Defense test method, apparatus and device, and readable storage medium

Abstract

The invention discloses a defense test method, device and equipment and a readable storage medium. The method comprises the following steps: reading a malicious abnormal traffic packet which does not conform to a standard file uploading protocol from a malicious traffic library; wherein the malicious abnormal traffic packet is obtained by performing deformation processing on a standard traffic packet conforming to a standard file uploading protocol; sending the malicious and abnormal traffic packet to an application firewall through a network; counting the flow processing result of the application firewall to obtain an interception rate; and determining a defense index of the application firewall by using the interception rate. The method and the device have the technical effects that the defense capability of the application firewall is effectively detected based on the malicious abnormal traffic packet obtained by deforming the standard traffic packet.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a defense testing method, device, equipment and readable storage medium. Background Art

[0002] In the field of network security, the design goal of application firewalls (WAF) is to intercept malicious traffic as much as possible. To achieve this goal, WAF needs to find a balance between RFC (Recommended Document) specifications and various Web product specifications.

[0003] Although the HTTP (Hyper Text Transfer Protocol) file upload protocol specification is relatively standardized, the RFC file specification is not mandatory to comply with, and each product may have different requirements, designs, and implementation methods when implementing the upload function. Therefore, the file upload defense capabilities of each WAF vary due to design and implementation methods. This makes it more difficult to detect the defense capabilities of application firewalls. However, the defense capability detection of application firewalls is an urgent need to be solved.

[0004] In summary, how to effectively detect the defense capability of application firewalls is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] The purpose of this application is to provide a defense testing method, device, equipment and readable storage medium, which can effectively detect the defense capability of an application firewall based on malicious malformed traffic packets.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] A defense testing method, comprising:

[0008] Reading malicious malformed traffic packets that do not conform to the standard file upload protocol from the malicious traffic library; wherein the malicious malformed traffic packets are obtained by deforming standard traffic packets that conform to the standard file upload protocol;

[0009] Sending the malicious malformed traffic packet to the application firewall through the network;

[0010] The traffic processing results of the application firewall are counted to obtain an interception rate;

[0011] The interception rate is used to determine the defense index of the application firewall.

[0012] Preferably, obtaining the malicious malformed traffic packet includes:

[0013] Obtain a standard traffic package that complies with the standard file upload protocol;

[0014] The standard traffic packet is deformed to obtain the malicious deformed traffic packet;

[0015] The malicious malformed traffic packet is stored in the malicious traffic library.

[0016] Preferably, deforming the standard traffic packet to obtain the malicious deformed traffic packet includes:

[0017] By using a distortion processing program, the multi-part object set in the standard traffic packet is deformed into arbitrary characters to obtain the malicious deformed traffic packet.

[0018] Preferably, deforming the standard traffic packet to obtain the malicious deformed traffic packet includes:

[0019] By utilizing a distortion processing program, the main body in the standard traffic packet is subjected to line wrapping processing to obtain the malicious deformed traffic packet.

[0020] Preferably, statistics are collected on the traffic processing results of the application firewall to obtain the interception rate, including:

[0021] Receiving return information sent by the application firewall for each data packet;

[0022] The returned information is parsed to determine the interception rate.

[0023] Preferably, parsing the returned information and determining the interception rate includes:

[0024] Parsing the returned information to obtain returned features;

[0025] Obtaining an interception feature, and performing matching detection on the return feature and the interception feature;

[0026] Based on the matching detection result, the interception rate is determined.

[0027] Preferably, parsing the returned information and determining the interception rate includes:

[0028] If the returned information is a file name, it is determined that the traffic packet bypasses interception;

[0029] If the returned information is an error message indicating that the resource is unavailable, it is determined that the traffic packet is intercepted;

[0030] If the returned information is an error prompt, the traffic packet is determined to be unacceptable traffic;

[0031] According to the analysis results, the total number of traffic packets and the number of intercepted traffic packets are obtained;

[0032] The interception rate is obtained by comparing the number of intercepted traffic packets with the total number of traffic packets.

[0033] A defense test device, comprising:

[0034] A malicious traffic acquisition module, used to read malicious malformed traffic packets that do not comply with the standard file upload protocol from the malicious traffic library; wherein the malicious malformed traffic packets are obtained by deforming the standard traffic packets that comply with the standard file upload protocol;

[0035] A traffic replay module, used for sending the malicious malformed traffic packet to the application firewall through the network;

[0036] An interception statistics module is used to collect statistics on the traffic processing results of the application firewall to obtain an interception rate;

[0037] The defense determination module is used to determine the defense index of the application firewall using the interception rate.

