Website file tamper-proofing method and firewall

Abstract

The invention aims to provide a website file tamper-proofing method and a firewall system applying the method, for a web request of accessing a web server through a firewall, whether the request belongs to a tamper-proofing directory is judged according to url, if yes, a file pre-fetched to a local cache in advance is returned to a client, and otherwise, the request is directly sent to the server; therefore, even if a website tampering attack occurs, only the local cache file can be modified. According to the method, the local cache file is subjected to timing synchronization, through similarity comparison, the synchronized file is subjected to tamper-proof detection, alarms are provided even if tampering attacks are found, and corresponding requests and responses are blocked by the firewall, so that a real web server can be effectively protected, and the tamper-proof efficiency of a website is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of website server protection, and in particular relates to a method for preventing website files from being tampered with and a firewall system applying the method. Background Art

[0002] With the popularization and development of the Internet and network applications, network attacks have followed. Tampering with web page files is a common method of hacker attacks. Web page tampering attacks are often difficult to check in advance and prevent in real time, and it is difficult to trace the responsibility due to the complex network environment. The method of tampering with URLs to achieve the purpose of attack is popular with many attackers because of its simplicity and ready availability. It includes obtaining server permissions through remote injection or detection, remotely logging into the server, and adding, modifying, and deleting website pages or databases.

[0003] Under the existing technical conditions, although there are security devices such as firewalls and intrusion detection systems as security prevention measures, Web application attacks are still difficult to detect and can easily break through the protection of firewalls and intrusion detection systems. Simply relying on traditional network security devices such as firewalls and intrusion detection systems cannot effectively prevent web page tampering attacks. For this reason, web page anti-tampering technology has become one of the focuses of research in the security field.

[0004] The anti-tampering system protects the safe operation of websites, maintains the image of governments and enterprises, ensures the normal operation of Internet businesses, and effectively solves the problem of illegal modification of websites. Summary of the invention

[0005] Based on the above background, the present invention aims to provide a website file tamper-proof method and a firewall system using the method, which prevents tampering of website server files through proxy technology.

[0006] The technical solution of the embodiment of the present invention includes two parts, the specific contents are as follows: On the one hand, a method for preventing website files from being tampered with is provided, comprising: Determine whether the website access request belongs to the preset tamper protection directory. If so, retrieve the corresponding file from the local cache to respond to the request. Otherwise, forward the request to the website server for response and add the server's response page file to the local cache. The tampering protection directory includes website URLs that are configured as protected status; for websites belonging to the tampering protection directory, the website files are pre-fetched from the server to the local cache every first cycle, the cache files are synchronously updated every second cycle, and the synchronized files are compared and detected with the historical cache files every third cycle. If the file changes exceed a preset threshold, it is determined that the website files have been tampered with.

[0007] Preferably, the first period>the third period≧the second period, and the third period is an integer multiple of the second period.

[0008] Furthermore, the synchronized file is compared with the local cache file, including comparing the similarity between the two. When it exceeds a preset threshold, it indicates that the web page content has changed, and it is determined whether the web page content has been tampered with based on the similarity level.

[0009] The above similarity comparison includes using the simhash algorithm to calculate the Hamming distance between the cache file and the synchronization file.

[0010] Furthermore, file read and write operations are intercepted for the site directory of the website belonging to the tampering protection directory. When the operated file belongs to a protected object, all file modification operations except for file operations in the exception directory and trusted processes are blocked and an alarm is issued.

[0011] Preferably, the website, exception directory, and trusted process of the tampering protection directory are used as protection strategies, and when the operation on the website triggers the protection strategy, it is blocked and an alarm is issued.

[0012] Preferably, before file tampering prevention, website server files are crawled to local cache every first cycle, and the first pre-fetched website content is used as a baseline for comparison with subsequent pre-fetched content; and before performing file pre-fetching in the subsequent first cycle, the files pre-fetched in the previous first cycle are cleared.

[0013] The website files are pre-fetched from the server to the local cache every first cycle, and the crawled data is stored in a preset file directory using a python crawler. The file directory name is "site ip + site port". The crawled data is controlled by crawling depth, media type, and single file size.

[0014] On the other hand, a file tamper-proof firewall system includes: The tamper protection module processes user requests and returns cached files or sends them to the server based on whether the URL is in the tamper protection directory. A file pre-fetching module, which periodically pre-fetches files from the website server and caches them locally in response to user requests to the protected website; The file synchronization module synchronizes cache files with the website regularly to ensure the update of cache files; The tampering detection module compares the synchronized files with the historical cache files and determines whether the server files have been tampered with based on the file similarity.

