악성 파일 업로드 공격 대응방안 연구
Research on countermeasures against malicious file upload attacks
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Malicious file upload attacks mean that the attacker to upload or transfer files of dangerous types that can be automatically processed within the web server's environment. Uploaded file content can include exploits, malware and malicious scripts. An attacker can user malicious content to manipulate the application behavior. As a method of detecting a malicious file upload attack, it is generally used to find a file type by detecting a file extension or a signature of the file. However, this type of file type detection has the disadvantage that it can not detect files that are not encoded with a specific program, such as PHP files. Therefore, in this paper, research was conducted on how to detect and block any program by using essential commands or variable names used in the corresponding program when writing a specific program. The performance evaluation results show that it detected specific files effectively using the suggested method.
Abstract
Malicious file upload attacks mean that the attacker to upload or transfer files of dangerous types that can be automatically processed within the web server's environment. Uploaded file content can include exploits, malware and malicious scripts. An attacker can user malicious content to manipulate the application behavior. As a method of detecting a malicious file upload attack, it is generally used to find a file type by detecting a file extension or a signature of the file. However, this type of file type detection has the disadvantage that it can not detect files that are not encoded with a specific program, such as PHP files. Therefore, in this paper, research was conducted on how to detect and block any program by using essential commands or variable names used in the corresponding program when writing a specific program. The performance evaluation results show that it detected specific files effectively using the suggested method.
참고문헌 (9)
- 김수정, "정적 분석 기반 기계학습 기법을 활용한 악성코드 식별 시스템 연구", 정보보호학회논문지, 29(4), pp.775~784 (2019), 한국정보보호학회[DOI]
- Cisco 2018 annual cybersecurity report, , Cisco, ~ (2018)
- 하정우, "WhiteList 기반의 악성코드 행위분석을 통한 악성코드 은닉 웹사이트 탐지 방안 연구", 정보보호학회논문지, 21(4), pp.61~75 (2011), 한국정보보호학회
- Zhi-Yong Li, "A Web Page Malicious Code Detect Approach Based on Script Execution", ICNC.09, Fifth International Conference, pp.308~312 (2009)
- 김광현, "웹 취약점 분석을 위한 프락시 시스템의 설계 및 구현", 한국전자통신학회 논문지, 9(9), pp.1011~1018 (2014), 한국전자통신학회
- 박재연, "리눅스 아파치 웹 서버 실시간 로그 분석을 통한 공격 탐지 프로그램 개발", 정보과학회 컴퓨팅의 실제 논문지, 24(4), pp.190~197 (2018), 한국정보과학회[DOI]
- P. M. Wrench, "Towards a PHP webshell taxonomy using deobfuscation-assisted similarity analysis", 2015 Information Security for South Africa (ISSA), pp.1~8 (2015)
- 이인복, "시그니처 기반 침입 탐지 시스템의 최적화", 정보과학회지, 33(6), pp.55~60 (2015)
- "Snort"[URL]