Dynamic defense method and system based on web application firewall

Abstract

The invention discloses a dynamic defense method and system based on a web application firewall, and relates to the technical field of network defense, and the method comprises the steps: determining a target Internet and a target application program connected with the firewall, and obtaining a web application; constructing a dynamic transmission channel between the firewall and the target internet; obtaining access data through the target Internet, and folding the access data through the dynamic transmission channel to obtain folded data; and transmitting the folded data through a dynamic transmission channel, destroying the folded data which does not conform to a preset condition as abnormal data, obtaining access data again until the access data conform to the preset condition, transmitting the access data to the firewall, restoring the folded data, and providing the folded data to the target application through the firewall. The method has a good data transmission security guarantee effect, and the channel between the target internet and the firewall can be prevented from being tampered and damaged.

Description

Technical Field

[0001] The present invention relates to the technical field of network defense, and in particular to a dynamic defense method and system based on a web application firewall. Background Art

[0002] A web application firewall is a security device or service specifically designed to protect web applications from malicious attacks. It is located before the web server and serves as an intermediate layer between the application and the Internet. It is responsible for monitoring, filtering and blocking malicious traffic, and can reduce the probability of malicious traffic attacking the application. The existing web application firewalls are difficult to shield the intrusion of malicious traffic from networks other than the Internet in the process of obtaining access data through the Internet. For example, in the process of obtaining access data, it is easy for external networks to tamper with the access data obtained, and the access data that should have been safe can be tampered with into malicious processes, and there is no good security defense effect. Summary of the invention

[0003] The purpose of the present invention is to provide a dynamic defense method and system based on a web application firewall to solve the deficiencies in the background technology.

[0004] In order to achieve the above object, the present invention provides the following technical solution: a dynamic defense method based on a web application firewall, comprising the following steps:

[0005] Determine the target Internet and target application of the firewall connection to get the web application;

[0006] Build a dynamic transmission channel between the firewall and the target Internet;

[0007] Access data is obtained through the target Internet, and the access data is folded through a dynamic transmission channel to obtain folded data;

[0008] The folded data is transmitted through a dynamic transmission channel, the folded data that does not meet the preset conditions is destroyed as abnormal data, and the access data is re-acquired until it meets the preset conditions and is transmitted to the firewall. The folded data is restored and provided to the target application through the firewall.

[0009] In a preferred embodiment, the step of building a dynamic transmission channel between the firewall and the target Internet includes:

[0010] An information acquisition channel is set between the firewall and the target Internet, and a folding space is set in the information acquisition channel at a position close to the target Internet end;

[0011] Setting multiple information boxes and corresponding mutagenesis points in the information acquisition channel to obtain multiple verification nodes;

[0012] The information acquisition channel after setting the folding space and the verification node is used as a dynamic transmission channel.

[0013] In a preferred embodiment, the step of setting an information acquisition channel between the firewall and the target Internet, and setting a folding space at a position close to the target Internet end in the information acquisition channel includes:

[0014] A preprocessing space is set up in the information transmission channel at a location close to the target Internet terminal;

[0015] A plurality of information architecture chains are set in the preprocessing space, wherein the information architecture chain is composed of a plurality of information architectures in sequence, the information architecture includes a plurality of information grids, and the plurality of information grids are linked and positions of the plurality of information grids are fixed;

[0016] A preprocessing space storing a plurality of information architecture chains is used as a folding space.

[0017] In a preferred embodiment, the step of setting a plurality of information frames and corresponding mutagenesis points in the information acquisition channel to obtain a plurality of verification nodes includes:

[0018] A plurality of transmission areas are set in the information acquisition channel, a plurality of verification points are set in the transmission area, and the transmission area where the plurality of verification points are set is used as an information frame, wherein the number of information frames in the information acquisition channel is the same as the number of information architectures in a single information architecture chain;

[0019] Establishing a communication relationship between the information frame and the folding space based on the information transmission channel, and setting a mutagenesis point in the information frame corresponding to the folding space;

[0020] The multiple information boxes and the corresponding mutagenesis points are used as multiple verification nodes.

[0021] In a preferred embodiment, the step of acquiring access data through the target Internet and folding the access data through a dynamic transmission channel to obtain folded data includes:

[0022] Access data is obtained through the target Internet, and the access data is transmitted through a dynamic transmission channel. When the access data passes through the folded space, the access data is divided to obtain a plurality of sub-access data, and the number of the sub-access data is the same as the number of information grids;

[0023] Randomly select an information architecture chain, and take the first information architecture group in the information architecture chain as the target architecture;

[0024] Multiple sub-access data are stored one-to-one in the information grid in the target architecture to obtain folded information.

