Cross-site scripting attack defense method and device, electronic equipment and medium

Abstract

The invention provides a cross-site scripting attack defense method which can be applied to the technical field of big data and the technical field of artificial intelligence. The method comprises the steps that codes or text data input by a user are received, keywords in the codes or the text data are recognized, and a keyword recognition result is obtained; analyzing an input feature and a behavior pattern of the user, and dynamically adjusting a preset verification matching condition based on the keyword recognition result and the analysis result; and performing defense processing on the code or text data according to the adjusted verification matching condition, and outputting processed security data.

Description

Technical Field

[0001] The present disclosure relates to the fields of big data technology and artificial intelligence, and more specifically to a defense method, device, equipment, medium and program product for cross-site scripting attacks. Background Art

[0002] With the rapid development of network technology and the widespread popularity of network applications, network security threats are becoming increasingly severe. Among them, cross-site scripting (XSS) attacks, as a common security threat, seriously endanger the security of network applications. XSS attacks usually refer to attackers injecting malicious script code into web pages, thereby executing these codes in the user's browser to obtain user sensitive information, steal session data, hijack user operations, etc., which brings great risks to user privacy and system security.

[0003] At present, traditional XSS defense methods mainly include strategies such as static rule matching and whitelist configuration. However, with the continuous evolution of attack methods, the defense methods of existing technologies have many limitations. On the one hand, matching strategies based on static rules and fixed whitelists are difficult to cover new XSS attack variants and lack the ability to effectively respond to dynamic attack patterns; on the other hand, existing technologies only perform simple matching and filtering on request parameters or page content, and lack a defense mechanism for dynamic behavior analysis, making it difficult to effectively distinguish normal users from potential attackers, affecting the security and accuracy of the system. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for defending against cross-site scripting attacks.

[0005] According to a first aspect of the present disclosure, a method for defending against cross-site scripting attacks is provided, which is applied to a server side and includes: receiving code or text data input by a user, identifying keywords in the code or text data, and obtaining keyword recognition results; analyzing the user's input characteristics and behavior patterns, and dynamically adjusting preset verification and matching conditions based on the keyword recognition results and analysis results; and performing defense processing on the code or text data according to the adjusted verification and matching conditions, and outputting processed security data.

[0006] According to an embodiment of the present disclosure, the identifying of keywords in the code or text data to obtain keyword identification results specifically includes: vectorizing the code or text data, inputting the vectorized code or text data into a preset embedding layer, and generating corresponding word vectors; inputting the word vectors into a pre-built keyword identification model, the keyword identification model generates a keyword classification probability by extracting context-dependent features of the word vectors, wherein the keyword identification model is incrementally updated based on attack sample data updated at preset time intervals; and classifying the code or text data based on the keyword classification probability, and outputting the identification result of the target suspicious keyword.

[0007] According to an embodiment of the present disclosure, the vectorizing of the code or text data specifically includes: performing word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data; counting the occurrence frequency of each word or event attribute based on the word segmentation data, and calculating the weight information of each word or event attribute based on the statistical results; and quantizing the weight information to convert the word segmentation data into vectorized data.

[0008] According to an embodiment of the present disclosure, the vectorizing of the code or text data specifically includes: performing word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data; filtering the word segmentation data using a stop word list to generate a filtered word segmentation result; and vectorizing the filtered word segmentation result using a bag of words model to convert the word segmentation data into vectorized data.

[0009] According to an embodiment of the present disclosure, the analysis of user input characteristics and behavior patterns specifically includes: counting the character length and input frequency of the user input content to generate input feature data; obtaining the user's input source information, analyzing the credibility of the request source based on the input source information, and obtaining a credibility identification result; and analyzing the user's input characteristics based on the input feature data and the credibility identification result to obtain an input feature analysis result.

[0010] According to an embodiment of the present disclosure, the analysis of user input characteristics and behavior patterns specifically includes: obtaining the number of requests made by the user in a unit time; obtaining the user's request volume and request content, and generating corresponding behavior characteristic data; tracking the user's operation path, and identifying the target abnormal path; and analyzing the user's behavior pattern based on the number of requests, the behavior characteristic data and the target abnormal path to obtain a behavior pattern analysis result.

[0011] According to an embodiment of the present disclosure, in the process of performing defense processing on the code or text data, the method also includes: desensitizing the user's sensitive information; and / or using encryption technology to transmit and securely store non-sensitive information, and implementing access permission control.

[0012] According to an embodiment of the present disclosure, the code or text data is defensively processed based on the adjusted verification matching conditions, specifically including: adding inspection and filtering operations on the code or text data; or using target security measures to perform secondary verification of the user identity.

[0013] According to an embodiment of the present disclosure, the method further includes: defining resource loading rules, wherein the resource loading rules are used for verification operations of the client during a web page resource loading process; and sending the resource loading rules as a hypertext transfer protocol response header to the client through server configuration or application code, so that the client verifies the compliance of each resource loading request based on the resource loading rules during web page rendering.

[0014] According to an embodiment of the present disclosure, the method further includes: in response to obtaining user input content, using the client to detect special characters and script tags in the input content, escaping or removing the detected target abnormal content, and generating processed input content.

