비관계형 데이터베이스 환경에서 CNN과 RNN을 활용한 NoSQL 삽입 공격 탐지 모델 = Detection of NoSQL Injection Attack in Non-Relational Database Using Convolutional Neural Network and Recurrent Neural Network

다국어 초록 (Multilingual Abstract)

With a variety of data types and high utilization of data, non-relational databases are a popular data storage because itsupports better availability and scalability. The increasing use of this technology also brings the risk of NoSQL injectionattacks. Existing works mostly discuss the rule-based detection of NoSQL injection attacks that it is hard to deal withNoSQL queries beyond the coverage of the rules. In this paper, we propose a model for detecting NoSQL injection attacks.
Our model is based on deep learning algorithms that select features from NoSQL queries using CNN, and classify NoSQLqueries using RNN. Also, we experiment the proposed model to compare with existing models, and find that our modeloutperforms traditional models in terms of detection rate.

국문 초록 (Abstract)

데이터 활용의 다양성이 높아짐에 따라 비관계형 데이터베이스 사용이 증가했으며, 이에 대한 NoSQL 삽입 공격또한 증가했다. 전통적으로 NoSQL 삽입 공격을 탐지하기 위해 규칙 기반 탐지 방법론이 제안돼왔으나, 이 방식은규칙의 범위를 벗어나 발생하는 삽입 공격에의 대응이 어렵다는 한계점이 있다. 이에 본 논문에서는 CNN 알고리즘을 이용해 특징을 추출하고, RNN 알고리즘을 활용해 NoSQL 삽입 공격을 탐지하는 기법을 제시한다. 또한, 실험을 통하여 본 논문에서 제시한 모델이 기존의 지도학습을 이용한 가장 우수한 모델보다 정확도는 10%, 정밀도는4%, 재현율은 14%, F2-score는 0.082만큼 더 높은 비율로 NoSQL 삽입 공격을 탐지함을 보인다.

참고문헌 (Reference)

1 MongoDB, "mongodb all customers"

2 Wired Business Media, "Thousands of MongoDB Databases Found Exposed on the Internet"

3 Y. Bengio, "Representation Learning: A Review and New Perspectives" 35 (35): 1798-1828, 2013

4 OWASP, "OWASP Top10"

5 A. M. Eassa, "Nosql racket: A testing tool for detecting nosql injection attacks in web applications" 8 (8): 614-622, 2017

6 A. Ron, "No SQL, no injection?" 2015

7 B. Hou, "MongoDB NoSQL Injection Analysis and Detection" 75-78, 2016

8 F. A. Gers, "Learning to forget:continua l prediction with LSTM" 850-855, 1999

9 B. Xu, "Empirical evaluation of rectified activations in convolutional network"

10 X. Zhang, "Character-level convolutional networ -ks for text classification" 28 : 649-657, 2015

11 CWE, "CWE VIEW: Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors"

12 NIST, "CVE-2019-9039 Detail"

13 NIST, "CVE-2018-1784 Detail"

14 M. R. Ul Islam, "Automatic Detection of NoSQL Injection Using Supervised Learning" 760-769, 2019

15 B. Shi, "An endto-end trainable neural network for image-based sequence recognition and its application to scene text recognitio -n" 39 (39): 2298-2304, 2016

16 D. P. Kingma, "Adam: A method for stochastic optimization"

17 S. Albelwi, "A frame work for designing the architectures of deep convolutional neural networks" 19 (19): 242-263, 2017