[0038] An electronic device, comprising:

[0039] Memory for storing computer programs;

[0040] A processor is used to implement the steps of the above-mentioned defense testing method when executing the computer program.

[0041] A readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned defense testing method are implemented.

[0042] By using the method provided in the embodiment of the present application, malicious deformed traffic packets that do not comply with the standard file upload protocol are read from a malicious traffic library; wherein the malicious deformed traffic packets are obtained by deforming the standard traffic packets that comply with the standard file upload protocol; the malicious deformed traffic packets are sent to an application firewall through a network; the traffic processing results of the application firewall are counted to obtain an interception rate; and the defense index of the application firewall is determined using the interception rate.

[0043] When it is necessary to test the defense capability of the application firewall, malicious malformed data packets that do not conform to the standard file upload protocol can be read from the malicious traffic library. The malicious malformed data packets are obtained by deforming the standard traffic packets that conform to the standard file upload protocol. The malicious malformed traffic packets can be sent to the application firewall through the network. Then, the traffic processing results of the application firewall are counted to obtain the interception rate. The defense index of the application firewall can be determined based on the interception rate. That is, by sending malicious malformed traffic packets that do not conform to the standard file upload protocol but can be transmitted over the network to the application firewall for interception testing, based on the statistics of the traffic processing results of the firewall, the defense capability of the application firewall can be clearly seen through its interception rate.

[0044] Technical effect of the present application: The present application realizes effective detection of the defense capability of the application firewall based on malicious deformed traffic packets obtained by deforming standard traffic packets.

[0045] Correspondingly, the embodiments of the present application also provide a defense test device, equipment and readable storage medium corresponding to the above-mentioned defense test method, which have the above-mentioned technical effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 This is a flowchart of an implementation of a defense testing method in an embodiment of the present application;

[0048] Figure 2 This is a schematic diagram of the structure of a defense test device in an embodiment of the present application;

[0049] Figure 3 This is a schematic diagram of the structure of an electronic device in an embodiment of the present application;

[0050] Figure 4 This is a schematic diagram of the specific structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0052] Please refer to Figure 1 , Figure 1 This is a flowchart of a defense testing method in an embodiment of the present application, the method comprising the following steps:

[0053] S101. Read malicious malformed traffic packets that do not comply with the standard file upload protocol from a malicious traffic library.

[0054] Among them, the malicious deformed traffic packet is obtained by deforming the standard traffic packet that complies with the standard file upload protocol.

[0055] In the embodiment of the present application, a malicious traffic library can be pre-set to store malicious malformed traffic packets that do not conform to the standard upload protocol. The malicious malformed traffic packets can be specifically obtained by deforming standard traffic packets that conform to the standard file upload protocol.

[0056] In a specific implementation of the present application, obtaining a malicious malformed traffic packet includes:

[0057] Obtain a standard traffic package that complies with the standard file upload protocol;

[0058] Deform the standard traffic packets to obtain malicious malformed traffic packets;

[0059] The malicious and malformed traffic packets are stored in the malicious traffic library.

[0060] For ease of description, the above steps are combined for explanation below.

[0061] Among them, standard data packets can be obtained by setting up a file upload service or a public blog on the Internet to obtain standard traffic packets. For example, you can write a web service and set up a file upload scenario, and then use proxies or traffic capture tools such as Wireshark (a network protocol detection program) and Burp Suite (an integrated platform for attacking web applications) to obtain standard traffic packets; you can also search for keywords such as file upload traffic through search engines and open the web page to obtain standard traffic.

[0062] After obtaining the standard traffic packet, the standard traffic packet can be deformed to obtain a malicious malformed traffic packet, and then the malicious malformed traffic packet is stored in a malicious traffic library for standby use.

[0063] In order to make the deformed malicious malformed traffic be sent through the network and have detection value, when deforming, the deformation can be performed on the standard traffic packet, which does not affect the network transmission and can reveal its abnormal position. Specifically, by analyzing the RFC file upload protocol, the deformation can be confirmed. For example, by studying the file upload source code of PHP (a general open source scripting language) and JAVA (object-oriented programming language), and maliciously changing the traffic according to the characteristics of the code; then the above-mentioned positions are distorted by special characters, line breaks, uppercase and lowercase, other encodings, insertion symbols, etc. through the Fuzz program (distortion processing program), thereby generating a large amount of traffic carrying malicious characteristics.

[0064] In a specific implementation of the present application, a standard traffic packet is deformed to obtain a malicious deformed traffic packet, including:

[0065] Method 1: Use the distortion processing program to deform the multi-part object set in the standard traffic packet into arbitrary characters to obtain a malicious malformed traffic packet.

