웹 사이트 구조화 및 페이지별 동작크기 계산을 통한 동적 웹 취약점 점검 방법 및 절차 개선 연구
Improvement of Dynamic Web Vulnerability Inspection Method and Procedure by Website Structuring and Calculating Each Page's Action Size
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
웹이 발전함에 따라 다양한 웹 취약점이 발견되고 있다. 많은 기업과 여러 기관에서 웹 취약점을 제거하기 위해 노력하고 있으나 웹 취약점은 줄어들고 있지 않다. 웹 취약점 점검은 그 특성상 동적점검이 필수적으로 요구되며, 정확한 점검을 위해서는 수동점검이 바람직하다. 수동으로 진행하는 동적점검의 경우, 오탐이나 점검누락 그리고 점검자에 따른 점검의 편향(차이) 등과 같은 다양한 문제가 존재한다. 본 논문에서는 오탐이나 점검누락 등을 방지하고 점검자의 편향을 해결할 수 있는 점검방법과 절차를 제시한다. 제안방식은 점검 대상 웹 사이트를 정보구조설계(IA)를 이용하여 구조화한 후, 세부 페이지들을 7가지의 동작 기능으로 분류한다. 세부페이지들은 파라메타 개수를 이용하여 크기를 구하고, 세부페이지의 크기를 합하여 웹 사이트 전체의 크기를 수치화한다. 점검에 사용할 웹 취약점 항목을 이용하여 하루 동안에 점검 가능한 페이지 수를 계산한 후, 그 값을 이용하여 웹 사이트 전체 크기에서 전체 점검 일정을 계산한다. 제안방법과 현재방법으로 취약점 점검하여 발견한 취약점 개수를 비교하고, 관련 분야 종사자를 대상으로 한 설문 결과를 분석하여 제안방법의 타당성을 검증 하였다. 제안방식은 동적점검뿐만 아니라 정적점검에서도 응용이 가능하다.
Abstract
As the Web evolves, various web vulnerabilities are being discovered. Many companies and organizations are working to eliminate Web vulnerabilities, but they are not shrinking. Due to the nature of web vulnerability checks, dynamic checks are essential, and manual checks are preferred for accurate checking. In the case of a dynamic inspection performed manually, there are various problems such as false negative, missing inspection target and deflection due to inspectors. In this paper, we propose inspection methods and procedures to prevent a false negative, missing inspection target and deflection due to inspectors. In the proposed method, the web site is structured by Information Architecture(IA), and the detailed pages are classified into seven operation functions. The detailed pages are obtained by using the number of parameters, and the size of the entire website is calculated by adding the sizes of the detailed pages. Based on the number of Web vulnerability items to be used for the check, calculate the size of the page that can be checked in one day, and calculate the total inspection schedule. We verified the validity of the proposed method by comparing the number of vulnerabilities detected by the proposed method and the current method, and by analyzing the results of questionnaires for the related field workers. The proposed method can be applied not only to dynamic inspection but also to static inspection.
참고문헌 (27)
- "Many security vulnerabilities found in most web applications" (2017)[URL]
- Web vulnerability analysis and technical support, "KISA", Korea Internet Security Agency, ~ (2016)
- "Bombu hacking is attacking web vulnerability DB-the reason for the 2 million personal information was revealed" (2017)[URL]
- M. Y. Bae, "A study on HTML5 security fragility analysis and inspection technique", Department of Information Communication Engineering, pp.2016
- 서광익, "보안 취약점 검사를 위한 AOP 기반의 동적 분석", 정보과학회논문지 : 소프트웨어 및 응용, 37(10), pp.773~778 (2010), 한국정보과학회
- K. G. Kim, "Internet hacking and security-Introduction to Information Security and Practice" (2015), Hanbit academy
- T. Y. Park, "Study on the improvement of web vulnerability diagnosis of companies using Web Privacy Impact Assessment(WPIA)", pp.2015
- T. M. Liu, "The interactive mechanism of static and dynamic analysis in the reverse analysis of embedded software", International Journal of Multimedia and Ubiquitous Engineering, 11(10), pp.33~44 (2016)
- A. D. Petukhov, "Detecting security vulnerabilities in web applications using dynamic analysis with penetration testing", OWASP Application Security Conference, pp.19~22 (2008)
- "Static analysis vs dynamic analysis in software testing" (2016)[URL]
- S. Z. JIN, "Detection of DOM-based cross-site scripting with dynamic request", KOREA INFORMATION SCIENCE SOCIETY, 38(2C), pp.168~171 (2011)
- D. D. Bertoglio, "Overview and open issues on penetration test", the Brazilian Computer Society, 23(2) (2017)
- "Dictionary of information and communication terms" (2017)[URL]
- KISA, "Detailed information on how to analyze and evaluate key information infrastructure vulnerabilities", Korea Internet Security Agency, ~ (2014)
- "Explanation of technical vulnerability diagnosis consulting" (2017)[URL]
- J. H. Lee, "A study on improvement of web vulnerability inspection standard of the Critical Information and Communication Infrastructure", Proceedings of the 21st KKITS Spring Conference, 11(1), pp.76~79 (2017)
- "Category:OWASP Top Ten Project" (2017)[URL]
- 문재찬, "안전한 웹 애플리케이션 개발을 위한 취약점 분석 및 위협 완화", 한국컴퓨터정보학회논문지, 17(2), pp.127~137 (2012), 한국컴퓨터정보학회
- NCSC, "Homepage security management manual", National Cyber Security Center, ~ (2005)
- KISA, "Website development for information system development operators SW (web) development security guide", Korea Internet Security Agency, ~ (2012)
- "Vulnerability analysis and evaluation criteria for major IT infrastructure facilities(No. 2013-37)" (2017)[URL]
- KISA, "Homepage for information system development operator guide to vulnerability diagnosis and removal", Korea Internet Security Agency, ~ (2013)
- "Web Vulnerability check" (2017)[URL]
- J. M. Lee, "Information architecture for world wide web" (2011), Hanbit academy
- R. W. Saaty, "The analytic hierarchy process -what it is and how it is used", Mathematical Modelling, 9(3–5), pp.161~176 (1987)
- "Decision-making using the analytic hierarchy process(AHP) and SAS/IML" (2017)[URL]
- R. A. Kruger, "Focus groups: A practical guide for applied research" (2015), Sage Publication Inc