Cross-site script XSS attack processing method, device, equipment, medium and program

Abstract

The invention discloses a cross-site script (XSS) attack processing method, device, equipment, medium and program, which are executed by a browser client and applied to the field of financial science and technology. The method comprises the following steps: acquiring a request description feature associated with an XSS attack contained in an application access request; inputting the request description feature into a pre-trained attack monitoring model, and performing XSS attack monitoring on the target Web application; if the XSS attack is identified, intercepting access of a user to the target Web application, and acquiring historical cache data for the target Web application in local cache data; and when it is predicted that the user is suffered from the XSS attack, carrying out risk prompting on the user. According to the embodiment of the invention, through measures such as real-time monitoring, accurate identification, active interception and intelligent risk prompt, the security protection capability of the Web application is remarkably improved, and a safer and more reliable network environment is provided for a user.

Description

Technical Field

[0001] The present invention is applicable to the field of financial technology, and in particular relates to a cross-site scripting (XSS) attack processing method, device, equipment, medium and program. Background Art

[0002] XSS attack (Cross Site Scripting) is a common web application security vulnerability that can endanger user data security and privacy by injecting malicious scripts into web pages. Traditional XSS detection methods are often based on rules or pattern matching, but these methods face many limitations, such as poor adaptability to new attack patterns, high false positive rates, and challenges that are easily circumvented by attackers.

[0003] At present, with the widespread application of machine learning, the application of machine learning in the field of network security has also achieved certain results. However, traditional machine learning algorithms are affected by factors such as uneven data distribution, improper feature selection, and attackers' avoidance strategies when dealing with XSS attack detection. As a result, it is difficult for machine learning models to fully learn attack features during training, resulting in missed detections or false detections, affecting detection accuracy. Summary of the invention

[0004] Based on this, the present invention provides a cross-site scripting (XSS) attack processing method, device, equipment, medium and program to solve the problem that traditional machine learning algorithms are easily affected by external factors when detecting XSS attacks, resulting in low result accuracy.

[0005] In a first aspect, an embodiment of the present invention provides a method for processing a cross-site scripting (XSS) attack, the method comprising:

[0006] When an application access request for a target Web application is detected, obtaining a request description feature associated with an XSS attack contained in the application access request;

[0007] Input the request description feature into a pre-trained XSS attack monitoring model to perform XSS attack monitoring on the target Web application;

[0008] If an XSS attack is identified, the user's access to the target Web application is intercepted, and historical cache data for the target Web application is obtained from the local cache data;

[0009] When it is predicted based on the historical cache data that the user has been victimized by an XSS attack, a risk warning is provided to the user.

[0010] In a second aspect, an embodiment of the present invention provides a cross-site scripting (XSS) attack processing device, the device comprising:

[0011] A feature acquisition module, used for acquiring, when an application access request for a target Web application is detected, a request description feature associated with an XSS attack contained in the application access request;

[0012] An attack detection module, used to input the request description features into a pre-trained XSS attack monitoring model to perform XSS attack monitoring on the target Web application;

[0013] A cache acquisition module, for intercepting the user's access to the target Web application if an XSS attack is identified, and acquiring historical cache data for the target Web application from the local cache data;

[0014] The risk warning module is used to provide a risk warning to the user when it is predicted based on the historical cache data that the user has been harmed by an XSS attack.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a cross-site scripting (XSS) attack processing method described in any embodiment of the present invention.

[0019] In a fourth aspect, a computer-readable storage medium is also provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a cross-site scripting (XSS) attack processing method described in any embodiment of the present invention when executed.

[0020] In a fifth aspect, a computer program product is also provided, which includes a computer program, and when the computer program is executed by a processor, it implements a cross-site scripting (XSS) attack processing method described in any embodiment of the present invention.

[0021] The technical solution of the embodiment of the present invention can quickly obtain the request description features associated with the XSS attack contained in the request, ensuring that the system can monitor the attack at the early stage, thereby effectively shortening the response time and improving the efficiency of security protection; at the same time, by obtaining the historical cache data for the target Web application in the local cache data, the method can provide users with additional security protection to prevent attackers from using historical data for malicious operations; risk warnings can not only help users realize potential security risks in a timely manner, but also guide users to take necessary protective measures. The embodiment of the present invention significantly improves the security protection capabilities of Web applications through effective measures such as real-time monitoring, accurate identification, active interception, and intelligent risk warnings, providing users with a more secure and reliable network environment.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 This is a flowchart of a method for processing a cross-site scripting (XSS) attack provided in accordance with Embodiment 1 of the present invention;

