Security protection method and DPMA protection model

Abstract

The invention discloses a security protection method. The method comprises: a DPMA protection model obtains protection information about a web attack event, wherein the DPMA protection model comprises a web detection module, a web protection module, a web monitoring module, and a web auditing module; and the DPMA protection model conducts linked actions according to the protection information about the web attack event to achieve security protection of a web application, wherein the linked actions include interactions between the web detection module, the web protection module, the web monitoring module, and the web auditing module by means of the protection information about the web attack event. The invention also discloses a DPMA protection model.

Description

technical field [0001] The invention relates to Web technology, in particular to a safety protection method and a DPMA (Detect, Protect, Monitor, Audit, detection, protection, detection and audit) protection model. Background technique [0002] With the continuous progress and development of network (Web) application technology, the Web application program bears more and more services, and the security problems that the Web application faces are more and more complicated. According to statistics from authoritative organizations, security attacks on web applications have surpassed the sum of security attacks on other layers, and hacker attacks have gradually shifted from the traditional network layer to the application layer. [0003] Web applications are businesses that directly provide services to the outside world. While providing convenient services for users, they also provide opportunities for malicious attackers. Once compromised, attackers can use this as a springboar...

AI Technical Summary

Problems solved by technology

Existing security detection and protection equipment such as firewalls, vulnerability scanners, etc. can be used to detect and protect against some attacks, which play a very important role, but there are still certain limitations, mainly in: From the perspective of detection technical means: Since vulnerability scanning is a detection method based on black boxes, it is inevitable to have false positives and false negatives; intrusion detection is mainly based on the rule base / signature base detection method. Behavior) is difficult to find, and for web attack events that escaped detection, it is difficult to reproduce the attack scene, and it is impossible to trace the source afterwards

In terms of protection technology, the firewall mainly works at the network layer, and is powerless against security attacks at the application layer; for web application firewalls, although they work at the application layer, there is no unified standard due to the irregularity of the writing of web application codes. , causing a large number of false positives in the web application firewall and making it impossible to use effectively; when a web application security incident occurs, there is a lack of corresponding auditing and tool traceability means

In addition, these safety detection and protection devices work independently without interaction with each other, and cannot perform correlation analysis and linkage processing on a certain safety behavior and event, and the alarm events are relatively isolated

Images