establishment method through profiling log analysis. In claim 3,
If the detection frequency of the detected source IP does not satisfy a predetermined condition, profiling generating an exception rule for processing a request URL having the detected source IP as a normal request among request URLs that do not violate the profile attribute Automated web firewall policy establishment method through log analysis. In claim 4,
The predetermined condition for the detection frequency is determined to be equal to or greater than a first detection frequency criterion or greater than or equal to a second detection frequency criterion;
The first detection frequency criterion is determined that the source IP is detected a first reference number of times during a first time, and the second detection frequency criterion is determined that the source IP is detected a second reference number of times during a second time period;
The first time is set longer than the second time, and the second detection frequency criterion is set higher than the first detection frequency criterion. An automated web firewall policy establishment method through profiling log analysis. In claim 3,
Automated web firewall through profiling log analysis that creates an exception rule to treat a request URL that does not contain special characters and contains a single parameter without a delimiter as a normal request among request URLs that do not violate the profile properties How to make a policy. In claim 3,
The profile-based security policy is an automated web firewall policy establishment method through profiling log analysis determined for each URL page. A computer-readable recording medium in which a program for executing the method of any one of claims 3 to 7 is recorded on a computer. delete delete Analyze the request URL that does not violate the profile attribute of the profile-based security policy in the detection log for the abnormal URL request detected according to the profile-based security policy established by learning the normal request URL profile based on the normal response data during the learning period analysis unit, and
An exception rule generating unit for generating an exception rule for the profile-based security policy based on the result of analyzing the request URL - the exception rule is to process a request URL falsely detected by the profile-based security policy as a normal request URL including,
The request URL that does not violate the profile attribute of the profile-based security policy is a request URL in which the parameter name and parameter value of the request URL in the detection log do not violate the profile attribute of the profile-based security policy,
The analysis unit obtains a detection rate for each source IP by classifying a request URL that contains a special character or does not contain a single parameter without a separator among request URLs that does not violate the profile attribute as an exception processing candidate, Checking whether the detection frequency satisfies a predetermined condition for a source IP whose detection rate is less than a predetermined criterion,
The detection ratio is obtained by the formula R = N / T,
Here, N is the number of request URLs having a corresponding source IP among the exception processing candidate classification request URLs, and T is the number of total URLs included in the detection log. An automated web firewall policy establishment device through profiling log analysis. In claim 11,
If the detection frequency of the detected source IP does not satisfy a predetermined condition, profiling generating an exception rule for processing a request URL having the detected source IP as a normal request among request URLs that do not violate the profile attribute Automated web firewall policy establishment device through log analysis. In claim 12,
The predetermined condition for the detection frequency is determined to be equal to or greater than a first detection frequency criterion or greater than or equal to a second detection frequency criterion;
The first detection frequency criterion is determined that the source IP is detected a first reference number of times during a first time, and the second detection frequency criterion is determined that the source IP is detected a second reference number of times during a second time period;
The first time is set longer than the second time, and the second detection frequency criterion is set higher than the first detection frequency criterion. An automated web firewall policy establishment apparatus through profiling log analysis. In claim 11,
Automated web firewall through profiling log analysis that creates an exception rule to treat a request URL that does not contain special characters and contains a single parameter without a delimiter as a normal request among request URLs that do not violate the profile properties policy making device. In claim 11,
The profile-based security policy is an automated web firewall policy establishment device through profiling log analysis determined for each URL page.

Images