웹 소스코드 파일에 숨겨진 악성 Javascript URL에 대한 점검 체계
A Discovery System of Malicious Javascript URLs hidden in Web Source Code Files
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
One of serious security threats is a botnet-based attack. A botnet in general consists of numerous bots, which are computing devices with networking function, such as personal computers, smartphones, or tiny IoT sensor devices compromised by malicious codes or attackers. Such botnets can launch various serious cyber-attacks like DDoS attacks, propagating mal-wares, and spreading spam e-mails over the network. To establish a botnet, attackers usually inject malicious URLs into web source codes stealthily by using data hiding methods like Javascript obfuscation techniques to avoid being discovered by traditional security systems such as Firewall, IPS(Intrusion Prevention System) or IDS(Intrusion Detection System). Meanwhile, it is non-trivial work in practice for software developers to manually find such malicious URLs which are hidden in numerous web source codes stored in web servers. In this paper, we propose a security defense system to discover such suspicious, malicious URLs hidden in web source codes, and present experiment results that show its discovery performance. In particular, based on our experiment results, our proposed system discovered 100% of URLs hidden by Javascript encoding obfuscation within sample web source files.
Abstract
One of serious security threats is a botnet-based attack. A botnet in general consists of numerous bots, which are computing devices with networking function, such as personal computers, smartphones, or tiny IoT sensor devices compromised by malicious codes or attackers. Such botnets can launch various serious cyber-attacks like DDoS attacks, propagating mal-wares, and spreading spam e-mails over the network. To establish a botnet, attackers usually inject malicious URLs into web source codes stealthily by using data hiding methods like Javascript obfuscation techniques to avoid being discovered by traditional security systems such as Firewall, IPS(Intrusion Prevention System) or IDS(Intrusion Detection System). Meanwhile, it is non-trivial work in practice for software developers to manually find such malicious URLs which are hidden in numerous web source codes stored in web servers. In this paper, we propose a security defense system to discover such suspicious, malicious URLs hidden in web source codes, and present experiment results that show its discovery performance. In particular, based on our experiment results, our proposed system discovered 100% of URLs hidden by Javascript encoding obfuscation within sample web source files.
참고문헌 (15)
- G Davanzo, "Anomaly detection technique for a web defacement monitoring service", Expert Systems with Applications(ESWA), 38(10), pp.12521~12530 (2011)
- S. Khattak, "A Taxonomy of Botnet Behavior, Detection, and Defense", IEEE Communications Survey & Tutorials, 16(2), pp.898~924 (2014)
- A multi-perspective analysis of the storm (peacomm)worm, "Porras, Phillip", Computer Science Laboratory, SRI International, ~ (2007)
- D. Dagon, "Botnet Detection and Response – The network is the infection", Copperative Association for Internet Data Analysis DNS-OARC Workshop, 25 (2005)
- D. Dagon, "A taxonomy of botnet structures", Twenty-Third Annual Computer Security Applications Conferenece ACSAC 2007, 36, pp.325~339 (2007)
- W Xu, "The Power of Obfuscation Techniques in Malicious Javascript Code: A Measurement Study", Proceedings of International Conference on Malicious and Unwanted Software, pp.9~16 (2012)
- W Xu, "JStill : Mostly Static Detection of Obfuscated Malicious Javascript Code", Proceedings of the third ACM conference on Data and application security and privacy, pp.117~128 (2013)
- Mavrommatis, "All your iframes point to us", Proceedings of USENIX Security Symposium, pp.1~16 (2008)
- C Curtsinger, "Zozzle : Fast and Precise In-Browser Javascript Malware Detection", Proceedings of USENIX Security Symposium, pp.33~48 (2011)
- "ChromeDriver"[URL]
- JW Ratcliff, "Pattern matching : The gestalt approach", Dr. Dobb’s Journal, 13(7) (1998)
- "N-gram"[URL]
- "Zohn-H"[URL]
- "Pyhton"[URL]
- "Selenium Webdriver"[URL]