System for detecting related script character string of client dynamic URL by using perturbation method

Abstract

The invention discloses a system for detecting a related script character string of a client dynamic URL by using a perturbation method. The system disclosed by the invention can effectively and quickly detect whether the client dynamic URL exists in a webpage, further finds out a positional relationship with the character string of a webpage source code (script part) of the client dynamic URL, and stores the relationship, the system can be applied to a web active defense system based on URL jumping in order to perform jumping on these character strings in a jumping process to achieve the jumping of the dynamically generated URL of the client script, thereby solving the compatibility problem of the client script and ensuring the normal operation of the website service while realizing security defense.

Description

technical field [0001] The invention belongs to the technical field of computers, and relates to a client dynamic URL-related script character string detection system and method using a perturbation method. Background technique [0002] URL, Uniform Resource Locator, uniquely identifies a resource on the World Wide Web. Usually, the URL indicating the location of the resource remains unchanged, which greatly facilitates hackers to launch attacks on the system, because the address of the attack target is always the same, such as CSRF attack, XSS injection attack, etc. In recent years, XSS, directory traversal, CSRF, and SQL attacks have had a very serious impact on network security, and these attacks are all based on URLs. For this reason, Chinese patent CN106657044A proposes a web page address jumping method for improving the security defense of the website system, and this technology can effectively improve the protection ability of the website system. However, in some we...

AI Technical Summary

Problems solved by technology

However, in some website application systems, some dynamic URLs will be generated by the client browser engine, and the technology proposed in the above-mentioned patent cannot jump these URLs.

For this kind of website application system, the method described in Chinese patent CN106657044A will intercept the URLs dynamically generated by these clients, causing some normal businesses to fail to run, that is, there is a compatibility problem between the method described in this patent and the client scripts that generate dynamic URLs

In order to further improve the protection capability of the website system and solve the compatibility problem of client-side scripts, this patent proposes a dynamic URL-related script string detection system for client-side using the perturbation method. The relationship between the URL generated in (such as loading the URL through AJAX) and the strings in the source code of the webpage script, so that these strings can be jumped during the jumping process, and the URL generated dynamically by the client script can be jumped, so as to solve customer problems. Compatibility issues with side scripts

Images