WO2017138673A1

WO2017138673A1 - Method and system for tracking web-database user by using data mining

Info

Publication number: WO2017138673A1
Application number: PCT/KR2016/001451
Authority: WO
Inventors: 임성욱; 이재주; 서경은
Original assignee: (주)모니터랩
Priority date: 2016-02-12
Filing date: 2016-02-12
Publication date: 2017-08-17

Abstract

The present invention relates to a method and a system for tracking a web-database user by using data mining, and the method according to the present invention comprises the steps of: collecting a URL included in a web service request transmitted to a web server; collecting a query transmitted from the web server to a database server; determining, as a candidate URL having caused the query, a URL collected before a predetermined time on the basis of a collecting time point of the collected query; and calculating the correlation between the collected query and the collected URL by using the number of times each collected URL for each collected query is determined as a candidate URL. According to the present invention, an SQL, having been induced by a web database user through a web server or a WAS, can be recorded, and an actual user having induced the SQL can be tracked. Therefore, a DB attack can be blocked by a method for blocking a web service request occurring in a specific IP.

Description

Web-database user tracking method and system using data mining

The present invention relates to a web-database user tracking method and system, and more particularly, to a web-database user using data mining that can track a user who has generated an abnormal query based on a temporal correlation between a web service request and a query. To a tracking method and system.

Recently, with the development of computer communication technology, various Internet services such as electronic commerce services such as purchasing goods or banking through the Internet, various certificate issuance services, and game services have exploded.

However, hacking attempts for various purposes such as monetary, political, or honorary desires are increasing as much as the increase of services through the Internet. In particular, the topic of hacking in recent years is exploiting the vulnerability of web applications.

In general, most web sites for providing Internet services provide web applications as a window for providing Internet services to users, and the web applications are linked to a database. When a user enters a specific parameter value in a web browser to use an Internet service, the web server receives it and sends it back to a web application server (WAS). WAS combines the prepared QUERY with the input parameter values and prepares the complete query statement and sends it to the database. The database performs the action according to the passed query and the result is the input parameter value. It is delivered to the user in the reverse order.

However, if the user inputs a normal value, there is no problem, but if the user inputs an abnormal value and the input value is not validated, an incorrectly written query that is not grammatical is passed to the database when it is combined with the query in WAS. It can cause errors, and furthermore, a malicious attacker can lead to unintended results at the time of development by manipulating appropriate input values. Such attacks are called SQL injection attacks.

In addition to the SQL injection attacks described above, various types of database attacks have been attempted, and database security products have been released to protect the database from these attacks. In addition, Web server security products have been released to detect and respond to attacks on the web server itself, and are generally installed and operated separately from database security products.

1 illustrates a configuration of a conventional general database security product, and FIG. 2 illustrates a configuration of a database security product including a conventional WEB / WAS.

As a database security product used to protect a conventional database, as shown in FIG. 1, a main product is a type of product that controls access and authority and leaves an audit log for all SQLs. However, although the conventional database security products provide security functions for the users directly accessing through the DB client program, the WAS (Web Application Server, WEB Server) and the commonly used as shown in FIG. For the database communication accessed through the same middleware, only the information of the middleware can be traced, and there is a problem in that it is not possible to check who actually obtained and modified the information by accessing the database.

In particular, the biggest problem of conventional database security is that when the attack is through middleware such as WAS, it is impossible to obtain information about the user who caused the actual attack. Could not provide a way.

On the other hand, there is a known technique for tracking the attacker who attempted the attack based on the conditional identity or similarity between the URL parameter included in the web service request and the DB-QUERY.

FIG. 3 is a diagram provided to describe a technique for tracking an attacker based on conditional identity or similarity between a parameter of a URL included in a conventional web service request and a DB-QUERY.

As illustrated in FIG. 3, URL1 and Query1 can be tracked based on similarity, but the parameter 'free' of URL2 is processed in a web server (or WAS) and is impossible to track when modified to '1'. There was this.

Accordingly, an aspect of the present invention is to provide a web-database user tracking method and system using data mining that can track a user who has generated an abnormal query based on a temporal correlation between a web service request and a query.

Web-database user tracking method according to an embodiment of the present invention for solving this technical problem is to collect the URL included in the web service request to the web server, query transmitted to the database server from the web server Collecting, determining URLs collected before a predetermined time on the basis of collection time of the collected queries as candidate URLs for generating the queries, and for each of the collected queries, each of the collected URLs is determined as candidate URLs. Calculating a degree of association between the collected query and the collected URL using the number of times.

