基於資料注入點的準確過濾方法

針對網路攻擊與防護，經過歷年來的研究，已經建立一套基礎的研究成果。相關的研究顯示，網路上的injection attack，早已是一種有效且危險的攻擊手法。注入攻擊（Injection attack）是透過網站中的注入點（injection point），將惡意的攻擊字串輸入其中，藉以達到觀察回應並偷取資料，或破壞、癱瘓伺服器、甚至是取得伺服器的控制權等目的。　　本論文提出一套多層次過濾規則搭配機制，透過injection point的尋找以及檢測，找出可能有弱點的injection point。以injection point為測試單位，找出適合各injection point的規則搭配組合。並以實驗結果分析說明，此套弱點分析測試架構，相較於以往使用單一規則過濾的好處。

關鍵字

注入點；穿透測試；輸入驗證

並列摘要

Numbers of the programs are poorly written, lacking even the most basic security procedures for handling input data from users. The input validation vulnerability can be detected by many tools but few tools can fix the flaws automatically. The security gateway can used to protect vulnerable Web sites immediately but it may induce false recognition through impersonal rule. By means of hybrid analysis and injection test, the Web pages having vulnerability can be listed. Only those in vulnerable list need to be checked completely, so as to mitigate the system load and false positives effectively. Moreover an algorithm based on multilevel strategy is proposed producing individual sanitizing rule automatically for every vulnerable injection point. To meet the aim of automated validation, the hybrid analyzer, the testing framework and the meta-programs are integrated into a sanitizing mechanism after we analyze the data flow. According to the experimental results, the mechanism has been proved to be a more effective scheme than those traditional input handling methods for mitigating malicious injection.

並列關鍵字

Injection point ； Penetration testing ； Input validation

參考文獻

[1] Jin-Cherng Lin and Jan-Min Chen, “An Automatic Revised Tool for Anti-malicious Injection”, in Proceedings of The Sixth IEEE International Conference on Computer and Information Technology (CIT’06).

[5] Jovanovic, N.; Kruegel, C.; Kirda, E.; “Pixy: a static analysis tool for detecting Web application vulnerabilities”, In Proc. Of the 2006 IEEE Symposium on Security and privacy, 21-24 May 2006 Page(s):6 pp.

[6] Huang, Y. W., Huang, S. K., Lin, T. P., Tsai, C. H. “Web Application Security Assessment by Fault Injection and Behavior Monitoring.” In Proc. 12th Int’l World Wide Web Conference, p.148-159, Budapest, Hungary, 2003.

[13] Dharmapurikar, S., Krishnamurthy, P., Sproull, T., and Lockwood, J. “Deep Packet Inspection Using Parallel Bloom Filters.” In Proc. 11th Symp. High Performance Interconnects (HOTI’03), p.44-51, Stanford, California, 2003.

[14] Hayes. J.H., Offutt. A.J., ”Increased software reliability through input validation analysis and testing Software Reliability Engineering”, 1999. Proceedings. 10th International Symposium on 1-4 Nov. 1999 Page(s):199 – 209

國際替代計量

基於資料注入點的準確過濾方法

未授權

主題瀏覽