XSS defensive system

Abstract

The invention discloses an XSS defensive system which is mainly realized through the following steps of: pre-establishing a website behavior model for a website to be browsed by a modeling module; detecting the browsing behavior of the website by a detection module; and authenticating the browsing behavior of a user through using a corresponding website behavior model by an authentication module, wherein only the behaviors defined in the behavior model can be successful in authentication and are allowed to be executed, and browsing behaviors unsuccessful in authentication are determined as illegal behaviors to be prevented, and an alarm is given out, thus damage to a client duo to potential XSS attack is avoided.

Description

technical field [0001] The invention relates to an XSS defense system, in particular to an XSS defense system based on behavior authentication. Background technique [0002] Today, the network is becoming a new platform and carrier for various services in real life. In order to improve user experience, scripting languages ​​(mostly JavaScript) are widely used in web applications. Unfortunately, this trend has made XSS (cross-site scripting) one of the most serious security problems on the Internet today. XSS (cross-site scripting attack), also known as CSS (Cross Site Script), refers to malicious attackers inserting malicious script code into a web page. When a user browses the page, the script code embedded in the web will be executed. , so as to achieve the special purpose of maliciously attacking users. The origin of the name "cross-site scripting attack" originates from the initial "cross-site" feature of this type of attack method. Now XSS is no longer limited to the...

AI Technical Summary

Problems solved by technology

The disadvantages mainly include: it needs to be deployed on various browsers, which is difficult to implement and popularize; the success rate of the method depends on the recognition rate of illegal scripts; it may affect the browsing speed

The above methods only start from the point of XSS attack, and do not grasp the essential reasons that cause XSS attack to occur and cause harm. Therefore, it can only be said to treat the symptoms but not the root cause, and it is difficult to completely eliminate the occurrence of XSS attacks.

[0005] In summary, the existing defense methods against XSS attacks still have obvious limitations in terms of robustness and usability

At the same time, in reality, many websites are attacked by XSS without the knowledge of the administrators. At this time, it is basically impossible to use the above method to protect the user clients browsing these websites.

Images