Security detection method based on application firewall and related equipment

Abstract

The invention discloses a security detection method based on an application firewall and related equipment, which are used for actively acquiring request parameters of an application system through the application firewall, configuring appropriate rules for the request parameters to realize accurate verification, and reducing the false alarm rate caused by using general rules. The method comprisesthe following steps: deploying an application firewall WAF in an application system and configuring a filter; calling an application firewall to perform security check filtering on the initial inbound request in the application system according to a preset general rule to obtain a target inbound request; starting an automatic parameter collection mechanism to monitor the target inbound request, wherein the automatic parameter collection mechanism is used for collecting a request parameter value corresponding to the target inbound request; sending the corresponding request parameter value to aparameter rule configuration platform; obtaining a target parameter rule sent by a parameter rule configuration platform, and synchronously deploying the target parameter rule to an application system; and calling the WAF to perform subsequent security detection based on the target parameter rule.

Description

technical field [0001] The invention relates to the field of network security, in particular to a security detection method based on an application firewall and related equipment. Background technique [0002] With the rapid development of Internet technology, network security has been paid more and more attention. The goal is to generally use a web application firewall (Web application firewall, WAF) to detect and verify the content of various requests from web application clients to ensure their security and legitimacy, and to block illegal requests in real time. Applications provide protection, and WAF is an important part of the network security defense-in-depth system. [0003] Most products on the market today are rule-based WAFs. The principle is that each session has to go through a series of tests, and each test consists of one or more detection rules. If the test fails, the request will be considered illegal and rejected. Rule-based WAF tests are easy to constru...

AI Technical Summary

Problems solved by technology

[0004] The existing solution is for the overall defense detection of attack characteristics, which cannot be strongly correlated with the business of the actual application system, resulting in a high false positive rate and affecting the normal function of the application system

Images