[0025] In a preferred embodiment, the step of restoring the folded data and providing it to the target application through the firewall includes:

[0026] The information architecture in the randomly selected information architecture chain is transmitted one by one in sequence to the mutagenesis point of the verification node;

[0027] Transmit the folded data and all information architectures except the target architecture in the randomly selected information architecture chain through a dynamic transmission channel. When the folded data passes through the verification node, the folded data that does not meet the preset conditions will be destroyed as abnormal data;

[0028] The access data is retrieved and processed into folded data until it meets the preset conditions and is transmitted to the firewall. The folded data is restored and provided to the target application through the firewall.

[0029] In a preferred embodiment, the step of transmitting the folded data through a dynamic transmission channel and destroying the folded data that does not meet the preset conditions as abnormal data when the folded data passes through the verification node includes:

[0030] In the information box, the verification points are arranged according to the information structure in the mutagenesis point. When the folded data passes through the verification node, the information grid in the folded data corresponds to the verification point.

[0031] The situation where the positions of the information grids in the folded data do not correspond to the verification points is regarded as not meeting the preset conditions, and the folded data that does not meet the preset conditions is regarded as abnormal data and destroyed.

[0032] The present invention also provides a dynamic defense system based on a web application firewall, comprising:

[0033] A determination module, used to determine the target Internet and target application connected to the firewall to obtain the web application;

[0034] A construction module, connected with the determination module, for constructing a dynamic transmission channel between the firewall and the target Internet;

[0035] A processing module, connected to the building module, for acquiring access data through the target Internet, and folding the access data through a dynamic transmission channel to obtain folded data;

[0036] The defense module is connected to the processing module and is used to transmit the folded data through a dynamic transmission channel, destroy the folded data that does not meet the preset conditions as abnormal data, reacquire the access data until it meets the preset conditions and transmit it to the firewall, restore the folded data, and provide it to the target application through the firewall.

[0037] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0038] The present invention provides a communication connection between multiple verification points and the mutagenesis points set in the information frame where they are located, and uses the multiple information frames and the corresponding mutagenesis points as multiple verification nodes. The verification points can be arranged through the mutagenesis points, which is convenient for the verification points to perform transmission verification on the data after the access data is folded. It has a good data transmission security guarantee effect and can avoid tampering and damage on the channel between the target Internet and the firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0040] Figure 1 The figure is a flow chart of the method of the present invention.

[0041] Figure 2 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Example 1, please refer to Figure 1 As shown, the dynamic defense method based on a web application firewall described in this embodiment includes the following steps:

[0044] S1, determine the target Internet and target application connected by the firewall to obtain the web application;

[0045] S2, build a dynamic transmission channel between the firewall and the target Internet;

[0046] S3, obtaining access data through the target Internet, and folding the access data through a dynamic transmission channel to obtain folded data;

[0047] S4, transmitting the folded data through a dynamic transmission channel, destroying the folded data that does not meet the preset conditions as abnormal data, reacquiring access data until it meets the preset conditions and transmitting it to the firewall, restoring the folded data, and providing it to the target application through the firewall;

[0048] As described in the above steps S1-S4, the verification points can be changed through the mutagenesis points, the number of verification points is the same as the number of information grids in a single transmission architecture, the number of information frames in the information acquisition channel is the same as the number of information architectures in a single information architecture chain, and multiple verification points are communicated and connected with the mutagenesis points set in the information frames. The multiple information frames and the corresponding mutagenesis points are used as multiple verification nodes. The verification points can be arranged through the mutagenesis points, which is convenient for the verification points to perform transmission verification on the data after the access data is folded subsequently. It has a good data transmission security protection effect and can avoid tampering and damage on the channel between the target Internet and the firewall.

[0049] In one embodiment, the step S2 of establishing a dynamic transmission channel between the firewall and the target Internet includes:

[0050] S21, setting an information acquisition channel between the firewall and the target Internet, and setting a folding space in the information acquisition channel at a position close to the target Internet end;

[0051] S22, setting a plurality of information boxes and corresponding mutagenesis points in the information acquisition channel to obtain a plurality of verification nodes;

[0052] S23, setting the information acquisition channel after the folding space and the verification node as a dynamic transmission channel;

[0053] As described in the above steps S21-S23, the firewall serves as an intermediate layer between the application and the Internet, and is responsible for monitoring, filtering and blocking malicious traffic. Therefore, the firewall is connected to the target Internet and the target application respectively. Since the target application obtains data through the target Internet, the data security of the target Internet needs to be paid attention to. Therefore, an information acquisition channel is set between the firewall and the target Internet, and a folding space is set in the information acquisition channel near the target Internet end. The folding space is located in the information acquisition channel near the network position of the target Internet data output port, and then a plurality of verification nodes are set in the information acquisition channel, wherein the verification node includes an information box and a corresponding mutagenesis point. After setting the information acquisition channel with the folding space and the verification node, a dynamic transmission channel is obtained, which can facilitate the subsequent guarantee of the source of the access data obtained from the target Internet, avoid tampering and destruction in the channel between the target Internet and the firewall, and has a good information security protection effect.

