Advanced SearchSearch Tips
A Design of Inter-Working System between Secure Coding Tools and Web Shell Detection Tools for Secure Web Server Environments
facebook(new window)  Pirnt(new window) E-mail(new window) Excel Download
 Title & Authors
A Design of Inter-Working System between Secure Coding Tools and Web Shell Detection Tools for Secure Web Server Environments
Kim, Bumryong; Choi, Keunchang; Kim, Joonho; Suk, Sangkee;
  PDF(new window)
Recently, with the development of the ICT environment, the use of the software is growing rapidly. And the number of the web server software used with a variety of users is also growing. However, There are also various damage cases increased due to a software security vulnerability as software usage is increasing. Especially web shell hacking which abuses software vulnerabilities accounts for a very high percentage. These web server environment damage can induce primary damage such like homepage modification for malware spreading and secondary damage such like privacy. Source code weaknesses checking system is needed during software development stage and operation stage in real-time to prevent software vulnerabilities. Also the system which can detect and determine web shell from checked code in real time is needed. Therefore, in this paper, we propose the system improving security for web server by detecting web shell attacks which are invisible to existing detection method such as Firewall, IDS/IPS, Web Firewall, Anti-Virus, etc. while satisfying existing secure coding guidelines from development stage to operation stage.
Secure Coding;Web Shell;Web Server;Source Code;
 Cited by
한국인터넷진흥원, "2014 한국인터넷백서," 2015, p. 494.

한국인터넷진흥원, "2008년 5월 인터넷침해사고동향 및 분석 월보," 2008, p. 22.

조성규.전문석, "개인정보 보호를 위한 조직구성과 관리체계에 관한 표준화 모델링," 디지털산업정보학회지, 8권, 3호, 2012, pp. 33-39.

서우석.전문석, "보안이벤트 사이의 상관분석기법을 이용한 조기위험경보시스템의 설계," 디지털산업정보학회지, 8권, 1호, 2012, pp. 65-72.

Da-Hye Jung, Jin-Young Choi, Song-Hee Lee, "Nuclear-related Software analysis based on secure coding.," Journal of the Korea Institute of Information Security and Cryptology, 23권, 2호, 2013, pp. 243-250. crossref(new window)

김준호, "소스코드 보안약점 탐지를 위한 정적도구의 활용과 기호실행 엔진을 활용한 개선 방안 연구," 숭실대학교, 서울, 2015, p. 5.

박우열.양일권.손창환.한경숙.표창우, "PHP 시큐어 코딩 규칙의 개발을 위한 보안 취약점 분석," 2014 한국정보과학회 제 41 회 정기총회 및 동계학술발표회, 2014, pp. 750-752.

안준선.이은영.창병모, "SW 개발보안을 위한 보안약점 표준목록 연구," 정보보호학회지, 25권, 1호, 2015, pp. 7-17.

김정숙, "소프트웨어 보안을 위한 시큐어 코딩," 한국콘텐츠학회지, 11권, 4호, 2013, pp. 56-60.

Byung-Ha Choi, Kyung-San Cho, "An Improved Detecting Scheme of Malicious Codes using HTTP Outbound Traffic," Journal of The Korea Society of Computer and Information, 14권, 9호, 2009, pp. 47-54.

박남열.김용민.노봉남, "우회기법을 이용하는 악성코드 행위기반 탐지 방법," 정보보호학회논문지, 16권, 3호, 2006, pp. 17-28.

허준호.홍명호.이정민.서경룡, "근거리 통신망에서의 DDoS 봇넷 탐지 시스템 구현," 멀티미디어학회논문지, 16권, 6호, 2013, pp. 678-688.

손유승.남길현.고승철, "스피어 피싱 대응을 위한 관리적 보안대책에 의한 접근," 한국정보통신학회논문지, 17권, 12호, 2013, pp. 2753-2762.