WO2017219733A1 - 请求的响应方法及装置 - Google Patents

请求的响应方法及装置 Download PDF

Info

Publication number
WO2017219733A1
WO2017219733A1 PCT/CN2017/079731 CN2017079731W WO2017219733A1 WO 2017219733 A1 WO2017219733 A1 WO 2017219733A1 CN 2017079731 W CN2017079731 W CN 2017079731W WO 2017219733 A1 WO2017219733 A1 WO 2017219733A1
Authority
WO
WIPO (PCT)
Prior art keywords
http
information
http response
request
response information
Prior art date
Application number
PCT/CN2017/079731
Other languages
English (en)
French (fr)
Inventor
孔勇
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017219733A1 publication Critical patent/WO2017219733A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the field of communications, and in particular to a response method and apparatus for a request.
  • the anti-attack means always solves the problem of remedial measures after the attack occurs, and an effective solution has not been proposed yet.
  • the embodiment of the invention provides a method and a device for responding to a request, so as to at least solve the problem that the anti-attack means in the related art always make corresponding remedial measures after the attack occurs.
  • a method for responding to a request including:
  • the method before performing the scrambling process on the HTTP response information, the method further includes:
  • performing the scrambling process on the HTTP response information includes: performing a scrambling process on a header and a packet of the HTTP response information.
  • performing a scrambling process on the header and the packet of the HTTP response information including: adding a predefined hash content to a package body of the HTTP response information; and lengthening a content length in the packet header information
  • the field is modified to increase the length of the content after the hash content.
  • the hash content includes: hidden attribute information, a fake hyperlink.
  • the method further includes: backing up the log audit information into a message queue implemented based on the in-memory database.
  • a request response device including:
  • the forwarding module is configured to forward the HTTP request to the destination server when receiving the hypertext transfer protocol HTTP request sent by the attacker and carrying the attack information
  • the obtaining module is configured to obtain the corresponding HTTP request from the destination server
  • the HTTP response information is configured to perform the scrambling process on the HTTP response information
  • the sending module is configured to send the HTTP response information after the scrambling process to the attacker.
  • the apparatus further includes: a determining module, configured to determine whether the HTTP request is in a scope of the scrambling process, and if yes, perform the scrambling process on the HTTP response information.
  • a determining module configured to determine whether the HTTP request is in a scope of the scrambling process, and if yes, perform the scrambling process on the HTTP response information.
  • the hash processing module is configured to perform a scrambling process on a header and a packet of the HTTP response information.
  • the hash processing module includes: an adding unit, configured to add a predefined hash content to a package body of the HTTP response information; and a modifying unit configured to set the content in the packet header information
  • the length field is modified to increase the length of the content after the hash content.
  • a computer storage medium is further provided, and the computer storage medium may store an execution instruction for performing the implementation of the response method of the request in the foregoing embodiment.
  • the HTTP request When receiving the Hypertext Transfer Protocol HTTP request carrying the attack information sent by the attacker, the HTTP request is forwarded to the destination server; and the HTTP response information corresponding to the HTTP request is obtained from the destination server.
  • the HTTP response information is subjected to the scrambling process; the HTTP response information after the scrambling process is sent to the attacker, and the technical solution is adopted to solve the related art, and the anti-attack means is always after the attack occurs.
  • the problem of corresponding remedial measures can be made, so that when the attacker launches an attack, the corresponding remedial measures can be made.
  • FIG. 1 is a flow chart of a method for responding to a request according to an embodiment of the present invention
  • FIG. 2 is a structural block diagram of a response device of a request according to an embodiment of the present invention
  • FIG. 3 is a block diagram showing another structure of a response device of a request according to an embodiment of the present invention.
  • FIG. 4 is a network topology diagram according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of execution of a security gateway according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for responding to a request according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:
  • Step S102 when receiving the Hypertext Transfer Protocol (HTTP) request carrying the attack information sent by the attacker, forwarding the HTTP request to the destination server;
  • HTTP Hypertext Transfer Protocol
  • Step S104 Obtain HTTP response information corresponding to the HTTP request from the destination server, and perform interference processing on the HTTP response information.
  • Step S106 Send the HTTP response information after the scrambling process to the attacking party.
  • the HTTP request After receiving the Hypertext Transfer Protocol (HTTP) request with the attack information sent by the attacker, the HTTP request is forwarded to the destination server; and the HTTP response information corresponding to the HTTP request is obtained from the destination server.
