Browse > Article

A Study on Secure Model based Virtualization for Web Application Security  

Yang, Hwan Seok (중부대학교/정보보호학과)
Yoo, Seung Jae (중부대학교/정보보호학과)
Publication Information
Convergence Security Journal / v.14, no.4, 2014 , pp. 27-32 More about this Journal
Abstract
Utilization of web application has been widely spread and complication in recent years by the rapid development of network technologies and changes in the computing environment. The attack being target of this is increasing and the means is diverse and intelligent while these web applications are using to a lot of important services. In this paper, we proposed security model using virtualization technology to prevent attacks using vulnerabilities of web application. The request information for query in a database server also can be recognized by conveying to the virtual web server after ID is given to created session by the client request and the type of the query is analyzed in this request. VM-Master module is constructed in order to monitor traffic between the virtual web servers and prevent the waste of resources of Host OS. The performance of attack detection and resource utilization of the proposed method is experimentally confirmed.
Keywords
Web Application; Virtualization; Security; Intrusion Detection;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Adam Kie˙zun, Philip J. Guo, Karthick Jayaraman, Michael D. Ernst, "Automatic Creation of SQL Injection and Cross-Site Scripting Attacks," ICSE‟09, May 16-24, 2009,
2 Gonzalez, J. M., Paxson, V., and Weaver N., "Shunting: a hardware/so ware architecture for exible, high-performance network intrusion prevention," In Conference on Computer and Communications Security (CCS), pp.129-149, 2007.
3 Fogla, P. and Lee, W., "Evading network anomaly detection systems: formal reasoning and practical techniques. In Proc of. ACM Conference on Computer and Communications Security (CCS), pp.59-68, 2006.
4 D. Scott and R. Sharp, "Avstracting Application-Level Web Security," Proc. 11th Int'l Conf. World Wide Web, pp.396-407, 2002.
5 Kruegel C., Mutz D., Valeur F., and Vigna G., "On the detection of anomalous system call arguments," In Proc. of European Symposium on Research in Computer Security, pp.326-343, 2003.
6 W. R. Cook and S. Rai, "Safe Query Objects: Statically Typed Objects as Remotely Executable Queries," Proc. 27th Int'l Conf. Software Eng. pp.97-106, 2005.
7 Klo M., Brefeld U., Dusse, P., Gehl C., and Laskov P., "Automatic feature selection for anomaly detection," In Proc. of ACM Workshop on Artical Intelligence for Security (AISEC), pp.71-76, 2008.