[0015] The second aspect of the present disclosure provides a cross-site scripting attack defense device, which is applied to a server side and includes: a keyword recognition module, which is used to: receive code or text data input by a user, recognize keywords in the code or text data, and obtain keyword recognition results; a dynamic adjustment module, which is used to: analyze the user's input characteristics and behavior patterns, and dynamically adjust preset verification and matching conditions based on the keyword recognition results and analysis results; and a defense module, which is used to: perform defense processing on the code or text data according to the adjusted verification and matching conditions, and output the processed security data.

[0016] According to an embodiment of the present disclosure, the keyword identification module may include a vectorization unit, a classification unit, and a recognition unit.

[0017] According to an embodiment of the present disclosure, the vectorization unit can be used to vectorize the code or text data, input the vectorized code or text data into a preset embedding layer, and generate a corresponding word vector.

[0018] According to an embodiment of the present disclosure, the classification unit can be used to input the word vector into a pre-built keyword recognition model, and the keyword recognition model outputs a keyword classification probability based on the extraction of context-dependent features, wherein the keyword recognition model is incrementally updated based on attack sample data updated at preset time intervals.

[0019] According to an embodiment of the present disclosure, the recognition unit may be used to classify the code or text data based on the keyword classification probability, and output a recognition result of a target suspicious keyword.

[0020] According to an embodiment of the present disclosure, the keyword identification module can also be used to perform word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data; count the occurrence frequency of each word or event attribute based on the word segmentation data, and calculate the weight information of each word or event attribute based on the statistical results; and quantify the weight information to convert the word segmentation data into vectorized data.

[0021] According to an embodiment of the present disclosure, the keyword identification module can also be used to perform word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data; filter the word segmentation data using a stop word list to generate filtered word segmentation results; and use a bag of words model to vectorize the filtered word segmentation results to convert the word segmentation data into vectorized data.

[0022] According to an embodiment of the present disclosure, the dynamic adjustment module can also be used to count the character length and input frequency of the user's input content to generate input feature data; obtain the user's input source information, analyze the credibility of the request source based on the input source information, and obtain a credibility identification result; and analyze the user's input characteristics based on the input feature data and the credibility identification result to obtain an input feature analysis result.

[0023] According to an embodiment of the present disclosure, the dynamic adjustment module can also be used to obtain the number of requests made by a user in a unit time; obtain the user's request volume and request content, and generate corresponding behavior feature data; track the user's operation path and identify the target abnormal path; and analyze the user's behavior pattern based on the number of requests, the behavior feature data and the target abnormal path to obtain a behavior pattern analysis result.

[0024] According to an embodiment of the present disclosure, the defense module can also be used to perform data desensitization processing on the user's sensitive information; and / or use encryption technology to transmit and securely store non-sensitive information, and implement access permission control.

[0025] According to an embodiment of the present disclosure, the defense module may also be used to increase the inspection and filtering operations on the code or text data; or to perform secondary verification of the user identity using target security measures.

[0026] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0027] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0028] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0029] According to the embodiments of the present disclosure, by using user behavior patterns and input features to dynamically adjust the verification matching conditions, it is more adaptive, avoids unnecessary full verification, and improves the utilization rate of computing resources. At the same time, this method combines user input features and behavior patterns for dynamic security protection, which can reduce misjudgments and misinterceptions, and avoid unnecessary interference with normal user operations; through defense processing of malicious data, it ensures the output of safe data, which not only protects user information security, but also improves the smooth experience of user access. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0031] Figure 1 A schematic diagram of an application scenario of a method, apparatus, device, medium, and program product for defending against a cross-site scripting attack according to an embodiment of the present disclosure is shown;

[0032] Figure 2 A flowchart schematically illustrates a method for defending against a cross-site scripting attack according to an embodiment of the present disclosure;

[0033] Figure 3 A flowchart of a method for identifying keywords in code or text data according to an embodiment of the present disclosure is schematically shown;

[0034] Figure 4 A flowchart of a method for defending against a cross-site scripting attack according to another embodiment of the present disclosure is schematically shown;

[0035] Figure 5A structural block diagram schematically shows a device for defending against cross-site scripting attacks according to an embodiment of the present disclosure; and

[0036] Figure 6 A block diagram of an electronic device suitable for implementing a defense method against cross-site scripting attacks according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0037] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0038] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0039] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0040] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0041] First, the technical terms described in this article are explained and described as follows.

[0042] Cross-Site Scripting (XSS) is a common network security attack method. Attackers inject malicious script codes into websites and execute these codes in other users' browsers to steal sensitive information, hijack user sessions, tamper with web page content, etc.

[0043] Long Short-Term Memory (LSTM) is a special recurrent neural network (RNN) structure that is mainly used to process and predict time series data or sequence data. It solves the gradient vanishing or gradient exploding problems that occur in traditional RNNs when processing long sequence data by introducing memory units and gating mechanisms.

[0044] The Hypertext Transfer Protocol response header (HTTP response header) is the meta-information that is included when the server returns response data to the client (such as a browser) in the Hypertext Transfer Protocol (HTTP protocol). It is used to indicate the attributes, status, and additional control information of the response.

