基於人工智慧的自動化網頁安全測試

Automatic Web Security Testing based on Artificial Intelligence

林聖翔(Sheng-Xiang Lin) ； 卓信宏(Hsin-Hung Cho)

《資訊安全通訊》 25卷3期 (2019/08) Pp. 40-56

摘要

以網頁安全為例，資安工程師在做測試時，通常會準備一個大量的攻擊語法列表，一些著名的免費漏洞掃描工具除了使用現成的攻擊語法列表外，有些是基於已知的攻擊語法格式來生成攻擊語法，這樣的方式能夠節省時間與人力成本，但這樣的結果僅能測試出已經被發現的問題，甚至有時候成功率也不高。為了增加安全測試的效率，我們靠增加攻擊語法的可變性，希望能挖掘出更多漏洞，因此我們提出了一套基於人工智慧的自動化網頁安全測試系統，藉由人工智慧強大的未知搜索能力生成偽資料的特性，來學習和產生攻擊語法，讓安全測試人員在測試上有新的選擇。

關鍵字

網頁安全 ； 人工智慧 ； 網頁安全測試系統 ； 網頁安全測試

並列摘要

In the case of web security, the administrator usually prepares a large list of attack vectors when perform security testing. Some well-known free vulnerability scanning tools use a list of out-of-the-box attack vectors, while others generate attack vectors based on a known attack syntax format. Although this approach can save a lot of time and labor costs, it is able to only test problems which have been identified, and sometimes the success rate is not high. To increase the efficiency of security testing, we will try to increase the diversity of attack vectors to uncover more vulnerabilities. Therefore, we proposed an automatic security testing system by using artificial intelligence techniques. With the powerful search ability of artificial intelligence for unknown areas, it has the ability to generate pseudo-data features out of thin air so that the attack vectors can be learned and generated. We can take advantage of that to make a second choice to test the website for the administrator.

並列關鍵字

Web Security ； Artificial Intelligence ； Web security test system ； Web security testing

參考文獻

S. Gorbunov and A. Rosenbloom, "AutoFuzz: Automated Network Protocol," International Journal of Computer Science and N etwork Security, pp. 239-245, August 2010.

P. Godefroid, H. Peleg and R. Singh, "Fuzzing, Learn&Fuzz: Machine Learning for Input," in IEEE/ACM International Conference on Automated Software Engineering, UrbanaChampaign, Illinois, USA, 2017.

B. P. Miller, L. Fredriksen and B. So, "An Empirical Study of the Reliability of UNIX Utilities," Communications of the ACM, vol. 33, no. 12, pp. 32-44, 1990.

P. Hope and B. Walther, Web Security Testing Cookbook, O'Reilly Media, 2008.

F. Yamaguchi, F. ’. Lindner and K. Rieck, "Vulnerability Extrapolation ： Assisted Discovery of Vulnerabilities using Machine Learning," in WOOT'11 Proceedings of the 5th USENIX conference on Offensive technologies, San Francisco, CA, 2011.