針對SQL Injection攻擊鑑識之分析

在網路 2.0，入侵者以未經授權的方式存取資料庫內容的網路攻擊被廣泛使用。根據OWASP的調查中，SQL注入攻擊（SQLIA）成為網路攻擊排行榜之冠。SQLIA是插入的SQL元字元和命令以更改原本的SQL查詢的內容，以執行惡意的SQL查詢來對資料庫進行攻擊。由於SQLIA的方式並沒有明顯的惡意特徵，所以SQLIA不易被偵測。因此，網路攻擊鑑識分析在此扮演非常重要的角色，以找出攻擊者攻擊資料庫的證據。對於過去所提出的Web攻擊分析方法只是一般的統計分析，僅僅只透過語法分析或簡單的特徵比對，效果並不顯著。因此，我們提出了一種方法來分析與分類SQLIA。首先，我們會將收集到的URL Request進行 Decode動作後，接著利用PHPIDS所提供的規則來進行比對，最後我們透過計算各別SQLIA 與每個攻擊的cluster中心之距離來對此攻擊進行分類。為了找出SQLIA的特徵模式，我們利用URL Request內的SQL關鍵字作為特徵值並利用K-Mean方法來分析與分類。

關鍵字

網路攻擊鑑識，Decode，SQLIA，K-Mean

並列摘要

In the WEB 2.0 generation, web attack has become a common issue and is widely used by intruders to exploit and access a system without any authorization. According to a survey from OWASP (Open Web Application Security Project’s), SQL injection attack (SQLIA) is placed first in the OWASP 2013’s top 10 list of cyber threats that is faced by the web service. SQLIA is a technique of inserting SQL meta-characters and commands into web-based input fields to change the original meaning of the SQL queries in order to manipulate the execution of the malicious SQL queries to access the databases unauthorized. SQLIA cannot be detected by any firewall or antivirus because it involves only the injection of one or many meta-characters and hence do not contain any malicious. Hence, forensic analysis is performed to find out the evidence of an attack and this plays an important role to make a conclusion on an incident whether to prove or disprove an intruder’s guilt. In previous researches, there were three ways of performing a forensic analysis namely, simple statistical analysis, parsing capabilities matching and simple signature matching. Thus, a method is proposed by analyzing the URL attack request and decoding the request before analyzing the request with the rule set that is provided by PHPIDS and then cluster these attacks by calculating the distance between every cluster and assigns the distance to the cluster with the nearest centroid point. To find the pattern of the SQL injection to cluster these attacks, a method is proposed whereby the SQL keyword is extracted as a token set from the URL request and then this token set is analyzed based on the K-mean method to find the standard centroid to cluster these attacks.

並列關鍵字

SQL injection, Request decoding, SQL keyword, K-means

參考文獻

[30] Phrack560x11A, “strict anomaly detection model for IDS,” from: http://phrack.org/authors.html.

[4] N. K. Singh, D. S. Tomar, and B. N. Roy, “An Approach to Understand the End User Behavior through Log Analysis,” International Journal of Computer Applications IJCA, Vol.5, No.11, pp.9-13, 2010.

[2] W. GJ. Halfond and A. Orso, “Detection and Prevention of SQL Injection Attacks,” Malware Detection Springer US, Vol.27, pp.85-109, 2007.

[6] I. Koral, A. K. Richard and P. A. Porras, “State transition analysis: A rule-based intrusion detection approach,” Software Engineering, IEEE Transactions on Vol.21, No.3, pp.181-199, March 1995

[7] A. Patel, Q. Qassim, and C. Wills, “A Survey of Intrusion Detection and Prevention Systems,” Information Management & Computer Security, Vol.18, Isu.4, pp.277–290, 2010

國際替代計量

針對SQL Injection攻擊鑑識之分析

未授權

主題瀏覽