  • the HTTP response letter Interference processing is performed; the HTTP response information after the scrambling process is sent to the attacker, and the above technical solution is adopted to solve the related technology, and the anti-attack means always make corresponding remedial measures after the attack occurs.
  • the problem in turn, can make corresponding remedial measures when the attacker launches an attack, which greatly improves the reliability of the WEB webpage.
  • the following solution may also be implemented: determining whether the HTTP request is in the scope of the scrambling process, and if so, performing the scrambling process on the HTTP response information, in fact, the scrambling process
  • the Scope contains which needs to be configured in advance. When receiving the Hypertext Transfer Protocol HTTP request sent by the attacker and carrying the attack information, it can determine whether the HTTP request is in the scope.
  • the scrambling process of step S104 may be implemented by performing a scrambling process on a header and a packet of the HTTP response information, specifically, adding the pre-defined hash content to the HTTP response information.
  • the content length field in the header information is modified to increase the content length after the hash content, wherein the hash content includes: hidden attribute information, false hyperlink.
  • the foregoing method further includes: backing up the log audit information to a message queue implemented based on the in-memory database.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, In the optical disc, includes a plurality of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform various embodiments of the present invention method.
  • a terminal device which may be a mobile phone, a computer, a server, or a network device, etc.
  • a request response device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again.
  • the term "module” is a combination of software and/or hardware that can perform a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 2 is a structural block diagram of a response device of a request according to an embodiment of the present invention. As shown in FIG. 2, the device includes:
  • the forwarding module 20 is configured to: when receiving the Hypertext Transfer Protocol HTTP request carrying the attack information sent by the attacker, forwarding the HTTP request to the destination server;
  • the obtaining module 22 is configured to obtain HTTP response information corresponding to the HTTP request from the destination server;
  • the scrambling processing module 24 is configured to perform a scrambling process on the HTTP response information
  • the sending module 26 is configured to send the HTTP response information after the scrambling process to the attacking party.
  • FIG. 3 is another structural block diagram of a response device of a request according to an embodiment of the present invention. As shown in FIG. 3, the device includes:
  • the determining module 28 is configured to determine whether the HTTP request is in the scope of the scrambling process, If yes, the HTTP response information is scrambled.
  • the scrambling processing module 24 is configured to perform a scrambling process on the header and the packet of the HTTP response information.
  • the scrambling processing module 24 includes: an adding unit 240, configured to be pre-defined. The hash content is added to the body of the HTTP response information; the modifying unit 242 is configured to modify the content length field in the header information to increase the content length after the hash content.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • the purpose of the preferred embodiment of the present invention is to provide a webpage content scrambling and log audit information backup method, which can proactively defend the HTTP response content and the web server log audit information, and mainly includes the following steps:
  • Step 1 Build a reverse proxy server between the web server and the user (as shown in Figure 4).
  • the reverse proxy server is based on Nginx; implement message forwarding and routing rules on the reverse proxy server, and then the user and the web.
  • the messaging between the servers is handled and forwarded via the reverse proxy server, while the reverse proxy server is transparent and invisible to the user and the server;
  • Step 2 Configure the Nginx-based functional module on the reverse proxy server, including the HTTP response content scrambling module and the server log audit information backup module.
  • the two modules are serially executed, that is, in HTTP.
  • the server log audit information backup module processes the server log audit information, and the processing flow is as shown in FIG. 2; the configuration file is modified to determine the scope (all HTTP requests, all web server response requests, or Specify the URI, etc.), the function module and the execution instruction; complete the compilation and installation; after the function module is added, restart the reverse proxy server to make the function module take effect;
  • Step 3 The attacker initiates a request to the server or uses a vulnerability scanning tool to sniff or attack
  • the HTTP request is sent to the reverse proxy server;
  • the reverse proxy server obtains the request content, and forwards the request to the upstream server;
  • the upstream server constructs the response content according to the HTTP request, including the response header and the package body, and sends the response to the reverse proxy server;
  • Step 4 The webpage content scrambling module on the reverse proxy server obtains the HTTP response packet content, and completes the HTTP response content scrambling. This step is implemented by the following substeps:
  • the content mixing module first reads the configuration item in the configuration file, that is, whether the specified configuration switch for adding the hash content is turned on; then, the HTTP response header and the package body are retrieved and processed, and the content confusion function is completed. For the following substeps, as shown in Figure 5:
  • FIG. 5 is only used to explain the steps (4.3.1) to 6 but is not used to limit the embodiment of the present invention.
