網頁應用程式注入攻擊之自動化防禦機制

注入弱點常肇因於未對輸入資料做檢查，因此適當的輸入資料檢查是防止注入攻擊的有效策略；這雖是一個簡單的概念，然而，我們發現現存許多程式在撰寫上未周全，常常連最基本檢查輸入資料的基本安全步驟都沒有，尤其是有些舊版本的程式，可能無法修改原始碼以便強化輸入檢查的能力。雖然已有許多工具可偵測出注入弱點，但是很少工具可以做到自動修復這個弱點，我們已致力於網頁應用程式注入攻擊的自動防禦機制的研究一段時間，而且開發了一個取名為安全守護員的系統，這個系統有很好的擴充性，可以處理當網站不斷擴大及新型的注入攻擊方法增加的情況，而且兼具穿透性，不但網站使用者不會查覺它的存在，也不需修改程式的原始碼及程式開發者參與。為了驗證這個防禦系統的有效性及效能，我們將重點放在識別網頁爬蟲 (Web crawler) 的精確度、速度及過濾惡意注入資料的精確度上；實驗結果證明我們的方法相較於其它過濾方法有更好的精確度，而且可以依據網站的安全政策，正確且快速的分辨出各類的網頁造訪者，以便排除違反安全政策的造訪者。

關鍵字

網頁應用程式防火牆；注入攻擊；網頁爬蟲；輸入資料檢查

並列摘要

Injection flaw results from invalidated input so proper input validation is an effective countermeasure to protect against injection attack. Some programs are poorly written, lacking even the most basic security procedures for sanitizing input. Furthermore some legacy applications may not be viable to modify the source of such components. The input validation vulnerability can be detected by many tools but very few tools can automatically fix the flaws. We had been devoted to the study of automated defense mechanism for Web application injection attack, and developed a security safeguard having a good “scalability” when applied to Web site growth or unknown injection attacks. It is transparent and independent of programming languages and requires neither application developer’s interactions nor source code modifications. To verify the effectiveness and efficiency of the defense mechanism, we focus on whether the detection errors had been reduced and the detection speediness and accuracy of identifying Web crawler. The experimental results show that our method renders least errors in comparison with other sanitizing strategies, and various Web visitors can be correctly and quickly differentiated in accordance with security policy.

並列關鍵字

Injection attack ； Web crawler ； Input validation ； Web application firewall

參考文獻

[1] Y. W. Huang, S. K. Huang, T. P. Lin and C. H. Tsai, “Securing Web application code by static analysis and runtime protection,” In Proc. of the 13th International World Wide Web Conference, 2004.

[3] Y. W. Huang, C. H. Tsai, T. P. Lin, S. K. Huang, D. T. Lee and S. Y. Kuo, “A Testing Framework for Web Application Security Assessment,” Journal of Computer Networks, Vol. 48, No. 5, pp.739-761, 2005.

[8] S. Dharmapurikar, P. Krishnamurthy, T. Sproull and J. Lockwood, “Deep Packet Inspection Using Parallel Bloom Filters,” In Proc. of the 11th Symp. High Performance Interconnects, pp.44-51, 2003.

[9] J. C. Lin and J. M. Chen, “An Automatic Revised Tool for Anti-malicious Injection,” In proc. Of the Sixth IEEE International Conference on Computer and Information Technology, 2006.

[10] Web application security consortium (WASC), Web Application Firewall Evaluation Criteria, http://www.webappsec.org/projects/wafec/, 2006.

國際替代計量

網頁應用程式注入攻擊之自動化防禦機制

未授權

主題瀏覽