Web application system security rule validity detection method and device

Abstract

The invention relates to the technical field of network security, and particularly provides a Web application system security rule validity detection method and device, and the method comprises the following steps: S1, compiling a security rule; s2, deploying a detection tool in a server where a detection system is located, and modifying tool configuration items; s3, reading the JSON configuration file customized by the user in the step S1, and analyzing the detection rule in the JSON configuration file; s4, the tool performs automatic detection on the specified Web application system according to the analyzed detection rule; s5, sorting the detection result by the tool, and outputting the detection result to an Excel file in a structured mode; and S6, knowing the safety condition of the Web application system according to the generated Excel report. Compared with the prior art, the detection rule can be flexibly customized, the detection accuracy is improved, and a visual and readable detection report is generated.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and specifically provides a method and a device for detecting the validity of security rules of a Web application system. Background Art

[0002] With the rapid development of the Internet, Web application systems have become an important part of modern information technology. However, the security issues of Web application systems are becoming increasingly prominent, and various attack methods are emerging in an endless stream, posing a serious threat to the integrity, confidentiality and availability of the system. Therefore, ensuring the security of Web application systems has become an important issue that needs to be solved urgently.

[0003] Although existing tools and methods have improved the security of Web application systems to a certain extent, there are still many shortcomings. Summary of the invention

[0004] The present invention aims at solving the above-mentioned deficiencies of the prior art and provides a highly practical method for detecting the effectiveness of security rules of a Web application system.

[0005] A further technical task of the present invention is to provide a device for detecting the validity of security rules of a Web application system that is reasonably designed and safe and applicable.

[0006] The technical solution adopted by the present invention to solve its technical problem is:

[0007] A method for detecting the effectiveness of security rules of a Web application system comprises the following steps:

[0008] S1. Write safety rules;

[0009] S2. Deploy the detection tool on the server where the detection system is located and modify the tool configuration items;

[0010] S3, read the JSON configuration file customized by the user in step S1, and parse the detection rules therein;

[0011] S4. The tool automatically detects the specified Web application system according to the parsed detection rules;

[0012] S5. The tool organizes the test results and outputs them to an Excel file in a structured manner;

[0013] S6. Understand the security status of the Web application system based on the generated Excel report.

[0014] Furthermore, in step S1, a JSON file is configured according to the security requirements of the business or company to define security detection rules, each rule including detection items, detection rule names, detection conditions and processing method fields.

[0015] Furthermore, in step S2, the server environment needs to install Java 8 and above, unzip the toolkit to the specified directory, modify the application.yml file, and set the relevant paths and parameters.

[0016] Further, in step S3, the tool is started by using the script run.bat or run.sh, or by using the command java-jar tool.jar. The tool reads the JSON configuration file customized by the user in step S1 and parses the detection rules therein.

[0017] Furthermore, in step S4, it further includes:

[0018] S4.1. Check whether the configuration file complies with the security rules, load the configuration file of the Web system, read the configuration attributes, and determine whether the configuration file complies with the requirements according to the security detection rules;

[0019] S4.2. Check whether the database connection complies with the security rules, load the database connection configuration file of the Web system, read the configuration information, and determine whether the database connection complies with the requirements according to the security detection rules;

[0020] S4.3. Check whether the dependent version complies with the security rules, obtain the dependent package version of the Web system, and determine whether the dependent version is safe according to the security detection rules;

[0021] S4.4. Check whether the system session timeout meets the security rules, load the session timeout configuration of the Web system, and determine whether the session timeout meets the requirements according to the security detection rules;

[0022] S4.5. Check whether the system filter complies with the security rules, load the filter configuration file of the Web system, read the configuration information, and determine whether the system filter complies with the requirements according to the security detection rules.

[0023] Furthermore, in step S5, the tool organizes the detection results and outputs them to an Excel file in a structured manner. The generated Excel report contains detection rules, detection results and recommended measures information.

[0024] Furthermore, in step S6, the user understands the security status of the Web application system based on the generated Excel report, focuses on the "failed" items, adjusts the configuration files, database settings or code dependencies according to the "suggested measures", and re-runs the detection tool.

[0025] A Web application system security rule validity detection device includes: at least one memory and at least one processor;

[0026] The at least one memory is used to store a machine-readable program;

[0027] The at least one processor is used to call the machine-readable program to execute a method for detecting the validity of security rules of a Web application system.

[0028] Compared with the prior art, the method and device for detecting the validity of security rules of a Web application system of the present invention have the following outstanding beneficial effects:

[0029] The present invention can realize flexible customization of detection rules, improve detection accuracy, and generate intuitive and easy-to-read detection reports. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Attached Figure 1 It is a flow chart of a method for detecting the effectiveness of security rules of a Web application system;

[0032] Attached Figure 2 It is a general architecture diagram of a method for detecting the effectiveness of security rules in a Web application system. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] A best embodiment is given below:

[0035] like Figure 1-2 As shown, a method for detecting the validity of security rules of a Web application system in this embodiment has the following steps:

[0036] S1. Write safety rules;

[0037] The rule configuration includes information such as the detection rule name, detection conditions, and processing methods.

[0038] Users can configure JSON files and define security detection rules based on their own business or company security requirements. Each rule contains detection items, detection rule names, detection conditions, and processing method fields.

[0039] An example of the configuration JSON file in this embodiment is as follows:

[0040] "ruleName":"Unsafe http response header, click hijacking vulnerability",

[0041] "checkMethod":[

[0042] "ruleType":"web.xml",

[0043] "content":[

[0044] "httpHeaderSecurity"

[0045] "fixSuggestion":"Modify the web.xml file and enable the httpHeaderSecurity filter".