[0066] Method 2: Use the distortion processing program to perform line wrapping on the main body of the standard traffic packet to obtain a malicious malformed traffic packet.

[0067] The multipart object set is multipart, and the main body is body. In addition to transforming multipart and body, you can also perform special processing on filename (project name) and name (name). The special processing here includes but is not limited to special characters, line breaks, uppercase and lowercase, other encodings, and insertion symbols.

[0068] It should be noted that in actual applications, at least one or more of method 1, method 2 and other methods can be selected to deform the standard traffic packet to obtain a malicious deformed traffic packet.

[0069] Based on the distortion processing program, the standard data packet is deformed and fully automated operation can be achieved.

[0070] S102: Send the malicious malformed traffic packet to the application firewall through the network.

[0071] In this embodiment, if the malicious malformed traffic packet is randomly deformed from the standard traffic packet, it may be impossible to send it. Therefore, the malicious malformed traffic packet that cannot be sent will not be included in the subsequent statistics.

[0072] If the malicious malformed traffic packet is randomly deformed from the designated position of the standard traffic packet, the deformation can also save the sending of the data packet. Therefore, all malicious malformed traffic packets are included in the subsequent statistics.

[0073] S103: Count the traffic processing results of the application firewall to obtain the interception rate.

[0074] After the application firewall receives the malicious malformed traffic packet, it will process the malicious malformed traffic packet and respond with feedback, that is, it will generate return information.

[0075] Therefore, by analyzing the returned information, the traffic processing results can be obtained, and by statistically analyzing the traffic processing results, the interception rate of the application firewall for malicious and abnormal traffic can be obtained.

[0076] In a specific implementation of the present application, statistics are collected on the traffic processing results of the application firewall to obtain the interception rate, including:

[0077] Step 1: Receive the return information sent by the application firewall for each data packet;

[0078] Step 2: Analyze the returned information and determine the interception rate.

[0079] For ease of description, the above steps are combined for explanation below.

[0080] After receiving the return information of each data packet sent by the application firewall, the return information is parsed to determine the interception rate.

[0081] Specifically, the above step 2, parsing the returned information and determining the interception rate, includes:

[0082] Parse the returned information to obtain the returned features;

[0083] Obtain interception features, and match the returned features with the interception features;

[0084] Based on the matching detection results, the interception rate is determined.

[0085] That is, users can customize the interception features of different WAF products according to their needs, thereby better ensuring the accuracy of interception of different WAF products.

[0086] After obtaining the returned information, the returned information can be parsed to obtain the returned features. Then, the returned features are matched with the interception features to obtain the matching detection results.

[0087] By taking statistics on the matching detection results, the interception rate can be determined.

[0088] For example: Analyze the WAF return page, and customize the page's 403 flag, attack, interception, etc.; then send it to different WAF targets through the network, and match the return results to see if they hit the interception feature. Users can customize the recording method of features as needed, including but not limited to title features, error page text features, HTTP response features, security vendor features, etc.

[0089] Specifically, the above step 2, parsing the returned information and determining the interception rate, includes:

[0090] If the returned information is a file name, it is determined that the traffic packet bypasses interception;

[0091] If the returned information is an error message indicating that the resource is unavailable, it is determined that the traffic packet has been intercepted;

[0092] If the returned information is an error message, it is determined that the traffic packet is unacceptable traffic;

[0093] According to the analysis results, the total number of traffic packets and the number of intercepted traffic packets are obtained;

[0094] Compare the number of intercepted traffic packets with the total number of traffic packets to get the interception rate.

[0095] That is to say, if the file name is returned, the interception is bypassed; if a 403 error message is returned, the interception is determined; if there is no 403 error message or file name error message, the traffic is determined to be unacceptable. By counting the data packets indicated as intercepted in the parsing results, and the total number of traffic packets, the interception rate can be obtained by comparing the two.

[0096] S104. Determine the defense index of the application firewall using the interception rate.

[0097] In this embodiment, the interception rate can be directly determined as the defense index. Interception rate intervals corresponding to different defense indexes can also be set, and the defense index of the application firewall is determined based on the interval in which the current interception rate is located.

[0098] By using the method provided in the embodiment of the present application, malicious deformed traffic packets that do not comply with the standard file upload protocol are read from a malicious traffic library; wherein the malicious deformed traffic packets are obtained by deforming the standard traffic packets that comply with the standard file upload protocol; the malicious deformed traffic packets are sent to an application firewall through a network; the traffic processing results of the application firewall are counted to obtain an interception rate; and the defense index of the application firewall is determined using the interception rate.