  • FIG. 5 can also be understood as the content of step S4.3.
  • the specific implementation process of the scrambling function is only used to explain the steps (4.3.1) to 6 but is not used to limit the embodiment of the present invention.
  • FIG. 5 can also be understood as the content of step S4.3.
  • the specific implementation process of the scrambling function is only used to explain the steps (4.3.1) to 6 but is not used to limit the embodiment of the present invention.
  • FIG. 5 can also be understood as the content of step S4.3.
  • the specific implementation process of the scrambling function is only used to explain the steps (4.3.1) to 6 but is not used to limit the embodiment of the present invention.
  • FIG. 5 can also be understood as the content of step S4.3.
  • the specific implementation process of the scrambling function is only used to explain the steps (4.3.1) to 6 but is not used to limit the embodiment of the present invention.
  • the content of the hash includes hidden attributes, several fake hyperlinks, and each hyperlink points to a fake URL.
  • the hidden attribute is added so as not to affect the normal user browsing the website, and the access response content of the fake link is still processed by the content, so The web scanner will fall into an infinite loop of fake connections and will not be able to get real and effective website structure and sensitive page information.
  • the content of the scrambling is as follows:
  • Step 5 The log audit information backup module on the reverse proxy server writes the message in the custom format to the message queue based on the in-memory database redis and implements the off-site read, and completes the log audit information off-site backup read.
  • the step is as follows: Substeps to achieve:
  • the on-site information has been stored in the message queue in the log audit information backup module, and then the on-site information is read.
  • the reading method can be multiple readings and one-time consumption, depending on different needs of consumers such as mail service, short message service, and log backup service. This step is divided into the following substeps:
  • the host address is the IP address where the reverse proxy server is located. Use the PING command to ensure the connection is successful.
  • Step 6 Send the HTTP response header and the response packet to the user, and the client receives the response message processed by the content confusion and the log audit information backup module, thereby realizing content confusion and log audit information backup, and achieving effective The purpose of protecting server information.
  • the embodiment of the invention achieves the following technical effects: when the attacker scans the web application website structure and the sensitive page information, the return information is mixed, the effective information acquired by the attacker is confused, and the attacker's detection scan cost is increased. After the attacker completes the attack through the vulnerability, the log audit information can also be used to back up the offsite information of the attacker attacking the site information. Prevent scene information from being destroyed. Compared with the traditional Web security defense, the present invention can not only confuse the attacker's audiovisual before the attack occurs, but also save the attack site information after the attack is completed, and can be flexibly configured, transparent to normal users, and has good scalability. portability.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • S2 Obtain HTTP response information corresponding to the HTTP request from the destination server, and perform interference processing on the HTTP response information;
  • S3 Send the HTTP response message after the scrambling process to the attacker.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the foregoing technical solution provided by the embodiment of the present invention may be applied to the request response process, and when receiving the Hypertext Transfer Protocol HTTP request carrying the attack information sent by the attacker, forwarding the HTTP request to the destination server;
  • the destination server obtains the HTTP response information corresponding to the HTTP request, performs the scrambling process on the HTTP response information, and sends the HTTP response information after the scrambling process to the attacking party, and solves the related problem by using the foregoing technical solution.
