WO2015090117A1

WO2015090117A1 - Website protection method and device

Info

Publication number: WO2015090117A1
Application number: PCT/CN2014/089960
Authority: WO
Inventors: 姚熙
Original assignee: 北京奇虎科技有限公司; 奇智软件（北京）有限公司
Priority date: 2013-12-16
Filing date: 2014-10-31
Publication date: 2015-06-25
Also published as: CN103685274A

Abstract

Disclosed are a website protection method and device. The method comprises: sending a test request message to a website server, and receiving a response message which is returned by the website server; parsing the response message, and determining the type of the website; according to the type of the website, setting a corresponding security protection rule for the website; and according to the set corresponding security protection rule, conducting security protection on the website. By way of recognizing the type of the website, the present invention automatically selects a corresponding security protection technology for the website; since there is no need for manual intervention in an implementation process, the present invention has the advantages of convenience and quickness, and can really achieve one-click setting; moreover, since different types of security protection technologies are set for different websites in advance, the potential security risks caused by artificial selection errors are avoided, and accurate security protection solutions can be provided for the websites.

Description

Website protection method and device

Technical field

The present invention relates to the field of network security technologies, and in particular, to a website protection method and apparatus.

Background technique

With the rapid development of the Internet, network security issues are also very serious. For website architecture, website security issues are mainly divided into the following four aspects: server security, border security, security on the Internet and extranet. Before the attack occurs, it is the key to preventive measures before the attack occurs. The firewall system is the first line of defense for website security. It can filter and block many attacks.

As the first post for website security, the system administrator (webmaster) must ensure the security of the web server system and also consider some basic security protections of the website application. Currently, some specialized network security vendors provide website security products. During the construction of the website, the system administrator only needs to perform corresponding selection and setting operations according to such security protection products. This kind of security protection product will list all the security protection technologies. Generally, all the default security options are selected. The webmaster cancels the unnecessary technology as needed, leaving only the protection technology required by the website.

The above-mentioned method of manual selection of protection technology by the stationmaster is cumbersome, and some webmasters are not very familiar with the security protection technology. If the necessary protection technology for the website is omitted, it will pose a threat to website security.

Summary of the invention

In view of the above problems, the present invention has been made in order to provide a website protection method and apparatus that overcomes the above problems or at least partially solves the above problems.

According to an aspect of the present invention, a website protection method is provided, including:

Sending a test request message to the website server, and receiving a response message returned by the website server;

Parsing the response message to determine a type of the website;

Setting corresponding security protection rules for the website according to the type of the website;

The website is secured according to the corresponding security protection rules set.

According to another aspect of the present invention, there is also provided a website protection device comprising:

a messaging unit, configured to send a test request message to the website server, and receive a response message returned by the website server;

a website type determining unit, configured to parse the response message, and determine a type of the website;

a rule setting unit, configured to set a corresponding security protection rule for the website according to the type of the website;

The security protection unit is configured to perform security protection on the website according to the corresponding security protection rules set.

It can be seen that the present invention automatically selects the corresponding security protection technology by identifying the type of the website, and the implementation process does not require manual intervention, and has the advantages of convenience and speed, and can truly realize the “one-click” setting; Different types of security protection technologies are set to avoid the security risks caused by human error, and can provide accurate security protection solutions for websites.

The above description is only an overview of the technical solutions of the present invention, and the above-described and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 shows a flow chart of a website protection method according to an embodiment of the present invention;

Figure 2 shows a block diagram of an intelligent electronic device for performing the method according to the invention;

Figure 3 shows a schematic diagram of a storage unit for holding or carrying program code implementing the method according to the invention.

detailed description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the embodiments of the present invention have been shown in the drawings, the embodiments Rather, these embodiments are provided so that this disclosure will be more fully understood and the scope of the disclosure will be fully disclosed.

A website is a collection of related web pages for displaying specific content created on the Internet using tools such as HTML according to certain rules. According to the function, the website can be divided into: portal, forum, community, blog, e-commerce website, enterprise website. These sites have different levels and requirements for security protection. Taking the portal as an example, due to the large number of users and large page views, there is a high security risk. The most common web application security vulnerabilities include: SQL injection, XSS cross-site, form bypass, cookie spoofing, information leakage, Google Hacking, access control errors, PHP-specific exploits, and variable abuse. Use, file inclusion, upload vulnerability attacks, web page tampering, hanging horses, etc. The web application firewall provides a converged solution for web security and web application delivery for web services of various websites, ensuring the security and performance of web services. The web application firewall can set security rules, that is, set corresponding security protection technologies for the above different security vulnerabilities.

The invention provides a website protection method, which automatically loads the corresponding protection technology of the type by identifying the website type, thereby realizing the website security protection accurately and conveniently.

FIG. 1 is a flowchart of a website protection method according to an embodiment of the present invention, which mainly includes:

S101: Send a test request message to the website server, and receive a response message returned by the website server;

Specifically, the service node sends a test request message to the website server. For example, the firewall server sends a test request to the web site server, and the firewall server is responsible for parsing the data returned by the website.

