Journal of KIISE (정보과학회 논문지)

Korean Institute of Information Scientists and Engineers (한국정보과학회)
권호 표지
DOI QR코드

DOI QR Code

HTTP Request - SQL Query Mapping Scheme for Malicious SQL Query Detection in Multitier Web Applications

Multitier 웹 어플리케이션 환경에서 악의적인 SQL Query 탐지를 위한 HTTP Request - SQL Query 매핑 기법

  • 서영웅 (POSTECH 정보전자융합공학부) ;
  • 박승영 (강원대학교 전기전자공학부)
  • Received : 2016.05.13
  • Accepted : 2016.10.15
  • Published : 2017.01.15
⟨ Previous Next ⟩

Abstract

The continuously growing internet service requirements has resulted in a multitier system structure consisting of web server and database (DB) server. In this multitier structure, the existing intrusion detection system (IDS) detects known attacks by matching misused traffic patterns or signatures. However, malicious change to the contents at DB server through hypertext transfer protocol (HTTP) requests at the DB server cannot be detected by the IDS at the DB server's end, since the DB server processes structured query language (SQL) without knowing the associated HTTP, while the web server cannot identify the response associated with the attacker's SQL query. To detect these types of attacks, the malicious user is tracked using knowledge on interaction between HTTP request and SQL query. However, this is a practical challenge because system's source code analysis and its application logic needs to be understood completely. In this study, we proposed a scheme to find the HTTP request associated with a given SQL query using only system log files. We first generated an HTTP request-SQL query map from system log files alone. Subsequently, the HTTP request associated with a given SQL query was identified among a set of HTTP requests using this map. Computer simulations indicated that the proposed scheme finds the HTTP request associated with a given SQL query with 94% accuracy.

지속적으로 증가하는 인터넷 서비스 요구사항을 만족하기 위하여 인터넷 서비스를 제공하는 시스템은 웹 서버와 DB(database) 서버로 구성된 multitier 구조로 변화되어왔다. 이러한 multitier 웹 어플리케이션 환경에서 기존의 IDS(intrusion detection system)는 웹 서버와 DB 서버에서 misused traffic pattern들이나 signature들을 매칭하여 이미 알려진 공격을 검출하고 해당 접속을 차단하는 방식으로 동작한다. 하지만 이러한 방식의 IDS는 정상적인 HTTP(hypertext transfer protocol) request를 이용하여 악의적으로 DB 서버의 내용의 변조를 시도하는 attacker의 공격을 DB 서버단에서 제대로 검출하지 못한다. 그 이유는 DB 서버는 웹 서버로부터 받은 SQL(structured query language) query가 어떤 사용자의 HTTP request에 의해 발생한 것인지 알지 못하는 상태에서 처리하며, 웹 서버는 SQL query 처리 결과 중 어떤 것이 악의적으로 DB 서버 변조를 시도한 SQL query에 의한 결과인지 알 수 없기 때문이다. 이런 공격을 검출하기 위해서는 HTTP request와 SQL query 사이의 상호작용관계를 명확히 파악하고, 이를 이용하여 악의적인 SQL query를 발생시킨 사용자를 추적해야 한다. 이를 위해서는 해당 시스템의 소스코드를 분석하거나 application logic을 완벽하게 파악해야 하므로 현실적으로 불가능하다. 본 논문에서는 웹 서버와 DB 서버에서 제공하는 로그만을 이용하여 모든 HTTP request와 SQL query간의 mapping 관계를 찾아내고, 이를 이용하여 특정 SQL query를 발생시킨 HTTP request를 추정하는 기법을 제안한다. 모의실험을 통하여 94%의 정확도로 HTTP request를 추정할 수 있음을 확인하였다.

