Cross-site scripting attack monitoring system and method

Abstract

The invention relates to a cross-site scripting attack monitoring system. The cross-site scripting attack monitoring system comprises an application serving module, a monitoring module and an analyzing module. The application serving module comprises a service module and a redefining module. The service module receives and responds to a service request of a user side, and the redefining module redefines a script built-in function adopted in a cross-site scripting attack and returns redefining information of the script built-in function to the user side; the monitoring module monitors calling information of the user side to the redefined script built-in function; the analyzing module analyzes the safety of the calling information. The cross-site scripting attack monitoring system can realize accurate locating of the source of the cross-site scripting attack, the attacking time, leaked data, attacked vulnerability and the like. In addition, the invention further provides a cross-site scripting attack monitoring method.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a cross-site scripting attack monitoring system and method. Background technique [0002] In recent years, the focus of attention in the field of software security has gradually shifted from server-side attacks to client-side attacks, and cross-site scripting (XSS, English full name is Cross Site Script) attacks have been regarded as the most important security problem faced by network applications. threaten. Cross-site scripting often takes advantage of application security flaws and causes destructive consequences together with other vulnerabilities. Sometimes cross-site scripting attacks may also turn into a virus or a worm capable of self-propagation, causing more serious damage. In 2005, Myspace was attacked based on a cross-site scripting worm, causing a large number of users to receive millions of requests and had to close its applications. In 2009, Tw...

AI Technical Summary

Problems solved by technology

On June 28, 2011, a relatively large cross-site scripting attack occurred on Sina Weibo, which caused a serious breakdown in account security.

Relevant permissions need to be obtained for operating system-level function calls and analysis. At the same time, the detection tool needs to be installed on the client side. The implementation cost is high, and it tends to protect the client side, and the protection of the website is not obvious enough.

In addition, this detection method cannot automatically notify the vulnerability service provider to help it improve the vulnerability service

[0006] In addition, the existing cross-site scripting attack detection tools cannot monitor the behavior of the client. Therefore, it is difficult to effectively obtain the source of the attack, and cannot realize the early warning and notification functions when the attack occurs, let alone automatically prevent the attack when the attack occurs

Images