KR20050048558A - Web service preservation system based on profiling and method the same - Google Patents

Abstract

The present invention relates to a profiling-based web service security system and method thereof. The present invention analyzes web service response data in real time to generate and update a profile database for a normal request, and detects an abnormal request (attack) using the same. Blocking helps protect against unknown attacks. In addition, since malicious actions on the web service can be efficiently detected and blocked, the web service can be protected.

Web service security method according to the present invention for implementing this step comprises the steps of receiving a web service request of the web client; Verifying whether the web service request of the web client is a normal web service request or an abnormal web service request using a web service profile database; If the verification result is a normal web service request, transmitting the web service request of the client to a web service system; and blocking the web service request of the client if an abnormal web service request; And generating and updating a profile database for a normal web service request in the web service profile database by analyzing the response of the web service system in real time.

Description

Profiling-based web service security system and its method {WEB SERVICE PRESERVATION SYSTEM BASED ON PROFILING AND METHOD THE SAME}

The present invention relates to a profiling-based web service security system and method, and more particularly, to a profiling-based web service security system and method that can detect and block known as well as unknown attacks on web services.

In general, an attack on a web service is performed to perform a malicious action such as interfering with a stable web service by using security vulnerabilities on the web service, and leaking important internal information. Therefore, when the web service attacked by such malicious behavior manages e-commerce service or personal information in particular, it can cause a significant problem such as economic loss and personal information leakage.

The existing security system was a pattern matching method using signatures of known web service attacks. This pattern matching method is performed as follows. First, we extract specific signatures by analyzing attacks caused by abnormal requests. A particular signature becomes a signature that can represent a particular attack. After storing these signatures in the database of the security system, the signatures are used to detect attacks. Examples of such detection techniques include CheckPoint's intercept and Wins Technet's Sniper IPS.

Such a pattern matching security system is easy to develop and implement, but has a disadvantage in that a web service cannot be completely protected because new attacks not registered in the signature database of the security system cannot be detected in advance. In addition, each time a new type of attack occurs, it takes considerable time to analyze it, generate a signature, and store it in the security system's database to detect the attack, during which time the web service is exposed to the new type of attack. Will be.

Therefore, the web service security system using signature pattern matching method is only a passive technique for detecting only attacks caused by known abnormal requests, and thus, a new web service security as a more positive technique for detecting unknown attacks immediately. The system was needed.

Accordingly, the present invention has been made to solve the above problems, and an object of the present invention is to infiltrate a web service system using a security vulnerability of a web service by an external unauthorized person, including hackers, such as web service failure and major information leakage. The present invention provides a profiling-based web service security system and method for detecting and blocking an attack.

Profiling-based web service security method according to the present invention for achieving the above object comprises the steps of: receiving a web service request from a web client; Verifying whether the web service request of the web client is a normal web service request or an abnormal web service request using a web service profile database; If the verification result is a normal web service request, transmitting the web service request of the client to a web service system; and blocking the web service request of the client if an abnormal web service request; And generating and updating a profile database for a normal web service request in the web service profile database by analyzing the response of the web service system in real time.

The web service profile database may further include a known web service attack signature database.

The web service security method may further include reporting a detection and blocking result of the abnormal web service request to an administrator.

Profiling-based web service security system according to the present invention for achieving the above object, Web service request processing module for processing a web service request of a web client; A web service response processing module for processing a web service response of the web client; A web service profiling module which analyzes the web service request and response in real time and creates and updates a profile database for a normal web service request; And a web service request verification and blocking module for detecting and blocking an abnormal web service request using the web service profile database.

Here, the web service request processing module may deliver the web service request of the web client to the web service request verification module, and then deliver only the web service request verified by the web service request verification module to the web service system. .

The web service profile database may further include a known web service attack signature database.

In addition, the web service request verification module verifies the web service request of the client received from the web service request processing module using the web service profile database, and if the web service request is normal, checks the web service request of the client. Delivering to the web service system, and if the web service request is abnormal, the web service request blocking module to block the web service request of the client.

