KR20090070040A - New attack pattern creating and distributing system based on profile violation log and method thereof - Google Patents

Abstract

A new attack pattern generation, a distribution system and a method thereof for using profile violation log data of a web service request violating the profile regulation are provided to increase the security and reduce the error detection of the web protective device by automatically distributing the new attack pattern. A log collector(110) collects profile violation log data. The profile violation log data is generated about a web service request violating the profile regulation. A pattern generator(150) produces the new offense pattern by using the collected above profile half log data. A pattern distributor(190) distributes the new offense pattern to the web protective device.

Description

New attack pattern generation and distribution system based on profile violation log and its method {NEW ATTACK PATTERN CREATING AND DISTRIBUTING SYSTEM BASED ON PROFILE VIOLATION LOG AND METHOD THEREOF}

The present invention relates to a new attack pattern generation and distribution system and a method thereof, and more particularly, to create a new attack pattern based on the profile violation log and to automatically distribute it to each security device. And how to do it.

Recently, along with the increase of web services, malicious attacks such as interfering with stable web services and leaking important internal information by using security vulnerabilities on web services are increasing day by day.

Due to this malicious attack behavior, the web service that is attacked can cause significant problems such as economic loss and personal information leakage, especially when managing e-commerce service or personal information. Therefore, various attempts have been made to detect and respond to web service attacks, and methods for recognizing intrusion patterns can be largely classified into pattern matching using profile and profile based.

The pattern matching method using the signature is performed as follows. First, we extract specific signatures by analyzing attacks by abnormal requests. Certain signatures are signatures that can represent a particular attack. After storing these signatures in the database of the security system, the signatures are used to detect attacks. Examples of such detection techniques include CheckPoint's intercept and Wins Technet's Sniper IPS.

On the other hand, the pattern-matching security system using signatures is easy to develop and implement, and can detect relatively accurate attacks, but it cannot fully detect new attacks not registered in the signature database of the security system. It can not have the disadvantage. In addition, each time a new type of attack occurs, it takes considerable time to analyze it, generate a signature, and store it in the security system's database to detect the attack, during which time the web service is exposed to the new type of attack. Will be.

Therefore, the web service security system using signature pattern matching method is only a passive technique for detecting only attacks caused by known abnormal requests. Therefore, the new web service security as a more positive technique for detecting unknown attacks immediately is available. A system is needed, and the proposed method is to detect web attacks by profiling parameters of web requests. Profile-based intrusion detection method is based on the normal behavior, the behavior that is contrary to it is considered as an intrusion.

However, the profile-based intrusion detection method may falsely detect normal web service requests as abnormal when the criteria for normal behavior are set too strictly, which may increase user inconvenience and reduce the reliability of the Internet service system. It may be. On the contrary, there is a problem that if the standard for normal behavior is widely allowed, it may be relatively vulnerable to an unknown attack type.

Therefore, the technical problem to be achieved by the present invention is to create a new attack pattern based on the profile violation log quickly and automatically distribute it to each web security device to reduce the false positives of the web security device and at the same time increase the security The present invention provides a pattern generation and distribution system and a method thereof.

According to an embodiment of the present invention, a new attack pattern generation and distribution method based on a profile violation log includes collecting profile violation log data generated for a web service request in violation of a profile rule; Generating a new attack pattern by using the collected profile violation log data, and distributing the generated new attack pattern to a web security device.

The method may further include verifying whether the collected profile violation log data correspond to a simple profile violation type.

When the collected profile violation log data corresponds to a simple profile violation type, the collected profile violation log data may be excluded from a new attack pattern generation target.

When the required input parameter does not exist in the web service request, when the input parameter value corresponds to at least one of a single value without a delimiter and the input parameter value does not include a special code even though there is a delimiter. Profile violation log data corresponding to the web service request can be determined as a simple profile violation type.

A computer readable medium according to another embodiment of the present invention records a program for causing a computer to execute any one of the above methods.

The new attack pattern generation and distribution system based on the profile violation log according to another embodiment of the present invention includes a log collector configured to collect profile violation log data generated for a web service request in violation of the profile rule, and the collected profile. And a pattern generation unit for generating a new attack pattern using the violation log data, and a pattern distribution unit for distributing the generated new attack pattern to a web security device.

