Cross-site scripting vulnerability attack detection method and system

Abstract

The present invention discloses a method and system for detecting cross-site scripting vulnerability attacks, and the cross-site scripting vulnerability attack detection system comprises: a URL extraction module, a URL filtering module, a group classification module, an attack dictionary library establishment module, a simulated request sending module, a mathematical model establishment module and a vulnerability judgment module. The cross-site scripting vulnerability attack detection method and system proposed by the present invention, by modeling the attack risk list, using the algorithm model combining GBDT and LR, ultimately only needs to output a set of parameters-attack instructions (attack vectors) to simulate attacks on requests, which can greatly shorten the time for detecting XSS vulnerabilities; the present invention can also improve the accuracy of XSS vulnerability detection.

Description

Technical Field

[0001] The present invention belongs to the field of Internet technology and relates to an attack detection method, and in particular to a cross-site scripting vulnerability attack detection method and system. Background Art

[0002] With the rapid development and widespread application of Internet technology, network security issues have received more and more attention from the industry, and network attacks and intrusions have become more and more prominent. Among them, cross-site scripting (XSS) attacks are one of the common attack methods and one of the most harmful web vulnerabilities. They have been rated as one of the top ten (TOP10) most serious, common, and dangerous web applications by the OWASP (Open Web Application Security Project) organization for many years. The XSS attack method is that the attacker inserts malicious JavaScript code into the web page. When the user browses the page, the script embedded in the web will be executed, thereby achieving the purpose of maliciously attacking the user. The reason for this is often that the data submitted by the client is not filtered or filtered strictly, resulting in the malicious script code being parsed as JS code when it is output. Its harm can steal the user's cookie information and impersonate the user to perform illegal operations; it can also be used for phishing attacks, hang Trojans on web sites, and even remotely control the user's host, threatening the user's privacy and property safety.

[0003] In the existing solutions, XSS vulnerability detection is performed through tool scanning, code checking, and manual penetration. The existing solutions have the following disadvantages: (1) Through tool scanning, the vulnerability rules of the scanning tool are single, the coverage of vulnerability detection points is low, the scanned interface is incomplete, and there are problems such as false positives and poor usability; (2) Through code checking, a lot of manpower is required, and the efficiency is low, with a high risk of omissions; (3) Manual penetration testing takes a lot of time, has low coverage, and has a low input-output ratio.

[0004] In view of this, there is an urgent need to design a new vulnerability detection method to overcome at least some of the above-mentioned defects of the existing vulnerability detection methods. Summary of the invention

[0005] The present invention provides a cross-site scripting vulnerability attack detection method and system, which can save time in the traversal scanning process, improve detection accuracy, and reduce the possibility of misjudgment.

[0006] To solve the above technical problem, according to one aspect of the present invention, the following technical solution is adopted:

[0007] A cross-site scripting vulnerability attack detection method, the cross-site scripting vulnerability attack detection method comprising:

[0008] Step S1: Get the source code of all web pages through crawler technology, extract URLs from them using breadth-first algorithm, put the parsed URLs into the visited table, and repeat the process; each time the captured URL is compared with the URL in the visited table, so as to filter out duplicate URLs and invalid URLs;

[0009] Step S2: extract request parameters and parameter values ​​from all valid URLs, including get requests and post requests, remove duplicate parameters, group and classify them, and persist them in the database;

[0010] Step S3, establish an XSS attack dictionary library, save the attack script commands included in OWASP and new types of XSS attacks in history in the form of a list to the database, and establish an XSS attack dictionary library;

[0011] Step S4: replace all parameter values ​​in step S2 with corresponding script commands in the XSS attack dictionary library, send a simulated request to the target server, and receive a returned response request; if the returned response request contains attack script content, load the corresponding parameter name and attack script into the attack risk list;

[0012] Step S5: Model the parameter name-attack script in the attack risk list, and use the composite model formed by the GBDT model and the LR model. First, use the GBDT (Gradient Boosting Decision Tree) model to automatically screen and combine features to obtain a discrete feature vector, and then use the feature vector as the input of the LR (Logistic Regression) model. Finally, output a pair of parameter name-attack script (one-to-one relationship) with the highest attack success rate, and load it into the attack vector feature library;

[0013] Step S6: According to the optimal set of attack vectors in the attack vector feature library, replace the corresponding parameter values ​​in the request to be tested, send an HTTP request to the site to be tested, and the site to be tested will return an HTTP response. According to the returned information, determine whether there is an XSS attack vulnerability.

