Snort를 활용한 IoT 웹 취약점 탐지 규칙 설계

Abstract

The rapid increase in IoT devices has led to a significant rise in network-based security threats. However, the detection rules included in the default Snort configuration have limitations in identifying application-layer attacks in IoT environments; in our experiments, they failed to detect XSS and SQL Injection attacks at all. To address this limitation, this study proposes newly designed Snort-based detection rules for XSS and SQL Injection attacks using traffic collected from real IoT environments. Experimental results show that the best-performing proposed rules (by F1 score) achieve a precision of 97% and a recall of 95% for SQL Injection, and 92% in both precision and recall for XSS, whereas the default Snort rules detect none of these attacks. The proposed rules can efficiently filter the packets judged to be threats from the large volume of traffic generated in the network, and can support intrusion detection by logging the detection results.