[0015] Preferably, the tampering detection module pre-fetches website files from the server to the local cache for websites belonging to the tampering protection directory every first cycle, synchronously updates the cache files every second cycle, and compares the synchronized files with the historical cache files every third cycle. If the file changes exceed a preset threshold, it is determined that the website files have been tampered with.

[0016] The embodiment of the present invention adopting the above technical solution has at least the following beneficial effects: for a web request that passes through a firewall to access a web server, it is determined whether the request belongs to a tampering protection directory based on the URL. If it does, the file pre-fetched to the local cache is returned to the client, otherwise the request is directly sent to the server; therefore, even if a website tampering attack occurs, only the local cache file can be modified. The locally cached files are synchronized regularly, and the synchronized files are tested for tampering through similarity comparison. Even if a tampering attack is found, an alarm is provided, and the corresponding request and response are blocked by the firewall, which can effectively protect the real web server and improve the efficiency of website tampering prevention. Implementation

[0017] To facilitate understanding, firstly, the technical terms involved in the embodiments of the present invention and their meanings are briefly explained.

[0018] Reverse proxy means that the website server uses the proxy server to provide services to users. When a user visits a website, the request is first transmitted to the proxy server. After a series of processing by the proxy server, the request is sent to the destination website; the information returned by the website is also transmitted to the user by the proxy server. This is a method to simplify or control the complexity of requests, and also provides additional benefits, such as load balancing, privacy or security.

[0019] The reverse proxy hides the real server. For example, when you request http: / / www.baidu.com, there are actually thousands of servers providing response services. The job of the reverse proxy server is to receive access requests and forward them to the real server. The commonly used ngnix is ​​a high-performance reverse proxy server that can be used to achieve load balancing of multiple servers.

[0020] For some websites, in order to quickly respond to user requests, shared cache is usually used, that is, a web proxy gateway is set between the user-side device and the website server, and the web proxy gateway caches the web page files on the website server. The page request from the user side first reaches the proxy gateway, and the proxy gateway queries whether the page file corresponding to the page request exists in the cache. If it exists in the cache, the cache file is directly returned to the client. If it does not exist in the cache, the proxy gateway obtains the page file from the website server and returns it to the client, and caches the page file. In this way, the gateway can directly return the page file in the cache when the next request is made.

[0021] In order to make the objectives, technical solutions and advantages of the embodiments of the present invention more clear, the present application is further described in detail below in conjunction with the embodiments.

[0022] It should be understood that the specific embodiments described herein are only used to explain the relevant contents of the present application, rather than to limit the application.

[0023] Methods for preventing website files from being tampered with include: Determine whether the website access request belongs to the preset tamper protection directory. If so, retrieve the corresponding file from the local cache to respond to the request. Otherwise, forward the request to the website server for response and add the server's response page file to the local cache. The tampering protection directory includes website URLs that are configured as protected status; for websites belonging to the tampering protection directory, the website files are pre-fetched from the server to the local cache every first cycle, the cache files are synchronously updated every second cycle, and the synchronized files are compared and detected with the historical cache files every third cycle. If the file changes exceed a preset threshold, it is determined that the website files have been tampered with.

[0024] As a preferred implementation, the first period>the third period≧the second period, and the third period is an integer multiple of the second period.

[0025] Furthermore, the synchronized file is compared with the local cache file, including comparing the similarity between the two. When it exceeds a preset threshold, it indicates that the web page content has changed, and it is determined whether the web page content has been tampered with based on the similarity level.

[0026] The above-mentioned similarity comparison includes using the simhash algorithm to calculate the Hamming distance between the cache file and the synchronization file. When the Hamming distance between the two exceeds a specified threshold, it is determined that tampering has occurred.

[0027] Furthermore, file read and write operations are intercepted for the site directory of the website belonging to the tampering protection directory. When the operated file belongs to a protected object, all file modification operations except for file operations in the exception directory and trusted processes are blocked and an alarm is issued.

[0028] As a preferred implementation, the website, exception directory, and trusted process of the tampering protection directory are used as protection strategies. When the operation on the website triggers the protection strategy, it is blocked and an alarm is issued.

[0029] Preferably, before file tampering prevention, website server files are crawled to local cache every first cycle, and the first pre-fetched website content is used as a baseline for comparison with subsequent pre-fetched content; and before performing file pre-fetching in the subsequent first cycle, the files pre-fetched in the previous first cycle are cleared.

[0030] The website files are pre-fetched from the server to the local cache every first cycle, and the crawled data is stored in a preset file directory using a python crawler. The file directory name is "site ip + site port". The crawled data is controlled by crawling depth, media type, and single file size.