[0014] As an implementation of the present invention, the data modeling step in step S5 specifically includes:

[0015] Step S51, parsing the request information contained in the input request, including the request URL, request method, request header, and request body, parsing the parameters and the corresponding request type into a database for storage;

[0016] Step S52, loading the XSS attack dictionary list;

[0017] Step S53: Replace the parameter value of the tested URL with the attack script in the attack dictionary list. If the attack is successful, record the corresponding parameter name and attack script in the attack risk list; simulate the attack in a loop to generate a large number of parameter-feature instruction pairs corresponding to the injection points, perform deep learning, and intelligently obtain tasks with common labels;

[0018] Step S54: Establish a recommendation algorithm model, model the parameter-attack script cluster (multiple parameters, each parameter corresponds to multiple attack scripts) in the attack risk list, use the GBDT algorithm model to automatically screen and combine features, thereby generating a new discrete feature vector, and then transmit the feature vector as input to the LR model to generate the most comprehensive recommendation results, that is, to obtain the optimal parameter-attack vector;

[0019] Step S55: When the sample data of the XSS attack dictionary list is changed, the attack risk list will be remodeled, and the original optimal solution may change.

[0020] As an implementation mode of the present invention, step S5 includes:

[0021] Step S501, performing feature cutting on the setting script of successful attack;

[0022] Step S502, training a GBDT feature model, wherein the GBDT feature model is composed of multiple trees, and the root node and leaf node are split according to the script's labels, attributes, and events. For each leaf node, tracing back to the root node can obtain a set of combined features;

[0023] Step S503: Use the label of the leaf node to identify a new combined feature. If the feature traced back from the last node to the root node can form an attack vector sample, the value of the sample is 1; if the feature fails to form an attack vector sample, the value of the sample is 0.

[0024] Step S504, iterating the decision tree to generate a batch of feature vectors;

[0025] Step S505: input the feature vector obtained in step S504 into LR model training, and output the final feature attack instruction.

[0026] As an implementation mode of the present invention, the cross-site scripting vulnerability attack detection method further includes: for each request at the input end, the script instructions in the attack dictionary list are used to traverse each parameter name of the URL, perform blind testing, and extend the time of XSS vulnerability detection.

[0027] According to another aspect of the present invention, the following technical solution is adopted: a cross-site scripting vulnerability attack detection system, the cross-site scripting vulnerability attack detection system comprising:

[0028] The URL extraction module is used to obtain the source code of all Web pages through crawler technology, extract URLs from them using the breadth-first algorithm, and put the parsed URLs into the visited table, repeating the cycle;

[0029] URL filtering module, which compares each captured URL with the URL in the visited table to filter out duplicate URLs and invalid URLs;

[0030] The grouping and classification module is used to extract request parameters and parameter values ​​from all valid URLs, including get requests and post requests, remove duplicate parameters, group and classify them, and persist them in the database;

[0031] The attack dictionary library establishment module is used to establish the XSS attack dictionary library; the attack script commands included in OWASP and the new attack script commands in the history of XSS attacks are saved in the database in the form of a list to establish the XSS attack dictionary library;

[0032] The simulated request sending module is used to replace the parameter value extracted from the valid URL with the corresponding script command in the XSS attack dictionary library, send the simulated request to the target server, and receive the returned response request; if the returned response request contains the attack script content, the corresponding parameter name and attack script are loaded into the attack risk list;

[0033] The mathematical model building module is used to model the parameter name-attack script in the attack risk list, using a composite model formed by the GBDT model and the LR model; the GBDT (Gradient Boosting Decision Tree) model is used to automatically screen and combine features to obtain a discrete feature vector; the feature vector is used as the input of the LR (LogisticRegression) model, and finally the pair of parameter name-attack script (one-to-one relationship) with the highest attack success rate is output and loaded into the attack vector feature library;

[0034] The vulnerability judgment module is used to replace the corresponding parameter values ​​in the request to be tested according to the optimal set of attack vectors in the attack vector feature library, send an HTTP request to the site to be tested, and the site to be tested will return an HTTP response. Based on the returned information, it is determined whether there is an XSS attack vulnerability.