  • the anti-attack means always solves the problem after the attack occurs, so that the attacker can make corresponding remedial measures when the attacker launches the attack.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明提供了一种请求的响应方法及装置，其中，所述方法包括：当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；从所述目的服务器获取对应所述HTTP请求的HTTP响应信息，对所述HTTP响应信息进行混扰处理；将经过混扰处理后的HTTP响应信息发送至所述攻击方，采用上述技术方案，解决了相关技术中，防攻击手段总是在攻击发生之后才做出相应的补救措施的问题，进而能够在攻击者发起攻击时，就能够作出相应的补救措施。

Description

请求的响应方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及一种请求的响应方法及装置。
背景技术
在互联网普及率越来越高的今天，生活中网络已经无处不在了。从个人电脑(Personal Computer，简称为PC)时代到移动互联网时代再到将来的物联网时代，网络带来的方便、快捷已然让人们深受其利。然而，不管是广大互联网用户还是IT公司，对网络安全的重视一直未能做到防范于未然，多数情况都是“亡羊补牢”。近年来，针对网络的各种攻击事件频繁发生，给网络安全敲响了警钟，尽管人们采用了各种方法和工具来加强网络通信的安全，但攻击成功的事件数量还是在不断上升。近年来比较“著名”的网络安全事件比如某旅游软件的漏洞事件：安全支付日志可便利下载导致大量用户银行卡信息泄露(包含持卡人姓名身份证、银行卡号、卡CVV码、6位卡Bin)。该漏洞一经曝出就引发了人们关于“电商网站存储用户信用卡等敏感信息，并存在泄露风险”的热议。还有快递1400万信息泄露，交易网站数据的大泄露、500万账户信息被泄、某影业公司的摄影计划、明星隐私、未发表的剧本等敏感信息被窃取、订票网站用户数据泄露含身份证及密码信息等等一系列事件，网络安全的重要性被提升到前所未有的高度。
目前，网民对涉及财产安全和信息隐私的安全困扰最为关注，其关注前三名分别为网络支付不安全、信息泄露和账号盗取。
由于网络设计之初所具有的开放、互连、共享性，就决定了现在的网络是不安全的，网络频遭各种攻击与破坏。新的攻击手段和方法也越来越多、层出不穷、千变万化。
传统的防火墙和入侵检测系统是一种被动的、静态的防卫手段。面对 不断出现的新攻击方法，传统的被动防御的手段越来越显得力不从心，常常是系统被攻击之后才做出相应的反应，这样的防御总在攻击发生之后才做出补救措施。
针对相关技术中，防攻击手段总是在攻击发生之后才做出相应的补救措施的问题，尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种请求的响应方法及装置，以至少解决相关技术中防攻击手段总是在攻击发生之后才做出相应的补救措施的问题。
根据本发明的一个实施例，提供了一种请求的响应方法，包括：
当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；从所述目的服务器获取对应所述HTTP请求的HTTP响应信息，对所述HTTP响应信息进行混扰处理；将经过混扰处理后的HTTP响应信息发送至所述攻击方。
可选地，对所述HTTP响应信息进行混扰处理之前，所述方法还包括：
判断所述HTTP请求是否处于混扰处理的作用域内，如果是，对所述HTTP响应信息进行混扰处理。
可选地，对所述HTTP响应信息进行混扰处理，包括：对所述HTTP响应信息的包头和包体进行混扰处理。
可选地，对所述HTTP响应信息的包头和包体进行混扰处理，包括：将预先定义的混扰内容添加至所述HTTP响应信息的包体中；将所述包头信息中的内容长度字段修改为增加了所述混扰内容之后的内容长度。
可选地，所述混扰内容包括：隐藏属性信息、虚假超链接。
可选地，所述方法还包括：将日志审计信息备份到基于内存数据库实现的消息队列中。
根据本发明的另一个实施例，还提供了一种请求的响应装置，包括：
转发模块，设置为当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；获取模块，设置为从所述目的服务器获取对应所述HTTP请求的HTTP响应信息；混扰处理模块，设置为对所述HTTP响应信息进行混扰处理；发送模块，设置为将经过混扰处理后的HTTP响应信息发送至所述攻击方。
可选地，所述装置还包括：判断模块，设置为判断所述HTTP请求是否处于混扰处理的作用域内，如果是，对所述HTTP响应信息进行混扰处理。
可选地，所述混扰处理模块，设置为对所述HTTP响应信息的包头和包体进行混扰处理。
可选地，所述混扰处理模块，包括：添加单元，设置为将预先定义的混扰内容添加至所述HTTP响应信息的包体中；修改单元，设置为将所述包头信息中的内容长度字段修改为增加了所述混扰内容之后的内容长度。
在本发明实施例中，还提供了一种计算机存储介质，该计算机存储介质可以存储有执行指令，该执行指令用于执行上述实施例中的请求的响应方法的实现。
