SQL Web Web SQL SQL SQL SQL SQL SQL SQL SQL SQL SQL SQL i

Size: px

Start display at page:

Download "SQL Web Web SQL SQL SQL SQL SQL SQL SQL SQL SQL SQL SQL i"

めぐのいなくら
5 years ago
Views:

1 28 SQL Proposal of attack detection method based on appearance frequency of symbols included in SQL injection attack and its relevance

2 SQL Web Web SQL SQL SQL SQL SQL SQL SQL SQL SQL SQL SQL i

3 SQL SQL ii

4 Abstract Proposal of attack detection method based on appearance frequency of symbols included in SQL injection attack and its relevance Cyber attacks targeting Web applications are a great threat to not only those who operate and manage Web applications but also their users. Among them, there are many attacks aimed at vulnerability of SQL injection attack, and it is pointed out that countermeasures have not kept up despite being a previously known vulnerability. SQL injection attack tends to include many symbols. Therefore, as an existing method, attack detection method focusing on symbols included in SQL injection attack has been proposed. However, while the existing method shows a high detection rate in detection of normal data, the detection rate of attack data is not higher than other detection methods. In order to prevent damage caused by SQL injection attack, it is necessary to improve attack detection rate without lowering performance against normal data. It is shown that the SQL injection attack has the following features. SQL statements inserted into SQL injection attacks differ according to the purpose of the attacker. In addition, in order to establish an SQL injection attack and obtain target information, information related to the database is required, and a method called blind SQL injection is used. In this paper, we propose an attack detection method that exploits the relationship between the attacker s purpose and the occurrence frequency of symbols included in blind SQL injection attack. The proposed method improves the attack detection rate iii

5 without lowering the detection rate of normal data by using the relationship between the purpose of the attacker and the information of the symbol included in the attack data. Moreover, by using blind SQL injection attack data for attack data, it is possible to block requests to collect database related information, which is considered to be a useful attack detection even in actual SQL injection attack. key words attack detection SQL injection machine learning iv

6 SQL SQL SQL SQL SQL SQL Web ( ) Web ( ) (WAF) SQL SVM (Support Vector Machine) SQL v

7 SQL vi

8 2.1 SQL SQL WAF vii

9 2.1 SQL (x ) ( ) (ModSecurity) (SVM) (x ) (x ) viii

10 1 1.1 ICT Web Web Web [1] Web OWASP (Open Web Application Security Project) Web SQL [2] SQL Web SQL Web SQL SQL [3] Web Web (WAF) WAF L7 L4 HTTP 1

11 1.1 [4] WAF SVM (Support Vector Machine) WAF SQL SQL [1] SQL ( ) ModSecurity SVM ModSecurity SVM [1] SQL SQL [11] SQL SQL SQL SQL SQL 2

12 1.2 SQL t 2 SQL 3 SQL 4 3 SQL 5 6 3

13 2 SQL SQL 2.1 SQL SQL (RDMS) RDBMS Oracle Database Microsoft SQL Server MySQL PostgreSQL SQL SQL 2.1 [3] SQL SQL users user admin id password SELECT id, password FROM users WHERE user = admin ; 2.1 SQL ( ) SELECT FROM WHERE AND = >=, a b c table name age YAMADA 20 4

14 2.2 SQL 2.2 SQL SQL (CWE-89: Improper Neutralization of Special Elements used in an SQL Command SQL Injection ) Web SQL [5] SQL Web SQL SQL [3] 2.1 SQL SQL [3] SQL SQL $username $password 5

15 2.3 SQL SELECT * FROM users WHERE user= $username AND password= $password SQL $username $password 1 or 1 = 1 SQL 1 = 1 OR SELECT * FROM users WHERE user= 1 OR 1 = 1 AND password= 1 OR 1 = 1 SQL SQL SQL SQL SQL SQL SQL 1 SQL 2.3 SQL SQL [6] 6

16 2.3 SQL Web ( ) SQL [3]? SQL SQL Web ( ) SQL SQL ( ; % + ) SQL [3] (WAF) WAF (Web Applicatioln Firewall) Web Web WAF 7 4 HTTP [4] WAF SVM (Support Vector Machine) WAF [1] 7

17 2.4 SQL 2.4 SQL SQL SQL SQL SQL SQL sqlmap sqlmap SQL sqlmap SQL [13] Boolean-based blind WHERE HAVING SQL AND 4908=2320 AND TFah = TFah Time-based blind SQL AND SLEEP(5) AND ybnw = ybnw Error-based SQL SELECT CAST(x FFFFFFFFFFFFFFFF AS UNSIGNED)+1; UNION query-based SQL UNION 8

18 2.4 SQL ) UNION ALL SELECT NULL,NULL,NULL# Stacked queries 1 SQL ; SELECT SLEEP(5) 9

19 3 SQL SQL SVM 3.1 SQL Apache ModSecurity SVM SQL 10

20 3.2 SVM (Support Vector Machine) [1] SQL [1] 3.2 SVM (Support Vector Machine) SVM 2 SVM (margin) ( ) (support vector) [12] SVM [9] ( ) 11

