Web attack protection method

Abstract

The invention relates to a Web attack protection method, which comprises the following steps that for each access request, at least one of the following protection combinations is provided: A, a blacklist protection sub flow process is firstly executed, and then, a white list protection sub flow process is executed; B, the blacklist protection sub flow process is executed, and meanwhile, the white list protection sub flow process is executed for the mirror flow rate of the access request; C, whether a URI (uniform resource identifier) of the access request is in a URI library sufficiently learning the white list or not is judged, if so, the white process protection sub flow process is executed on the access request, and if not, the blacklist protection sub flow process is executed for the access request, wherein in each combination, after the execution of the blacklist protection sub flow process on the access request for each access request, the white list learning sub flow process is executed, and the white list is learned by using the URI in the access request as the unit.

Description

technical field [0001] The invention relates to the field of Web application security, in particular to a method for protecting against Web attacks. Background technique [0002] Web Application Firewall (WAF) is a product designed to provide protection for Web applications by implementing a series of security policies for HTTP / HTTPS. With the emergence of Advanced Persistent Threat (APT) attacks, it can be seen that hackers frequently use new vulnerabilities to attack, and the attacks are becoming more targeted and persistent. Protection against unknown attacks and rapid protection have become the main challenges encountered by WAF. [0003] In the field of web application security protection, existing protection strategies mainly include blacklist technology and whitelist technology. The blacklist technology mainly extracts the attack signature library by collecting known vulnerabilities, and identifies the attack behavior based on this library; if the access request mat...

AI Technical Summary

Problems solved by technology

However, if the blacklist technology is used alone, since the attack signature is based on known vulnerabilities, it is difficult to protect against unknown attacks, and if the whitelist technology is used alone, it is difficult to quickly prevent it because it takes time to learn

[0005] The shortcomings in the above-mentioned existing technologies have caused the current WAF to be unable to quickly defend against unknown attacks

Images