Skip list based cross-site scripting attack defense method

Abstract

The invention discloses a skip list based cross-site scripting attack defense method, and aims at detecting cross-site scripting attack vulnerability. The method comprises the steps of reading attack code field value of a cross-site scripting (XSS) attack XSS sample; standardizing; performing MD5 coding and integer conversion to obtain the long integer type data of the sample; creating skip list nodes to form a skip list which forms an attack vector feature database; intercepting data information submitted through POST / GET manner based on the HTTP traffic packet analysis; extracting the scrip vector parameter set according to the request header key value; standardizing; generating all sub-sequence sets A of which threshold values are possibly specified to the length L by the DFA description manner; performing 16-bit MD5 coding and integer conversion for each sub-sequence in A to obtain the long integer type; matching the long integer type of A with the skip list nodes in the feature database; if matching, performing dirt marking for script parameter Sm to obtain the vulnerability detection result.

Description

Technical field [0001] The invention belongs to the technical field of Web attack detection and defense. Background technique [0002] In response to cross-site scripting attacks, most of the current Web sites generally adopt defense strategies including client-side filtering, server-side filtering, and Web attack detection firewall deployment, which can be roughly divided into: client-side defense, server-side defense, and client-server collaboration defense. [0003] Client defense: (1) Filtering strategy: The general input data verification and filtering functions of Web applications are usually processed by client-side scripts (Javascript), such as mail format, text special characters and length restrictions, password robustness, etc., which can basically complete the customer 13 kinds of verification at the end, including the value is empty, must be an integer / double-precision number / Chinese character / common English character, minimum / maximum length, email format, date format...

AI Technical Summary

Problems solved by technology

However, each method has its disadvantages: the detection rate of filtering special characters is low, and the false positive rate is high, which makes it difficult for us to accurately defend against cross-site scripting.

Although the security and separation strategies are superior to filtering special characters in terms of false alarm rate and detection rate, they have high requirements on the system, consume a lot of system resources as a cost, and reduce user experience comfort.

However, the current cooperative defense between client and server is very complicated, and it is too complicated to implement, and it also has the shortcomings of dynamic detection technology, so it is currently relatively low in practicability

Images