[0045] With the continuous development of network technology, network applications are becoming more and more popular and widely used. Users can easily access various online services through browsers. However, the network security threats that come with it are also becoming increasingly serious. Among them, cross-site scripting (XSS) attacks are a common and harmful network security threat. The essence of XSS attacks is that attackers inject malicious script codes into web pages to induce browsers to execute these codes, thereby stealing users' sensitive information, obtaining session credentials, tampering with page content, or hijacking user operations. This attack not only affects the user's data security, but also poses a serious threat to the normal operation of network applications.

[0046] In the prior art, traditional XSS defense methods mainly rely on static rule matching, whitelist configuration or fuzzy matching. For example, Document 1 (Announcement No.: CN112054993B) discloses a defense method for website cross-site scripting attacks. By analyzing the website business logic, it determines whether the request supports script code input, configures a whitelist according to the request, and combines fuzzy matching technology and program processing of the back-end interface to achieve the effect of flexible and convenient defense against XSS attacks. However, this method mainly relies on static rule configuration and cannot quickly adapt to new XSS attack variants or dynamic attack modes, and has certain limitations. In addition, this defense method requires developers to perform more manual intervention on business logic and code, which increases the complexity of system maintenance.

[0047] On the other hand, Document 2 (Publication No.: CN114745202A) discloses a method for active defense against network attacks and a network security gateway based on active defense. The security gateway performs security checks on requests sent from the client to the server. If the check passes, the request is forwarded to the business system, thereby improving the security of network applications. Although this technology can improve the overall defense capability, it mainly relies on the request interception mechanism of the gateway, lacks in-depth analysis of the behavioral characteristics of user input, and cannot dynamically adjust the defense strategy. In addition, this technology does not fully consider user privacy protection, and it is difficult to meet the dual needs of user data security and privacy protection.

[0048] In summary, the XSS defense methods of the prior art have the following deficiencies: First, the traditional whitelist configuration and static rule matching cannot flexibly respond to new XSS attack variants or dynamic attack modes, and the defense capabilities are relatively limited. With the continuous evolution of attack methods, static methods cannot adjust the verification strategy in a timely manner, which can easily lead to missed defenses or misjudgments of attacks; second, the prior art only performs simple matching and filtering on request parameters or page content, and fails to deeply analyze the characteristics of user input data and user behavior patterns. This defense mechanism that lacks dynamic behavior analysis makes it difficult to effectively distinguish normal users from potential attackers, affecting the security and accuracy of the system; third, some prior art technologies rely on security gateways to fully intercept and inspect all requests, which increases the system's computing overhead, easily leading to increased server load and reduced system performance.

[0049] Based on this, an embodiment of the present disclosure provides a method for defending against cross-site scripting attacks, the method comprising: obtaining user input demand information, the demand information comprising application demand information and level demand information; based on the application demand information, using a generative artificial intelligence content algorithm in combination with a pre-built security demand knowledge graph library to generate a preliminary recommendation result; based on the application demand information, the level demand information and the preliminary recommendation result, using a security demand grading model for multi-level matching to generate an intermediate recommendation result; and displaying the intermediate recommendation result through a user interface, and generating a cross-site scripting attack defense result in response to the user's interactive operation. The cross-site scripting attack defense method provided by the present disclosure is more adaptive by dynamically adjusting the verification rules using user behavior patterns and input features, avoiding unnecessary full verification, and improving the utilization of computing resources. At the same time, the method combines user input features and behavior patterns for dynamic security protection, which can reduce misjudgment and misinterception, and avoid unnecessary interference with normal user operations; through defense processing of malicious data, ensuring the output of safe data, it not only guarantees the security of user information, but also improves the smooth experience of user access.

[0050] It should be noted that the cross-site scripting attack defense method, device, equipment, medium and program product determined in the present disclosure can be used in the fields of big data technology and artificial intelligence technology, and can also be used in various fields other than the fields of big data technology and artificial intelligence technology. The application field of the cross-site scripting attack defense method, device, equipment, medium and program product provided by the embodiments of the present disclosure is not limited.

[0051] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0052] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0053] Figure 1 The application scenario diagram of the cross-site scripting attack defense method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0054] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0055] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0056] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0057] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0058] It should be noted that the cross-site scripting attack defense method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the cross-site scripting attack defense device provided in the embodiment of the present disclosure can generally be set in the server 105. The cross-site scripting attack defense method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the cross-site scripting attack defense device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0059] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0060] The following will be based on Figure 1 The scene described by Figure 2 to Figure 4 The defense method for cross-site scripting attacks of the disclosed embodiment is described in detail.

[0061] Figure 2 The flowchart of the method for defending against cross-site scripting attacks according to an embodiment of the present disclosure is schematically shown.

[0062] like Figure 2 As shown, the cross-site scripting attack defense method of this embodiment includes operations S210 to S230, and the cross-site scripting attack defense method can be executed by the server 105.

[0063] In operation S210, a code or text data input by a user is received, and a keyword in the code or text data is recognized to obtain a keyword recognition result.

