Web page anti-tampering method based on file-driven watermark comparison

Abstract

The present invention relates to a webpage anti-tampering method based on file-driven watermark comparison, comprising the following steps: 1. When the driver installed on the server monitors that a webpage file is accessed, the kernel layer intercepts the IRP request; 2. Judging whether the request is satisfied at the same time : The process that initiates the IRP request is the specified web container process, and the purpose of the IRP request is to read a file, and the file that the IRP requests to read is a file that the user needs to protect. Step 1: As long as one of the conditions is not met, it will be released normally; 3. Calculate the watermark of the web page file, and compare the calculated watermark with the watermark backed up in the watermark database; if the watermark comparison results are the same, the IRP request will be released normally, Otherwise, request to the user layer to restore the tampered webpage file, and reject the IRP request. This method can not only effectively protect the Web site from tampering, but also improve the efficiency of watermark comparison.

Description

technical field [0001] The invention relates to the technical field of Web site security protection, in particular to a webpage tamper-proof method based on file-driven watermark comparison. Background technique [0002] With the rapid development of the Internet, the website as an information carrier has become an important way for enterprises and institutions to release information. However, more and more hackers use the loopholes of the website to illegally tamper with the information on the website. impact and serious economic losses. In response to this threat of network tampering, many software providers have developed various anti-tampering systems for web pages. [0003] At present, there are three related technologies of the anti-tampering system for static web pages: [0004] 1. Plug-in polling technology. The technical solution works independently and has nothing to do with the operating system, web container, etc., and is implemented by polling and monitoring ...

AI Technical Summary

Problems solved by technology

The main disadvantages of this technology are: (1) It has a certain impact on server access performance and resource occupation

(3) An independent publisher needs to be added during deployment

(4) Cannot prevent attacks on the database through the Web

This technology is based on the development of the driver in the kernel, and can promptly alarm and intercept captured tampering behaviors, but there are also some inherent defects: (1) There are many known methods to bypass file system-based inspections

(2) The implementation method is too dependent on the characteristics of the operating system, and some technologies use undocumented technology, which is unstable and non-upgradable

(3) The timing of the inspection is single, and once the capture is missed, there is no protective means

(4) Cannot prevent attacks on the database through the Web

Images