Anti-scan detection method and system based on various URL changes

Abstract

The present invention proposes an anti-scan detection method and system based on various URL changes. The method comprises: acquiring an original code accessed by a user through a Web application request; when it is detected that the user accesses the original code for the first time, modifying a real URL address and an access topic in the original code according to a fault URL obfuscation algorithm; and when it is detected that the user accesses the original code for the second time or for many times, continuing to modify the real URL address and the access topic in the original code according to the fault URL obfuscation algorithm, so that a vulnerability scanner cannot obtain the real URL address, and then cannot obtain the web page, wherein results of modifying the real URL address and the access topic for each time are different. According to the method and system proposed by the present invention, a crawler module, the core module of the scanner is disturbed, the detection mechanism of the vulnerability scanning is avoided, and the scanning problem is completely eliminated, so that the current scanner is invalid, and the security of the target system is ensured as much as possible.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to an anti-scanning detection method and system based on various changes of URLs. Background technique [0002] Vulnerability scanner is a product that discovers and attacks vulnerabilities by simulating hacker attacks. Vulnerability scanning is also the first step in hacking. From the perspective of attack prevention, doing a good job in anti-scanning is the primary task of information security protection. [0003] Existing web vulnerability scanning is one of the main methods to detect hidden dangers in web applications, and its core technology is inseparable from the research on crawler technology. The ability of web crawlers directly determines the vulnerability detection ability of web application scanning. A web crawler is an important basic functional module in a network-based web vulnerability scanner. Its efficiency in obtaining the directory structure and a...

AI Technical Summary

Problems solved by technology

However, this method has certain limitations

On the one hand, the attack on the target system can only be discovered after a period of time. During this period, the target system may have been compromised; on the other hand, the attacker intentionally constructs a return data packet, prolongs the attack period, and avoids the statistical window, thus making the statistics invalid.

Images