[0054] In one embodiment, the step S21 of setting an information acquisition channel between the firewall and the target Internet and setting a folding space at a position close to the target Internet terminal in the information acquisition channel includes:

[0055] S211, setting a preprocessing space at a location close to the target Internet terminal in the information transmission channel;

[0056] S212, setting a plurality of information architecture chains in the preprocessing space, wherein the information architecture chain is composed of a plurality of information architectures in sequence, the information architecture includes a plurality of information grids, and the plurality of information grids are linked and positions of the plurality of information grids are fixed;

[0057] S213, using the pre-processing space storing multiple information architecture chains as the folding space;

[0058] In one embodiment, the step S22 of setting a plurality of information frames and corresponding mutagenesis points in the information acquisition channel to obtain a plurality of verification nodes includes:

[0059] S221, setting a plurality of transmission areas in the information acquisition channel, setting a plurality of verification points in the transmission areas, and using the transmission areas where the plurality of verification points are set as information frames, wherein the number of information frames in the information acquisition channel is the same as the number of information architectures in a single information architecture chain;

[0060] S222, establishing a communication relationship between the information frame and the folding space based on the information transmission channel, and setting a mutagenesis point in the information frame corresponding to the folding space;

[0061] S223, using the multiple information boxes and the corresponding mutagenesis points as multiple verification nodes;

[0062] As described in the above steps S211-S213 and S221-S223, a preprocessing space is set in the information transmission channel near the target Internet terminal. The preprocessing space here is a data processing library connected to the information transmission channel. Multiple information architecture chains are set in the preprocessing space. The number of information architectures in the multiple information architecture chains is the same. Multiple information grids are set in the information architecture. The information grid here is a data storage unit for storing and transmitting data. The multiple information grids are linked. The linking process here is to fix the positions of the multiple information grids and bind them. The information grids here are fixed after the access data after the subsequent storage division. The information grids can no longer store other data. In this way, during the transmission process, the number of information grids is fixed. In order to ensure the stability of subsequent transmission, the changes in the access data transmission are completed through a single information architecture chain, which reduces the probability that the transmission of the unchanging information architecture will be easily replaced. The replaced information architecture will not change through subsequent mutagenesis points. The situation is abnormal. The number of information grids in the information architecture of a single information architecture chain is the same, but the positional relationship between the information grids in multiple information architectures is different. Then, the preprocessing space storing multiple information architecture chains is used as the folding space, and multiple transmission areas are set in the information acquisition channel. Multiple verification points are set in the transmission area. Each transmission area has multiple verification points. The verification points are changeable and can be changed through mutagenesis points. The number of verification points is the same as the number of information grids in a single transmission architecture. The number of information frames in the information acquisition channel is the same as the number of information architectures in a single information architecture chain. Multiple verification points are communicated and connected with the mutagenesis points set in the information frames. Multiple information frames and corresponding mutagenesis points are used as multiple verification nodes. The verification points can be arranged through the mutagenesis points, which is convenient for the verification points to transmit and verify the data after the access data is folded. It has a good data transmission security guarantee and can avoid tampering and damage on the channel between the target Internet and the firewall.

[0063] In one embodiment, the step S3 of acquiring access data through the target Internet and folding the access data through the dynamic transmission channel to obtain folded data includes:

[0064] S31, obtaining access data through the target Internet, transmitting the access data through a dynamic transmission channel, dividing the access data into a plurality of sub-access data when passing through the folded space, the number of the sub-access data being the same as the number of information grids;

[0065] S32, randomly selecting an information architecture chain, and taking the first ranked information architecture group in the information architecture chain as the target architecture;

[0066] S33, storing the plurality of sub-access data one-to-one in the information grid in the target architecture to obtain folding information;

[0067] As described in the above steps S31-S33, the target Internet is a platform for the target application to obtain information, and the access data is obtained through the target Internet. The access data here needs to be transmitted through a dynamic transmission channel. The folding space is located at the information output port of the target Internet. Therefore, it is equivalent to that the access data is directly put into the folding space as soon as it is output from the target Internet. There are multiple information architecture chains in the folding space. Here, an information architecture chain is randomly selected, and the information architecture group ranked first in the information architecture chain is used as the target architecture. The target architecture is the information architecture used for the initial transmission of the access data. When passing through the folding space, the access data is divided into multiple sub-access data. The number of sub-access data is the same as the number of information grids. Then, the multiple sub-access data are stored one-to-one in the information grids in the target architecture to obtain folding information. The randomly selected information architecture chain here is transmitted along with the folding information except for the target architecture, and the information grids in the information architecture except for the target architecture are in a closed state and will not be used by other information.