Keywords

Acknowledgement

Supported by : 강원대학교, 한국인터넷진흥원(KISA)

References

  1. W.W. Eckerson, "Three tier client/server architecture: Achieving scalability, performance, and efficiency in client server applications," Open Information Systems, Vol. 3, No. 10, pp. 46-50, Oct. 1995.
  2. SANS, The top cyber security risks [Online]. Available: http://www.sans.org/top-cyber-security-risks, 2011.
  3. CVE, Common vulnerabilities and exposures [Online]. Available: http://www.cve.mitre.org, 2011.
  4. Symantec, Five common web application vulnerabilities [Online]. Available: http://www.symantec.com/connect/articles/five-common-web-applicationvulnerabilities, 2011.
  5. C. Anley, "Advanced SQL injection in SQL server applications," Tech. Report, Next Generation Security Software, Ltd., 2002.
  6. Y. Shin, L. Williams, and T. Xie, "SQLUnitGen: Test case generation for SQL injection detection," Tech. Report TR 2006-21, Computer Science Dept., North Carolina State Univ., 2006.
  7. M. Le, A. Stavrou and B. B. Kang, "DoubleGuard: Detecting intrusions in multitier web applications," IEEE Transactions on Dependable and Secure Computing, Vol. 9, No. 4, pp. 512-525, Jul./Aug., 2012. https://doi.org/10.1109/TDSC.2011.59
  8. G. Vigna, "A stateful intrusion detection system for world-wide web servers," Proc. of IEEE Computer Security Applications Conference, pp. 34-43, 2003.
  9. M. Doroudian, "Database intrusion detection system for detecting malicious behaviors intransaction and inter-transaction levels," Proc. of International Symposium on Telecommunication, pp. 809-814, 2014.
  10. J. Newsome, B. Karp, and D.X. Song, "Polygraph: Automatically generating signatures for polymorphic worms," Proc. of IEEE Symposium on Security and Privacy, pp. 226-241, 2005.
  11. H. A. Kim and B. Karp, "Autograph: Toward automated distributed worm signature detection," Proc. of USENIX Security Symposium, 2004.
  12. Zhenkai Liang and R. Sekar, "Fast and automated generation of attack signatures: A basis for building self-protecting servers," Proc. of ACM Conference on Computer and Communication Security, pp. 213-222, 2005.
  13. B.I.A. Barry and H.A. Chan, "Syntax, and semantics-based signature database for hybrid intrusion detection systems," Security and Comm. Networks, Vol. 2, No. 6, pp. 457-475, Dec. 2009.
  14. C. Sinclair, "An application of machine learning to network intrusion detection," Proc. of IEEE Computer Security Applications Conference, pp. 371-377, 1999.
  15. C. F. Tsai, "Intrusion detection by machine learning: A review," Expert Systems with Applications, Vol. 36, No. 10, pp. 11994-12000, Dec. 2009. https://doi.org/10.1016/j.eswa.2009.05.029
  16. A. U. Patil and A. M. Dixit, "WebGuard: Enhancing Intrusion Detection in Multitier Web Applications," International Journal of Computer Applications, Vol. 95, No. 9, pp. 29-35, Jun. 2014. https://doi.org/10.5120/16624-6477
  17. N. S. Kulkarni and N. C. Thoutam, "Dual Protector: Intrusion detection scheme using double firewall in Multitier Architecture," International Journal of Advancement in Engineering Technology, Management & Applied Science, Vol. 3, No. 1, pp. 67-76, Jan. 2016.
  18. R. M. Pandurang and D. C. Kaira, "A mappingbased model for preventing cross site scripting and SQL injection attacks on web application and its impact analysis," Proc. of International Conference on Next Generation Computing Technologies, pp. 414-418, 2015.
  19. WordPress [Online], Available: http://www.wordpress.org, 2016.
  20. MySQL [Online]. Available: https://www.mysql.com, 2016.
  21. ModSecurity [Online]. Available: https://www.modsecurity.org, 2016.
  22. MySQL Proxy [Online]. Available: https://dev.mysql.com/doc/mysql-proxy/en, 2016.
  23. Form submission algorithm, HTML5, W3C recommendation, Oct. 2014.
  24. ANSI/ISO/IEC International Standard (IS) Database Language SQL-Part 2: Foundation (SQL/Foundation). 1999.
  25. M. T. Goodrich and R. Tamassia, Data Structures and Algorithms in Java, 4th ed., John Wiley & Sons, Inc., 2005.
  26. G. Navarro, "A guided tour to approximate string matching," ACM Computing Surveys, Vol. 33, No. 1, pp. 31-88, Mar. 2011.
  27. W3Techs, Usage of content management systems for websites [Online]. Available: http://w3techs.com/technologies/overview/content_management/all/, 2016.