Security protection method and DPMA protection model

Abstract

The invention discloses a security protection method. The method comprises: a DPMA protection model obtains protection information about a web attack event, wherein the DPMA protection model comprises a web detection module, a web protection module, a web monitoring module, and a web auditing module; and the DPMA protection model conducts linked actions according to the protection information about the web attack event to achieve security protection of a web application, wherein the linked actions include interactions between the web detection module, the web protection module, the web monitoring module, and the web auditing module by means of the protection information about the web attack event. The invention also discloses a DPMA protection model.

Description

technical field [0001] The invention relates to Web technology, in particular to a safety protection method and a DPMA (Detect, Protect, Monitor, Audit, detection, protection, detection and audit) protection model. Background technique [0002] With the continuous progress and development of network (Web) application technology, the Web application program bears more and more services, and the security problems that the Web application faces are more and more complicated. According to statistics from authoritative organizations, security attacks on web applications have surpassed the sum of security attacks on other layers, and hacker attacks have gradually shifted from the traditional network layer to the application layer. [0003] Web applications are businesses that directly provide services to the outside world. While providing convenient services for users, they also provide opportunities for malicious attackers. Once compromised, attackers can use this as a springboar...

AI Technical Summary

Problems solved by technology

Existing security detection and protection equipment such as firewalls, vulnerability scanners, etc. can be used to detect and protect against some attacks, which play a very important role, but there are still certain limitations, mainly in: From the perspective of detection technical means: Since vulnerability scanning is a detection method based on black boxes, it is inevitable to have false positives and false negatives; intrusion detection is mainly based on the rule base/signature base detection method. Behavior) is difficult to find, and for web attack events that escaped detection, it is difficult to reproduce the attack scene, and it is impossible to trace the source afterwards

In terms of protection technology, the firewall mainly works at

Images