Before the firewall server sends the test request message to the website server, the method further includes: constructing the test request message according to the predetermined rule. The following is an example.

At present, there is a special content management system to provide users with website construction services. Dedecms is called "weaving dreams" and is a PHP open source website content management system. Website construction can be achieved through the dedecms template. The following website that will be built through the dedecms system is called "dedecms type website".

Phpcms is also a website content management system and an open source PHP development framework. Website construction can be achieved through the Phpcms template. The following website that is built through the Phpcms system is called "Phpcms type website."

For example, for a dedecms type of website, you can construct a test request message:

"http://www.test.com/dede/login.php"; if the response is normal, returning a non-404 page, you can perform subsequent response resolution. It can be seen that the above test request message is implemented by constructing a URL (Uniform Resource Locator) for testing including a "dede" field.

As another example, for a phpcms type of website, a test request message can be constructed:

"http://www.test.com/index.php?m=member&c=index&a=register". If the response is normal, returning a non-404 page, you can perform subsequent response resolution. It can be seen that the above test request message is implemented by constructing a URL for testing containing a "php related" field.

S102: Parse the response message to learn the type of the website;

Specifically, the corresponding website type is determined according to the identifier parsed from the corresponding information. For example, the firewall server parses the response message and learns the type of the website based on the uri and the submitted parameters.

Among them, uri refers to the Uniform Resource Identifier, which is used to locate each resource (HTML document, image, video clip, program, etc.) available on the Web.

A URI generally consists of three parts:

1, the host name.

The name of the resource itself, represented by the path.

Refer to the following URI, which conforms to the current RFC 4395 specification: protocol name:://domain name.root domain/directory/filename.suffix.

For example: "http://bc/d/ef" (assuming bc is an available domain name, ef is a standard file), the interpretation of this URI is: This is a resource accessible through the HTTP protocol, located in the host bc On the host, access the "d" folder on the host through the string "/d" in the URI, and request access to the file "/d/ef" on the host through "ef". Another example is the URI: "mailto: name@domain", which points to a user's mailbox.

2, the identifier

Some URIs point to the inside of a resource. This URI ends with "#" followed by an anchor identifier (called a fragment identifier). For example, here is a URI pointing to section_2:

Protocol://domain name/directory/file# fragment identifier (for example: /a/b.php#a).

3, relative URI

The relative URI does not contain any naming specification information. Its path usually refers to resources on the same machine. Relative URIs may contain relative paths (eg, ".." means the previous path) and may also contain fragment identifiers.

The firewall server identifies the uri specific characters and parameters based on the parsing of the response message, and learns the type of the website.

For example, for a dedecms type website, the response message contains a unique rule, for example:

1, uri is "/include/common\.inc\.php", and the submitted data contains "GLOBALS";

2, uri is "/plus/carbuyaction\.php", and the parameters submitted are "../".

As another example, for Phpcms type websites, the response message contains unique rules, as follows:

1, uri is "/yp/product.php", and the parameters submitted are "\bpagesize\s*=.*?print" mode data;

2, for all uri, the submitted parameters have "\ba\s*=\s*account_manage_avatar\b" mode data, and the submitted data has "\b<\?php\b" Mode data.

That is, if the firewall server parses out the above specific data/parameters, the corresponding website type can be known.

S103: Set corresponding security protection rules for the website according to the type of the website;

For example, if it is identified as a dedecms type website, the protection technology corresponding to the dedecms type website is automatically set, if the Phpcms type website is identified; the corresponding protection technology of the Phpcms type is automatically set. Surgery.

In a specific implementation, different security rule bases may be set for different types of websites in advance. After the website type is identified, the corresponding security rule base is automatically invoked, so that the corresponding security protection technology is selected according to the website type.

For example, for a certain type of website, the security rule library contains security rules: SQL injection attack filtering, page tampering and recovery functions, and control of the application layer to restrict some users from uploading files and accessing sensitive pages. , comprehensive tracking and analysis of suspicious ip, and so on. For another type of website, the security rules library contains security rules: SQL injection attack filtering, XSS cross-site identification, form bypass identification, anti-page tampering, and so on.

Those skilled in the art understand that the security level is different for various types of websites, but some conventional general security protection technologies are required by most websites. In addition to general protection technologies, specific websites need additional supplements according to requirements. Special protection technology. Therefore, before the setting of the corresponding security protection rule for the website, the method further includes: dividing the security protection rule into a general security protection rule and a special security protection rule. Correspondingly, setting the corresponding security protection rules for the website includes: setting the general security protection rules and the corresponding special security protection rules as the protection rules of the website according to the determined type of the website. This ensures targeted security protection for the website.

S104: Perform security protection on the website according to the set security protection rules.

The firewall server runs the security rules set in step 103 above to provide corresponding security protection for the website. For example, the security rules including "filtering of SQL injection attacks, page tampering and recovery functions, control of the application layer to restrict access to files and access to sensitive pages, and full tracking and analysis of suspicious ips" are initiated. The library, the firewall server provides these security protections for the website. In a specific implementation, the access request message is matched with the security protection rule for the website, and if the security protection rule is hit, it is considered as an attack, so the access request message is filtered out; if it is missed, it is considered to be safe. Therefore, the access request message is released.