[0031] On the other hand, a file tamper-proof firewall system includes: The tamper protection module processes user requests and returns cached files or sends them to the server based on whether the URL is in the tamper protection directory. A file pre-fetching module, which periodically pre-fetches files from the website server and caches them locally in response to user requests to the protected website; The file synchronization module synchronizes cache files with the website regularly to ensure the update of cache files; The tampering detection module compares the synchronized files with the historical cache files and determines whether the server files have been tampered with based on the file similarity.

[0032] As a preferred implementation, the tampering detection module pre-fetches website files from the server to the local cache for websites belonging to the tampering protection directory every first cycle, synchronously updates the cache files every second cycle, and compares the synchronized files with the historical cache files every third cycle. If the file changes exceed a preset threshold, it is determined that the website file has been tampered with.

[0033] According to the technical solution of the embodiment of the present invention described above, for a web request that passes through a firewall to access a web server, it is determined whether the request belongs to a tampering protection directory based on the URL. If it does, the file pre-fetched to the local cache is returned to the client, otherwise the request is directly sent to the server; therefore, even if a website tampering attack occurs, only the local cache file can be modified. The locally cached files are synchronized regularly, and the synchronized files are tested for tampering through similarity comparison. Even if a tampering attack is found, an alarm is provided, and the corresponding request and response are blocked by the firewall, which can effectively protect the real web server and improve the efficiency of website tampering prevention.

[0034] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0035] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.

Claims

1. A method for preventing website files from being tampered with, characterized in that: include: Determine whether the website access request belongs to the preset tamper protection directory. If so, retrieve the corresponding file from the local cache to respond to the request. Otherwise, forward the request to the website server for response and add the server's response page file to the local cache. The tampering protection directory includes website URLs that are configured as protected status; for websites belonging to the tampering protection directory, the website files are pre-fetched from the server to the local cache every first cycle, the cache files are synchronously updated every second cycle, and the synchronized files are compared and detected with the historical cache files every third cycle. If the file changes exceed a preset threshold, it is determined that the website files have been tampered with.

2. The anti-tampering method according to claim 1, characterized in that: The first period>the third period≧the second period, and the third period is an integer multiple of the second period.

3. The anti-tampering method according to claim 1, characterized in that: The synchronization file is compared with the local cache file, including comparing the similarity between the two. When it exceeds a preset threshold, it indicates that the web page content has changed, and it is determined whether the web page content has been tampered with based on the similarity level.

4. The anti-tampering method according to claim 3, characterized in that: The similarity comparison includes using a simhash algorithm to calculate the Hamming distance between the cache file and the synchronization file.

5. The anti-tampering method according to claim 4, characterized in that: The file read and write operations of the site directory of the website belonging to the tampering protection directory are intercepted. When the operated file belongs to the protected object, all file modification operations except the file operations of the exception directory and the trusted process are blocked and an alarm is issued.

6. The anti-tampering method according to claim 1, characterized in that: The website, exception directory, and trusted process of the tampering protection directory are used as protection strategies. When the operation on the website triggers the protection strategy, it is blocked and an alarm is issued.

7. The anti-tampering method according to claim 1, characterized in that: Before file tampering prevention, the website server files are crawled to the local cache every first cycle, and the website content pre-fetched for the first time is used as the baseline for comparison with the subsequent pre-fetched content; and before performing file pre-fetching in the subsequent first cycle, the files pre-fetched in the previous first cycle are cleared.

8. The anti-tampering method according to claim 7, characterized in that: The website files are pre-fetched from the server to the local cache every first cycle, and the crawled data is stored in a preset file directory using a python crawler. The file directory name is "site ip + site port"; the crawled data is controlled by crawling depth, media type, and single file size.

9. A file tamper-proof firewall system, characterized in that: include: The tamper protection module processes user requests and returns cached files or sends them to the server based on whether the URL is in the tamper protection directory. A file pre-fetching module, which periodically pre-fetches files from the website server and caches them locally in response to user requests to the protected website; The file synchronization module synchronizes cache files with the website regularly to ensure the update of cache files; The tampering detection module compares the synchronized files with the historical cache files and determines whether the server files have been tampered with based on the file similarity.

10. The firewall system according to claim 9, characterized in that: The tampering detection module pre-fetches website files from the server to the local cache for websites belonging to the tampering protection directory every first cycle, synchronously updates the cache files every second cycle, and compares the synchronized files with the historical cache files every third cycle. If the file changes exceed a preset threshold, it is determined that the website file has been tampered with.