[0035] As an implementation mode of the present invention, the mathematical model building module specifically includes:

[0036] The request information parsing unit is used to parse the request information contained in the input request, including the request URL, request method, request header, and request body, and parse the parameters and the corresponding request type into a database for storage;

[0037] Attack dictionary list loading unit, used to load XSS attack dictionary list;

[0038] The attack script replacement unit is used to replace the parameter value of the tested URL with the attack script in the attack dictionary list. If the attack is successful, the corresponding parameter name and attack script are recorded in the attack risk list; the attack is simulated in a loop to generate a large number of parameter-feature instruction pairs corresponding to the injection points, and deep learning is performed to intelligently obtain tasks with common labels;

[0039] The recommendation algorithm model building unit is used to build the recommendation algorithm model, model the parameter-attack script cluster (multiple parameters, each parameter corresponds to multiple attack scripts) in the attack risk list, and use the GBDT algorithm model to automatically screen and combine features to generate new discrete feature vectors, and then transmit the feature vectors as input to the LR model to generate the most comprehensive recommendation results, that is, to obtain the optimal parameter-attack vector;

[0040] The mathematical model reconstruction unit is used to re-model the attack risk list when the sample data of the XSS attack dictionary list changes, and the original optimal solution may change.

[0041] As an implementation mode of the present invention, the mathematical model building module specifically includes:

[0042] A feature cutting unit is used to perform feature cutting on the setting script of successful attack;

[0043] GBDT feature model unit, used to train the GBDT feature model. The GBDT feature model consists of multiple trees. The root node and leaf node are split according to the script's label, attribute, and event. For each leaf node, a set of combined features can be obtained by tracing back to the root node.

[0044] The attack vector sample generation unit is used to identify a new combined feature through the label of the leaf node. If the features traced back from the last node to the root node can form an attack vector sample, the sample value is 1, and if the formation fails, the value is 0;

[0045] A feature vector generation unit, used to iterate the decision tree to generate a batch of feature vectors;

[0046] The feature attack instruction generating unit is used to input the feature vector obtained by the feature vector generating unit into the LR model training to obtain the final feature attack instruction.

[0047] As an embodiment of the present invention, the cross-site scripting vulnerability attack detection system further includes: a blind test module, which uses the script instructions in the attack dictionary list to traverse each parameter name of the URL for each request from the input end, performs blind testing, and prolongs the time of XSS vulnerability detection.

[0048] The beneficial effects of the present invention are as follows: the cross-site scripting vulnerability attack detection method and system proposed in the present invention, by modeling the attack risk list and using a combined model (a combination of the GBDT model and the LR model), ultimately only needs to output a set of parameters - attack instructions (attack vectors) to simulate attacks on requests, which can greatly shorten the time for detecting XSS vulnerabilities and improve the accuracy of XSS vulnerability detection; while the attack feature library of traditional XSS vulnerability detection tools in the industry is too old, the samples are insufficient, and the loop traversal results in too low detection coverage and large errors in test results. When a new attack code appears, only the XSS attack dictionary list needs to be entered.

[0049] The present invention has the following technical effects:

[0050] (1) Through the combined model (GBDT model combined with LR model), GBDT is first used to automatically screen and combine features to obtain discrete feature vectors, and then the LR model is used to output the optimal attack vector, which saves time in the traversal scanning process, improves detection accuracy with deep learning technology, and reduces misjudgment;

[0051] (2) Replace the parameters in the request with attack dictionary script instructions and improve the XSS detection coverage by traversing the fields;

[0052] (3) The obtained request information is stored in the form of a list to facilitate standardized management. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 The figure is a flow chart of a method for detecting a cross-site scripting vulnerability attack in one embodiment of the present invention.

[0054] Figure 2 The figure is a schematic diagram of the composition of a cross-site scripting vulnerability attack detection system in one embodiment of the present invention.

[0055] Figure 3 The figure is a schematic diagram of the composition of a mathematical model building module in one embodiment of the present invention.

