XSS attack detection method and device

Abstract

The embodiment of the invention provides an XSS attack detection method and device. The method comprises the following steps: detecting a received user request, and judging whether the received user request is an XSS attack or not; if the attack is the XSS attack, extracting an XSS attack vector from the user request; and acquiring a response message corresponding to the user request, putting the response message into the JS sandbox to run, executing a monitoring event, comparing the monitored event corresponding to the response message with the XSS attack vector, and if the comparison result is consistent, determining that the XSS attack is successful. For the characteristics of XSS attacks, the XSS attack vector and the operation result of the response message in the JS sandbox are extracted, the extracted attack vector is compared with the operation result of the JS sandbox, the attack result is researched and judged, and the maintenance cost is reduced.

Description

technical field [0001] The invention relates to the field of information security, in particular to an XSS attack detection method and device. Background technique [0002] In order to achieve the purpose of maliciously attacking the user, the attacker will insert some malicious script codes into the web page. When the user browses the page, the script code maliciously inserted by the attacker may be executed to complete the XSS attack. [0003] At present, the detection of XSS attacks can use methods such as rule-based detection, machine learning-based algorithm prediction and judgment detection, or semantic analysis-based detection. However, none of these methods has entered the link where the browser actually executes JS scripts, and is all based on text analysis and detection. Therefore, there are certain false positives and false negatives. In the prior art, XSS attacks can also be detected by matching rules on the response page: by injecting a specific attack payload ...

AI Technical Summary

Problems solved by technology

However, this method is prone to false positives. Because the payload is not encoded, it does not mean that the browser will execute the payload. It is possible that the payload is displayed as text, thus causing false positives.

[0004] Also, due to the fact that there are a large number of scanning attacks in the network, most of which are scanners, a large number of attacks are ineffective

Traditional intrusion detection systems (IDS for short) will alert all attacks, and the protection personnel only need to care about successful attacks, so alerting all attacks will cause huge costs to maintenance personnel

Images