[0064] Figure 3 The flowchart of the method for identifying keywords in code or text data according to an embodiment of the present disclosure is schematically shown.

[0065] like Figure 3 As shown, the method for identifying keywords in code or text data in this embodiment may include operations S310 to S330.

[0066] In operation S310, the code or text data is vectorized, and the vectorized code or text data is input into a preset embedding layer to generate a corresponding word vector.

[0067] Specifically, the vectorization process may include: performing word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data. The word segmentation processing can be combined with a preset word segmentation rule library to accurately extract common event attributes in scripting programming languages. For example, during the word segmentation processing, common attributes or functions of the on event can be particularly identified, including event attributes such as 'onmouseenter', 'onmouseover', 'onmousemove', 'onmousedown', 'onmouseleave', 'onclick', 'onload', 'onerror', 'onmousewheel', 'onscroll', 'onbeforecopy', 'onbeforecut', 'onstart', 'oncontextmenu', 'oncopy', etc.

[0068] In some embodiments of the present disclosure, the frequency of occurrence of each word or event attribute can be further counted based on the word segmentation data, and the weight information of each word or event attribute can be calculated based on the statistical results; and the weight information can be quantified to convert the word segmentation data into vectorized data.

[0069] According to an embodiment of the present disclosure, by performing a statistical analysis on the frequency of occurrence of words or event attributes, the distribution of each word or event attribute in the input data can be calculated, the importance of each word can be quantified, and which specific words or event attributes are more likely to be associated with potential attacks can be revealed. Based on the statistical results, the weight information of each word or event attribute can be calculated, and the importance of the word can be quantified by methods such as term frequency-inverse document frequency (TF-IDF). The calculation of weight information can effectively distinguish high-frequency but meaningless words from low-frequency but high-value attack features, and improve the accuracy of vectorized representation.

[0070] According to the embodiments of the present disclosure, the vectorization process is refined through word segmentation and weight quantization, and compared with the fuzzy matching of the prior art, the features of suspicious data can be extracted more accurately.

[0071] In other embodiments of the present disclosure, in order to further optimize the word segmentation data and reduce the interference of noise on the vectorization results, the word segmentation data can also be filtered using a stop word list to generate filtered word segmentation results; and the filtered word segmentation results can be vectorized using a bag of words model to convert the word segmentation data into vectorized data. Specifically, through the preset stop word list, common meaningless words or event attributes in code or text data, such as structural tags and other irrelevant characters in HTML code, can be filtered out, and key content with practical significance is retained to generate filtered word segmentation results. The filtering operation helps to reduce the dimension of the input data, highlight the feature information that contributes to XSS attack detection, and improve the quality of subsequent vectorization results.

[0072] After completing word segmentation and stop word filtering, vectorization technology can be used to quantify the filtered word segmentation results. Specifically, the bag-of-words model or other numerical methods can be used to convert the word segmentation results into a vector form that can be processed by the model. The bag-of-words model generates a corresponding sparse vector representation by counting the frequency of vocabulary occurrence, effectively retaining the local features of the code or text data. Similarly, other methods (such as word embedding technology, etc.) can also be applied to this stage to further enhance the vector representation's ability to express context.

[0073] In operation S320, the word vector is input into a pre-built keyword recognition model, and the keyword recognition model generates a keyword classification probability by extracting context-dependent features of the word vector, wherein the keyword recognition model is incrementally updated based on attack sample data updated at preset time intervals.

[0074] In the embodiments of the present disclosure, in order to achieve efficient identification and defense against XSS, a long short-term memory network (LSTM) model based on natural language processing (NLP) can be used to construct a keyword recognition model. Specifically, the construction process may include the following:

[0075] 1) Perform data preparation and preprocessing such as word segmentation and vectorization. You can collect a data set containing scripting languages ​​with known XSS attacks and annotate the data set. For example, a keyword is annotated as 1 for malicious and 0 for normal. The preprocessing process can refer to operation S310 and will not be described in detail here.

[0076] 2) Build an LSTM-based neural network model for keyword recognition. The model structure can include an embedding layer to map the word vectors of the input data to a continuous space to express the semantic relationship between words; and multiple LSTM layers to extract context-dependent features in text sequences and capture the long-range dependencies between consecutive words in the code or text; finally, the model can complete the classification task through the fully connected layer, output the classification probability of the keyword in the input data, and determine whether it is a malicious XSS keyword.

[0077] 3) In the model training phase, the LSTM model can be trained using annotated data sets. During the training process, the model effectively distinguishes malicious input from normal input by learning the characteristics of XSS attack keywords, ensuring that the model has high accuracy and recognition capabilities. The trained model will be evaluated using the test set to check its performance indicators in detecting XSS attack keywords, such as accuracy, recall, and F1 score. Based on the evaluation results, the model can be parameter tuned and structure optimized to further improve its detection performance.