The web service response processing module may receive the web service response data from the web service system, transmit the web service response data to the web service profiling module, and process the web service response data of the web client.

In addition, the web service profiling module is configured to generate and update a profile database for a normal request in the web service profile database by analyzing web service response data received from the web service system in real time.

The web service security system may further include an administrator reporting module for reporting a result of detecting and blocking the abnormal web service request to an administrator.

Thus, abnormal requests to attack vulnerabilities in web services can be blocked in real time without relying on the signature of the attack.

Hereinafter, with reference to the accompanying drawings will be described in detail an embodiment of the present invention.

1 is a block diagram illustrating a positional relationship between a profiling-based web service security system 100 and a web service system 200 according to the present invention.

Referring to FIG. 1, a web client 10 requesting a web service to the web service system 200 through the Internet, and a web service system processing a web service response to the web service request of the web client 10. (200), and is connected between the Internet and the web service system 200, by verifying whether a web service request of the web client 10 is a normal web service request or an abnormal web service request using a database, A function of forwarding a web service request of the client to a web service system if the web service request of the web client is a normal web service request, and blocking a web service request of the client if the web service request of the web client is an abnormal web service request It is provided with a web service security system 100 to perform the.

As shown in FIG. 1, the web service security system 100 receives and monitors a web service request of the client 10 and transmits a normal web service request to the web service system 200. Located between the systems 200. Next, the web service security system 100 will be described in more detail with reference to the accompanying drawings.

2 is a block diagram of a profiling-based web service security system 100 according to the present invention.

The web service security system 100 includes a known attack signature database (DB) 101, a web service profile database (DB) 102, a web service request processing module 110, as shown in FIG. And a web service request verification module 120, a web service request blocking module 130, an administrator reporting module 140, a web service response processing module 150, and a web service profiling module 160.

Here, the known attack signature database (DB) 101 and the web service profile database (DB) 102 may request that the web service request of the web client 10 is normal in the web service request verification module 120. It is used to detect whether it is a request or an abnormal request.

Here, the known attack signature database (DB) 101 stores an already known web service attack signature database (DB), and the web service profile database (DB) 102 is already known or A database that stores verified web service profile data, and stores a profile database for normal requests generated and updated by the web service profiling module 160.

In addition, the web service request processing module 110 receives the web service request from the web client 10 and transmits the web service request verification module 120 to the web service request verification module 120. Only the web service request passed through the process is transmitted to the web service system 200.

Then, the web service request verification module 120 transmits the web service request of the web client 10 received from the web service request processing module 110 to the known attack signature database (DB) 101. Web service profile database (DB) 102 is used to detect whether the web service request is a normal web service request (known attack) or an abnormal web service request (unknown attack).

Here, the method for detecting whether the web service request is a normal web service request includes pattern matching a web service request of the web client 10 with a signature stored in the known attack signature database 101. If a web service request of s) exists in the known attack signature database 101, it is regarded as a normal web service request.

In addition, a method of detecting whether the web service request is an abnormal web service request is detected by using the web service profile database 102. The web service request of the web client 10 is determined by the web service profile database ( If it does not exist at 102, it is regarded as an abnormal web service request.

As such, when the web service request verification module 120 determines that the web service request of the web client 10 is attacked or abnormal, the web service blocking module 130 causes the web service request of the web client 10 to be executed. When the web service request is normal, the web service request of the web client 10 is transmitted to the web service system 200 through the web service request processing module 110.

Next, the web service request blocking module 130 blocks the access when the web service request of the web client is an abnormal web service request as a result of the verification of the web service request verification module 120.

In addition, the manager report module 140 reports to the administrator the abnormal web service request and the detection and blocking result of the attack. In this case, the manager reporting module 140 may be implemented as a graphical user interface (GUI).