The apparatus may further include a log analyzer configured to verify whether the collected profile violation log data corresponds to a simple profile violation type.

The log analyzer may exclude a new attack pattern generation target when the collected profile violation log data corresponds to a simple profile violation type.

When the required input parameter does not exist in the web service request, when the input parameter value corresponds to at least one of a single value without a delimiter and the input parameter value does not include a special code even though there is a delimiter. Profile violation log data corresponding to a web service request may be determined as a simple profile violation type.

As described above, according to the present invention, the security of the web security device can be improved by quickly generating a new attack pattern which is not yet known and automatically distributing it to each web security device.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention.

1 is a view provided to explain a new attack pattern generation and distribution system according to an embodiment of the present invention.

Referring to FIG. 1, a new attack pattern generation and distribution system (hereinafter, referred to as “the main system”) according to the present invention is connected to a plurality of web security devices 30 through a communication network 20 to provide various information and data. Can give and receive.

The communication network 20 does not select a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), the Internet, and the like. It doesn't matter what type of communication you have.

The web security device 30 verifies whether the web service request transmitted from the user terminal to the web server is normal, and stores log data when an abnormal web service request is detected. In particular, when the web security device 30 according to the present invention detects a web service request violating a positive security policy, the web security device 30 may generate profile violation log data thereof and provide it to the system 100.

Next, the operation of the web security device of FIG. 1 will be described in more detail.

2 is a view provided to explain the operation of the web security device, Figure 3 is a view showing in more detail the web security device of FIG.

2 and 3, the web security device 30 is located between the user terminal 10 and the web server 40 and may be connected to both devices 10 and 40 through the communication network 20.

The user terminal 10 is a communication terminal device used by a user to use a web service. The user terminal 10 is a laptop computer, a workstation, a palmtop computer, a personal digital assistant (PDA), a web pad, as well as a desktop computer. It can be made of a communication terminal having a computing power by having a memory means such as a microprocessor. The user terminal 10 may transmit the web service request data in the form of a TCP / IP based HTTP message to the web server 40, and may receive the response data and provide the response data to the user. The user may input an input parameter value required for the web service request on the web browser of the user terminal 10 and include it in the web service request data and transmit it to the web server 40. For example, if a user enters a '?' After a URL in a web browser address bar (URL input window) and then inputs an input parameter name and a value for the input parameter in the form of a query, a web request message including a predetermined input parameter value is included. May be transmitted to the web server 40 in a GET manner. Of course, the user may input the input parameter value in the HTTP form of the web page and include it in the payload portion of the web service request data by POST.

The web server 40 provides the response data according to the web service request transmitted from the user terminal 10 to the user terminal 10.

The web security apparatus 30 receives the web service request data transmitted from the user terminal 10 to the web server 40 in an inline manner or in a proxy manner to determine whether it is normal. If abnormal web service request is detected, log data about it is saved. When the web security device 30 detects an abnormal web service request, the web security device 30 may report a security manager, and may block the abnormal web service request from being transmitted to the web server 40.

In particular, the web security device 30 according to the present invention includes an attack signature DB 31, a web service profile DB 33, a web request verification module 35, and a log DB 37.

The attack signature DB 31 stores a known web attack pattern, that is, an attack signature. In addition, the attack signature DB 31 may be updated when a new web attack pattern is known. In particular, according to the present invention can receive and store a new web attack pattern generated in the system 100.

The web service profile DB 33 stores profile information for a normal web service request. Profile information for a normal web service request may include the following information. For example, 1) input parameter information (permitted parameter information) allowed to be included in the web service request data, 2) a range of parameter values that the accept parameter can have, or 3) input parameter information that must be included in the web service request data. (Essential parameter information) and the like. Of course, in addition to the profile information for the normal web service request may be included in the web service profile DB 33 in various forms by the security administrator.

The web request verification module 35 verifies whether the received web service request is normal by using the attack signature DB 31 and the web service profile DB 33. First, the web request verification module 35 detects an abnormal web service request by performing pattern matching on the received web service request with the attack signature stored in the attack signature DB 31.