[0046] S2. Deploy the detection tool on the server where the detection system is located and modify the tool configuration items;

[0047] The server environment needs to have Java 8 or above installed. After decompressing the tool package to the specified directory, modify the application.yml file and set the relevant paths and parameters.

[0048] S3, read the JSON configuration file customized by the user in step S1, and parse the detection rules therein;

[0049] Start the tool through the script run.bat (Windows) or run.sh (Linux), or start the tool through the command java-jartool.jar. The tool reads the JSON configuration file customized by the user in step S1 and parses the detection rules therein.

[0050] S4. The tool automatically detects the specified Web application system according to the parsed detection rules;

[0051] Further including:

[0052] S4.1. Check whether the configuration file complies with the security rules, load the configuration file of the Web system, read the configuration attributes, and determine whether the configuration file complies with the requirements according to the security detection rules;

[0053] For example, check the value of the server.timeout property in the application.properties file.

[0054] S4.2. Check whether the database connection complies with the security rules, load the database connection configuration file of the Web system, read the configuration information, and determine whether the database connection complies with the requirements according to the security detection rules;

[0055] For example, check whether the password in the datasource.properties file is encrypted.

[0056] S4.3. Check whether the dependent version complies with the security rules, obtain the dependent package version of the Web system, and determine whether the dependent version is safe according to the security detection rules;

[0057] For example, parse the dependent package version in the lib folder and check whether the version meets the security requirements.

[0058] S4.4. Check whether the system session timeout meets the security rules, load the session timeout configuration of the Web system, and determine whether the session timeout meets the requirements according to the security detection rules;

[0059] For example, whether session.timeout meets the defined timeout criteria.

[0060] S4.5. Check whether the system filter complies with the security rules, load the filter configuration file of the Web system, read the configuration information, and determine whether the system filter complies with the requirements according to the security detection rules.

[0061] For example, the filter configuration file web.xml verifies whether the filter complies with the set security rules.

[0062] S5. The tool organizes the test results and outputs them to an Excel file in a structured manner;

[0063] The generated Excel report contains information such as detection rules, detection results, and recommended measures.

[0064] S6. Understand the security status of the Web application system based on the generated Excel report;

[0065] Users can understand the security status of the Web application system based on the generated Excel report, focus on the "failed" items, and adjust the configuration files, database settings or code dependencies according to the "suggested measures". Re-run the detection tool to ensure that the problem has been resolved.

[0066] Based on the above method, a Web application system security rule validity detection device in this embodiment includes: at least one memory and at least one processor;

[0067] The at least one memory is used to store a machine-readable program;

[0068] The at least one processor is used to call the machine-readable program to execute a method for detecting the validity of security rules of a Web application system.

[0069] The above-mentioned specific implementations are only specific cases of the present invention. The patent protection scope of the present invention includes but is not limited to the above-mentioned specific implementations. Any technical solutions that comply with the claims of the present invention and any appropriate changes or substitutions made by ordinary technicians in the relevant technical field shall fall within the patent protection scope of the present invention.

[0070] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting the effectiveness of security rules of a Web application system, characterized in that: The steps are as follows: S1. Write safety rules; S2. Deploy the detection tool on the server where the detection system is located and modify the tool configuration items; S3, read the JSON configuration file customized by the user in step S1, and parse the detection rules therein; S4. The tool automatically detects the specified Web application system according to the parsed detection rules; S5. The tool organizes the test results and outputs them to an Excel file in a structured manner; S6. Understand the security status of the Web application system based on the generated Excel report.

2. A method for detecting the validity of security rules of a Web application system according to claim 1, characterized in that: In step S1, configure the JSON file according to your own business or company security requirements and define security detection rules. Each rule contains detection items, detection rule names, detection conditions, and processing method fields.

3. A method for detecting the validity of security rules of a Web application system according to claim 2, characterized in that: In step S2, the server environment needs to install Java 8 or above. After decompressing the toolkit to the specified directory, modify the application.yml file and set the relevant paths and parameters.

4. A method for detecting the validity of security rules of a Web application system according to claim 3, characterized in that: In step S3, the tool is started by using the script run.bat or run.sh, or by using the command java-jar tool.jar. The tool reads the JSON configuration file customized by the user in step S1 and parses the detection rules therein.

5. A method for detecting the validity of security rules of a Web application system according to claim 4, characterized in that: In step S4, further comprising: S4.

1. Check whether the configuration file complies with the security rules, load the configuration file of the Web system, read the configuration attributes, and determine whether the configuration file complies with the requirements according to the security detection rules; S4.

2. Check whether the database connection complies with the security rules, load the database connection configuration file of the Web system, read the configuration information, and determine whether the database connection complies with the requirements according to the security detection rules; S4.

3. Check whether the dependent version complies with the security rules, obtain the dependent package version of the Web system, and determine whether the dependent version is safe according to the security detection rules; S4.

4. Check whether the system session timeout meets the security rules, load the session timeout configuration of the Web system, and determine whether the session timeout meets the requirements according to the security detection rules; S4.

5. Check whether the system filter complies with the security rules, load the filter configuration file of the Web system, read the configuration information, and determine whether the system filter complies with the requirements according to the security detection rules.

6. A method for detecting the validity of security rules of a Web application system according to claim 5, characterized in that: In step S5, the tool organizes the detection results and outputs them to an Excel file in a structured manner. The generated Excel report contains detection rules, detection results and recommended measures information.

7. A method for detecting the validity of security rules of a Web application system according to claim 6, characterized in that: In step S6, the user understands the security status of the Web application system based on the generated Excel report, focuses on the "failed" items, adjusts the configuration files, database settings or code dependencies according to the "suggested measures", and re-runs the detection tool.

8. A Web application system security rule validity detection device, characterized in that: include: at least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is configured to call the machine-readable program to execute the method according to any one of claims 1 to 7.

Images