페이로드 임베딩 사전학습 기반의 웹 공격 분류 모델
Web Attack Classification Model Based on Payload Embedding Pre-Training
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
인터넷 사용자가 폭발적으로 늘어나면서 웹을 이용한 공격이 증가했다. 뿐만 아니라 기존의 방어 기법들을 우회하기 위해 공격 패턴이 다양해졌다. 전통적인 웹 방화벽은 알져지지 않은 패턴의 공격을 탐지하기 어렵다. 따라서 인공지능으로 비정상을 탐지하는 방식이 대안으로 연구되고 있다. 특히 공격에 악용되는 스크립트나 쿼리가 텍스트로이루어져 있다는 이유로 자연어 처리 기법을 적용하는 시도가 일어나고 있다. 하지만 스크립트나 쿼리는 미등록 단어(Unknown word)가 다량 발생하기 때문에 자연어 처리와는 다른 방식의 접근이 필요하다. 본 논문에서는BPE(Byte Pair Encoding)기법으로 웹 공격 페이로드에 자주 사용되는 토큰 집합을 추출하여 임베딩 벡터를 학습시키고, 주의 메커니즘 기반의 Bi-GRU 신경망으로 토큰의 순서와 중요도를 학습하여 웹 공격을 분류하는 모델을제안한다. 주요 웹 공격인 SQL 삽입 공격, 크로스 사이트 스크립팅, 명령 삽입 공격에 대하여 분류 평가 결과 약0.9990의 정확도를 얻었으며, 기존 연구에서 제안한 모델의 성능을 상회하는 결과를 도출하였다.
Abstract
As the number of Internet users exploded, attacks on the web increased. In addition, the attack patterns have beendiversified to bypass existing defense techniques. Traditional web firewalls are difficult to detect attacks of unknownpatterns.Therefore, the method of detecting abnormal behavior by artificial intelligence has been studied as an alternative. Specifically, attempts have been made to apply natural language processing techniques because the type of script or querybeing exploited consists of text. However, because there are many unknown words in scripts and queries, natural languageprocessing requires a different approach. In this paper, we propose a new classification model which uses byte pair encoding(BPE) technology to learn the embedding vector, that is often used for web attack payloads, and uses an attentionmechanism-based Bi-GRU neural network to extract a set of tokens that learn their order and importance. For major webattacks such as SQL injection, cross-site scripting, and command injection attacks, the accuracy of the proposed classificationmethod is about 0.9990 and its accuracy outperforms the model suggested in the previous study.
참고문헌 (24)
- Internet Security Threat Report, volume 24, "Symantec", ~ (2019)
- Hsiu-Chuan Huang, "Web Application Security: Threats, Countermeasures, and Pitfalls", Computer, 50(6), pp.81~85 (2017)
- Hung Le, "URLnet: Learning a URL representation with deep learning for malicious URL detection", arXiv preprint arXiv:1802.03162, ~ (2018)
- Michiaki Ito, "Web application firewall using character-level convolutional neural network", 2018 IEEE 14th International Colloquium on Signal Processing & Its Applications, pp.103~106 (2018)
- Yang, Wenchuan, "Detecting malicious urls via a keyword-based convolutional gated-recurrent-unit neural network", IEEE Access, 7, pp.29891~29900 (2019)
- Saiyu Hao, "BL-IDS: Detecting Web Attacks Using Bi-LSTM Model Based on Deep Learning", International Conference on Security and Privacy in New Computing Environments, pp.551~563 (2019)
- Ren, "A Bi-Directional LSTM Model with Attention for Malicious URL Detection", 2019 IEEE 4th Advanced Information Technology, Electronic and Automation Control Conference, pp.300~305 (2019)
- Sennrich, Rico, "Neural machine translation of rare words with subword units", arXiv preprint arXiv:1508.07909, ~ (2016)
- Armand Joulin, "Fasttext. zip:Compressing text classification models", arXiv preprint arXiv:1612.03651, ~ (2016)
- Vandana Dwivedi, "SQLAS: Tool to detect and prevent attacks in php web applications", International Journal of Security Privacy and Trust Management, 4(1), pp.21~30 (2015)
- Sahu, Divya Rishi, "Analysis of web application code vulnerabilities using secure coding standards", Arabian Journal for Science and Engineering, 42(2), pp.885~895 (2017)
- Jason Bau, "State of the art: Automated black-box web application vulnerability testing", 2010 IEEE Symposium on Security and Privacy, pp.332~345 (2010)
- Priyank Bhojak, "SQL Injection and XSS Vulnerability Detection in Web Application", International Journal of Advanced Research in Computer Science and Software Engineering, 5(12), pp.110~115 (2015)
- Roesch, "Snort:Lightweight intrusion detection for networks", Proceedings of the 13th USENIX conference on System administration, pp.229~238 (1999)
- "Open Source Web Application Firewall"[URL]
- Nilesh Khochare, "Tool to Detect and Prevent Web Attacks", International Journal of Advanced Research in Computer Engineering & Technology, 1(4), pp.375~378 (2012)
- Mikhail Zolotukhin, "Analysis of http requests for anomaly detection of web attacks", Proceedings of IEEE 12th International Conference on Dependable, Autonomic and Secure Computing, pp.406~411 (2014)
- Abdelhamid Makiou, "Improving Web Application Firewalls to detect advanced SQL injection attacks", Information Assurance and Security 2014 10th International Conference, pp.35~40 (2014)
- Zhang, Zhaoxuan, "Efficient detection of anomolous HTTP payloads in networks", SoutheastCon 2016, pp.1~3 (2016)
- Baojiang Cui, "Malicious URL detection with feature extraction based on machine learning", International Journal of High Performance Computing and Networking, 12(2), pp.166~178 (2018)
- "Sqlmap" (2012)[URL]
- Stasinopoulos, Anastasios, "Commix:Detecting and exploiting command injection flaws", The Black hat Europe 2015 (2015)
- "Most advanced XSS scanner"[URL]
- "URL dataset(ISCX-URL-2016)"[URL]