Meanwhile, if there is no abnormality as a result of performing pattern matching on the received web service request, the web request verification module 35 refers to the web service profile DB 33 to determine whether it is normal. For example, if the received web service request data includes an unacceptable parameter, has an unacceptable parameter value, or does not have a required parameter that must be included, the web request verification module 35 performs a corresponding web service request. It can be judged abnormal.

The log DB 37 stores log data for the web service request detected as abnormal by the web request verification module 35.

The web security device 30 is log data for a web service request that violates a positive security policy, that is, a profile rule, among log data stored in the log DB 37 (hereinafter referred to as 'profile violation log data'). ) May be periodically transmitted to the system 100 (not shown). Of course, the system 100 may be configured to periodically access the web security device 30 to collect profile violation log data.

4 and 5 will be described in more detail with respect to the operation of the present system 100.

4 is a block diagram illustrating the present system 100 of FIG. 1 in more detail, and FIG. 5 is a flowchart provided to explain the operation of the present system.

4 and 5, the system 100 includes a log collector 110, a log analyzer 130, a pattern generator 150, a pattern verifier 170, and a pattern distributor 190. It may include.

First, the log collection unit 110 collects profile violation log data from the web security device 30 (S510). The log collecting unit 110 may access the web security device 30 at predetermined intervals and extract and collect only profile violation log data from log data stored in the web attack detection log DB 37. Of course, depending on the embodiment, the web security device 30 may be implemented to automatically transmit the data to the system 100 when the profile violation log data is generated.

Thereafter, the log analyzer 130 classifies the collected profile violation log data into simple profile violation types and attack types (S520). In the following cases, it can be judged as a simple profile violation type. For example, ① the required parameter does not exist in the web service request data, ② the input parameter value is a single value without delimiter, or ③ the input parameter value does not contain a special code even if there is a delimiter. Can be classified as

For example, when profile violation log data for the following web service request is collected, the log analyzer 130 may classify a simple profile violation type.

1) http://www.abc.com/main/main.nhn?abc=def

In this case, the input parameter is 'abc' and the input parameter value is 'def'. Since the input parameter value is a single value without a separator (②), it can be classified as a simple profile violation type.

2) http://www.abc.com/main/main.nhn?abc=def ghi

In this case, the input parameter is 'abc' and the input parameter value is 'def ghi'. If the input parameter value is composed of two or more words such as 'def', 'space (ASCII code% 20)', and 'ghi' but without special code (③), it can also be classified as simple profile violation type. have.

3) http://www.abc.com/main/main.nhn?abc=def(ghi) "or 1 = 1-

In this case, the input parameter is 'abc' and the input parameter value is 'def (ghi) "or 1 = 1-' Since the input parameter value contains two or more words and special codes, it can be classified as a new attack type. Here, for example, special code can be the following code (in parentheses are ASCII code values).

“(0x22), # (0x23), $ (0x24),% (0x25), & (0x26), '(0x27), * (0x2A), / (0x2F),: (0x3A),; (0x3B), \ (0x5C), ^ (0x5E), (0x60), | (0x7B)

As such, the log analyzer 130 excludes (dismissed) log data classified as a simple profile violation type from the collected profile violation log data as a target for generating a new attack pattern and excludes the log data classified as the remaining attack types from the pattern generator. Transfer to 150 (S530).

Thereafter, the pattern generator 150 generates a new attack pattern using the profile violation log data classified as the attack type (S540). The pattern generator 150 extracts and compares only input parameter values from profile violation log data classified as the attack type, and generates a corresponding pattern as a new attack pattern when a common string exists in a predetermined number of profile violation log data. The string here also contains a single character.

More detailed description of the example generated by the new attack pattern is as follows.

For example, suppose that the input parameter value extracted from each profile violation log data contains a string such as 1) to 6) below.

1) def (ghi) "or 1 = 1-

2) abfc "or 2 = 2-

3) xxxx "or 11 = 11 #

4) CCCCCCCCCCCCCCCCCCCCCC \ VISTA abce .....

5) CCCCCCCCCCCCCCCCCCCCCC \ WINXP XXXX .....