[0078] Furthermore, in order to cope with the ever-changing XSS attack methods, the keyword recognition model can support real-time updates. Specifically, new attack sample data can be received at preset time intervals, and the existing model can be incrementally updated using online learning methods. Among them, new attack sample data can be obtained through network logs, user feedback, or active scanning, and the new samples can be annotated in combination with expert knowledge or known rules, and the word segmentation, vectorization and other operations are performed on them according to the methods of the data preprocessing stage to generate a new training data set composed of new sample sequences and labels.

[0079] According to the embodiments of the present disclosure, in the incremental update phase, the model can be fine-tuned using a lower learning rate and a smaller batch size, and the model can be updated in real time with only a small number of training iterations. Therefore, the keyword recognition model can continuously adapt to new attack methods and maintain a high recognition capability for new XSS attacks.

[0080] According to the embodiments of the present disclosure, by vectorizing code or text data and extracting context-dependent features, the accuracy of keyword recognition is improved, and misjudgment and missed judgment are reduced. At the same time, by incrementally updating the keyword recognition model, it can quickly adapt to the ever-changing attack methods, improve the system's detection ability for new XSS attacks, ensure the real-time and accuracy of the model, and reduce the risk of misjudgment and missed judgment.

[0081] In operation S330, based on the keyword classification probability, the code or text data is classified and the recognition result of the target suspicious keyword is output. Specifically, the target suspicious keyword can be identified by comparing the classification probability with a preset classification threshold and generating a recognition result output.

[0082] Return to reference Figure 2 In operation S220, the user's input characteristics and behavior patterns are analyzed, and the preset verification matching conditions are dynamically adjusted based on the keyword recognition results and the analysis results.

[0083] In an embodiment of the present disclosure, the method for analyzing the input features of a user may include the following:

[0084] 1) Count the character length and input frequency of user input content to generate input feature data. By counting the character length, abnormal input behavior can be effectively captured, such as overlong character input, too short input, or input content with a specific pattern; at the same time, the input frequency reflects the rate at which users submit data per unit time. By analyzing the changing trend of the input frequency, abnormal input operations that are submitted continuously and in large quantities in a short period of time can be identified. Such operations often have the characteristics of attack behavior;

[0085] 2) Obtain the user's input source information, analyze the credibility of the request source based on the input source information, and obtain a credibility identification result. Credibility analysis can comprehensively judge the legitimacy and suspiciousness of the input source in a variety of ways. For example, detect the geographic location, request frequency, and historical access records of the input source IP address, and analyze whether there is IP forgery or abnormal activity; at the same time, parse the browser proxy string to determine whether it is consistent with the normal user environment and identify whether there is any behavior of forging the browser logo. Credibility analysis can identify possible forged or abnormal request sources through comprehensive judgment of source information, and further screen out high-risk input content;

[0086] 3) Analyze the user's input features based on the input feature data and the credibility recognition result to obtain an input feature analysis result. Specifically, the input feature data can be combined with the credibility recognition result to extract the comprehensive features of the user's input behavior through analysis methods such as weight allocation, data aggregation and pattern matching to generate an input feature analysis result.

[0087] In an embodiment of the present disclosure, the method for analyzing a user's behavior pattern may include the following:

[0088] 1) Obtain the number of user requests and request content, and generate corresponding behavior feature data. For example, if it is found that a user sends a large number of similar or repeated requests in a short period of time, and the request content contains specific keywords or malicious code fragments, such behavior is likely to be an automated attack operation performed by an attacker using a script tool, and the behavior feature data will mark and record this;

[0089] 2) Track the user's operation path and identify the target abnormal path. It can record the user's operation process such as clicks, jumps and data submissions in the network application, build a complete operation track, and compare and analyze it with the preset normal user operation path. When it is detected that the user's operation path obviously deviates from the normal process, such as bypassing the normal page process, directly accessing the hidden interface, or triggering sensitive operations in an unexpected path, the path can be marked as a target abnormal path;

[0090] 3) Analyze the user's behavior pattern based on the number of requests, the behavior feature data and the target abnormal path to obtain a behavior pattern analysis result.

[0091] Return to reference Figure 2 In operation S230, the code or text data is defense-processed according to the adjusted verification matching condition, and the processed security data is output.

[0092] Specifically, during the defense process, the code or text data can be checked and filtered to remove malicious scripts or suspicious content that may exist therein. For example, the special characters, tags, and event attributes in the input data can be checked one by one to identify abnormal code fragments. For the detected suspicious content, it can be filtered and cleaned by methods such as character escape, tag removal or replacement to ensure that the input data no longer contains potential attack payloads after processing. The inspection and filtering operations can effectively remove malicious script code in user input and prevent these codes from being executed in the system backend, thereby eliminating the threat of cross-site scripting attacks.

[0093] In other embodiments, for high-risk input content, targeted security measures can be introduced to perform secondary verification of user identity. For example, when an abnormality is detected in the input content or user operation, an additional security verification process can be triggered, such as requiring the user to complete verification code verification, SMS verification, or multi-factor identity authentication. Secondary verification measures can effectively curb further attacks by malicious users and ensure that the system only processes input content from trusted users, thereby reducing security risks.