[0056] Figure 4 The figure is a schematic diagram of the composition of a mathematical model building module in one embodiment of the present invention. DETAILED DESCRIPTION

[0057] The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0058] In order to further understand the present invention, preferred embodiments of the present invention are described below in conjunction with examples. However, it should be understood that these descriptions are only for further illustrating the features and advantages of the present invention, rather than limiting the claims of the present invention.

[0059] The description in this section is only for several typical embodiments, and the present invention is not limited to the scope of the embodiments. The same or similar prior art means and some technical features in the embodiments are mutually replaced within the scope of the present invention.

[0060] The description of the steps in each embodiment in the specification is only for the convenience of explanation, and the implementation of the present application is not limited by the order of the steps. The "connection" in the specification includes both direct connection and indirect connection.

[0061] The present invention discloses a method for detecting cross-site scripting vulnerability attacks. Figure 1 is a flow chart of a method for detecting a cross-site scripting vulnerability attack in one embodiment of the present invention; please refer to Figure 1 , the cross-site scripting vulnerability attack detection method includes:

[0062] [Step S1] The source code of all web pages is obtained through crawler technology, and URLs are extracted from them using a breadth-first algorithm. The parsed URLs are put into a visited table, and the cycle repeats; each captured URL is compared with the URL in the visited table to filter out duplicate URLs and invalid URLs;

[0063] [Step S2] Extract request parameters and parameter values ​​from all valid URLs, including get requests and post requests, remove duplicate parameters, group and classify them, and persist them in the database;

[0064] [Step S3] Establish an XSS attack dictionary library, save the attack script commands included in OWASP and new types of XSS attacks in history in the form of a list to the database, and establish an XSS attack dictionary library;

[0065] [Step S4] Replace all parameter values ​​in step S2 with corresponding script commands in the XSS attack dictionary library, send a simulated request to the target server, and receive a returned response request; if the returned response request contains attack script content, load the corresponding parameter name and attack script into the attack risk list (one-to-one or one-to-many relationship);

[0066] [Step S5] Model the parameter name-attack script in the attack risk list, and use the composite model formed by the GBDT model and the LR model. First, use the GBDT (Gradient Boosting Decision Tree) model to automatically screen and combine features to obtain a discrete feature vector, and then use the feature vector as the input of the LR (Logistic Regression) model. Finally, output a pair of parameter name-attack script with the highest attack success rate (one-to-one relationship), and load it into the attack vector feature library;

[0067] [Step S6] According to the optimal set of attack vectors in the attack vector feature library, the corresponding parameter values ​​in the request to be tested are replaced, and an HTTP request is sent to the site to be tested. The site to be tested will return an HTTP response, and it is determined whether there is an XSS attack vulnerability based on the returned information.

[0068] In one embodiment of the present invention, the method further includes: for each request at the input end, using the script instructions in the attack dictionary list to traverse each parameter name of the URL for blind testing, which greatly prolongs the time for XSS vulnerability detection.

[0069] In one embodiment of the present invention, the data modeling step in step S5 specifically includes:

[0070] (1) Parse the request information contained in the input request, such as the request URL, request method, request header, request body, and parse the parameters and corresponding request types into the database for storage. For example, if the URL request is: http: / / XX / user / login?user=**&password=***, the parsed parameter results are user, password, POST, etc.

[0071] (2) Load the XSS attack dictionary list, which contains about 1000+ entries. For example, the command sample in the dictionary list is: <script>alert('xss')< / script> ,

[0072] (3) Replace the parameter value of the tested URL with the attack script in the attack dictionary list. For example, in http: / / XX / user / login?user=**&password=***, the replacement value is http: / / XX / user / login?user= <script>alert('xss')< / script> &password= <script>alert('xss')< / script> If the attack is successful, the corresponding parameter name and attack script are recorded in the attack risk list. The attack is simulated in a loop to generate a large number of parameter-feature instruction pairs corresponding to the injection points, and deep learning is performed to intelligently obtain tasks with common labels, such as alert and src;

[0073] (4) Establish a recommendation algorithm model, model the parameter-attack script cluster (multiple parameters, each parameter corresponds to multiple attack scripts) in the attack risk list, and use the GBDT algorithm model to automatically screen and combine features to generate new discrete feature vectors. The feature vectors are then transmitted as input to the LR model to generate the most comprehensive recommendation results, that is, to obtain the optimal parameter-attack vector.

