• Journal of Information Processing Systems
• /
• v.13 no.4
• /
• pp.689-702
• /
• 2017

The Structured Query Language (SQL) Injection continues to be one of greatest security risks in the world according to the Open Web Application Security Project's (OWASP) [1] Top 10 Security vulnerabilities 2013. The ease of exploitability and severe impact puts this attack at the top. As the countermeasures become more sophisticated, SOL Injection Attacks also continue to evolve, thus thwarting the attempt to eliminate this attack completely. The vulnerable data is a source of worry for government and financial institutions. In this paper, a detailed survey of different types of SQL Injection and proposed methods and theories are presented, along with various tools and their efficiency in intercepting and preventing SQL attacks.

• Convergence Security Journal
• /
• v.12 no.6
• /
• pp.93-99
• /
• 2012

As the most common application development of software development time, error-free quality, adaptability to frequent maintenance, such as the need for large and complex software challenges have been raised. When developing web applications to respond to software reusability, reliability, scalability, simplicity, these quality issues do not take into account such aspects traditionally. In this situation, the traditional development methodology to solve the same quality because it has limited development of new methodologies is needed. Quality of applications the application logic, data, and architecture in the entire area as a separate methodology can achieve your goals if you do not respond. In this study secure coding, the big issue, web application factors to deal with security vulnerabilities, web application architecture, design procedure is proposed. This proposal is based on a series of ISO/IEC9000, a web application architecture design process.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.6
• /
• pp.73-79
• /
• 2020

Nowadays, with the rapid spread of streaming services in the internet world, security vulnerabilities are also increasing rapidly. For streaming security, this paper proposes a PN(pseudo-random noise) distributed structure-based security processor for web streaming contents(SP-WSC). The proposed SP-WSC is basically a PN distributed code algorithm designed for web streaming characteristics, so it can secure various multimedia contents. The proposed SP-WSC is independent of the security vulnerability of the web server. Therefore, SP-WSC can work regardless of the vulnerability of the web server. That is, the SP-WSC protects the multimedia contents by increasing the defense against external unauthorized signals. Incidentally it also suggests way to reduce buffering due to traffic overload.

• The Journal of the Korea Contents Association
• /
• v.21 no.1
• /
• pp.284-291
• /
• 2021

As the current security monitoring system is operated as a passive system only for response after an attacker's attack, it is common to respond to intrusion incidents after an attack occurs. In particular, when new assets are added and actual services are performed, there is a limit to vulnerability testing and pre-defense from the point of view of an actual hacker. In this paper, a new security monitoring model has been proposed that uses multiple hacking-related search engines to add proactive vulnerability response functions of protected assets. In other words, using multiple search engines with general purpose or special purpose, special vulnerabilities of the assets to be protected are checked in advance, and the vulnerabilities of the assets that have appeared as a result of the check are removed in advance. In addition, the function of pre-checking the objective attack vulnerabilities of the protected assets recognized from the point of view of the actual hacker, and the function of discovering and removing a wide range of system-related vulnerabilities located in the IP band in advance were additionally presented.

• Journal of Digital Convergence
• /
• v.12 no.10
• /
• pp.259-264
• /
• 2014

The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may contain files that are not normally exposed through links on the web site. The directory list have some serious vulnerability to show internal files and directory to outsider attackers. Therefore, the proposed countermeasure of directory list is presented to prevent unnecessary valuable information from outsider attackers.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2016.01a
• /
• pp.101-102
• /
• 2016

사물인터넷(Internet of Things)의 도래와 함께, 무선공유기(wireless access point)들의 보안이 심각한 문제로 대두되고 있다. 연구진은 대부분의 무선공유기들이 제공하는 웹 기반 관리 인터페이스들에 웹 어플리케이션 취약점(web application vulnerability)들이 존재할 수 있다는 점을 착안, 국내 주요 무선공유기들에 대한 웹 어플리케이션 취약점 점검을 수행하였으며, 악용이 가능한 여러 취약점들이 존재함을 확인하였다. 본 논문에서는 연구진이 무선공유기 대상 웹 어플리케이션 취약점 점검에 보조적으로 사용하기 위하여 개발한 3종의 모바일 앱(mobile app)들을 설명한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.10a
• /
• pp.464-466
• /
• 2021

Currently, most companies have security solutions such as firewalls or WAF (Web Application Firewall) for web services, cloud systems, and data centers. Recently, as the need for remote access increases, the task of overcoming the security vulnerabilities of remote access control is becoming more important. In this paper, the concept of the network security model from the perspective of zero trust and the strategy and security system using it will be reviewed.

• The KIPS Transactions:PartC
• /
• v.13C no.1 s.104
• /
• pp.19-26
• /
• 2006

Recently, web server hacking is trending toward web application hacking which uses comparatively vulnerable web applications based on open sources. And, it is possible to hack databases using web interfaces because web servers are usually connected databases. Web application attacks use vulnerabilities not in web server itself, but in web application structure, logical error and code error. It is difficult to defend web applications from various attacks by only using pattern matching detection method and code modification. In this paper, we propose a method to secure the web applications based on profiling which can detect and filter out abnormal web application requests.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2010.05a
• /
• pp.303-306
• /
• 2010

Personal information being leaked, and personal assets that through a malicious web site for hackers to exploit. Other confidential information via the web site of the country, and your personal information by illegally accessing the data has been obtained who Hacker forces are operating in some countries. Due to the problem of web site management has many vulnerabilities that web sites, as well as programs. In this paper, in the trend world, as well as domestic XSS, SQL Injection, Web Shell analysis of the vulnerability to attacks and XSS, SQL Injection, Web Shell is a direct attack to attack. Security measures are presented what after the attack demonstrated the hack to data collection, analysis. In this study, web site management, web site security and safety can be improved and research will contribute.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2000.10a
• /
• pp.433-438
• /
• 2000

Now, It is vulnerabilities and problems of adaption in user identification and authentication on the Web environments; the BAA(Basic Access Authentication) of HTTP1.0 is that use. ID and password is passed with clear-text between client and server, For this enhancement, the DAA(Digest Access Authentication) of HTTP1.1 is that use. password is digested by MAC(Message Authentication Code) mechanism. but, this mechanism is not adapted by venders of Web browsers. This paper propose the lava based user identification and authentication model to resolve the above problems. Proposed systems are applied to the Web environment, since it has independence to web server and client.