Java Web framework vulnerability attack general detection and positioning method and system

Abstract

The invention discloses a Java Web framework vulnerability attack general detection and positioning method and system, and the system comprises: a context information collection module which is used for deploying a probe code of an RASP at each key level of an application program, and obtaining key context data such as parameter information of a related sensitive function; a vulnerability judgment module which is used for constructing an attack detection rule matching algorithm according to the established vulnerability utilization rule set, namely the representation characteristics of different vulnerability attack types in each level of the Web program; and a vulnerability alarm module which is used for receiving a judgment result of the vulnerability judgment module and outputting feedback information which comprises a judgment result of vulnerability attacks suffered by the program. The collected context information application rules in the program can be directly matched, meanwhile, the detection rule set can be expanded along with expansion of vulnerability attack types analyzed in the early stage, the operation state in the program can be monitored in real time, unknown vulnerability defense is achieved, and effectiveness and practicability are achieved.

Description

Technical field [0001] The invention relates to the field of computer network security, in particular to a method and system for general detection and positioning of Java Web framework vulnerability attacks. Background technique [0002] For rapid development, developers will choose to use Java Web frameworks to quickly build programs, but inevitably, these frameworks will have varying degrees of security flaws. For Java Web frameworks, there are often many vulnerabilities and a high risk ratio. For the protection of Java Web framework vulnerability attacks, most of the industry uses the WAF (Web Application Firewall) solution, but this solution relies on manual analysis to extract the vulnerability characteristics to formulate pattern matching rules, so the detection and details of the vulnerability attacks Positioning is more difficult. At the same time, because the detection results are affected by the quality of the matching rules, the access is identified outside the appli...

AI Technical Summary

Problems solved by technology

For the protection of Java Web framework vulnerability attacks, the industry mostly uses the WAF (Web Application Firewall, Web Application Firewall) solution, but this solution relies on manual analysis to extract vulnerability characteristics and formulate pattern matching rules. Therefore, the detection and details of vulnerability attacks Positioning is more difficult

At the same time, because the detection results are affected by the quality of the matching rules, the access is identified outside the application, and if it is suspicious, the access is blocked, resulting in a high false positive rate of detection, and the unknown vulnerability attack cannot be identified.

Images