Next, the web service response processing module 150 receives the web service response data from the web service system 200, transmits the web service response data to the web service profiling module 160, and the web service response of the web client 10. Process the data.

Finally, the web service profiling module 160 analyzes the web service response received from the web service system 200 in real time, and analyzes the profile database for a normal web service request in the web service profile database 102. Web service profiling is created and updated. In this case, since the response data of the web service system 200 comes from a reliable web service system 200 unlike the request data from the client 10 including the attacker, the response data of the web service system 200 is analyzed and the URL and the parameter are analyzed. The value can be extracted to build a web service profile database 102 for normal requests.

3 and 4 are flowcharts illustrating a profiling-based web service security method according to the present invention.

First, referring to FIG. 3, the web service request of the web client 10 is received by the web service request processing module 110 and then transferred to the web service request verification module 120 (step S10).

Next, the web service request verification module 120 compares the web service request of the web client 10 with the signature stored in the known attack signature database 101 to determine the web service request of the web client 10. It is determined whether it is a normal request or an abnormal request (step S20). At this time, if the web service request of the web client 10 exists in the known attack signature database 101, it is regarded as a normal web service request.

Next, when the web service request of the web client 10 is regarded as a normal web service request in step S20, the web service request verification module 120 receives the web service request of the web client 10. It is considered whether the web service request of the web client 10 is a normal request or an abnormal request in comparison with the profile data stored in the web service profile database 102 (step S30). At this time, if the web service request of the web client 10 exists in the web service profile database (DB) 102, it is regarded as a normal web service request.

Next, when the web service request of the web client 10 is regarded as a normal web service request in step S30, the web service request verification module 120 performs the request through the web service request processing module 110. The web service system 200 transmits a web service request of the web client 10.

If the web service request of the web client 10 is regarded as an abnormal request in steps S20 and S30, the web service request verification module 120 causes the web service blocking module 130 to cause the web service blocking module 130 to fail. Block the web service request of the web client 10 (step S40).

Next, the administrator reporting module 140 reports the detection and blocking result of the abnormal web service request and the attack to the administrator (step S50).

4, when a web service response is received from the web service system 200 to the web service profiling module 160 (step S100), the web service profiling module 160 receives the web service response. The analyzed web service response is analyzed in real time, and web service profiling is performed to generate and update a profile database for a normal web service request in the web service profile database 102 (step S110).

Finally, the web service response processing module 150 receives the web service response data from the web service system 200 and transmits the received web service response data to the web client 10 (step S120).

EXAMPLE

Next, a process of blocking and detecting an attack when accessing a web server (eg, Naver) from a web browser (client) will be described.

First, a method of detecting a passive attack by signature is as follows.

1-1. Naver Attack Attempt by Web Browser (Client):

http://www.naver.com/login.php?username=amdin&passwd= 'or 1 = 1

1-2. The web service security system 100 receives a web service request.

1-3. The web service security system 100 compares the request of the web browser with the attack patterns of the known attack signature database 101. At this time, since the pattern ['or 1 = 1] exists in the known attack signature database 101, it is regarded as an attack.

1-4. The web service request blocking module 130 blocks a Naver attack attempt.

1-5. The administrator reporting module 140 notifies the administrator of the report that the attack has been attempted and blocked.

Next, create and update a web service profile database.

2-1. A web browser requests Naver News (http://news.naver.com/).

2-2. The web service security system 100 receives the web service request and transmits the request to the NAVER web server 200.

2-3. The Naver web server 200 receives response data (data including news and link information).

The response data is analyzed and normal NAVER news menus are extracted and recorded in the web service profile database 102.

The content recorded in the web service profile database 102 is as follows.

http://www.naver.com/news/main1.php?section_id=100&menu_id=100

http://www.naver.com/news/main1.php?section_id=101&menu_id=101

http://www.naver.com/news/main1.php?section_id=101&menu_id=101

2-4. The NAVER Web Server response data is sent to the web browser.

