CN101217537B

CN101217537B - A network attacking prevention method

Info

Publication number: CN101217537B
Application number: CN2007103068330A
Authority: CN
Inventors: 董韶瑜
Original assignee: 董韶瑜
Current assignee: HANGZHOU HEZHONG DATA TECHNOLOGY CO., LTD.
Priority date: 2007-12-28
Filing date: 2007-12-28
Publication date: 2011-04-20
Anticipated expiration: 2027-12-28
Also published as: CN101217537A

Abstract

The invention relates to a prevention method of network attacks, which comprises the following steps: (1) any of the clients sends a request to the website server; (2) the website server receives the request; (3) the website server transforms the characters with grammatical meaning in the request into the corresponding characters centralized by multi-byte characters; (4) the website server returns a web page to the client after analyzing and executing the request of the transformed characters. The invention has the beneficial effect that the method provided by the invention can effectively defeat the implant attacks of executable components. Meanwhile, the impact to business logic is far less than blocking suspicious characters.

Description

A kind of prevention method of network attack

Technical field

The present invention relates to WEB and use the intrusion detection field, relate in particular to a kind of prevention method of network attack.

Background technology

Submit to the attack of content to be based on a kind of attack that often is subjected to of the operation system of B/S framework to professional website use, but the feature of this attack is to add execution character when utilizing by B/S interface submission data, when the serviced device of these contents is resolved and is handled, because the leak of business software, these should be only carried out in its environment as the part of executable statement as the content of factual data character, thereby cause operation system to carry out external command, the consequence of this attack comprises illegally obtains data of database, destroy the integrality of database, even reach the purpose of carrying out any order.

At present, the main risk prevention instruments that prevents this attack has two classes: based on the examination of service logic and general examination.Examination based on service logic mainly realizes in operation system, implication according to service logic and each input domain, check the reasonability of input, but filter execution character and have the character of grammatical meaning with other, but the shortcoming of this method is: must realize in each different business systems, very high for existing operation system improvement cost, sometimes or even impossible.General examination generally can realize with the method for independent of service, but its shortcoming is, because do not have and the operation system hook, Screening is difficult to determine whether some tagged words are to attack character, the character that much has grammatical meaning often is considered to the reasonable character that normal data is submitted to, and be easy to take place flase drop, will cause the operation system can't operate as normal.

Summary of the invention

The objective of the invention is to: a kind of prevention method of network attack is provided, guarantees semantic constant to data that regular traffic is submitted to, avoid guarding network attack under the condition of the influence of operation system.

For achieving the above object, the prevention method of network security provided by the invention comprises:

(1) sends a request by arbitrary client to the website service end;

(2) the website service termination is received this request;

(3) the website service end is corresponding character with the character that has structuralized query sql like language grammatical meaning in this request according to " Chinese Character Set Code for Informati: baseset " GB2312 code conversion;

Through this conversion, when application software is put into statement to the content after conversion, this symbol has not had grammatical meaning, thereby, only can be taken as business tine and enter statement, thereby can not play the effect that statement is cut apart, thereby just can not play the effect of attack, simultaneously, this conversion can not destroy the service logic of application software.Content before content and the unconverted in application software after conversion has identical semanteme.

(4) the prompting page of the common system mistake of tackling after the request analysis of website service end with hand over word is the wrong page of HTTP error code 500 to 599 scopes and is converted into a general wrong display page and returns client.

In the composition the carried out injection attacks of reality, often adopt the method for trial/mistake for the analysis of system, in other words, utilize system that effective attack method is found out in the error message of attempting attacking content.For fear of finding out system vulnerability, this method adopts the intercepting system miscue page, and replaces with a general wrong display page.Like this, the assailant just is difficult to find the details of system vulnerability.

Attacked client for fear of the operation system error message and intercepted and captured, can after interception, be carried out necessary analysis, can be carried out the information of the target that composition will attack to determine whether to contain in the error message database or other.The wrong page of website is all represented with the 5xx (500 to 599) of return code among the HTTP usually, these information usually contain some tagged words, the error message of database server often contains some key messages, this method will contain the page obstruction of these key messages, replace with general wrong display page.

Beneficial effect: the method that the present invention proposes can be defeated effectively and can carry out the composition injection attacks.Simultaneously, but much smaller to the influence of service logic more than stopping suspicious character.

Embodiment

With web portal security crime prevention system of method construct of the present invention.The request of client arrives the website service end by gateway, and the website service end filters the content of being transmitted, and finds out the word and the symbol that wherein have the sql like language grammatical meaning, SELECT for example, and UPDATE, DELETE, TRANCATE, '; ', '--' (two minus sign), ' ' ' (single quotation marks) etc.These characters are corresponding Chinese symbol according to the GB2312 code conversion, as shown in the table:

Symbol	ASCII character	The GB2312 sign indicating number
			SELECT	53 45 4C 45 43 54	A3D3 A3C5 A3CC A3C5 A3D4 A3D5
UPDATE	55 50 44 41 54 45	A3D5 A3C5 A3CC A3C1 A3D4 A3C5
			DELETE	44 45 4C 45 54 45	A3C4 A3C5 A3CC A3C5 A3D4 A3C5

TRANCATE	54 52 41 4E 43 41	A3D4 A3D2 A3C1 A3CE A3C3 A3C1
				54 45	A3D4 A3C5
；	3B	A3BB
			--	2D 2D	A3AD A3AD
′	27	A3A7

For at this extraneous character, do not do conversion.To pass to website service through the input of character string after the above-mentioned conversion.

With this transformation in 1.1 described SQL examples.That is, establishing the SQL template is

SELECT?username，phone，idnumber?FROM?user?WHERE?id＝′％s′

The user is input as

a′；DELETE?from?user；--′

Then, user's input is converted into

a′；D?E?L?E?T?E?from?user；——

Above-mentioned SQL statement template is put in this input once conversion, obtained

SELECT?username，phone，idnumber?FROM?user?WHERE?id＝′a′；

D?E?L?E?T?E?from?user；——′

Because above-mentioned quotation marks, branch, keyword DELETE is converted into multibyte character, they have not had the effect of SQL grammer, and it is by name that the program of being attacked can attempt to seek the user

a′；D?E?L?E?T?E?from?user；——

The user.Certainly can not find.But different with the SQL statement of unconverted, it can delete database table user.

Except that this conversion, service is also done following conversion to the wrong page from website service:

Gateway changes with the following page the page of HTTP return code in 500 to 599 scopes:

" input error: '＜input content〉'.Please re-enter.”

Under the situation of the input of character string in above-mentioned example, the user it will be appreciated that following error message:

Input error: ' a '; D E L E T E from user;---'.Please re-enter.Attack not success.

Claims

1. the prevention method of a network attack is characterized in that, comprises the following steps:

(1) sends a request by arbitrary client to the website service end;

(2) the website service termination is received this request;

(4) after the request analysis of website service end with hand over word, tackle the wrong page that common system mistake prompts for HTTP error code 500 to 599 scopes, be converted into a general wrong display page and return client.