CAJ | 학술논문

随着 Internet 的发展，恶意用户利用 Web 应用程序存在的漏洞，对 Web 站点实施攻击，从而完成获取信息资料、植入病毒木马、伪装钓鱼网站、恶意插入广告等恶意操作，危害用户的利益，降低网站的可信度。随着 Web 攻击的日益增长，网站的安全风险达到了前所未有的高度。针对 Web 站点安全问题，在 HTTP 协议模型的基础上，结合 URL 解析技术及 Web 服务器核心扩展技术，文章设计并实现了一个基于 ISAPI 过滤器的 Web 防火墙系统。该系统可抵御常见网络攻击行为，为基于 HTTP 协议的 IIS 网站提供安全保障。系统主要包括3个组成部分：配置模块、过滤模块及日志模块。文章对系统过滤模块的设计与实现进行了详尽的阐述，系统的主要功能包括：过滤 HTTP 请求类型、限制头部长度、禁止 SQL 注入、禁止 Cookie 注入、禁止跨站攻击、防止敏感目录扫描、过滤请求文件类型以及 IP 黑名单。系统通过上述功能可以有效检测 Web 攻击行为并能做出正确处理，为 Web 网站安全提供有效保障。文章最后对系统进行功能测试，测试表明，系统可以对常见的 Web 攻击行为进行过滤处理并做出预期响应。系统符合设计目标，具有较高的实用价值。
수착 Internet 적발전，악의용호이용 Web 응용정서존재적루동，대 Web 참점실시공격，종이완성획취신식자료、식입병독목마、위장조어망참、악의삽입엄고등악의조작，위해용호적이익，강저망참적가신도。수착 Web 공격적일익증장，망참적안전풍험체도료전소미유적고도。침대 Web 참점안전문제，재 HTTP 협의모형적기출상，결합 URL 해석기술급 Web 복무기핵심확전기술，문장설계병실현료일개기우 ISAPI 과려기적 Web 방화장계통。해계통가저어상견망락공격행위，위기우 HTTP 협의적 IIS 망참제공안전보장。계통주요포괄3개조성부분：배치모괴、과려모괴급일지모괴。문장대계통과려모괴적설계여실현진행료상진적천술，계통적주요공능포괄：과려 HTTP 청구류형、한제두부장도、금지 SQL 주입、금지 Cookie 주입、금지과참공격、방지민감목록소묘、과려청구문건류형이급 IP 흑명단。계통통과상술공능가이유효검측 Web 공격행위병능주출정학처리，위 Web 망참안전제공유효보장。문장최후대계통진행공능측시，측시표명，계통가이대상견적 Web 공격행위진행과려처리병주출예기향응。계통부합설계목표，구유교고적실용개치。
With the development of Internet, malicious users attack Web sites by using leaks which exit in Web applications to achieve accessing to information, implanting trojans and virus, camouflaging fishing sites, inserting malicious advertising and other illegal operations. These malicious behaviours damage the profit of the legal users and reduce the credibility of the site.With the increasment of Web attacks , the security risks of websites have reached unprecedented levels. According to the security problems of Web sites, basing on the HTTP protocol model, combining with the URL parsed technique and core extension technique of Web server, the paper designs and implements the WAF system based on ISAPI filter. The system can resist a variety of network attacks, and can protect IIS Web sites basing on the HTTP protocol. The system contains three modules, they are configuration module, filtration module and log module. This paper introduces the design and implementation of the filtration module in detail. The system mainly implements the following functions: filtering the type of HTTP request, restricting the length of HTTP head, forbidding SQL injection, forbidding Cookie injection, forbidding XSS attack, prohibiting the scan of sensitive directory, filtering the type of files and IP blacklist. The System can detect Web attacks effectively and can response correctly. At last, the system testing environment is set up to achieve function test, The result of the test shows that the system can filter Web attacks and react as expected. The system can meet the requirement, and it has high practical value.