通过本发明实施例，当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；从所述目的服务器获取对应所述HTTP请求的HTTP响应信息，对所述HTTP响应信息进行混扰处理；将经过混扰处理后的HTTP响应信息发送至所述攻击方，采用上述技术方案，解决了相关技术中，防攻击手段总是在攻击发生之后才做出相应的补救措施的问题，进而能够在攻击者发起攻击时，就能够作出相应的补救措施。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为根据本发明实施例的请求的响应方法的流程图；
图2是根据本发明实施例的请求的响应装置的结构框图；
图3是根据本发明实施例的请求的响应装置的另一结构框图；
图4为根据本发明实施例的网络拓扑关系图；
图5为根据本发明实施例的安全网关执行流程图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
实施例1
在本发明实施例中，提供了一种请求的响应方法，图1为根据本发明实施例的请求的响应方法的流程图，如图1所示，包括以下步骤：
步骤S102，当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；
步骤S104，从目的服务器获取对应HTTP请求的HTTP响应信息，对HTTP响应信息进行混扰处理；
步骤S106，将经过混扰处理后的HTTP响应信息发送至攻击方。
通过上述各个步骤，当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；从所述目的服务器获取对应所述HTTP请求的HTTP响应信息，对所述HTTP响应信 息进行混扰处理；将经过混扰处理后的HTTP响应信息发送至所述攻击方，采用上述技术方案，解决了相关技术中，防攻击手段总是在攻击发生之后才做出相应的补救措施的问题，进而能够在攻击者发起攻击时，就能够作出相应的补救措施，大大提升了WEB网页的可靠性。
在执行步骤S104之前，在本发明实施例中，还可以执行以下方案：判断HTTP请求是否处于混扰处理的作用域内，如果是，对HTTP响应信息进行混扰处理，实际上，混扰处理的作用域包含哪些是需要提前配置好的，当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，就可以判断该HTTP请求是否位于作用域内。
在一个可选实施例中，步骤S104的混扰处理可以通过以下方案实现：对HTTP响应信息的包头和包体进行混扰处理，具体地，将预先定义的混扰内容添加至HTTP响应信息的包体中；将包头信息中的内容长度字段修改为增加了混扰内容之后的内容长度，其中，混扰内容包括：隐藏属性信息、虚假超链接。
可选地，上述方法还包括：将日志审计信息备份到基于内存数据库实现的消息队列中。
通过本发明实施例的上述技术方案，即在攻击发生之前收集Web应用网站结构信息和敏感页面时给攻击者返回添加了混扰内容的信息；在攻击发生之后隐蔽地完成对攻击现场的异地备份。对攻击者进行诱导和迷惑，增加其攻击成本和时间，且有效地防止了服务器信息的泄露。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例的 方法。
实施例2
在本实施例中还提供了一种请求的响应装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”是可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图2是根据本发明实施例的请求的响应装置的结构框图，如图2所示，该装置包括：
转发模块20，设置为当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；
获取模块22，设置为从目的服务器获取对应HTTP请求的HTTP响应信息；
混扰处理模块24，设置为对HTTP响应信息进行混扰处理；
发送模块26，设置为将经过混扰处理后的HTTP响应信息发送至攻击方。
通过上述各个模块的综合作用，当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；从所述目的服务器获取对应所述HTTP请求的HTTP响应信息，对所述HTTP响应信息进行混扰处理；将经过混扰处理后的HTTP响应信息发送至所述攻击方，采用上述技术方案，解决了相关技术中，防攻击手段总是在攻击发生之后才做出相应的补救措施的问题，进而能够在攻击者发起攻击时，就能够作出相应的补救措施，大大提升了WEB网页的可靠性。
图3是根据本发明实施例的请求的响应装置的另一结构框图，如图3所示，该装置包括：
判断模块28，设置为判断HTTP请求是否处于混扰处理的作用域内， 如果是，对HTTP响应信息进行混扰处理。
可选地，混扰处理模块24，设置为对HTTP响应信息的包头和包体进行混扰处理，如图3所示，混扰处理模块24，包括：添加单元240，设置为将预先定义的混扰内容添加至HTTP响应信息的包体中；修改单元242，用于将包头信息中的内容长度字段修改为增加了混扰内容之后的内容长度。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
为了更好的理解上述请求的响应过程，以下结合优选实施例进行说明，但不用于限定本发明实施例。
本发明优选实施例的目的在于提供一种网页内容混扰和日志审计信息备份方法，能够对HTTP响应内容和Web服务器日志审计信息进行主动性的防御处理，主要包括以下步骤：
步骤1：在Web服务器与用户之间搭建一个反向代理服务器(如图4所示)，该反向代理服务器基于Nginx实现；在反向代理服务器上实现消息转发和路由规则，之后用户和Web服务器之间的消息传递都经由反向代理服务器处理和转发，而对于用户和服务器来说反向代理服务器是透明不可见的；
