Abstract
As usage of the Internet for typical applications increases and new e-commerce and extranets proliferate, World Wide Web (WWW) has become a popular, powerful and convenient tool and application for billions of users. It offers global access to nearly any type of information. However, another disturbing trend has been with regard to the types of attacks malicious parties have been launching. Network security continues to increase in importance. It has comes a security underside fraught with increasing communications and productivities associated with access information, email, streaming media, instant message, etc. While several years ago most attacks exploited network-level vulnerabilities such as flaws in the TCP/IP protocol, today’s hackers primarily exploit application-level bugs and come into next generation network attacks. Blended attacks that target new vulnerabilities found in applications. The Intrusion Detection System (IDS) engine ensures that protocols are indeed valid, the application headers are compliant according to the application's legal syntax and semantics, the header values are validated and overflows are prevented as well as analyzes the application payloads and searches for both known and unknown malicious contents. However, the higher-level attacks used by well-disciplined intruders are often transmitted via encrypted SSL connections to web servers and appeared to be legitimate business activity to network-level security device, these attacks can easily penetrate traditional firewalls and the IDSes. This thesis presents an approach to a practical framework of the SSL Proxy Server which performs cryptographic functions, decrypts packets, restores the origin contents of HTTPS traffic, also provides layer-7 application firewall to inspect the contents and identity the signatures. After performing in-depth intrusion detection analysis, the SSL proxy server, then forwards secure traffic to the origin web server. Besides, the proxy server also provides several application-layer services such as caching technique due to cipher-text traffic has been decrypted already. In our points of view in this thesis will focus on the detail procedures of restoring content from encrypted packet. Furthermore, exploring the potentials of innovation and improving the performance, the framework has the ability to take advantage of a characteristic of SSL known as resume handshake. It reduces the burden of establishing connection between SSL proxy server and origin web server. In addition, the flexibility and comprehensive SSL cipher suites help transferring data in diverse context. As a result, the refinement not only mitigates the traffic between SSL proxy server and web server but also off-loads SSL processing from web server. We implement our proposal to demonstrate the efficiency functionalities and also give experimental results for all the proposed techniques.