[0074] (5) When the sample data of the XSS attack dictionary list changes, the attack risk list will be remodeled and the original optimal solution may change.

[0075] In one embodiment of the present invention, step S5 includes:

[0076] Step S501: Perform feature cutting on the script that successfully attacks, for example, obtaining the script <script>、<alert>、<style>、<body>进行特征切割；特征切割的方式可以通过符号和空格；

[0077] 步骤S502、训练GBDT特征模型，该模型由多棵树组成，根据脚本的标签、属性、事件进行根节点和叶子结点拆分；如可以使用<script>、<style>、<svg>、<form>等作为树的根节点，<alert>、<body>作为树的叶子节点，对于每个叶子节点，回溯到根节点都可以得到一组组合特征；

[0078] 步骤S503、用叶子节点的标号可以标识一个新的组合特征，例如从最后一个节点回溯到根节点的特征能够构成攻击向量样本，则该样本取值为1，构成失败则取值为0；

[0079] 步骤S504、迭代决策树产生一批[0,0,1,0,....]、[0,1,1,0,0,...]的特征向量；

[0080] 步骤S505、将特征向量输入LR模型训练，输出最终的特征攻击指令。

[0081] 本发明进一步揭示一种跨站脚本漏洞攻击检测系统，图2为本发明一实施例中跨站脚本漏洞攻击检测系统的组成示意图；请参阅图2，所述跨站脚本漏洞攻击检测系统包括：URL提取模块1、URL过滤模块2、分组归类模块3、攻击字典库建立模块4、模拟请求发送模块5、数学模型建立模块6及漏洞判断模块7。

[0082] 所述URL提取模块1用以通过爬虫技术获取到所有Web页面的源码，利用广度优先算法从中提取出URL，将解析出来的URL放入visited表中，循环往复。

[0083] 所述URL过滤模块2用以将每次抓取的URL与visited表中的URL进行比较，从而过滤掉重复的URL以及无效的URL。

[0084] 所述分组归类模块3用以从所有有效的URL中提取出请求参数及参数值，包括get请求和post请求，将参数去重后分组归类，持久化到数据库中。

[0085] 所述攻击字典库建立模块4用以建立XSS攻击字典库；将owasp收录的以及历史上XSS攻击出现新型的攻击脚本命令以列表的形式保存至数据库，建立XSS攻击字典库。

[0086] 所述模拟请求发送模块5用以替换有效URL中提取出请求的参数值为XSS攻击字典库中对应的脚本命令，发送模拟请求到目标服务器，并接收返回的响应请求；如果返回的响应请求中含有攻击脚本内容，就将对应的参数名以及攻击脚本加载到攻击风险列表中。

[0087] 所述数学模型建立模块6用以对攻击风险列表中的参数名-攻击脚本进行建模，使用GBDT模型及LR模型形成的复合模型；利用GBDT(Gradient Boosting Decision Tree)模型自动进行特征筛选和组合，得到离散特征向量；把该特征向量作为LR(LogisticRegression)模型的输入，最终输出攻击成功率最高的一对参数名-攻击脚本(一对一的关系)，加载到攻击向量特征库中。

[0088] 所述漏洞判断模块7用以根据攻击向量特征库中最优的一组攻击向量，替换待测请求中对应的参数值，发送HTTP请求到被检测的站点，被测站点会返回一个HTTP响应，根据返回信息判断是否存在XSS攻击漏洞。

[0089] 图3为本发明一实施例中数学模型建立模块的组成示意图；请参阅图3，在本发明的一实施例中，所述数学模型建立模块6具体包括：请求信息解析单元61、攻击字典列表加载单元62、攻击脚本替换单元63、推荐算法模型建立单元64及数学模型重建单元65。

