SlideShare a Scribd company logo
1 of 28
Download to read offline
以成本角度選擇網頁應用程式防 
禦策略 
大同大學 軟體工程實驗室 
報告者:關凡宇 
指導教授:林金城博士
Outline 
• 研究動機 
• 研究目標 
• 相關研究 
• 研究內容 
• 範例 
• 結論 
• 未來工作 
2
研究動機 
• 針對網頁應用程式弱點進行攻擊,已成為現今攻 
擊事件最常出現的手法 
▫ 對於風險評估的研究卻還是針對傳統網路層的攻擊 
手法做研究 
▫ 亦未考慮成本因素 
3
研究目標 
• 藉由評估各項攻防策略所需的成本以及可獲得的 
利益,並以博奕理論為基礎,計算出最佳的防守 
策略選擇 
4
Game Theory 
• 網路安全領域有許多以博奕理論來闡述網路攻防 
雙方行為的研究 
• 網路攻防行為與賽局博奕行為相似 
▫ 至少有兩個參賽者 
▫ 雙方選擇特定策略 
▫ 每個策略都會造成特定結果 
▫ 賽局結束後雙方會依照各自的狀態取得報酬 
• 最終目的是在一群策略集合中,找出最佳策略 
5
Interactions 
• 管理者認為某潛在風險R1之後的資產最為重要, 
故花費所有成本全力的試圖防止R1被成功入侵 
• 攻擊者預期到R1對管理者來說最為重要,管理者 
必定會以全力防護 
▫ 故攻擊者轉向次要目標R2 
• 若攻擊者這樣的行為也被管理者考慮在內,則防 
守者勢必會分出部分成本防止R2被成功入侵 
6
Costs 
• 對防守方來說… 
▫ 進行安全防護的成本(RCost) 
▫ 被入侵所損失的成本(DCost) 
• 對攻擊方來說… 
▫ 進行攻擊所需的成本(ACost) 
7
成本評估 
• 對防守方來說… 
▫ 由於可能存在的安全威脅數以萬計,故需要找一個 
分類方式,進而評估各種類型的潛在安全風險 
8
An Attack Taxonomy for DARPA Data 
9
分析流程 
• 弱點掃描 
• 列表弱點 
• 評估成本 
• 建立Payoff Table 
• 計算機率 
• 分配資源 
10
弱點掃描 
• 使用網頁弱點掃描工具對系統進行掃描 
▫ 可綜合多種掃描工具取得更審慎的結果 
▫ 可由管理者團隊經由會議的方式去除明顯的誤判 
11
列表弱點 
• 將可能的潛在風險進行列表 
12
評估成本 
• 根據Table 1的方式,將風險分類,並定義 
RCost、DCost的值 
▫ 該值應由管理團隊考量該風險後的資產在系統中的 
重要程度,經由會議的方式取得一個共識值 
• 以相似的方式,對攻擊方可能需要的攻擊成本 
(ACost),從人力與知識成本、頻寬成本、運算 
成本的角度做評估 
▫ 同樣由管理者們經由會議的方式取得共識值 
13
評估收益 
• 收益=得到的好處-支出的成本 
• 系統損失=攻擊者獲利,攻擊者成本=防守者獲 
利 
• 對防守方來說… 
▫ 防守成功時的收益為 
(攻擊方花費的成本)-(安全修補所需的成本) 
=ACostAttacker(n)-RCostDefender(m) 
▫ 防守失敗時的收益為 
(攻擊方花費的成本)-(安全修補所需的成本+造成 
的傷害耗費的成本) 
=ACostAttacker(n)-(RCostDefender(m)+DCostDefender(n)) 
14
評估收益(Cont.) 
• 對攻擊方來說… 
▫ 攻擊成功時的收益為 
(防守方進行修補所需的成本+防守方被攻擊的損 
失造成的成本)-攻擊方進行攻擊的成本 
=(DCostDefender(n)+RCostDefender(m))-ACostAttacker(n) 
▫ 攻擊失敗時的收益為 
防守方進行修補所需的成本-攻擊方進行攻擊的成 
本= 
RCostDefender(m) – ACostAttacker(n) 
15
Payoff Table 
• 由前述公式,即可根據攻防雙方的策略組合,建 
立雙方的Payoff Table 
16
Nash Equilibrium 
• 一旦建立了前述的Payoff Table 之後,就可以根 
據Nash Equilibrium 計算出各策略所應採用的機 
率比重 
• 管理者即可根據該比重,分配有限的可用資源在 
各種潛在安全威脅上 
17
範例 
• 環境 
▫ Apache Web Server 1.3.41 
▫ PHP 5.2.11 
▫ Open Journal System 
• 使用掃描工具 
▫ N-Stalker 
18
N-Stalker Scanning Result 
19
潛在威脅表 
• 由於「Sun Management Center 3.5 Error 
Message Information Disclosure Vulnerability 」 
為誤判,故將這項結果刪除 
• 整理出的潛在威脅表為 
20
風險成本分析表 
21
攻擊成本分析 
22
Payoff Table 
23
計算結果 
• 計算後可得到防守方各策略的機率 
• PD1=0.3846,PD5=0.2308,PD6=0.3846 或是 
PD1=0.3846,PD5=0.3846,PD6=0.2308 
• 兩組解代表無論使用哪一組解,Expected Payoff 
都是相同的 
• DCost最高者為D7「Denial of Service」風險, 
但經過計算後,對防守方來說並非最佳策略 
24
計算結果(Cont.) 
• 若防守者在有限的人力、物力、預算之下,對於 
D1、D4、D6策略,也就是「Possible Insecure 
HTTP Method Found 」、「Brute force」、 
「Session Fixation 」,以38:23:38或是 
38:38:23的比例做修補 
25
結論 
• 本文將潛在安全風險進行系統式的評估 
• 再利用博奕理論的概念,衡量攻防雙方各自的策 
略後所需付出的成本以及可能得到的收益,對管 
理者提出行動的建議 
• 由範例結果證明對最危險的風險進行修補,並不 
一定是最佳的策略 
26
未來工作 
• 管理者可能會因為對該弱點不夠瞭解,而對威脅 
性產生誤判,則會影響最後計算出的比重 
• 未知的攻擊方式可能無法被掃描工具掃描到 
27
28