The method may further comprise determining a URL that is most relevant to the collected query as the URL that generated the collected query.

The method may further include blocking the requested web service request from the IP address corresponding to the URL that caused the abnormal query.

Web-database user tracking system according to an embodiment of the present invention for solving this technical problem, a web security unit for collecting the URL included in the web service request delivered to the web server, and forwarded from the web server to the database server Collect the queries, determine the URLs collected before a predetermined time based on the collection time of the collected queries as candidate URLs for generating the queries, and for each of the collected queries, each of the collected URLs is defined as candidate URLs. And a database security unit configured to calculate an association degree between the collected query and the collected URL using the number of times.

The database security unit may determine a URL that is most relevant to the collected query as the URL that generated the collected query.

The web security unit may block the requested web service request from the IP address corresponding to the URL that caused the abnormal query.

The degree of association between the collected query and the collected URL may be defined by the following equation.

[Equation]

Where R _NM is the degree of association between Query-N and URL-M, P _NM is the probability that Query-N and URL-M appear at the same time, P _M is the probability that URL-M appears, and P _N is Query denotes the probability of the occurrence -N, C _NM is a URL-M a number of times, C _ij is a j-URL specified by the URL of the candidate Query-N can be defined as the number of times specified by the URL of the candidate Query-i.

The URL included in the web service request may be collected together with an IP address that requested the web service.

According to the present invention, there is an advantage that the web database user can record the SQL caused by the web server or the WAS, and can track the user who actually caused the SQL. This has the advantage of blocking DB attacks by blocking web service requests from specific IPs.

1 is a diagram illustrating the configuration of a conventional general database security product.

2 is a diagram illustrating a configuration of a database security product including a conventional WEB / WAS.

4 is a block diagram illustrating a configuration of a web-database user tracking system using data mining according to an embodiment of the present invention.

5 is a flowchart illustrating an operation of a web-database user tracking system using data mining according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention.

Referring to FIG. 4, the web-database user tracking system using data mining according to an embodiment of the present invention may include a web security unit 210 and a database security unit (hereinafter referred to as a 'DB security unit') 230. .

The user terminal 100 is a communication terminal used by a user to use a web service. The user terminal 100 may be a laptop computer, a workstation, a palmtop computer, a personal digital assistant (PDA), a web pad, as well as a desktop computer. It can be made of a communication terminal having a computing power by having a memory means such as a microprocessor.

The user terminal 100 may transmit a web service request message in the form of a TCP / IP-based HTTP message to the web server 20 through the communication network 10, and may receive the response data and provide the response data to the user. The user may input a specific input parameter value on the web browser of the user terminal 100 and include the same in a web request message to transmit to the web server 220. For example, when a user puts a '?' After a URL in the address bar (URL input window) of a web browser, and then inputs an input parameter name and a value for an input parameter, the user obtains a web request message including a predetermined input parameter value. Can be transmitted to the web server 220. Of course, users can also send web request messages by POST by entering input parameter values in the HTTP form of the web page.

The communication network 10 does not select a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), the Internet, and the like. It doesn't matter what type of communication you have.

The web service request transmitted from the user terminal 100 to the web server 220 is transmitted to the web security unit 210 corresponding to the web firewall located in front of the web server 220 before being transmitted to the web server 220. Can be inspected according to a predetermined policy.

In more detail, the web security unit 210 receives a web service request from the plurality of user terminals 100 connected through the communication network 10 to the web server 220 to determine whether it is normal or abnormal, and determines whether the web is abnormal. The service request may be blocked from being delivered to the web server 220.

The web security unit 210 collects a URL (Uniform Resource Locator) included in a web service request transmitted from the user terminal 100 and an IP address of the user terminal 100 and transmits the collected data to the DB security unit 230. Perform the function. In the following description, it is referred to as URL information including an IP collected together with a URL.

Each time the web security unit 210 collects the URL information, the web security unit 210 transmits the information on the time when the web security unit 210 collected the URL information (or the time when the web service request was received by the web security unit 210) together with the URL information. It is desirable to. Of course, according to an embodiment, the web security unit 210 may be implemented to periodically transmit the URL information collected for a predetermined time with the URL collection time information. Meanwhile, the URL collection time may be replaced with information that can distinguish the order in which the URL information is collected by the web security unit 210.

The web server 220 provides the user terminal 100 with response data according to a web service request transmitted from the user terminal 100. The web server 220 generates and delivers a DB query QUERY (hereinafter referred to as a 'DB query') for a database service request to the DB server 240 if necessary according to a web service request, and accordingly the database response data. Received may be provided to the user terminal 100.

