CAJ | 학술논문

基于云计算环境下网络攻击与防御技术的研究，对传统后门隐藏方式进行分析，提出了一种基于Oracle触发器的后门隐藏技术。通过在当前Oracle账户下指定的触发器中插入Java存储过程调用语句块，当业务系统发生特定操作行为时，触发Java存储过程调用语句块的执行，达到通过Java存储过程调用外部程序的目的，从而启动潜伏于操作系统中的后门程序，而在业务系统正常的业务操作过程中，触发器执行自身应有功能，后门程序保持长期静态潜伏。通过针对该后门隐藏技术实现原理的深入分析，找到了有效的防御措施。
기우운계산배경하망락공격여방어기술적연구，대전통후문은장방식진행분석，제출료일충기우Oracle촉발기적후문은장기술。통과재당전Oracle장호하지정적촉발기중삽입Java존저과정조용어구괴，당업무계통발생특정조작행위시，촉발Java존저과정조용어구괴적집행，체도통과Java존저과정조용외부정서적목적，종이계동잠복우조작계통중적후문정서，이재업무계통정상적업무조작과정중，촉발기집행자신응유공능，후문정서보지장기정태잠복。통과침대해후문은장기술실현원리적심입분석，조도료유효적방어조시。
Because of oracle cloud computing technology occupying an important seat in the cloud computing market and the feature of oracle database in the basic position of the oracle cloud computing infrastructure so-lutions, We put forward a backdoor hidden technology based on oracle trigger for new attack and defense tech-nology research in cloud computing environments. in short, we insert java stored procedure call statement block in specified trigger under the current oracle account, when the certain operation is taking place in the in-formation system, the java stored procedure call statement block is running because of the oracle trigger, and for the purpose of executing external program through the java stored procedure, so the backdoor program is running which is hiding in the operation system, otherwise when we do the normal operation in the information system, the trigger perform the original job, and the backdoor is taking long time static latent.