More Related Content

Featured

Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsKurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summarySpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentLily Ray
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best PracticesVit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project managementMindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...RachelPearson36
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Applitools
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at WorkGetSmarter
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...DevGAMM Conference
 
Barbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationBarbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationErica Santiago
 
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them wellGood Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them wellSaba Software
 
Introduction to C Programming Language
Introduction to C Programming LanguageIntroduction to C Programming Language
Introduction to C Programming LanguageSimplilearn
 
The Pixar Way: 37 Quotes on Developing and Maintaining a Creative Company (fr...
The Pixar Way: 37 Quotes on Developing and Maintaining a Creative Company (fr...The Pixar Way: 37 Quotes on Developing and Maintaining a Creative Company (fr...
The Pixar Way: 37 Quotes on Developing and Maintaining a Creative Company (fr...Palo Alto Software
 

Featured (20)

Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 
ChatGPT webinar slides
ChatGPT webinar slidesChatGPT webinar slides
ChatGPT webinar slides
 
More than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike RoutesMore than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike Routes
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
 
Barbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationBarbie - Brand Strategy Presentation
Barbie - Brand Strategy Presentation
 
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them wellGood Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
 
Introduction to C Programming Language
Introduction to C Programming LanguageIntroduction to C Programming Language
Introduction to C Programming Language
 
The Pixar Way: 37 Quotes on Developing and Maintaining a Creative Company (fr...
The Pixar Way: 37 Quotes on Developing and Maintaining a Creative Company (fr...The Pixar Way: 37 Quotes on Developing and Maintaining a Creative Company (fr...
The Pixar Way: 37 Quotes on Developing and Maintaining a Creative Company (fr...
 

以成本角度選擇網頁應用程式防禦策略