[0099] When it is necessary to test the defense capability of the application firewall, malicious malformed data packets that do not conform to the standard file upload protocol can be read from the malicious traffic library. The malicious malformed data packets are obtained by deforming the standard traffic packets that conform to the standard file upload protocol. The malicious malformed traffic packets can be sent to the application firewall through the network. Then, the traffic processing results of the application firewall are counted to obtain the interception rate. The defense index of the application firewall can be determined based on the interception rate. That is, by sending malicious malformed traffic packets that do not conform to the standard file upload protocol but can be transmitted over the network to the application firewall for interception testing, based on the statistics of the traffic processing results of the firewall, the defense capability of the application firewall can be clearly seen through its interception rate.

[0100] Technical effect of the present application: The present application realizes effective detection of the defense capability of the application firewall based on malicious deformed traffic packets obtained by deforming standard traffic packets.

[0101] Corresponding to the above method embodiment, the embodiment of the present application further provides a defense test device. The defense test device described below and the defense test method described above can refer to each other.

[0102] See also Figure 2 As shown, the device includes the following modules:

[0103] The malicious traffic acquisition module 101 is used to read malicious malformed traffic packets that do not conform to the standard file upload protocol from the malicious traffic library; wherein the malicious malformed traffic packets are obtained by deforming the standard traffic packets that conform to the standard file upload protocol;

[0104] The traffic replay module 102 is used to send malicious malformed traffic packets to the application firewall through the network;

[0105] The interception statistics module 103 is used to collect statistics on the traffic processing results of the application firewall to obtain the interception rate;

[0106] The defense determination module 104 is used to determine the defense index of the application firewall using the interception rate.

[0107] Using the device provided in the embodiment of the present application, malicious deformed traffic packets that do not comply with the standard file upload protocol are read from a malicious traffic library; wherein the malicious deformed traffic packets are obtained by deforming the standard traffic packets that comply with the standard file upload protocol; the malicious deformed traffic packets are sent to an application firewall through a network; the traffic processing results of the application firewall are counted to obtain an interception rate; and the defense index of the application firewall is determined using the interception rate.

[0108] When it is necessary to test the defense capability of the application firewall, malicious malformed data packets that do not conform to the standard file upload protocol can be read from the malicious traffic library. The malicious malformed data packets are obtained by deforming the standard traffic packets that conform to the standard file upload protocol. The malicious malformed traffic packets can be sent to the application firewall through the network. Then, the traffic processing results of the application firewall are counted to obtain the interception rate. The defense index of the application firewall can be determined based on the interception rate. That is, by sending malicious malformed traffic packets that do not conform to the standard file upload protocol but can be transmitted over the network to the application firewall for interception testing, based on the statistics of the traffic processing results of the firewall, the defense capability of the application firewall can be clearly seen through its interception rate.

[0109] Technical effect of the present application: The present application realizes effective detection of the defense capability of the application firewall based on malicious deformed traffic packets obtained by deforming standard traffic packets.

[0110] In a specific implementation of the present application, the malicious traffic acquisition module is specifically used to acquire a standard traffic packet that complies with a standard file upload protocol;

[0111] Deform the standard traffic packets to obtain malicious malformed traffic packets;

[0112] The malicious and malformed traffic packets are stored in the malicious traffic library.

[0113] In a specific implementation of the present application, the malicious traffic acquisition module is specifically used to use a distortion processing program to deform a multi-part object set in a standard traffic packet into arbitrary characters to obtain a malicious deformed traffic packet.

[0114] In a specific implementation of the present application, the malicious traffic acquisition module is specifically used to utilize a distortion processing program to perform line wrap processing on the main body of a standard traffic packet to obtain a malicious deformed traffic packet.

[0115] In a specific implementation of the present application, the interception statistics module is specifically used to receive the return information sent by the application firewall for each data packet;

[0116] Parse the returned information and determine the interception rate.

[0117] In a specific implementation of the present application, the interception statistics module is specifically used to parse the returned information to obtain the returned features;

[0118] Obtain interception features, and match the returned features with the interception features;

[0119] Based on the matching detection results, the interception rate is determined.

[0120] In a specific implementation of the present application, the interception statistics module is specifically used to determine that the traffic packet bypasses interception if the returned information is a file name;

[0121] If the returned information is an error message indicating that the resource is unavailable, it is determined that the traffic packet has been intercepted;

[0122] If the returned information is an error message, it is determined that the traffic packet is unacceptable traffic;

[0123] According to the analysis results, the total number of traffic packets and the number of intercepted traffic packets are obtained;

[0124] Compare the number of intercepted traffic packets with the total number of traffic packets to get the interception rate.