In the embodiment of FIG. 4, the web server 220 generates a DB query. However, a WAS server (not shown) is provided separately from the web server 220 to generate a DB query in the WAS server. It can also be implemented to pass

When the WAS server is provided separately from the web server 220, the WAS server prepares a complete SQL query by combining the prepared query and the input parameter values, and requests the database service to the DB server 240. And receive the database response data accordingly and deliver the data back to the web server 220.

Hereinafter, the web server 220 may be understood to include the function of the WAS server, and as described above, the web server 220 may be implemented separately from the WAS server.

The DB security unit 230 receives a DB query transmitted from the web server 220 to the DB server 240 to determine whether it is normal or abnormal, and blocks the abnormal DB query from being transmitted to the DB server 240. Function can be performed.

The DB security unit 230 may collect a DB query and calculate an association degree between the DB query and the URL by using the URL information collected by the web security unit 210. In addition, the DB security unit 230 may determine a URL that is most relevant to the collected DB queries as the URL that generated the query. In addition, the DB security unit 230 may transfer the IP address corresponding to the URL that caused the abnormal query to the web security unit 210 to block the web service request requested from the IP.

The following table describes how to calculate the degree of association between DB queries and URLs.

시간(TIME)TIME	URLURL	IPIP
Time1Time1	URL-1URL-1	10.0.0.10110.0.0.101
Time2Time2	URL-2URL-2	10.0.0.10210.0.0.102
Time3Time3	URL-3URL-3	10.0.0.10310.0.0.103
Time4Time4	URL-4URL-4	10.0.0.10410.0.0.104
……	……	……

The DB security unit 230 may have a URL information collection table as shown in Table 1 in which URL information collected by the web security unit 210 is recorded. In Table 1, TIME represents a time at which URL information is collected by the web security unit 210. In the URL information collection table, URLs may be arranged in the order of time collected by the web security unit 210.

The DB security unit 230 may designate a URL collected before a predetermined time as a candidate URL based on the time of collecting the corresponding DB query with reference to the URL information collection table.

For example, suppose that the collection point of a specific DB query (Query-1) is 13:00, and it is set to designate a URL collected three seconds before the DB query collection point as a candidate URL, and Time3 is 12:59:58. When Time4 is 12:59:59, the DB security unit 230 may designate URL-3 and URL-4 as candidate URLs for generating a DB query.

As shown in Table 2 below, the DB security unit 230 may create a query-URL association table as illustrated in Table 2 below by counting the number of times each URL is designated as a candidate URL of the corresponding DB query for each DB query.

	URL-1URL-1	URL-2URL-2	URL-3URL-3	……	URL-MURL-M	……
Query-1Query-1	C₁₁ C ₁₁	C₁₂ C ₁₂	C₁₃ C ₁₃	……	C_1M C _1M	……
Query-2Query-2	C₂₁ C ₂₁	C₂₂ C ₂₂	C₂₃ C ₂₃	……	C_2M C _2M	……
Query-3Query-3	C₃₁ C ₃₁	C₃₂ C ₃₂	C₃₃ C ₃₃	……	C_3M C _3M	……
……	……	……	……	……	……	……
Query-NQuery-N	C_N1 C _N1	C_N2 C _N2	C_N3 C _N3	……	C_NM C _NM	……
……	……	……	……	……	……	……

In Table 2, C _NM indicates the number of times that URL-M is designated as a candidate URL for Query-N. Whenever the DB security unit 230 collects a DB query transmitted from the web server 220 to the DB server 240, the DB security unit 230 refers to a URL information collection table as illustrated in Table 1 above to obtain a candidate URL for the corresponding DB query. You can specify and update Table 2.

The DB security unit 230 may calculate a degree of association between the DB query and the URL according to Equation 1 below using the association table of Table 2.

Where R _NM is the degree of association between Query-N and URL-M, P _NM is the probability that Query-N and URL-M appear at the same time, P _M is the probability that URL-M appears, and P _N is Query Indicates the probability of -N. C _NM may be defined as the number of times that URL-M is designated as the candidate URL of Query-N, and C _ij may be defined as the number of times that URL-j is designated as the candidate URL of Query-i.

The DB security unit 230 may determine a URL having the highest correlation with respect to a specific DB query as the URL that generated the DB query. In addition, when a specific DB query is determined to be an abnormal query, the DB security unit 230 may check an IP corresponding to the URL determined to have generated the query in Table 1.

The DB security unit 230 may transfer the IP corresponding to the URL that generated the DB query determined to be abnormal to the web security unit 210 to block the web service request transmitted from the IP.

