Web firewall and method for automatically checking web server for vulnerabilities

• US 8,353,043 B2
• Filed: 03/28/2008
• Issued: 01/08/2013
• Est. Priority Date: 10/16/2007
• Status: Active Grant

• Current Assignee: PDXen Biosystems Co.
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Min Sik, Park, Jung Gil
• Primary Examiner(s): Zee, Edward
• Assistant Examiner(s): Debnath, Suman
• Application Number:
  US12/057,457
• Publication Number:
  US 20090100522A1
• Time in Patent Office: 1,747 Days
• Field of Search: 726 22- 25, 713189-194
• US Class Current: 726/25
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Provided is a web firewall for automatically checking for vulnerabilities, including: an administrating server scheduling part for ordering the examination of an administrating web server according to a predetermined examination schedule; a vulnerability search database calling part for calling a vulnerability search database previously stored according to the order of the administrating server scheduling part; a vulnerability searching part for searching for potential vulnerabilities of the administrating web server corresponding to data included in the called vulnerability search database; a vulnerability information deducing part for optimizing the results searched in the vulnerability searching part to deduce vulnerability information; a vulnerability checking part for checking the vulnerabilities of the administrating web server based on the results deduced from the vulnerability information deducing part; and a detailed vulnerability information reporting part for reporting detailed information on the checked vulnerabilities.

Claims

1. An administrating web server including a web firewall for automatically checking for vulnerabilities, comprising:

a processor;

an administrating server scheduling part for ordering the examination of the administrating web server according to a predetermined examination schedule;

a vulnerability search database calling part for calling a vulnerability search database previously stored according to the order of the administrating server scheduling part,

wherein the called vulnerability search database comprises a list of vulnerabilities included in the web firewall from internet data transmitted thought the web firewall to the web servers, and

wherein the list of vulnerabilities are generated prior to the ordered examination of the administrating web server according to the predetermined examination schedule;

a vulnerability searching part for searching for potential vulnerabilities of the administrating web server corresponding to data included in the called vulnerability search database, wherein the vulnerability searching part searches for potential vulnerabilities of the administrating web server using at least one external search engine, and

wherein the at least one external search engine searches for the potential vulnerabilities from the list of vulnerabilities included in the web firewall;

a vulnerability information deducing part for optimizing the results searched in the vulnerability searching part to deduce vulnerability information;

a vulnerability checking part for checking the vulnerabilities of the administrating web server based on the results deduced from the vulnerability information deducing part; and

a detailed vulnerability information reporting part for reporting detailed information on the checked vulnerabilities.

2. The administrating web server according to claim 1, wherein the administrating server scheduling part receives a vulnerability examination scheduling order from an external administrating server.

3. The administrating web server according to claim 1, further comprising:

a vulnerability search database for storing data on vulnerabilities of the administrating web server.

4. The administrating web server according to claim 3, wherein the vulnerability search database is regularly updated by an external administrator or via the Internet.

5. The administrating web server according to claim 1, wherein the vulnerability information deducing part collects information deduced from the at least one search engine and optimizes the results.

6. The administrating web server according to claim 1, wherein the detailed vulnerability information reporting part is transmitted to an external administrating server.

7. The administrating web server according to claim 1, wherein the vulnerability checking part searches for potential vulnerabilities which can allow abnormal access to the administrating web server, interrupt normal service of the administrating web server, or leak, modulate or delete data of the administrating web server.

8. The administrating web server according to claim 1, wherein the data included in the vulnerability search database comprises a list of vulnerabilities that can be searched by an external search engine.

9. A method of automatically checking for vulnerabilities using a web firewall for automatically checking for vulnerabilities, comprising the steps of:

setting a time schedule for checking administrating web server vulnerabilities corresponding to a predetermined examination schedule;

confirming a time corresponding to the set schedule and measuring available system resources when the set time has arrived;

calling a vulnerability search database when the system resources exceed a predetermined standard value, and

wherein the called vulnerability search database comprises a list of vulnerabilities include in the web firewall from internet data transmitted thought the web firewall;

searching for potential vulnerabilities of the administrating web server corresponding to data extracted from the called vulnerability search database, wherein the potential vulnerabilities of the administrating web server are searched using at least one external search engine, and

wherein the at least one external search engine searches for the potential vulnerabilities from the list of vulnerabilities included in the web firewall;

optimizing the results of the potential vulnerability search;

checking the vulnerabilities of the administrating web server corresponding to the optimized results; and

making a detailed report on the results of the vulnerability check of the administrating web server.

10. The method according to claim 9, wherein the vulnerability examination schedule is determined corresponding to a vulnerability examination schedule received from an external administrating server.

11. The method according to claim 9, wherein the step of searching for potential vulnerabilities of the administrating web server is performed by searching for potential vulnerabilities that can allow abnormal access to the administrating web server, interrupt normal service of the administrating web server, or leak, modulate or delete data of the administrating web server.

12. The method according to claim 9, wherein the data included in the vulnerability search database comprises a list of vulnerabilities that can be searched by an external search engine.

13. An administrating web server including a web firewall for automatically checking for vulnerabilities in a web server, comprising:

a processor;

an administrating server scheduling part for ordering the examination of the administrating web server according to a predetermined examination schedule;

a vulnerability search database calling part for calling a vulnerability search database previously stored according to the order of the administrating server scheduling part,

wherein the called vulnerability search database comprises a list of vulnerabilities included in a web firewall from internet data transmitted thought the web firewall to the web server, and

wherein the list of vulnerabilities are generated prior to using at least one external search engine to search for at least one or more of the vulnerabilities from the list of vulnerabilities;

a vulnerability searching part for searching for potential vulnerabilities of the administrating web server corresponding to data included in the called vulnerability search database, wherein the vulnerability searching part searches for potential vulnerabilities of the administrating web server using at least one external search engine, and the vulnerability searching part searches for potential vulnerabilities by examining whether a network port prohibited to the administrating web server is open;

a vulnerability information deducing part for optimizing the results searched in the vulnerability searching part to deduce vulnerability information;

a vulnerability checking part for checking the vulnerabilities of the administrating web server based on the results deduced from the vulnerability information deducing part; and

a detailed vulnerability information reporting part for reporting detailed information on the checked vulnerabilities.