An apt early warning method for xss attack

Abstract

The invention relates to an APT early warning method for XSS attacks. Firstly, the WEB attack detection result from the WEB application firewall is received, and according to the XSS attack detection result, a hacker's behavior of bypassing the interception rules of the WEB application firewall is simulated to generate new attack rules. Enrich the XSS attack rule base; then combine the APT attack knowledge base to identify the XSS attack detection results and generate APT attack identification results; add the unidentified XSS attacks to the unknown APT attack set; then pre-test the unknown APT attack set processing to obtain the preprocessing result set of unknown APT attacks; use the distributed Aprior algorithm based on MapReduce to perform association analysis on the preprocessing result sets of unknown APT attacks, generate APT association rules, and obtain APT analysis information corresponding to XSS attacks as APT threat information output. The present invention realizes various and active defense mechanisms against current XSS attacks.

Description

technical field [0001] The invention relates to the field of network security, in particular to an APT early warning method for XSS attacks. Background technique [0002] With the continuous growth of the scale of the Internet and the wide application of computer networks, while the network brings great convenience to people, it also brings various security problems, and problems such as network attacks and intrusions are increasing day by day. Cross-site scripting (XSS attack) attack has always been at the top of various attacks that threaten network security. It is a kind of malicious attacker who writes special malicious code by exploiting the vulnerability and injects it into the invaded system, and executes the injected malicious code. Steal user's private information or sensitive data, so as to achieve further intrusion attack means. Advanced persistent threat (APT attack), as a covert network attack through different attack processes based on high-level professional ...

AI Technical Summary

Problems solved by technology

[0004] In the context of the rapid development of global network informatization, most of the existing methods have problems such as low efficiency, unsatisfactory detection accuracy and passive defense in the face of a huge number of XSS attacks from various sources.

At the same time, in the face of targeted and highly disguised APT intrusions, XSS attacks are an important stage of early intrusions, and attackers also use various methods to bypass traditional firewalls, causing traditional detection mechanisms to fail.

Images