[0090] 所述请求信息解析单元61用以解析输入端请求中包含的请求信息，包括请求URL、请求方式、请求头、请求体，将参数和对应请求类型解析入库保存。

[0091] 所述攻击字典列表加载单元62用以加载XSS攻击字典列表；在一实施例中，XSS攻击字典列表大概1000+条数据。

[0092] 所述攻击脚本替换单元63用以替换被测URL参数值为攻击字典列表中的攻击脚本，如果攻击成功，记录对应的参数名和攻击脚本至攻击风险列表中；循环模拟攻击，生成大量注入点对应的参数-特征指令对，进行深度学习，智能获取到有共同标签的任务。

[0093] 所述推荐算法模型建立单元64用以建立推荐算法模型，对攻击风险列表中参数-攻击脚本簇(多个参数，每个参数对应多个攻击脚本)进行建模，利用GBDT算法模型自动进行特征筛选和组合，从而生成新的离散特征向量，再把特征向量作为输入传送至LR模型，来产生最为全面的推荐结果，即得到最优的参数-攻击向量。

[0094] 所述数学模型重建单元65用以当XSS攻击字典列表样本数据变更后，会重新对攻击风险列表进行建模，原最优解可能会变更。

[0095] 图4为本发明一实施例中数学模型建立模块的组成示意图；请参阅图4，在本发明的一实施例中，所述数学模型建立模块6具体包括：特征切割单元601、GBDT特征模型单元602、攻击向量样本生成单元603、特征向量生成单元604及特征攻击指令生成单元605。

[0096] 所述特征切割单元601用以对攻击成功的设定脚本进行特征切割，例如脚本中的<script>、<alert>、<style>、<body>进行特征切割；特征切割的方式可以通过符号和空格；

[0097] 所述GBDT特征模型单元602用以训练GBDT特征模型，所述GBDT特征模型由多棵树组成，根据脚本的标签、属性、事件进行根节点和叶子结点拆分，对于每个叶子节点，回溯到根节点能得到一组组合特征。

[0098] 所述攻击向量样本生成单元603用以通过叶子节点的标号标识一个新的组合特征，若从最后一个节点回溯到根节点的特征能够构成攻击向量样本，则该样本取值为1，构成失败则取值为0。所述特征向量生成单元604用以迭代决策树产生一批特征向量，特征向量可以如[0,0,1,0,....]、[0,1,1,0,0,...]。

[0099] 所述特征攻击指令生成单元605用以将所述特征向量生成单元得到的特征向量输入LR模型训练，得到最终的特征攻击指令。

[0100] 此外，所述跨站脚本漏洞攻击检测系统还可以包括盲测模块，用以对于输入端的每个请求，都用攻击字典列表中的脚本指令去遍历URL每一个参数名，进行盲测，延长XSS漏洞检测的时间。

[0101] 综上所述，本发明提出的跨站脚本漏洞攻击检测方法及系统，通过对攻击风险列表进行建模，使用GBDT+LR算法模型，最终只需要输出一组参数-攻击指令(攻击向量)，对请求进行模拟攻击，可以大幅缩短检测XSS漏洞的时间，也可提高XSS漏洞检测精确度；而业界传统的XSS漏洞检测工具攻击特征库太过老旧，样本不足，并且循环遍历，导致检测的覆盖率过低，测试结果误差较大，当新型攻击代码出现后，只需录入XSS攻击字典列表即可。

[0102] 本发明通过组合模型(GBDT模型与LR模型相结合)方式，先利用GBDT自动进行特征筛选和组合，得到离散特征向量，再利用LR模型输出最优的一条攻击向量，节省了遍历扫描过程中时间，用深度学习的技术提高了检测精准度，降低了误判；

[0103] 本发明对请求中的参数进行攻击字典脚本指令替换，通过遍历字段的方式，提高XSS检测覆盖率；此外，本发明对获取的请求信息，通过列表的形式进行存储，便于规范管理。

[0104] 需要注意的是，本申请可在软件和 / 或软件与硬件的组合体中被实施；例如，可采用专用集成电路(ASIC)、通用目的计算机或任何其他类似硬件设备来实现。在一些实施例中，本申请的软件程序可以通过处理器执行以实现上文步骤或功能。同样地，本申请的软件程序(包括相关的数据结构)可以被存储到计算机可读记录介质中；例如，RAM存储器，磁或光驱动器或软磁盘及类似设备。另外，本申请的一些步骤或功能可采用硬件来实现；例如，作为与处理器配合从而执行各个步骤或功能的电路。

