Method and device for detecting Web vulnerability scanning behavior

Abstract

The invention discloses a method for detecting a Web vulnerability scanning behavior. The method comprises the following steps: embedding a hidden link and / or a JS (Javascript) code into an HTML (Hyper Text Markup Language) text of response information sent to an access side; and if detecting the access side extracts and accesses the hidden link, and / or does not receive an HTTP request which is sent by the access side on the basis of executing the JS code, judging an access request of the access side as the Web vulnerability scanning behavior. The invention further discloses a device for detecting the Web vulnerability scanning behavior. According to the method and the device disclosed by the invention, the accuracy of judging the vulnerability scanning behavior is improved, and the misreporting and the underreporting when the Web vulnerability scanning behavior is detected are reduced.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for detecting Web vulnerability scanning behavior. Background technique [0002] Web vulnerability scanner is a common automated web security assessment tool. It can be configured to perform automatic vulnerability scanning on specified websites or other web applications, and finally summarize and output vulnerability scanning reports. The common forms of web vulnerability scanners are stand-alone software, distributed cloud-based scanners and hardware scanning devices. This kind of tool is easy to operate and effective, and is often used by hackers to attack websites. [0003] When a web scanner performs a scanning task, it has certain characteristics. Based on these characteristics, the web application firewall can identify different scanners or scanning behaviors. The core of the traditional device anti-scanning technology is to extract firewall ...

AI Technical Summary

Problems solved by technology

A scanner will establish a large number of TCP connections and send a large number of HTTP requests, so that only part of the scanning requests will be processed, and many scanning requests will be missed. Those missed scanning requests can still scan out many vulnerabilities. One of the important reasons for false negatives with anti-scanning mechanisms

[0007] 3) Some firewall rules monitor specific files or information, such as server configuration files, database files, compressed files, temporary files, requests for other known sensitive files, and such rules are the hardest hit areas for false positives of the anti-scan function , a large number of compressed files, data files or other special files, these files or information can be accessed normally on many websites, but such firewall rules will match such requests, causing false positives

[0008] In short, the existing anti-scanning technology performs protection according to the text characteristics of TCP connections or HTTP requests, resulting in serious false positives and false negatives.

Images