21 3.4 [8] 3.4 SQL 1 I A I N 2 ( J A J N ) s 1, s 2,..., s j 3 3 R 3 (x, y, t) 1 X x s 1, s 2,..., s x x 1 X 1 = s 1 2 = s 2... x = s x s j (j = 1, 2,..., x) R 3 X (j, 0, 0) 2 y 1 j s j y j (l i ) = z i(s j ) l i l i l i l i 12

22 3.5 z i (s x ) l i s x l s j1 s j2 (j 1, y j1 (l)) (j 2, y j2 (l)) 3 t t = 1 t = y = a 0 + a 1 x + a 2 x a 0 = b 00 + b 10 t + 2 a 1 = b 01 + b 11 t + 3 a 2 = b 02 + b 12 t + 4 i (i = 1, 2, 3, 4) SQL y = a 0 + a 1 x + a 2 x 2 5 y = a 0 + a 1 x + a 2 x 2 y SQL s jk (k = 1, 2,..., K) T N = (j k, y jk, 0) K k=1 T A = (j k, y jk, 0) K k=1 s j y j 13

23 3.6 SQL 2 T A = (j k, y jk, 0) K k=1 e(t A) T N = (j k, y jk, 0) K k=1 e(t N) 3.6 SQL SQL [10] 2,779 (J A = 2779) Wiki 444 (J A = 444) 3.1 2, SQL 3.1 (x ) 5 Space ; ) ( x

24 [1] 3.3 Apache ModSecurity 3.4 SVM ModSecurity SVM ModSecurity 3.2 ( ) 2, % 100% 3.3 (ModSecurity) % 38% 3.8 ModSecurity SVM 15

25 (SVM) 2, % 0% 2 SQL SQL Web 16

26 4 ModSecurity SVM SQL SQL 4.1 SQL SQL SQL SQL SQL SQL 17

27 4.2 SQL SQL SQL SQL SQL 4.2 SQL 4.2 SQL Web PHP/MySQL Web DVWA (Damn Vulnerable Web Application) VirtualBox Linux DVWA sqlmap $./sqlmap.py -o -u cookie= Cookie ; security=impossible dump-all 4.3 SQL 3 SQL 18

28 4.3 SQL 4.1 VirtualBox OS Web CentOS 6.7 (64bit) DVWA (Damn Vulnerable Web Application) DBMS mysql Ver Distrib , for Linux (x86 64) 4.2 OS OS X El Capitan sqlmap SQL sqlmap Web 1,924 (I A = 1924) Web 268 (I N = 268) 2 1, (x = 5)

4.3 SQL 4.1 4.3 y = a 0 + a 1 x + a 2 x 2 4.3 (2 ) (x ) 4.3 5 4.

29 4.3 SQL y = a 0 + a 1 x + a 2 x (2 ) (x ) y = a 0 + a 1 x + a 2 x (x ) 5 Space ( ), x

30 SP ( ), _ =. * > - `! " # $ & + / : ; [ ] ^ { } ~ DEL 4.2 SQL SQL 21

31 Space ( ), x (x ) 5 x Space ( ), Space ; ) ( 4.6 Space ; ) (

32 y = (b 00 + b 10 t) + (b 01 + b 11 t)x + (b 02 + b 12 t)x 2 b 00 = b 10 = b 01 = b 11 = b 02 = b 12 =

33 4.4 y = (b 00 + b 10 t) + (b 01 + b 11 t)x + (b 02 + b 12 t)x 2 b 00 = b 10 = b 01 = b 11 = b 02 = b 12 = t = 1 t = sqlmap SQL % 100% 94% 100% 24

34 SQL SQl SQL 2 Boolean-based blind Time-based blind Error-based UNION query-based Stacked queries SQL SQL SQL SQL sqlmap SQL 25

35 Web Space Space Space 5.3 SQL Web Web WAF [4] 5.3 SQL WAF WAF 26

36 5.3 課題複数 WAF インターネット WAF 選択装置図 5.1 最適 WAF 選択 27 サーバ

37 6 SQL SQL ModSecurity SVM SQL SQL [11] SQL SQL SQL SQL SQL SQL Web Web 28

38 29

39 30

40 [1] : WAF Vol.56 No.9 pp (2015) [2] Web SQL : http: // ( ) [3] IPA SQL : pdf( ) [4] : WAF Vol.77 Issue 3 pp (2015) [5] MITRE Common Weakness Enumeration definitions/89.html ( ) [6] : pp.50-54( ) [7] Web SQL : News/column_g/ /Cobs_ html ( ) [8] : research/application/gasshuku02/lca.pdf( ) [9], : SVM WAF 74 pp (2012) [10] Testing for SQL Injection (OTG-INPVAL-005) : index.php/testing_for_sql_injection_(otg-inpval-006) ( ) [11] : SQL 76 pp (2014) 31

41 [12] Sebastian Raschka : Python pp.66-67( ). [13] SlideShare Web : abend_cve_9999_0001/websqlm ( ) 32

29 jjencode JavaScript

29 jjencode JavaScript Kochi University of Technology Aca Title jjencode で難読化された JavaScript の検知 Author(s) 中村, 弘亮 Citation Date of 2018-03 issue URL http://hdl.handle.net/10173/1975 Rights Text version author Kochi, JAPAN http://kutarr.lib.kochi-tech.ac.jp/dspa