Corresponding to the above method, the present invention also provides a website protection device. The device can be implemented by hardware, software, or a combination of hardware and software. Specifically, the device may refer to a functional entity inside a service node (for example, a firewall server) or the service node device itself, as long as the function of the device is implemented.

Specifically, the website protection device includes:

a website type determining unit for parsing the response message and determining the type of the website;

The security protection unit is used to protect the website according to the corresponding security protection rules.

Preferably, the apparatus further comprises: a test message construction unit configured to construct a test request message according to a predetermined rule.

Preferably, the apparatus further includes: a website type classification unit, configured to determine a corresponding website type according to the identifier parsed from the corresponding information.

2, uri is "/plus/carbuyaction\.php", and the parameters submitted are "../".

The rule setting unit is further configured to divide the security protection rules into general security protection rules and special security protection rules. Correspondingly, the rule setting unit sets a general security protection rule and a corresponding special security protection rule as the protection rule of the website according to the determined type of the website.

Preferably, the message sending and receiving unit is further configured to receive an access request message to the website, and correspondingly, the security protection unit matches the access request message with the security protection rule, and if the access request message hits the security protection rule, filtering the access Request message; if missed, release the access request message.

The algorithms and displays provided here are not inherent to any particular computer, virtual system, or other device. Related. Various general purpose systems can also be used with the teaching based on the teachings herein. The structure required to construct such a system is apparent from the above description. Moreover, the invention is not directed to any particular programming language. It is to be understood that the invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

Similarly, the various features of the invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components of the website protection device in accordance with embodiments of the present invention. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the present invention can be stored On a computer readable medium, or in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, FIG. 2 illustrates an intelligent electronic device that can implement a method of implementing cloud killing against a kill test in accordance with the present invention. The intelligent electronic device conventionally includes a processor 210 and a computer program product or computer readable medium in the form of a memory 220. The memory 220 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. The memory 220 has a memory space 230 for program code 231 for performing any of the method steps described above. For example, storage space 230 for program code may include various program code 231 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to FIG. The storage unit may have a storage section or a storage space or the like arranged similarly to the storage 220 in the intelligent electronic device of FIG. 2. The program code can be compressed, for example, in an appropriate form. In general, the storage unit comprises a program 231' for performing the steps of the method according to the invention, ie a code readable by a processor, such as 210, which, when run by the intelligent electronic device, causes the intelligent electronic device Perform the various steps in the method described above.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to be limiting, and that the invention may be devised without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims

A website protection method, comprising:

Sending a test request message to the website server, and receiving a response message returned by the website server;

Parsing the response message to determine a type of the website;

Setting corresponding security protection rules for the website according to the type of the website;

The website is secured according to the corresponding security protection rules set.
The method of claim 1, before the sending the test request message to the website server, further comprising: constructing the test request message according to the predetermined rule.
The method of claim 1, the determining the type of the website comprises: determining a corresponding website type based on the identification parsed from the corresponding information.
The method of claim 1, before the setting a corresponding security protection rule for the website according to the type of the website, further comprising: dividing the security protection rule into a general security protection rule and a special security protection rule.
The method according to claim 4, wherein the setting a corresponding security protection rule for the website according to the type of the website comprises: setting a general security protection rule and corresponding special security protection according to the determined type of the website Rules serve as a protection rule for the site.
The method according to any one of claims 1-5, the security protection of the website according to the set security protection rule, comprising: if the access request message for the website hits the security protection rule, The access request message is filtered out; if not, the access request message is released.
A website protection device, comprising:

a messaging unit, configured to send a test request message to the website server, and receive a response message returned by the website server;

a website type determining unit, configured to parse the response message, and determine a type of the website;

a rule setting unit, configured to set a corresponding security protection rule for the website according to the type of the website;

The security protection unit is configured to perform security protection on the website according to the corresponding security protection rules set.
The apparatus of claim 7, the apparatus further comprising: a test message construction unit for constructing a test request message according to a predetermined rule.
The apparatus according to claim 7, further comprising: a website type classification unit configured to determine a corresponding website type based on the identification parsed from the corresponding information.
The apparatus according to claim 7, wherein said rule setting unit is further configured to use a security guard It is divided into general security protection rules and special security protection rules.
The apparatus according to claim 10, wherein the rule setting unit sets a general security protection rule and a corresponding special security protection rule as the protection rule of the website according to the determined type of the website.
The method according to any one of claims 7 to 11, the message transceiving unit is further configured to receive an access request message to the website, the security protection unit, the access request message and the security protection The rules are matched. If the access request message hits the security protection rule, the access request message is filtered out; if not, the access request message is released.
A computer program comprising computer readable code for causing a method of any one of claims 1-6 to be performed when the intelligent electronic device is operative to run the computer readable code.
A computer readable medium storing the computer program of claim 13.