[0068] In one embodiment, the step S4 of restoring the folded data and providing it to the target application through the firewall includes:

[0069] S41, transmitting the information architecture in the randomly selected information architecture chain to the mutagenesis point of the verification node one by one in sequence;

[0070] S42, transmitting the folded data and the information architectures other than the target architecture in the randomly selected information architecture chain through a dynamic transmission channel, and when the folded data passes through the verification node, destroying the folded data that does not meet the preset conditions as abnormal data;

[0071] S43, reacquire the access data and process it into folded data, until it meets the preset conditions and is transmitted to the firewall, the folded data is restored, and provided to the target application through the firewall;

[0072] In one embodiment, the step S42 of transmitting the folded data through the dynamic transmission channel and destroying the folded data that does not meet the preset conditions as abnormal data when the folded data passes through the verification node includes:

[0073] S421, in the information frame, the verification points are arranged according to the information structure in the mutagenesis point, and when the folded data passes through the verification node, the information grid in the folded data is corresponded to the verification point;

[0074] S422: The situation in which the positions of the information grids in the folded data and the verification points do not correspond to each other is regarded as not meeting the preset conditions, and the folded data that does not meet the preset conditions is regarded as abnormal data and destroyed.

[0075] As described in the above steps S41-S43, the information architecture in the randomly selected information architecture chain is transmitted one-to-one in sequence to the mutagenesis point of the verification node. For example, there are three information architectures A, B and C in the randomly selected information architecture chain, then there are three verification nodes in the dynamic transmission channel, namely 1, 2 and 3, and then the information architecture A is stored in the mutagenesis point in the verification node 1, the information architecture B is stored in the mutagenesis point in the verification node 2, and the information architecture C is stored in the mutagenesis point in the verification node 3. The verification points in the verification nodes can be arranged by the mutagenesis points. When the information architectures other than the target architecture in the folded data and the randomly selected information architecture chain pass through the verification nodes, the information grids in the folded data and the verification points are positionally corresponded. When the folded data passes through the first verification node 1, the corresponding information architecture A, the folded data is stored and transmitted according to the first-ranked information architecture, so it can be aligned with the verification point corresponding to the information architecture A in the verification node 1. The verification points here are interconnected and can communicate with each other to understand whether all the verification points can correspond to the information grid of the corresponding folded data. The situation where the position between the information grid in the folded data and the verification point does not correspond is regarded as not meeting the preset conditions. The folded data that does not meet the preset conditions is regarded as abnormal data and destroyed. If it meets the preset conditions, the multiple sub-access data in the folded data are transferred and stored in the next randomly selected information architecture chain except the target architecture, and the transmission is continued. The subsequent verification nodes are verified and repeated in the above manner until the preset conditions are met and transmitted to the firewall. The folded data is restored (multiple sub-access data are extracted from the folded data and combined in sequence. The access data is also split in sequence when splitting), and provided to the target application through the firewall, so that the complete data can be obtained and the probability of access data being tampered with during transmission can be avoided, and timely transmission termination can be achieved.

[0076] Example 2, please refer to Figure 2 As shown, the dynamic defense system based on a web application firewall described in this embodiment includes:

[0077] A determination module, used to determine the target Internet and target application connected to the firewall to obtain the web application;

[0078] A construction module, connected with the determination module, for constructing a dynamic transmission channel between the firewall and the target Internet;

[0079] A processing module, connected to the building module, for acquiring access data through the target Internet, and folding the access data through a dynamic transmission channel to obtain folded data;

[0080] The defense module is connected to the processing module and is used to transmit the folded data through a dynamic transmission channel, destroy the folded data that does not meet the preset conditions as abnormal data, reacquire the access data until it meets the preset conditions and transmit it to the firewall, restore the folded data, and provide it to the target application through the firewall.