[0025] Figure 2 is a flowchart of another cross-site scripting (XSS) attack processing method provided according to the second embodiment of the present invention;

[0026] Figure 3 2 is a schematic diagram of the structure of a cross-site scripting (XSS) attack processing device provided according to Embodiment 3 of the present invention;

[0027] Figure 4 It is a structural schematic diagram of an electronic device according to a cross-site scripting (XSS) attack processing method provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] Figure 1 This is a flow chart of a method for processing a cross-site scripting (XSS) attack provided in the first embodiment of the present invention. This embodiment is applicable to the situation of real-time monitoring and defense against cross-site scripting attacks. The method can be executed by a device for processing cross-site scripting (XSS) attacks. The device can be implemented in the form of hardware and / or software. The device can be configured in a bank device or system including a browser client. Figure 1 As shown, the method includes:

[0032] S110. When an application access request for a target Web application is detected, a request description feature associated with an XSS attack contained in the application access request is obtained.

[0033] XSS attack (Cross Site Scripting) is a common web security vulnerability. Attackers use this vulnerability to inject malicious scripts into the browser client application, thereby executing the script in the user's browser. This attack can allow attackers to steal users' sensitive information (such as cookies, session tokens, etc.), tamper with web page content, redirect users to malicious websites, etc.

[0034] The application access request is the trigger condition for the browser client to execute the processing method, and the request description characteristics may include request parameters, user input information, and web page address, etc. The above data are all information that may be used by XSS attackers, so they will be input into the XSS attack monitoring model for further analysis in subsequent steps.

[0035] S120: Input the request description feature into a pre-trained XSS attack monitoring model to perform XSS attack monitoring on the target Web application.

[0036] The pre-trained XSS attack monitoring model is built based on machine learning and has been trained with a large number of XSS attack data sets and non-attack data sets to learn the feature recognition of XSS attacks. The model can further determine whether the current application request carries an XSS attack.

[0037] Optionally, before inputting the request description feature into the pre-trained XSS attack monitoring model, the following steps may also be included:

[0038] Collecting XSS attack data sets and non-attack data sets, and performing data cleaning, feature extraction, and feature engineering on the XSS attack data sets and non-attack data sets to obtain the pre-processed XSS attack data sets and non-attack data sets;

[0039] Extracting sample description features associated with XSS attacks from the preprocessed XSS attack data set and non-attack data set respectively;

[0040] The machine learning model constructed based on the support vector machine algorithm is trained using the sample description features to obtain an XSS attack monitoring model; wherein an attention mechanism module is pre-added to the feature extraction layer of the machine learning model.

[0041] In order to train a machine learning model that can accurately identify XSS attacks, two types of data need to be collected in advance. One is the attack data set containing XSS attack instances, and the other is the normal request data that does not contain attacks, that is, the non-attack data set. The above data sets usually come from actual Web application access logs, security test data or public XSS attack sample libraries.

[0042] Data cleaning is used to remove noise and redundant information in the data set, such as invalid characters, duplicate records, etc., to ensure the quality and consistency of the data set; feature extraction is used to extract features useful for identifying XSS attacks from the cleaned data set. The features can reflect the behavioral patterns of XSS attacks, such as request parameters, user input information, web page addresses, etc.; feature engineering refers to further processing and optimization of the extracted features, such as standardization, normalization or encoding, to improve the performance and accuracy of the machine learning model.

[0043] Support vector machine (SVM) is a widely used machine learning algorithm, especially suitable for classification tasks. In an embodiment of the present invention, the sample description features extracted above are used as input to train the machine learning model built based on the SVM algorithm. During the training process, the model will learn how to distinguish between XSS attack and non-attack samples, and establish corresponding classification boundaries. In the XSS attack monitoring model, by pre-adding an attention mechanism module to the feature extraction layer, the model can pay more attention to feature information closely related to XSS attacks during the training process, and ignore unimportant noise information. In this way, the constructed XSS attack monitoring model can more accurately identify XSS attacks in practical applications, improve the accuracy and robustness of detection, and thus ensure the security of Web applications and the privacy of user data.

[0044] Furthermore, the sample description features or request description features associated with the XSS attack may include:

[0045] Request parameters, user input information, and web page addresses in application access requests;

[0046] Using the sample description features, a machine learning model built based on a support vector machine algorithm is trained to obtain an XSS attack monitoring model, which may specifically include:

[0047] Based on the preset cross-validation technology, the machine learning model is trained and tested multiple times to obtain an XSS attack monitoring model with preset model performance indicators.

