KR20080036706A - Web security module using regulation expression of web attack and include function of script language - Google Patents

Abstract

A web security module using regular web attack expression and an include function of a script file is provided to guarantee availability of a web service and detect/block web attack in real-time by using a script language parser as a web application module without modification. A data collecting module(S331) extracts/collects data such as a parameter value, cookie, and an IP(Internet Protocol) from data requested by a user. A managing module(S334) sets up a policy for blocking web attack, and blocks malicious packets and records a log by analyzing a data analysis result. An analyzing module(S333) extracts/collects information to be analyzed from the user request data received from a parser and an extending module, and checks whether the malicious code is included in the user request data by comparing the collected information with attack rules of a policy module(S336). The policy module defines the rules for discriminating the web attack by generating feature and a keyword of each weak point in a normal expression formula.

Description

Web security module using regulation expression of web attack and include function of script language}

1 is a configuration diagram for explaining the configuration of a web security module according to the present invention.

2 is a flow diagram illustrating a web security module in accordance with the present invention.

Explanation of symbols on the main parts of the drawings

100: web browser

200: web server

300: web application

310: command interpreter (interpreter)

320: expansion module

330: Web Security Module

331: Data Acquisition Module

333: Analysis Module

334 management module

336: policy module

400: database

410: DBMS Engine

500: external program

510: external executable

The present invention relates to an intrusion prevention system for securing a web application, and more particularly, to define a keyword used in a web attack as a rule using a regular expression and to include it in a web application using an include function of a script language. The present invention relates to a web security module and method for determining and blocking an attack in real time by modularization.

With the development of the Internet, many computer users have lived up to the use of the Internet to provide services such as e-mail, online shopping, and multimedia information. Recently, hacking incidents using vulnerabilities in web applications have increased rapidly. As a countermeasure, researches on intrusion prevention systems specialized for web applications have been highlighted. Until now, most of the attack techniques were exploits of operating system or program bugs, and the attacks could be countered to some extent by using periodic patches or security solutions, but the recent issue of web application hacking is limited to blocking by existing methods. There is. Existing firewalls and firewall-based products see only packet header information, which is limited to blocking based on packet contents.

Recently, products that can partially detect web application attacks by inserting user-defined patterns in IDS, IPS, and firewalls have been released. However, these products only analyze vulnerabilities in the network layer without knowledge of applications. Only protects against and does not protect against vulnerabilities in the web application code itself. In particular, various decoding and decryption techniques must be implemented to process packet data encryption and encoded traffic, and the network overload cannot guarantee the availability of web services, and log analysis is difficult to detect in real time. The degree is very low.

The present invention is to solve the problems of the prior art as described above, by acting as a web application module to use the command parser function of the script language as it is to ensure the availability of the web service and to enable real-time attack detection and blocking There is.

Another object of the present invention is to minimize the damage caused by administrator's incorrect security settings (web server, database server) and application vulnerability due to the developer's lack of security awareness (absence of exception handling, use of vulnerable routines and functions). Each time a new vulnerability is found, it provides a way to reduce the hassle and administrative cost of modifying the source code each time.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram for explaining the configuration of a web security module according to the present invention.

In the operation process of the web security module 330, when a user requests specific data to the web server 200 through the web browser 100, the web server 200 requests the language in which language (PHP, ASP, JSP. ...) is made, and then sent to the command interpreter 310 of the web application (300). The command interpreter 310 determines whether the extension module 320, the database 400, and the external program 500 are necessary to interpret the corresponding code and return a result. At this time, the web security module 330 The user's request determines whether malicious code is inserted and generates a result. When the result is sent to the web server 200, the web server 200 transmits the received result to the web browser 100.

As shown, the web security module 330 according to the present invention includes a data collection module 331, an analysis module 333, a management module 334, and a policy module 336.

The data collection module 331 extracts and collects data such as parameter values, cookies, and IP from user request data.

The management module 334 sets a policy for blocking an attack and records blocking and auditing of malicious packets through the received data analysis result. The scripting language commonly used to develop Web applications has an include feature that reads and executes a specified file, which loads an external file and acts as if it were a document written on a single page. That is, in the case of the PHP language when the management module 334 is called WebSec, the <? include ("WebSec.php"); ?> The code is inserted into the web page and the security module runs whenever the user requests this page.

The analysis module 333 compares the user's request data received from the command interpreter 310 and the expansion module 320 with the attack rules of the policy module 336, and determines whether malicious code is inserted. Is passed to the management module 334.

In the policy module 336, rules for determining attack data are defined as regular expressions. Attack rules are categorized around the "Top 10 Web Application Vulnerabilities" defined by OWASP (http://www.owasp.org) and detect and block web attacks by generating regular expressions of the characteristics and keywords of each vulnerability.

2 is a flowchart illustrating a web security module according to the present invention.

As shown, for the data collection (S331) of the web application, selecting the corresponding function through the development language determination (S332) to extract the necessary information and sent to the analysis module (S333), each attack rule of the policy module (S336) Pattern matching is performed to determine whether an attack is made, and the information is transmitted to the management module S334.

The analysis module S333 applies the rule with reference to the policy setting S337 that designates the attack blocking level.

The management module S334 performs policy setting (S337) or performs attack blocking (S335) and reports and audit records (S338) according to the received decision result.

As described above, according to the present invention, a web security module that detects a web attack by pattern matching using an attack rule defined by a regular expression using an include function of a script language. It has the advantage of detecting web application attacks that could not be blocked by opening ports.

In addition, the present invention can solve the vulnerabilities caused by the administrator and the developer by adding a module to the application without modifying the source code or the purchase of new equipment can reduce the implementation cost and management cost.

In addition, since the present invention operates as a module of a web application, regardless of web server and database type, and does not require analysis of packet data and analysis of web server logs, it is possible to guarantee availability of web services and to detect and block in real time. There is this.

Claims (2)

A data collection module for extracting and collecting data such as parameter values, cookies, IP, etc. from the user's request data; A management module that sets a policy for blocking an attack and records malicious packets and records audits through the received data analysis result; An analysis module which extracts and analyzes information to be analyzed from user request data received from the command interpreter and the expansion module, and compares it with attack rules of the policy module to check whether malicious code is inserted; A policy module in which rules for determining a web attack by generating characteristics and keywords of respective vulnerabilities in regular expressions are defined; Web security module, characterized in that consisting of. The method of claim 1, wherein the data collection module selects an input value processing function for each language by determining a language of a web application, and extracts and collects data such as parameter values, cookie values, and IP from user request data. The method of claim 1, in the management module, a method of modularizing the source code of the web application using the include function of the scripting language, The method of claim 1, wherein in the analysis module, a method of determining whether or not to insert malicious code by referring to / comparing a set of attack rules according to the policy setting level set by the management module; The web security module of claim 1, wherein the policy module includes a method of defining the characteristics and keywords of the vulnerabilities using regular expressions to determine a web attack.

Images