Finally, the method of detecting profile based positive attack is as follows.

3-1. Attempts to attack Naver News Service in a web browser:

http://www.naver.com/news/default.ide?XXXXXXXXXXXXXXX=a1

3-2. The web service security system 100 receives a request.

3-3. The web service security system 100 compares the request of the web browser with attack patterns of the known attack signature database 101. At this time, the new type of attack passes the attack detection using the known attack signature database 101 because there is no pattern in the known attack signature database 101.

3-4. The web service profile database 102 is checked for a request from a web browser.

Since the request of the web browser is not in the profile database (Naver news menu) generated in the above 2-3, it is regarded as an attack.

3-5. The web service request blocking module 130 blocks a Naver news service attack attempt.

3-6. The administrator reporting module 140 notifies the administrator of the report that the attack has been attempted and blocked.

Therefore, the present invention analyzes the web service response data requested by the web client 10 in real time, creates and updates a profile database only for normal web service requests, and uses the same to detect and block abnormal requests (attacks). You can also defend against unintended attacks.

The present invention is not limited to the above-described embodiments, but can be variously modified and changed by those skilled in the art, which should be regarded as included in the spirit and scope of the present invention as defined in the appended claims. something to do.

As described above, the web service security system and method according to the present invention have the effect of blocking an abnormal request to attack a vulnerability of a web service in real time without depending on the attack signature.

In addition, it can effectively detect and block malicious behavior of web services, thereby protecting web services.

1 is a block diagram illustrating a positional relationship between a profiling-based web service security system and a web service system according to the present invention.

2 is a block diagram of a profiling-based web service security system according to the present invention.

3 and 4 are flowcharts for explaining a profiling-based web service security method according to the present invention.

<Description of Major Symbols in Drawing>

10: web client (attacker)

100: web service security system

101: Known Attack Signature Database

102: Web service profile database (DB)

110: web service request processing module

120: web service request validation module

130: Web service request blocking module

140: manager reporting module

150: web service response processing module

160: web service profiling module

200: Web service system

Claims (10)

Receiving a web service request from a web client; Verifying whether the web service request of the web client is a normal web service request or an abnormal web service request using a web service profile database; If the verification result is a normal web service request, transmitting the web service request of the client to a web service system; and blocking the web service request of the client if an abnormal web service request; And Analyzing the response of the web service system in real time to create and update a profile database for a normal web service request in the web service profile database. The method of claim 1, The web service profile database further comprises a known web service attack signature database. The method of claim 1, wherein the web service security method is: And reporting a result of detecting and blocking the abnormal web service request to an administrator. A web service request processing module for processing a web service request of a web client; A web service response processing module for processing a web service response of the web client; A web service profiling module which analyzes the web service request and response in real time and creates and updates a profile database for a normal web service request; And And a web service request verification and blocking module for detecting and blocking an abnormal web service request using the web service profile database. The web service request processing module of claim 1, wherein the web service request processing module comprises: And transmitting the web service request of the web client to the web service request verification module, and then forwarding only the web service request verified by the web service request verification module to the web service system. The web service profile database of claim 1, wherein the web service profile database comprises: Web service security system further comprises a known Web service attack signature database. 2. The method of claim 1, wherein the web service request verification module is: Verifying the web service request of the client received from the web service request processing module using the web service profile database, If the web service request is normal, the web service request from the client is forwarded to the web service system. If the web service request is abnormal, causes the web service request blocking module to block the web service request of the client. The web service response processing module of claim 1, wherein the web service response processing module comprises: Receiving the web service response data from the web service system, transmitting the web service response data to the web service profiling module, and processing the web service response data of the web client. The web service profiling module of claim 1, further comprising: Web service response data received from the web service system in real time to generate and update a profile database for a normal request in the web service profile database. The system of claim 1, wherein the web service security system is: And a manager reporting module for reporting a detection and blocking result of the abnormal web service request to an administrator.