[0094] Furthermore, in order to further ensure the security of user data during the defensive processing of code or text data, a security protection mechanism of data desensitization and encrypted storage can also be introduced. Specifically, when processing the user's input data, the user's sensitive information contained therein can be desensitized. Data desensitization is a way to reduce the risk of sensitive information leakage by covering, replacing or encrypting part of the sensitive content while retaining the data structure and function. For example, for sensitive data such as the user's name, mobile phone number, email, address, etc., it can be fuzzy processed by character replacement, partial shielding or randomization, so that the sensitive information cannot be directly obtained and identified during storage or display, while still meeting the normal operation of the business logic.

[0095] For non-sensitive information, encryption technology can also be used to protect it in order to ensure the security of data during transmission and storage. Specifically, during data transmission, a secure encryption protocol can be used to encrypt data to ensure that data will not be intercepted or tampered with by middlemen during network transmission, thereby preventing the risk of data leakage. During data storage, non-sensitive information can be encrypted and stored using encryption algorithms, and combined with key management strategies, the data cannot be accessed without authorization. In addition, strict access control can be implemented, and data read and write permissions can be managed in a hierarchical manner to ensure that only users or programs with corresponding permissions can access specific data, thereby effectively preventing data from being illegally read or abused.

[0096] According to the embodiments of the present disclosure, the above-mentioned defense method for cross-site scripting attacks can also be specifically applied to low-code platforms to solve the XSS security threat problem faced by low-code platforms during the development process. Specifically, a defense system based on intelligent keyword recognition and user behavior analysis can be embedded in the forms, components and script editing interfaces of the low-code platform. By integrating real-time scanning and prompting functions, the system can perform real-time analysis and detection of input content during the process of developers creating or editing forms, components and scripts, and identify suspicious keywords that may exist therein. Specifically, based on the trained keyword recognition model, the system performs a deep scan of event attributes, script codes and other high-risk characters in the input content in combination with user input features and contextual information. When the system detects suspicious keywords, it will provide a security warning to the developer through the interface, and give keyword recognition results and optimization suggestions, prompting the developer to make modifications or optimizations to prevent potential security risks from spreading to the application.

[0097] In addition to verification on the server side, the embodiments of the present disclosure also provide a method for implementing a defense mechanism on the front end.

[0098] Figure 4The flowchart of a method for defending against cross-site scripting attacks according to another embodiment of the present disclosure is schematically shown.

[0099] like Figure 4 As shown, the cross-site scripting attack method of this embodiment may include operations S410 to S420.

[0100] In operation S410, a resource loading rule is defined, where the resource loading rule is used for a verification operation of the client during a webpage resource loading process.

[0101] Specifically, the client first receives the resource loading rules sent by the server through the Hypertext Transfer Protocol (HTTP) response data. Resource loading rules can be used to clearly define the resource types, source addresses, protocols and other restrictions allowed by the web page during resource loading. The server can pre-define a set of resource loading rules based on the structure and security requirements of the network application, and send the rules to the client as part of the HTTP response header. The rules can effectively limit the loading sources of resources such as scripts, style sheets, images, etc. in the page, and prevent unauthorized third-party resources from being loaded, especially resources containing potentially malicious scripts.

[0102] In operation S420, the resource loading rule is sent to the client as a hypertext transfer protocol response header through server configuration or application code, so that the client verifies the compliance of each resource loading request based on the resource loading rule during the webpage rendering process.

[0103] According to an embodiment of the present disclosure, the verification process may include parsing resource loading requests, extracting information such as the source address, protocol type, resource type, etc. of the resource, and matching it with the resource loading rules. For example, it is possible to verify whether the domain name of the script resource belongs to the trusted list, check whether the protocol of the resource is HTTPS, and whether there is an attempt to load unauthorized external scripts, embedded content, or other resources. Through the real-time verification mechanism, the client can quickly identify potential illegal resource requests and prevent unauthorized resources from entering the web page rendering process, thereby blocking the propagation path of cross-site scripting attacks.

[0104] In the embodiment of the present disclosure, if it is detected during the verification process that the resource loading request does not comply with the resource loading rules, the client will immediately block the loading of the resource to prevent it from being executed in the user's browser. The blocking mechanism may include directly discarding the request for the illegal resource, or terminating the download and execution process of the resource, thereby effectively preventing malicious script code from running in the web page, preventing attackers from stealing users' sensitive information, obtaining session tokens, performing unauthorized operations, or tampering with web page content through cross-site scripting injection.

[0105] According to the embodiments of the present disclosure, by performing verification and interception on the client side, unnecessary network backhaul and server-side processing burdens are reduced, the efficiency of resource loading is improved, and the computing overhead of the server side is reduced; by verifying resource loading requests on the client side and completing security protection on the front end, the security inspection pressure on the server side is reduced, and computing resource consumption is effectively reduced; local verification based on resource loading rules eliminates the need for repeated requests to the server, shortens resource loading time, and can improve web page rendering efficiency.