[0105] 以上所述实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。

[0106] 这里本发明的描述和应用是说明性的，并非想将本发明的范围限制在上述实施例中。实施例中所涉及的效果或优点可因多种因素干扰而可能不能在实施例中体现，对于效果或优点的描述不用于对实施例进行限制。这里所披露的实施例的变形和改变是可能的，对于那些本领域的普通技术人员来说实施例的替换和等效的各种部件是公知的。本领域技术人员应该清楚的是，在不脱离本发明的精神或本质特征的情况下，本发明可以以其它形式、结构、布置、比例，以及用其它组件、材料和部件来实现。在不脱离本发明范围和精神的情况下，可以对这里所披露的实施例进行其它变形和改变。< / script>

Claims

1. A method for detecting a cross-site scripting vulnerability attack, characterized in that: The cross-site scripting vulnerability attack detection method comprises: Step S1: Get the source code of all web pages through crawler technology, extract URLs from them using breadth-first algorithm, put the parsed URLs into the visited table, and repeat the process; each time the captured URL is compared with the URL in the visited table, so as to filter out duplicate URLs and invalid URLs; Step S2: extract request parameters and parameter values ​​from all valid URLs, including get requests and post requests, remove duplicate parameters, group and classify them, and persist them in the database; Step S3, establish an XSS attack dictionary library, save the attack script commands included in OWASP and new types of XSS attacks in history in the form of a list to the database, and establish an XSS attack dictionary library; Step S4: replace all parameter values ​​in step S2 with corresponding script commands in the XSS attack dictionary library, send a simulated request to the target server, and receive a returned response request; if the returned response request contains attack script content, load the corresponding parameter name and attack script into the attack risk list; Step S5: Model the parameter name-attack script in the attack risk list, and use the composite model formed by the GBDT model and the LR model. First, use the GBDT model to automatically screen and combine features to obtain a discrete feature vector, and then use the feature vector as the input of the LR model. Finally, output a pair of parameter name-attack script with the highest attack success rate and load it into the attack vector feature library; Step S6: According to the optimal set of attack vectors in the attack vector feature library, replace the corresponding parameter values ​​in the request to be tested, send an HTTP request to the site to be tested, and the site to be tested will return an HTTP response. According to the returned information, determine whether there is an XSS attack vulnerability.

2. The cross-site scripting vulnerability attack detection method according to claim 1, characterized in that: The data modeling step in step S5 specifically includes: Step S51, parsing the request information contained in the input request, including the request URL, request method, request header, and request body, parsing the parameters and the corresponding request type into a database for storage; Step S52, loading the XSS attack dictionary list; Step S53: Replace the parameter value of the tested URL with the attack script in the attack dictionary list. If the attack is successful, record the corresponding parameter name and attack script in the attack risk list; simulate the attack in a loop to generate a large number of parameter-feature instruction pairs corresponding to the injection points, perform deep learning, and intelligently obtain tasks with common labels; Step S54: Establish a recommendation algorithm model, model the parameter-attack script cluster in the attack risk list, use the GBDT algorithm model to automatically screen and combine features, thereby generating a new discrete feature vector, and then transmit the feature vector as input to the LR model to generate the most comprehensive recommendation results, that is, to obtain the optimal parameter-attack vector; Step S55: When the sample data of the XSS attack dictionary list is changed, the attack risk list will be remodeled.

3. The cross-site scripting vulnerability attack detection method according to claim 1, characterized in that: The step S5 comprises: Step S501, performing feature cutting on the setting script of successful attack; Step S502: training a GBDT feature model, wherein the GBDT feature model is composed of multiple trees, and the root node and leaf node are split according to the script's label, attribute, and event. For each leaf node, a set of combined features can be obtained by tracing back to the root node; Step S503: Use the label of the leaf node to identify a new combined feature. If the feature traced back from the last node to the root node can form an attack vector sample, the value of the sample is 1; if the feature fails to form an attack vector sample, the value of the sample is 0. Step S504, iterating the decision tree to generate a batch of feature vectors; Step S505: input the feature vector obtained in step S504 into LR model training, and output the final feature attack instruction.