[0048] Request parameters are data submitted to the server by users through URLs or forms when accessing Web applications. These data may contain sensitive information and may be used by attackers to construct malicious requests. For example, the username and password submitted by users when logging in, or the query conditions submitted when querying a database, etc. Attackers may inject malicious scripts by tampering with request parameters to attack users. User input information can be keywords entered by users in the search box or personal information filled in the form. The above input information may be used by attackers to inject malicious scripts through reflective or stored XSS attacks to attack users. URL is the unique identifier for users to access Web resources. Attackers may inject malicious scripts by tampering with parameters in the URL, or attack by inducing users to visit URLs containing malicious scripts.

[0049] As a binary classification model, the essential idea of ​​support vector machine (SVM) is to find a hyperplane to separate samples of different categories. In XSS attack detection, SVM can be used to distinguish normal requests from malicious requests. Cross-validation is a commonly used model evaluation method. It divides the data set into training sets and test sets, trains and tests the model multiple times to evaluate the performance and stability of the model. In XSS attack detection, methods such as k-fold cross-validation can be used. First, divide the data set into k subsets; second, select k-1 subsets as training sets each time, and the remaining subset as the test set; finally, repeat this process k times, select a different subset as the test set each time, and evaluate the performance of the model by calculating indicators such as the average accuracy of k tests.

[0050] Among them, the preset model performance indicators may include accuracy, recall rate, F1 score, etc.

[0051] By collecting data sets that include various possible attack scenarios and normal access scenarios, a rich data foundation is provided for the training of machine learning models. The introduced attention mechanism can dynamically adjust the model's weights for different features, thereby more accurately identifying potential XSS attacks in a complex and changing network environment, and enhancing the model's ability to capture key information.

[0052] S130: If an XSS attack is identified, intercept the user's access to the target Web application, and obtain historical cache data for the target Web application from the local cache data.

[0053] If the XSS attack monitoring model identifies that the current application access request does contain an XSS attack, the browser client will immediately intercept the user's access to the target Web application to prevent the attack from being successfully executed. At the same time, in order to more comprehensively evaluate the user's security status, the browser client will search and obtain the historical cache data related to the target Web application in the local cache data. This data may include various information when the user previously visited the Web application, such as historical access records, user behavior, etc.

[0054] S140: When it is predicted based on the historical cache data that the user has been victimized by an XSS attack, a risk warning is provided to the user.

[0055] With the historical cache data, the system can further analyze the data to predict whether the user has been harmed by an XSS attack. This prediction may be based on a variety of factors, such as the user's historical access frequency to the target Web application within the effective historical monitoring time interval, the specific actions performed by the user (especially privacy actions, such as logging in, entering private information, and making payments), and whether these actions match known XSS attack patterns.

[0056] If the prediction results show that the user has been victimized by an XSS attack, the system will issue a risk warning to the user, informing them of the security threats they may face, and recommending that they take appropriate protective measures, such as changing their login password, payment password, etc., and installing or updating network defense software.

[0057] Optionally, providing risk warning to the user according to the behavior type of the privacy behavior may include:

[0058] If the behavior type of the privacy behavior is a user login behavior, obtaining at least one login account matching the login behavior, and prompting the user to modify the login password of each login account;

[0059] If the behavior type of the privacy behavior is the input behavior of user privacy information, obtaining the type of user privacy information input by the user, and providing the user with a privacy leakage prompt of the type of user privacy information;

[0060] If the behavior type of the privacy behavior is a payment behavior, the user is prompted to change the payment password.

[0061] The embodiment of the present invention describes the specific steps of how to provide risk warnings to users based on their privacy behavior types when the system predicts that the user has been harmed by an XSS attack, where the privacy behavior includes user login behavior, user privacy information input behavior, and payment behavior. By providing targeted warnings based on the privacy behavior types, users can have a clearer understanding of the risks they face, and can take timely measures to protect their accounts and information security.

[0062] Furthermore, after providing risk warning to the user according to the behavior type of the privacy behavior, the method may further include:

[0063] At least one network defense software is determined according to the behavior type of the privacy behavior, and installation prompts for each network defense software are provided to the user.