[0125] Corresponding to the above method embodiment, the embodiment of the present application further provides an electronic device. The electronic device described below and the defense test method described above can refer to each other.

[0126] See also Figure 3 As shown, the electronic device includes:

[0127] A memory 332, for storing computer programs;

[0128] The processor 322 is used to implement the steps of the defense testing method of the above method embodiment when executing a computer program.

[0129] For details, please refer to Figure 4 , Figure 4 A schematic diagram of the specific structure of an electronic device provided for this embodiment, which may have relatively large differences due to different configurations or performances, may include one or more processors (central processing units, CPU) (for example, one or more processors) and a memory 332, and the memory 332 stores one or more computer programs 342 or data 344. Among them, the memory 332 can be a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the processor 322 can be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the electronic device 301.

[0130] The electronic device 301 may further include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0131] The steps in the defense test method described above can be implemented by the structure of the electronic device.

[0132] Corresponding to the above method embodiment, the embodiment of the present application further provides a readable storage medium. The readable storage medium described below and the defense testing method described above can refer to each other.

[0133] A readable storage medium stores a computer program, which implements the steps of the defense testing method of the above method embodiment when the computer program is executed by a processor.

[0134] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0135] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0136] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0137] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0138] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms include, include or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0139] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A defensive testing method, It is characterized in that include: Reading malicious malformed traffic packets that do not conform to the standard file upload protocol from the malicious traffic library; wherein the malicious malformed traffic packets are obtained by deforming standard traffic packets that conform to the standard file upload protocol; Sending the malicious malformed traffic packet to the application firewall through the network; The traffic processing results of the application firewall are counted to obtain an interception rate; The interception rate is used to determine the defense index of the application firewall.

2. The method according to claim 1, It is characterized in that Obtaining the malicious malformed traffic packet includes: Obtain a standard traffic package that complies with the standard file upload protocol; The standard traffic packet is deformed to obtain the malicious deformed traffic packet; The malicious malformed traffic packet is stored in the malicious traffic library.

3. The method according to claim 2, It is characterized in that The standard traffic packet is deformed to obtain the malicious deformed traffic packet, including: By using a distortion processing program, the multi-part object set in the standard traffic packet is deformed into arbitrary characters to obtain the malicious deformed traffic packet.

4. The method according to claim 2, It is characterized in that The standard traffic packet is deformed to obtain the malicious deformed traffic packet, including: By utilizing a distortion processing program, the main body in the standard traffic packet is subjected to line wrapping processing to obtain the malicious deformed traffic packet.

5. The method according to any one of claims 1 to 4, It is characterized in that The traffic processing results of the application firewall are counted to obtain the interception rate, including: Receiving return information sent by the application firewall for each data packet; The returned information is parsed to determine the interception rate.

6. The method according to claim 5, It is characterized in that Parsing the returned information to determine the interception rate includes: Parsing the returned information to obtain returned features; Obtaining an interception feature, and performing matching detection on the return feature and the interception feature; Based on the matching detection result, the interception rate is determined.

7. The method according to claim 5, It is characterized in that The parsing the returned information and determining the interception rate includes: If the returned information is a file name, it is determined that the traffic packet bypasses interception; If the returned information is an error message indicating that the resource is unavailable, it is determined that the traffic packet is intercepted; If the returned information is an error prompt, the traffic packet is determined to be unacceptable traffic; According to the analysis results, the total number of traffic packets and the number of intercepted traffic packets are obtained; The interception rate is obtained by comparing the number of intercepted traffic packets with the total number of traffic packets.

8. A defense test device, It is characterized in that include: A malicious traffic acquisition module, used to read malicious malformed traffic packets that do not comply with the standard file upload protocol from the malicious traffic library; wherein the malicious malformed traffic packets are obtained by deforming the standard traffic packets that comply with the standard file upload protocol; A traffic replay module, used for sending the malicious malformed traffic packet to the application firewall through the network; An interception statistics module is used to collect statistics on the traffic processing results of the application firewall to obtain an interception rate; The defense determination module is used to determine the defense index of the application firewall using the interception rate.

9. An electronic device, It is characterized in that include: Memory for storing computer programs; A processor, configured to implement the steps of the defense testing method according to any one of claims 1 to 7 when executing the computer program.

10. A readable storage medium, It is characterized in that The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the defense testing method according to any one of claims 1 to 7 are implemented.

Images