4. The cross-site scripting vulnerability attack detection method according to claim 1, characterized in that: The cross-site scripting vulnerability attack detection method further includes: for each request from the input end, using the script instructions in the attack dictionary list to traverse each parameter name of the URL, performing blind testing, and extending the time of XSS vulnerability detection.

5. A cross-site scripting vulnerability attack detection system, characterized in that: The cross-site scripting vulnerability attack detection system includes: The URL extraction module is used to obtain the source code of all Web pages through crawler technology, extract URLs from them using the breadth-first algorithm, and put the parsed URLs into the visited table, repeating the cycle; URL filtering module, which compares each captured URL with the URL in the visited table to filter out duplicate URLs and invalid URLs; The grouping and classification module is used to extract request parameters and parameter values ​​from all valid URLs, including get requests and post requests, remove duplicate parameters, group and classify them, and persist them in the database; The attack dictionary library establishment module is used to establish the XSS attack dictionary library; the attack script commands included in OWASP and the new attack script commands in the history of XSS attacks are saved in the database in the form of a list to establish the XSS attack dictionary library; The simulated request sending module is used to replace the parameter value extracted from the valid URL with the corresponding script command in the XSS attack dictionary library, send the simulated request to the target server, and receive the returned response request; if the returned response request contains the attack script content, the corresponding parameter name and attack script are loaded into the attack risk list; The mathematical model building module is used to model the parameter name-attack script in the attack risk list, using a composite model formed by the GBDT model and the LR model; the GBDT model is used to automatically screen and combine features to obtain a discrete feature vector; the feature vector is used as the input of the LR model, and finally the pair of parameter name-attack script with the highest attack success rate is output and loaded into the attack vector feature library; The vulnerability judgment module is used to replace the corresponding parameter values ​​in the request to be tested according to the optimal set of attack vectors in the attack vector feature library, send an HTTP request to the site to be tested, and the site to be tested will return an HTTP response. Based on the returned information, it is determined whether there is an XSS attack vulnerability.

6. The cross-site scripting vulnerability attack detection system according to claim 5, characterized in that: The mathematical model building module specifically includes: The request information parsing unit is used to parse the request information contained in the input request, including the request URL, request method, request header, and request body, and parse the parameters and the corresponding request type into a database for storage; Attack dictionary list loading unit, used to load XSS attack dictionary list; The attack script replacement unit is used to replace the parameter value of the tested URL with the attack script in the attack dictionary list. If the attack is successful, the corresponding parameter name and attack script are recorded in the attack risk list; the attack is simulated in a loop to generate a large number of parameter-feature instruction pairs corresponding to the injection points, and deep learning is performed to intelligently obtain tasks with common labels; The recommendation algorithm model building unit is used to build the recommendation algorithm model, model the parameter-attack script cluster in the attack risk list, and use the GBDT algorithm model to automatically screen and combine features to generate new discrete feature vectors. The feature vectors are then transmitted as input to the LR model to generate the most comprehensive recommendation results, that is, to obtain the optimal parameter-attack vector. The mathematical model reconstruction unit is used to re-model the attack risk list when the sample data of the XSS attack dictionary list changes.

7. The cross-site scripting vulnerability attack detection system according to claim 5, characterized in that: The mathematical model building module specifically includes: A feature cutting unit is used to perform feature cutting on the setting script of successful attack; GBDT feature model unit, used to train the GBDT feature model. The GBDT feature model consists of multiple trees. The root node and leaf node are split according to the script's label, attribute, and event. For each leaf node, a set of combined features can be obtained by tracing back to the root node. The attack vector sample generation unit is used to identify a new combined feature through the label of the leaf node. If the features traced back from the last node to the root node can form an attack vector sample, the sample value is 1, and if the formation fails, the value is 0; A feature vector generation unit, used to iterate the decision tree to generate a batch of feature vectors; The feature attack instruction generating unit is used to input the feature vector obtained by the feature vector generating unit into the LR model training to obtain the final feature attack instruction.

8. The cross-site scripting vulnerability attack detection system according to claim 5, characterized in that: The cross-site scripting vulnerability attack detection system further includes: a blind test module, which uses the script instructions in the attack dictionary list to traverse each parameter name of the URL for each request from the input end, performs blind testing, and prolongs the time of XSS vulnerability detection.

Images