[0064] In the embodiment of the present invention, after the risk warning, a guidance for security defense measures is also provided, that is, at least one network defense software is determined according to the behavior type of the privacy behavior, and the installation prompt of each network defense software is provided to the user. This not only helps the user to take security measures in time to protect their information security, but also guides the user to understand and use more network security defense means, and enhances the user's information security protection ability.

[0065] The embodiment of the present invention can quickly obtain the request description features associated with the XSS attack contained in the request, ensuring that the system can monitor the attack at the early stage, thereby effectively shortening the response time and improving the efficiency of security protection; at the same time, by obtaining the historical cache data for the target Web application in the local cache data, the method can provide users with additional security protection to prevent attackers from using historical data for malicious operations; risk warnings can not only help users realize potential security risks in a timely manner, but also guide users to take necessary protective measures. The embodiment of the present invention significantly improves the security protection capabilities of Web applications through effective measures such as real-time monitoring, accurate identification, active interception, and intelligent risk warnings, providing users with a more secure and reliable network environment.

[0066] Embodiment 2

[0067] Figure 2 Flow chart of another cross-site scripting XSS attack processing method provided in Embodiment 2 of the present invention. This embodiment is refined based on the above embodiment. Correspondingly, Figure 2 As shown, the method specifically includes:

[0068] S210: When an application access request for a target Web application is detected, a request description feature associated with an XSS attack contained in the application access request is obtained.

[0069] S220: Input the request description feature into a pre-trained XSS attack monitoring model to perform XSS attack monitoring on the target Web application.

[0070] S230: If an XSS attack is identified, intercept the user's access to the target Web application, and obtain historical cache data for the target Web application from the local cache data.

[0071] S240. Obtain a valid historical monitoring time interval according to the current system time.

[0072] The effective historical monitoring time interval is a time period traced back from the current system time. This time period is considered to be a time range with reference value for analyzing whether a user has suffered from XSS attack. The specific time length can be pre-configured based on various factors such as the characteristics of the XSS attack and user behavior patterns.

[0073] S250: Detect, according to the historical cache data, the historical access frequency of the user to the target Web application within the effective historical monitoring time interval.

[0074] After determining the effective historical monitoring time interval, it is necessary to analyze the user's access records to the target Web application during this time period. The access records are usually saved in the historical cache data. By analyzing these records, the system can calculate the frequency of users accessing the target Web application during this time period, that is, the historical access frequency, which is an important indicator for evaluating whether the user has been harmed by XSS attacks.

[0075] S260: If the historical access frequency exceeds a preset frequency threshold, continue to identify various user behaviors performed by the user on the target Web application within the effective historical monitoring time interval.

[0076] S270: If it is determined that the user behavior includes privacy behavior, it is predicted that the user has been harmed by an XSS attack.

[0077] Exceeding the preset frequency threshold means that the user's account or device is being accessed frequently, which may be a sign of an XSS attack. Therefore, it is necessary to further analyze the various behaviors performed by the user within the above effective historical monitoring time interval to more accurately determine whether the user has been harmed by an XSS attack. After identifying the behaviors performed by the user within the effective historical monitoring time interval, the system will determine whether these behaviors contain privacy behaviors. Privacy behaviors usually refer to those that may involve user sensitive information or user privacy, such as logging into an account, entering personal privacy information, making payments, etc. If privacy behaviors are detected in the above behaviors, it is predicted that the user may have been harmed by an XSS attack.

[0078] S280: Prompt the user for a risk based on the type of the privacy behavior.

[0079] After determining that the user may have been victimized by an XSS attack, a risk warning will be provided based on the specific type of privacy behavior performed by the user. The purpose of the risk warning is to make the user aware that their account or device may be in an unsafe state and take appropriate measures to protect their privacy and security. If the privacy behavior performed by the user is to log in to the account, the user can be prompted to change the login password; if the user enters personal privacy information, the user can be reminded to pay attention to the leakage of privacy information; if the user makes a payment, the user can be prompted to change the payment password.

[0080] The technical solution of the embodiment of the present invention, by refining the overall solution, focuses on how to predict whether a user is harmed by an XSS attack. Specifically, by obtaining an effective historical monitoring time interval, the system can focus on the user's recent interaction with the target Web application, thereby quickly identifying abnormal access patterns based on historical access frequencies, and providing timely basis for subsequent risk warnings. The risk warning process provides targeted risk warnings and security defense measures guidance by timely and accurately identifying the user's abnormal access behavior and privacy behavior, effectively improving the user's information security level.