[0081] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A dynamic defense method based on a web application firewall, characterized in that: The following steps are involved: Determine the target Internet and target application of the firewall connection to get the web application; Build a dynamic transmission channel between the firewall and the target Internet; Access data is obtained through the target Internet, and the access data is folded through a dynamic transmission channel to obtain folded data; The folded data is transmitted through a dynamic transmission channel, the folded data that does not meet the preset conditions is destroyed as abnormal data, and the access data is re-acquired until it meets the preset conditions and is transmitted to the firewall. The folded data is restored and provided to the target application through the firewall.

2. According to claim 1, a dynamic defense method based on a web application firewall is characterized in that: The step of building a dynamic transmission channel between the firewall and the target Internet includes: An information acquisition channel is set between the firewall and the target Internet, and a folding space is set in the information acquisition channel at a position close to the target Internet end; Setting multiple information boxes and corresponding mutagenesis points in the information acquisition channel to obtain multiple verification nodes; The information acquisition channel after setting the folding space and the verification node is used as a dynamic transmission channel.

3. A dynamic defense method based on a web application firewall according to claim 2, characterized in that: The step of setting an information acquisition channel between the firewall and the target Internet, and setting a folding space at a position close to the target Internet end in the information acquisition channel, comprises: A preprocessing space is set up in the information transmission channel at a location close to the target Internet terminal; A plurality of information architecture chains are set in the preprocessing space, wherein the information architecture chain is composed of a plurality of information architectures in sequence, the information architecture includes a plurality of information grids, and the plurality of information grids are linked and positions of the plurality of information grids are fixed; A preprocessing space storing a plurality of information architecture chains is used as a folding space.

4. The dynamic defense method based on a web application firewall according to claim 3 is characterized in that: The step of setting a plurality of information frames and corresponding mutagenesis points in the information acquisition channel to obtain a plurality of verification nodes includes: A plurality of transmission areas are set in the information acquisition channel, a plurality of verification points are set in the transmission area, and the transmission area where the plurality of verification points are set is used as an information frame, wherein the number of information frames in the information acquisition channel is the same as the number of information architectures in a single information architecture chain; Establishing a communication relationship between the information frame and the folding space based on the information transmission channel, and setting a mutagenesis point in the information frame corresponding to the folding space; The multiple information boxes and the corresponding mutagenesis points are used as multiple verification nodes.

5. The dynamic defense method based on a web application firewall according to claim 1, characterized in that: The step of obtaining access data through the target Internet and folding the access data through a dynamic transmission channel to obtain folded data includes: Access data is obtained through the target Internet, and the access data is transmitted through a dynamic transmission channel. When the access data passes through the folded space, the access data is divided to obtain a plurality of sub-access data, and the number of the sub-access data is the same as the number of information grids; Randomly select an information architecture chain, and take the first information architecture group in the information architecture chain as the target architecture; Multiple sub-access data are stored one-to-one in the information grid in the target architecture to obtain folded information.

6. The dynamic defense method based on a web application firewall according to claim 1, characterized in that: The step of restoring the folded data and providing it to the target application through the firewall includes: The information architecture in the randomly selected information architecture chain is transmitted one by one in sequence to the mutagenesis point of the verification node; Transmit the folded data and all information architectures except the target architecture in the randomly selected information architecture chain through a dynamic transmission channel. When the folded data passes through the verification node, the folded data that does not meet the preset conditions will be destroyed as abnormal data; The access data is retrieved and processed into folded data until it meets the preset conditions and is transmitted to the firewall. The folded data is restored and provided to the target application through the firewall.

7. A dynamic defense method based on a web application firewall according to claim 6, characterized in that: The step of transmitting the folded data through the dynamic transmission channel and destroying the folded data that does not meet the preset conditions as abnormal data when the folded data passes through the verification node includes: In the information box, the verification points are arranged according to the information structure in the mutagenesis point. When the folded data passes through the verification node, the information grid in the folded data corresponds to the verification point. The situation where the positions of the information grids in the folded data do not correspond to the verification points is regarded as not meeting the preset conditions, and the folded data that does not meet the preset conditions is regarded as abnormal data and destroyed.

8. A dynamic defense system based on a web application firewall, used to implement a dynamic defense method based on a web application firewall as described in any one of claims 1 to 7, characterized in that: include: A determination module, used to determine the target Internet and target application connected to the firewall to obtain the web application; A construction module, connected with the determination module, for constructing a dynamic transmission channel between the firewall and the target Internet; The processing module is connected to the building module and is used to obtain access data through the target Internet, and fold the access data through the dynamic transmission channel to obtain folded data; The defense module is connected to the processing module and is used to transmit the folded data through a dynamic transmission channel, destroy the folded data that does not meet the preset conditions as abnormal data, reacquire the access data until it meets the preset conditions and transmit it to the firewall, restore the folded data, and provide it to the target application through the firewall.

Images