[0106] Furthermore, in order to further enhance the defense capability against cross-site scripting (XSS) attacks, in addition to using the above-mentioned content security policy to strictly control resource loading, other front-end defense mechanisms can also be combined to improve the security of network applications from multiple dimensions to prevent attackers from exploiting front-end vulnerabilities to perform malicious operations. For example, HTTP Strict Transport Security (HSTS) can be used for front-end defense, which ensures that the browser always uses a secure transport protocol (such as HTTPS) when communicating with the server by passing a specified security policy to the browser. The HSTS policy can effectively prevent protocol downgrade attacks and prevent attackers from downgrading secure HTTPS communications to insecure HTTP through man-in-the-middle attacks, thereby protecting the integrity and confidentiality of data during transmission and preventing sensitive information from being intercepted or tampered with.

[0107] Furthermore, in order to prevent cross-site scripting attacks from being executed on the browser side, you can also use the X-XSS-Protection response header to enable the browser's built-in XSS filtering and blocking functions. X-XSS-Protection is a browser's built-in security mechanism. When the browser detects a possible malicious script in the input data, it will automatically block the execution of the script and provide a security prompt to the user.

[0108] Furthermore, real-time detection and processing can be performed on user input content to prevent malicious script code from being executed in the page and ensure the security of network applications. Specifically, in response to obtaining the user's input content, special characters and script tags in the input content can be detected, and the detected target abnormal content can be escaped or removed to generate processed input content.

[0109] During the detection process, the preset security rule library and dynamic keyword matching mechanism can be combined to analyze and match the content input by the user character by character to identify abnormal code fragments or tags that pose security risks. After detecting the target abnormal content in the input content, a targeted security processing strategy can be adopted to escape or remove the abnormal content. Exemplarily, for input content containing special characters, the characters can be escaped, for example, symbols such as <, >, & are converted into safe encoding forms, such as <, > and &, etc., so as to avoid the browser parsing these characters as actual code and executing malicious scripts. For malicious script tags or event attributes, their content can be directly removed, and the risky parts can be stripped off to ensure the security of the final input content.

[0110] Based on the above-mentioned cross-site scripting attack defense method, the present disclosure also provides a cross-site scripting attack defense device. Figure 5 The device is described in detail.

[0111] Figure 5 The structural block diagram of the cross-site scripting attack defense device according to an embodiment of the present disclosure is schematically shown.

[0112] like Figure 5 As shown, the cross-site scripting attack defense device 500 of this embodiment includes a keyword recognition module 510 , a dynamic adjustment module 520 , and a defense module 530 .

[0113] The keyword recognition module 510 may be used to receive a code or text data input by a user, recognize keywords in the code or text data, and obtain a keyword recognition result. In one embodiment, the keyword recognition module 510 may be used to perform the operation S210 described above, which will not be described in detail here.

[0114] The dynamic adjustment module 520 can be used to analyze the input characteristics and behavior patterns of the user, and dynamically adjust the preset verification matching conditions based on the keyword recognition results and the analysis results. In one embodiment, the dynamic adjustment module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0115] The defense module 530 can be used to perform defense processing on the code or text data according to the adjusted verification matching condition, and output the processed security data. In one embodiment, the defense module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0116] According to an embodiment of the present disclosure, the keyword identification module 510 may include a vectorization unit, a classification unit, and a recognition unit.

[0117] The vectorization unit may be used to vectorize the code or text data, input the vectorized code or text data into a preset embedding layer, and generate a corresponding word vector. In one embodiment, the vectorization unit may be used to perform the operation S310 described above, which will not be described in detail here.

[0118] The classification unit may be used to input the word vector into a pre-built keyword recognition model, the keyword recognition model outputs a keyword classification probability based on the extraction of context-dependent features, wherein the keyword recognition model is incrementally updated based on attack sample data updated at preset time intervals. In one embodiment, the classification unit may be used to perform the operation S320 described above, which will not be described in detail herein.

[0119] The recognition unit may be used to classify the code or text data based on the keyword classification probability and output the recognition result of the target suspicious keyword. In one embodiment, the recognition unit may be used to perform the operation S330 described above, which will not be described in detail here.

[0120] According to an embodiment of the present disclosure, the keyword identification module 510 can also be used to perform word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data; count the occurrence frequency of each word or event attribute based on the word segmentation data, and calculate the weight information of each word or event attribute based on the statistical results; and quantify the weight information to convert the word segmentation data into vectorized data.

[0121] According to an embodiment of the present disclosure, the keyword identification module 510 can also be used to perform word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data; filter the word segmentation data using a stop word list to generate filtered word segmentation results; and use a bag of words model to vectorize the filtered word segmentation results to convert the word segmentation data into vectorized data.

[0122] According to an embodiment of the present disclosure, the dynamic adjustment module 520 can also be used to count the character length and input frequency of the user's input content to generate input feature data; obtain the user's input source information, analyze the credibility of the request source based on the input source information, and obtain a credibility identification result; and analyze the user's input features based on the input feature data and the credibility identification result to obtain an input feature analysis result.

[0123] According to an embodiment of the present disclosure, the dynamic adjustment module 520 can also be used to obtain the number of requests made by the user in a unit time; obtain the user's request volume and request content, and generate corresponding behavior feature data; track the user's operation path and identify the target abnormal path; and analyze the user's behavior pattern based on the number of requests, the behavior feature data and the target abnormal path to obtain the behavior pattern analysis results.

