Network attack defense method and equipment

Abstract

The invention provides a network attack defense method and equipment. The method comprises steps of scanning a page access request, so as to acquire addressing information of the page access request in a rule factor base; building a corresponding rule tree according to the addressing information and the rule factor base; determining attack decision information corresponding to the rule tree according to factor related information of rule factors corresponding to nodes in the rule tree and structure information of the rule tree; and finally, processing the page access request according to the attack decision information. Rule factors in the rule factor base include words, punctuations and so on that make up an attack statement, and superposition of a few rule factors replaces a lot of pattern strings and feature codes, so that compared with the prior art, the method prevents frequent updating of the rule factor base and can defense novel attacks proactively.

Description

Technical field [0001] This application relates to the computer field, and in particular to a technology for defending against network attacks. Background technique [0002] With the prosperous development of the Internet, hacker attacks have become more frequent. SQL (StructuredQueryLanguage) injection, XSS attacks (CrossSiteScripting), cookie spoofing, malicious scanning, and horse hacking have become more frequent. universal. Moreover, the current various network attack behaviors are very confusing. They simulate normal access characteristics to initiate access requests to the website and adopt some bypass strategies, such as adding some comments to the injection sentence through Unicode transcoding, BASE64 encoding, etc. Symbols, etc. are bypassed. The detection mechanism of the existing technology is difficult to identify such network attacks. Most of the current WAF (WebApplicationFirewall, website application-level intrusion prevention system) related products adopt the ...

AI Technical Summary

Problems solved by technology

Moreover, the current various network attack behaviors are very confusing. They simulate normal access characteristics to initiate access requests to the website, and adopt some bypass strategies, such as adding some comments to the injection statement through Unicode transcoding, BASE64 encoding, etc. characters etc. to bypass

The detection mechanism of the existing technology is difficult to identify such network attacks. Most of the current WAF (WebApplication Firewall, website application-level intrusion prevention system) related products adopt the following interception detection mechanism: rely on the mastered attack type to summarize the corresponding pattern string to form Rule base, to detect and filter the access content; or, rely on the mastered attack types to summarize the corresponding signature code to form a rule base, to detect and filter the access content

[0003] However, the following problems generally exist in the prior art: (1) the pattern strings in the pattern str...

Images