6) CCCCCCCCCCCCCCCCCCCCCC \ WIN2K ZZZZ .....

Common strings in 1), 2), and 3) are “, or, =. That is, common strings (“, or, =) are included in the three profile violation log data. Therefore, when the common string is included in at least three or more profile violation log data, the pattern generator 150 generates the following pattern as a new attack pattern when it is implemented to recognize it as a new attack pattern.

New Attack Pattern 1: “, or, =

Similarly, CCCCCCCCCCCCCCCCCCCCCC, \ are common to 4), 5) and 6). Therefore, the newly created attack pattern is as follows.

New Attack Pattern 2: CCCCCCCCCCCCCCCCCCCCCC, \

Here, the attack pattern separated by a comma (,) means an AND condition for the character string before and after the comma. In other words, it is considered an attack only when all three items are included in the parameter value.

Next, the pattern verification unit 170 verifies the new attack pattern generated by the pattern generation unit 150 (S550). The pattern verification unit 170 may provide a newly generated new attack pattern to a security expert to be verified. As a result, the newly generated new attack pattern may be distributed to the web security device 30 even if the attack pattern is not actually an attack pattern, thereby minimizing a false positive of a normal web service request as an abnormal one. However, this is to minimize false positives and is not essential.

The pattern distributor 190 distributes the new attack pattern generated by the pattern generator 150 to the web security device 30 to update the attack signature DB 31 (S560). As a result, whenever a new attack type appears, a new attack pattern is quickly generated and distributed to the web security device 30 to increase security.

Embodiments of the invention include a computer readable medium containing program instructions for performing various computer-implemented operations. This medium records a program for executing the integrated security method described so far. The media may include, alone or in combination with the program instructions, data files, data structures, and the like. Examples of such media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CDs and DVDs, floppy disks and program commands such as magnetic-optical media, ROM, RAM, flash memory, and the like. Hardware devices configured to store and perform such operations. Alternatively, the medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Although the preferred embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a view provided to explain a new attack pattern generation and distribution system according to an embodiment of the present invention.

2 is a view provided to explain the operation of the web security device.

3 is a view illustrating the web security device of FIG. 2 in more detail.

4 is a block diagram illustrating the present system of FIG. 1 in more detail.

5 is a flowchart provided to explain the operation of the present system.

Claims (9)

Collecting profile violation log data generated for a web service request that violates the profile rule; Generating a new attack pattern using the collected profile violation log data; And, Distributing the generated new attack pattern to a web security device; New attack pattern generation and distribution method based on the profile violation log, characterized in that it comprises a. The method of claim 1, Verifying whether the collected profile violation log data correspond to a simple profile violation type; New attack pattern generation and distribution method based on the profile violation log, characterized in that it further comprises. The method of claim 2, If the collected profile violation log data corresponds to a simple profile violation type, new attack pattern generation and distribution method based on the profile violation log, characterized in that excluded from the target of generating a new attack pattern. The method of claim 3, wherein When the required input parameter does not exist in the web service request, when the input parameter value corresponds to at least one of a single value without a delimiter and the input parameter value does not include a special code even though there is a delimiter, And a profile violation log data corresponding to the web service request is determined to be a simple profile violation type. A computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 1 to 4. A log collector configured to collect profile violation log data generated for the web service request in violation of the profile rule; A pattern generator configured to generate a new attack pattern using the collected profile violation log data; A pattern distribution unit distributing the generated new attack pattern to a web security device; New attack pattern generation and distribution system based on the profile violation log, characterized in that it comprises a. The method of claim 6, A log analyzer to verify whether the collected profile violation log data corresponds to a simple profile violation type; New attack pattern generation and distribution system based on the profile violation log, characterized in that it further comprises. The method of claim 7, wherein The log analysis unit, If the collected profile violation log data corresponds to a simple profile violation type, new attack pattern generation and distribution system based on the profile violation log, characterized in that excluded from the target of generating a new attack pattern. The method of claim 8, When the required input parameter does not exist in the web service request, when the input parameter value corresponds to at least one of a single value without a delimiter and the input parameter value does not include a special code even though there is a delimiter, And a profile violation log data corresponding to the web service request is determined as a simple profile violation type.

Images