XSS attack detection method and device, equipment and medium

Abstract

The invention discloses an XSS attack detection method, apparatus and device, and a medium. The method comprises the steps of obtaining to-be-detected traffic; extracting a payload in the to-be-detected flow to obtain a to-be-detected payload; performing corresponding processing on the to-be-detected payload by using a bypassing reduction strategy corresponding to the target bypassing strategy so as to reduce the payload subjected to bypassing deformation in the to-be-detected payload to obtain a corresponding processed payload; and determining whether the to-be-detected traffic is the XSS aggressive traffic or not based on the feature information of the processed payload. According to the method, before whether the to-be-detected traffic is the XSS aggressive traffic is determined based on the feature information of the payload, the to-be-detected payload is correspondingly processed by using the bypassing restoration strategy, so that the payload subjected to bypassing deformation in the to-be-detected payload can be restored, the missing report rate is reduced, and the detection capability aiming at the XSS attack is improved.

Description

technical field [0001] The present application relates to the technical field of information security, and in particular to an XSS attack detection method, device, equipment and medium. Background technique [0002] XSS (Cross Site Scripting, cross-site scripting attack) is a very common web application security vulnerability. Attackers take advantage of this vulnerability to embed malicious script codes in normal pages, allowing users to execute malicious scripts when they visit the page to achieve the purpose of attack. All points where data can be submitted to the page may be tampered by hackers and become unexpected input, resulting in XSS vulnerabilities. At the same time, the flexibility of JavaScript and HTML syntax leads to various types of bypass and confusion, so XSS defense has always been the focus and difficulty of web security construction. [0003] The current mainstream XSS detection technology is mainly filtering based on rules. Security personnel collect...

AI Technical Summary

Problems solved by technology

However, there is a lag in the rule-based XSS detection method. Only when the XSS attack is exposed, can the corresponding rules be extracted.

What's more serious is that with the enhancement of XSS obfuscation and bypassing capabilities, it is difficult to extract effective rules, which is likely to cause false negatives and false positives

Images