A dynamic defense method for web applications based on semantic collaboration

Abstract

The invention relates to a dynamic defense method of a Web application based on semantic collaboration. According to the dynamic defense method provided by the invention, dynamic conversion is performed on a resource address by using the semantic collaboration technology and the character string randomization technology based on a Markov model, effective dynamic conversion is performed on a staticaddress and a dynamic resource address returned by a server, the converted resource addresses have certain readability, so that it is difficult for an attacker to discern whether the address has undergone dynamic defense processing, thereby improving the defense strength of the Web application. According to the dynamic defense method provided by the invention, a semantic collaboration list is used, so that a dynamic defense system can effectively handle the problem of dynamically generating codes in the resource address. A more covert Web resource address can be obtained by using a characterstring randomization method based on the Markov model, so that it is difficult for the attacker to quickly locate the defense means adopted by a website. By means of the adoption of the semantic collaboration list and the Markov model, the security of a Web application system is effectively improved.

Description

technical field [0001] The invention belongs to the technical field of network security and relates to a dynamic defense method for Web applications based on semantic coordination. Background technique [0002] With the continuous development of web applications, the behavior of attacking web systems through web injection methods such as SQL injection and XSS attacks and stealing data is increasing. The current web application system needs to spend a lot of manpower and material resources for code security audit work. Generally, only the application systems of large companies can achieve high security, while a large number of web application systems developed by small companies often have a certain amount of web security. security breach. To this end, it is necessary to develop a web injection defense system between web applications and users to detect and protect the data flow flowing into and out of web applications, so as to increase security for various applications. A...

AI Technical Summary

Problems solved by technology

The above technical solutions have certain shortcomings in the offensive and defensive confrontation environment. Since the random address is significantly different from the normal web resource address, the attacker can immediately judge that the system uses a defense method of dynamic resource transformation, so as to adjust the attack strategy in a targeted manner and increase defense difficulty

Images