[0124] According to an embodiment of the present disclosure, the defense module 530 may also be used to perform data desensitization processing on sensitive information of the user; and / or use encryption technology to transmit and securely store non-sensitive information, and implement access permission control.

[0125] According to an embodiment of the present disclosure, the defense module 530 may also be used to add inspection and filtering operations on the code or text data; or to perform secondary verification of the user identity using target security measures.

[0126] According to an embodiment of the present disclosure, any multiple modules of the keyword recognition module 510, the dynamic adjustment module 520, and the defense module 530 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the keyword recognition module 510, the dynamic adjustment module 520, and the defense module 530 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the keyword recognition module 510, the dynamic adjustment module 520, and the defense module 530 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0127] Figure 6 A block diagram of an electronic device suitable for implementing a user interaction method according to an embodiment of the present disclosure is schematically shown.

[0128] like Figure 6As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0129] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0130] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0131] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0132] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0133] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the user interaction method provided by the embodiment of the present disclosure.

[0134] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0135] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0136] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0137] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0138] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0139] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0140] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for defending against cross-site scripting attacks, applied to a server, characterized in that: The method comprises: Receiving a code or text data input by a user, identifying keywords in the code or text data, and obtaining a keyword recognition result; Analyze the user's input characteristics and behavior patterns, and dynamically adjust the preset verification matching conditions based on the keyword recognition results and analysis results; and According to the adjusted verification matching conditions, the code or text data is defensively processed and the processed security data is output.

2. The method according to claim 1, characterized in that: The identifying of the keywords in the code or text data to obtain the keyword identification result specifically includes: Vectorizing the code or text data, inputting the vectorized code or text data into a preset embedding layer, and generating corresponding word vectors; Inputting the word vector into a pre-built keyword recognition model, the keyword recognition model generates a keyword classification probability by extracting context-dependent features of the word vector, wherein the keyword recognition model is incrementally updated based on attack sample data updated at preset time intervals; and Based on the keyword classification probability, the code or text data is classified and a recognition result of a target suspicious keyword is output.

3. The method according to claim 2, characterized in that The vectorizing of the code or text data specifically includes: Performing word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data; Counting the occurrence frequency of each word or event attribute based on the word segmentation data, and calculating the weight information of each word or event attribute based on the statistical result; and The weight information is quantized to convert the word segmentation data into vectorized data.

4. The method according to claim 2, characterized in that: The vectorizing of the code or text data specifically includes: Performing word segmentation processing on the words or event attributes in the code or text data to generate word segmentation data; Filtering the word segmentation data using a stop word list to generate a filtered word segmentation result; and The filtered word segmentation results are vectorized using a bag-of-words model to convert the word segmentation data into vectorized data.

5. The method according to any one of claims 1 to 4, characterized in that: The analyzing of the user's input characteristics and behavior patterns specifically includes: Count the character length and input frequency of the user input content to generate input feature data; Acquiring input source information of the user, analyzing the credibility of the request source based on the input source information, and obtaining a credibility identification result; and The input feature of the user is analyzed based on the input feature data and the credibility recognition result to obtain an input feature analysis result.

6. The method according to claim 5, characterized in that The analyzing of the user's input characteristics and behavior patterns specifically includes: Get the number of requests made by the user per unit time; Obtain the user's request volume and request content, and generate corresponding behavioral feature data; Track the user's operation path and identify abnormal target paths; and The user's behavior pattern is analyzed based on the number of requests, the behavior feature data and the target abnormal path to obtain a behavior pattern analysis result.

7. The method according to any one of claims 1 to 4 and 6, characterized in that: In the process of performing defense processing on the code or text data, the method further includes: Desensitize sensitive user information; and / or Use encryption technology to transmit and securely store non-sensitive information, and implement access permission control.

8. The method according to any one of claims 1 to 4 and 6, characterized in that: The defensive processing of the code or text data according to the adjusted verification matching condition specifically includes: Adding checking and filtering operations to the code or text data; or Leverage targeted security measures to perform a secondary verification of user identity.

9. The method according to any one of claims 1 to 4 and 6, characterized in that: The method further comprises: defining resource loading rules, wherein the resource loading rules are used for verification operations of the client during the webpage resource loading process; and The resource loading rule is sent to the client as a hypertext transfer protocol response header through server configuration or application code, so that the client verifies the compliance of each resource loading request based on the resource loading rule during the web page rendering process.

10. The method according to claim 9, characterized in that The method further comprises: In response to obtaining the user's input content, the client is used to detect special characters and script tags in the input content, and the detected target abnormal content is escaped or removed to generate processed input content.

11. A cross-site scripting attack defense device, applied to a server, characterized in that: The device comprises: The keyword recognition module is used to: receive the code or text data input by the user, recognize the keywords in the code or text data, and obtain the keyword recognition result; A dynamic adjustment module, used to: analyze the user's input characteristics and behavior patterns, and dynamically adjust the preset verification matching conditions based on the keyword recognition results and analysis results; and The defense module is used to: perform defense processing on the code or text data according to the adjusted verification matching conditions, and output the processed security data.

12. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images