Referring to FIG. 5, first, the web security unit 210 includes a uniform resource locator (URL) and a user included in a web service request transmitted from a plurality of user terminals 100 connected through a communication network 10 to a web server 220. The IP address and the like of the terminal 100 are collected (S510). The URL information collected in step S510 may be transferred to the DB security unit 230 and recorded in the URL information collection table as illustrated in Table 1 described above.

Meanwhile, the DB security unit 230 collects each time a DB query is transmitted from the web server 220 to the DB server 240 (S520). Steps S510 and S520 are continuously performed each time a web service request or DB query is received while the web-database user tracking system according to the present invention is operating.

Next, the DB security unit 230 designates candidate URLs with reference to Table 1 with respect to the collected DB queries (S530). In operation S530, the DB security unit 230 may designate a URL collected before a predetermined time as a candidate URL based on the time of collecting the corresponding DB query by referring to the URL information collection table. Here, the predetermined time, that is, the time difference between the URL collection time and the DB query collection time may vary according to the administrator's setting, and may be adjusted according to a network environment in which the web server 220 and the DB server 240 are connected.

Whenever candidate URLs are designated for the collected DB queries, the DB security unit 230 may generate a query-URL association table as illustrated in Table 2 by counting the number of times designated as candidate URLs of the corresponding DB queries.

Thereafter, the DB security unit 230 may calculate an association degree between the collected DB query and the URL using the query-URL association table (S540). The degree of association between the DB query and the URL may be calculated by Equation 1 described above.

Next, the DB security unit 230 may determine a URL having the highest association with respect to the collected DB queries as the URL that generated the query (S550).

In addition, the DB security unit 230 may transfer the IP address corresponding to the URL that caused the abnormal query to the web security unit 210 to block the web service request requested from the corresponding IP (S560).

Embodiments of the invention include a computer readable medium containing program instructions for performing various computer-implemented operations. This medium records a program for executing the web-database user tracking method using data mining described above. The media may include, alone or in combination with the program instructions, data files, data structures, and the like. Examples of such media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CDs and DVDs, floppy disks and program commands such as magnetic-optical media, ROM, RAM, flash memory, and the like. Hardware devices configured to store and perform such operations. Alternatively, the medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Although the preferred embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

Claims

Collecting the URL included in the web service request forwarded to the web server,

Collecting queries transmitted from the web server to a database server;

Setting a URL collected before a predetermined time as a candidate URL for generating the query based on a collection time of the collected query, and

Calculating an association degree between the collected query and the collected URL by using the number of times that each of the collected URLs is a candidate URL for each of the collected queries;

Web-database user tracking method comprising a.
In claim 1,

The degree of association between the collected query and the collected URL is determined by the following equation:

Where R NM is the degree of association between Query-N and URL-M, P NM is the probability that Query-N and URL-M appear at the same time, P M is the probability that URL-M appears, and P N is Query denotes the probability of the occurrence -N, C NM is the number of times specified by the URL-M candidate URL of the Query-N, C ij is defined as the number of the j-URL specified by the URL of the candidate Query-i.
The method of claim 1 or 2,

Determining the most relevant URL for the collected query as the URL that generated the collected query

Web-database user tracking method further comprising.
In claim 3,

The URL included in the web service request is collected together with the IP address that requested the web service,

Blocking the requested web service request from the IP address corresponding to the URL that caused the abnormal query

Web-database user tracking method further comprising.
A web security department that collects URLs included in web service requests sent to a web server, and

Collects a query transmitted from the web server to a database server, sets a URL collected before a predetermined time based on a collection time of the collected query as a candidate URL for generating the query, and collects the collected query for each collected query. A database security unit that calculates an association degree between the collected query and the collected URLs using a number of times each of the URLs determined as candidate URLs

Web-database user tracking system comprising a.
In claim 5,

The degree of association between the collected query and the collected URL is determined by the following equation:

Where R NM is the degree of association between Query-N and URL-M, P NM is the probability that Query-N and URL-M appear at the same time, P M is the probability that URL-M appears, and P N is Query denotes the probability of the occurrence -N, C NM is the number of times specified by the URL-M candidate URL of the Query-N, C ij is defined as the number of the j-URL specified by the URL of the candidate Query-i.
In claim 5 or 6,

The database security unit,

A web-database user tracking system that determines the most relevant URL for the collected query as the URL that generated the collected query.
In claim 7,

The URL included in the web service request is collected together with the IP address that requested the web service,

The web security unit web-database user tracking system that blocks the requested web service request from the IP address corresponding to the URL that caused the abnormal query.