[0081] Embodiment 3

[0082] Figure 3 A schematic diagram of the structure of a cross-site scripting (XSS) attack processing device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0083] The feature acquisition module 310 is used to acquire the request description feature associated with the XSS attack contained in the application access request when an application access request for the target Web application is detected;

[0084] An attack detection module 320, used to input the request description feature into a pre-trained XSS attack monitoring model to perform XSS attack monitoring on the target Web application;

[0085] The cache acquisition module 330 is used to intercept the user's access to the target Web application if an XSS attack is identified, and obtain the historical cache data for the target Web application from the local cache data;

[0086] The risk warning module 340 is used to provide a risk warning to the user when it is predicted based on the historical cache data that the user has been harmed by an XSS attack.

[0087] The embodiment of the present invention can quickly obtain the request description features associated with the XSS attack contained in the request, ensuring that the system can monitor the attack at the early stage, thereby effectively shortening the response time and improving the efficiency of security protection; at the same time, by obtaining the historical cache data for the target Web application in the local cache data, the method can provide users with additional security protection to prevent attackers from using historical data for malicious operations; risk warnings can not only help users realize potential security risks in a timely manner, but also guide users to take necessary protective measures. The embodiment of the present invention significantly improves the security protection capabilities of Web applications through effective measures such as real-time monitoring, accurate identification, active interception, and intelligent risk warnings, providing users with a more secure and reliable network environment.

[0088] Optionally, on the basis of the above embodiments, it further includes an attack monitoring model construction unit, which is used to collect XSS attack data sets and non-attack data sets before inputting the request description features into the pre-trained XSS attack monitoring model, and perform data cleaning, feature extraction and feature engineering on the XSS attack data sets and non-attack data sets to obtain the pre-processed XSS attack data sets and non-attack data sets;

[0089] Extracting sample description features associated with XSS attacks from the preprocessed XSS attack data set and non-attack data set respectively;

[0090] The machine learning model constructed based on the support vector machine algorithm is trained using the sample description features to obtain an XSS attack monitoring model; wherein an attention mechanism module is pre-added to the feature extraction layer of the machine learning model.

[0091] Optionally, based on the above embodiments, in the attack monitoring model construction unit, the sample description features or request description features associated with the XSS attack may include:

[0092] Request parameters, user input information, and web page addresses in application access requests;

[0093] Using the sample description features, a machine learning model built based on a support vector machine algorithm is trained to obtain an XSS attack monitoring model, which may specifically include:

[0094] Based on the preset cross-validation technology, the machine learning model is trained and tested multiple times to obtain an XSS attack monitoring model with preset model performance indicators.

[0095] Optionally, based on the above embodiments, the risk warning module 340 may further include:

[0096] A time interval acquisition unit, used to acquire a valid historical monitoring time interval according to the current system time;

[0097] An access frequency detection unit, configured to detect the historical access frequency of the user to the target Web application within the effective historical monitoring time interval according to the historical cache data;

[0098] A user behavior identification unit, configured to continue to identify various user behaviors performed by the user on the target Web application within the effective historical monitoring time interval if the historical access frequency exceeds a preset frequency threshold;

[0099] A privacy behavior identification unit, configured to predict that the user has been harmed by an XSS attack if it is determined that the user behavior contains privacy behavior;

[0100] A behavior type determination unit is used to provide risk warning to the user according to the behavior type of the privacy behavior.

[0101] Optionally, based on the above embodiments, the behavior type determination unit may also be used to, if the behavior type of the privacy behavior is a user login behavior, obtain at least one login account matching the login behavior, and prompt the user to modify the login password of each login account;

[0102] If the behavior type of the privacy behavior is the input behavior of user privacy information, obtaining the type of user privacy information input by the user, and providing the user with a privacy leakage prompt of the type of user privacy information;

[0103] If the behavior type of the privacy behavior is a payment behavior, the user is prompted to change the payment password.

[0104] Optionally, based on the above embodiments, it also includes a defense prompt unit, which is used to determine at least one network defense software according to the behavior type of the privacy behavior after issuing a risk prompt to the user according to the behavior type of the privacy behavior, and provide the user with installation prompts for each network defense software.

[0105] A cross-site scripting (XSS) attack processing device provided in an embodiment of the present invention can execute a cross-site scripting (XSS) attack processing method provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0106] Embodiment 4

[0107] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0108] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0109] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0110] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a cross-site scripting XSS attack processing method.

[0111] That is, when an application access request for a target Web application is detected, a request description feature associated with an XSS attack contained in the application access request is obtained;

[0112] Input the request description feature into a pre-trained XSS attack monitoring model to perform XSS attack monitoring on the target Web application;

[0113] If an XSS attack is identified, the user's access to the target Web application is intercepted, and historical cache data for the target Web application is obtained from the local cache data;

[0114] When it is predicted based on the historical cache data that the user has been victimized by an XSS attack, a risk warning is provided to the user.

[0115] In some embodiments, a cross-site scripting XSS attack processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the cross-site scripting XSS attack processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute a cross-site scripting XSS attack processing method in any other appropriate manner (e.g., by means of firmware).

[0116] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0117] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0118] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0119] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0120] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0121] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0122] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0123] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing a cross-site scripting (XSS) attack, characterized in that: Executed by a browser client, the method includes: When an application access request for a target Web application is detected, obtaining a request description feature associated with an XSS attack contained in the application access request; Input the request description feature into a pre-trained XSS attack monitoring model to perform XSS attack monitoring on the target Web application; If an XSS attack is identified, the user's access to the target Web application is intercepted, and historical cache data for the target Web application is obtained from the local cache data; When it is predicted based on the historical cache data that the user has been victimized by an XSS attack, a risk warning is provided to the user.

2. The method according to claim 1, characterized in that Before inputting the request description feature into the pre-trained XSS attack monitoring model, the method further includes: Collecting XSS attack data sets and non-attack data sets, and performing data cleaning, feature extraction, and feature engineering on the XSS attack data sets and non-attack data sets to obtain the pre-processed XSS attack data sets and non-attack data sets; Extracting sample description features associated with XSS attacks from the preprocessed XSS attack data set and non-attack data set respectively; The machine learning model constructed based on the support vector machine algorithm is trained using the sample description features to obtain an XSS attack monitoring model; wherein an attention mechanism module is pre-added to the feature extraction layer of the machine learning model.

3. The method according to claim 2, characterized in that The sample description features or request description features associated with the XSS attack include: Request parameters, user input information, and web page addresses in application access requests; The machine learning model constructed based on the support vector machine algorithm is trained using the sample description features to obtain an XSS attack monitoring model, which specifically includes: Based on the preset cross-validation technology, the machine learning model is trained and tested multiple times to obtain an XSS attack monitoring model with preset model performance indicators.

4. The method according to any one of claims 1 to 3, characterized in that: When it is predicted based on the historical cache data that the user has been harmed by an XSS attack, a risk warning is provided to the user, including: According to the current system time, obtain the effective historical monitoring time interval; Detecting, according to the historical cache data, the historical access frequency of the user to the target Web application within the effective historical monitoring time interval; If the historical access frequency exceeds a preset frequency threshold, continue to identify various user behaviors performed by the user on the target Web application within the effective historical monitoring time interval; If it is determined that the user behavior contains privacy behavior, it is predicted that the user has been harmed by an XSS attack; Providing a risk warning to the user based on the behavior type of the privacy behavior.

5. The method according to claim 4, characterized in that Providing risk warnings to the user based on the type of privacy behavior, including: If the behavior type of the privacy behavior is a user login behavior, obtaining at least one login account matching the login behavior, and prompting the user to modify the login password of each login account; If the behavior type of the privacy behavior is the input behavior of user privacy information, obtaining the type of user privacy information input by the user, and providing the user with a privacy leakage prompt of the type of user privacy information; If the behavior type of the privacy behavior is a payment behavior, the user is prompted to change the payment password.

6. The method according to claim 5, characterized in that After providing risk warning to the user according to the behavior type of the privacy behavior, the method further includes: At least one network defense software is determined according to the behavior type of the privacy behavior, and installation prompts for each network defense software are provided to the user.

7. A cross-site scripting (XSS) attack processing device, characterized in that: include: A feature acquisition module, used for acquiring, when an application access request for a target Web application is detected, a request description feature associated with an XSS attack contained in the application access request; An attack detection module, used to input the request description features into a pre-trained XSS attack monitoring model to perform XSS attack monitoring on the target Web application; A cache acquisition module, for intercepting the user's access to the target Web application if an XSS attack is identified, and acquiring historical cache data for the target Web application from the local cache data; The risk warning module is used to provide a risk warning to the user when it is predicted based on the historical cache data that the user has been harmed by an XSS attack.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a cross-site scripting (XSS) attack processing method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a cross-site scripting (XSS) attack processing method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements a cross-site scripting (XSS) attack processing method according to any one of claims 1 to 6.

Images