步骤2：在反向代理服务器上配置基于Nginx的功能模块，包括HTTP响应内容混扰模块和服务器日志审计信息备份模块两个部分，这两个模块在微观上是串行执行的，即在HTTP响应内容混扰模块生效之后，服务器日志审计信息备份模块再对服务器日志审计信息进行处理，处理流程如附图2所示；修改配置文件，确定作用域(所有HTTP请求、所有Web服务器响应请求或者指定URI等)、功能模块及执行指令；完成编译安装；功能模块添加完成之后，重新启动反向代理服务器，让功能模块生效；
步骤3：攻击者向服务器发起请求或使用漏洞扫描工具进行嗅探或攻 击，HTTP请求发送到反向代理服务器；反向代理服务器获取请求内容，将请求转发给上游服务器；上游服务器根据HTTP请求构造响应内容，包括响应包头和包体，发送给反向代理服务器；
步骤4：反向代理服务器上的网页内容混扰模块获取HTTP响应包内容，完成HTTP响应内容混扰，该步骤通过以下子步骤来实现：
(4.1)查看服务器配置文件，确定此次请求是否在内容混扰模块作用域内，如果不在，跳到步骤6；
(4.2)如果此次请求在此模块作用域内，则启动内容混扰模块，将此请求交由此模块处理；
(4.3)内容混扰模块首先读取配置文件中的配置项，即指定的添加混扰内容的配置开关是否打开；然后检索并处理HTTP响应包头和包体，完成内容混扰功能，此步骤分为以下几个子步骤，如图5所示：
需要说明的是，图5中的步骤描述仅用来解释说明一下步骤(4.3.1)至步骤6，但不用来限定本发明实施例，图5也可以理解为是对步骤S4.3中内容混扰功能的具体实现流程。
(4.3.1)解析HTTP响应头部中的信息，判断Content Type是否为text/plain；如果是，将此模块上下文信息中的配置项ctx->add_prefix设为1；如果不是，则跳转到步骤5；此处只对网页HTML内容做处理，如果对其他格式的响应比如图片文件、CSS格式文件做处理，会导致图片和CSS格式文件无法被正常解析；
(4.3.2)修改HTTP响应头部信息中的content length字段，在原来的基础上加上混扰内容的长度，确保HTTP响应体完整；
(4.3.3)在HTTP包体处理过程中，完成添加混扰内容；此步骤包括以下几个子步骤：
(4.3.3.1)定义要添加的混扰内容，混扰内容包括隐藏属性、若干虚假超链接，每个超链接又指向虚假的URL。添加隐藏属性是为了不影响正常用户浏览网站，虚假链接的访问响应内容依然会经过内容混扰处理，故 Web扫描器将陷入虚假连接的死循环中，无法获取真实有效的网站结构和敏感页面信息。混扰内容简略如下所示：
static ngx_str_t filter_prefix＝ngx_string("<div style＝'display:none；'><p>'Can you come to-morrow？'<a href＝'base.php？rub＝'>Traffic Analysis for</a>unpardonable in me.'<a href＝'buy'>Your password is*Remember this for later use</a>Elizabeth felt herself completely taken in.She had fully proposed being<a href＝'view.php？b＝'>appSettings</a>upon yourself alone.'<a href＝'freedownload.asp？bookid＝'>Warning:*am able*write**configuration file</a>attending it,and occasionally from some peevish allusions of her<a href＝'index2.php？p＝'>Most Submitted Forms and Scripts</a>very tender affection for Bingley.Having never even fancied herself<a href＝'config.php？_CCFG[_PKG_PATH_DBSE]＝'>This summary was generated by wwwstat</a>tears and lamentations of regret,invectives against the villainous<a href＝'path.php？pre＝'>WebSTAR Mail-Please Log In</a>her,after his return from</p></div>")；
(4.3.3.2)查看上下文中的add_prefix是否为1，如果为1表示需要进行处理，否则跳到步骤5；
(4.3.3.3)将上下文信息中的add_prefix设为2，表明已经处理过，防止重复处理；
(4.3.3.4)从内存池中生成ngx_chain_t链表，将上一步定义的混扰内容添加到链表的头部，即添加到HTTP响应包体的头部；
步骤5：反向代理服务器上的日志审计信息备份模块将自定义格式的消息写入基于内存数据库redis实现的消息队列中并实现异地读取，完成日志审计信息异地备份读取，该步骤通过以下子步骤来实现：
(5.1)将redis嵌入Nginx模块中，安装redis和redis的C语言客户端到反向代理服务器；
(5.2)在日志审计信息备份模块完成redis连接初始化工作，通过 PING心跳连接确保连接成功；如果连接不成功，进行出错处理，跳到步骤6；
(5.3)创建消息队列，确定消息队列名称，不同的模块具有不同的消息队列，更方便读取时的分类和统计；
(5.4)将需要存储的现场信息进行格式化，然后通过redisCommand命令写入到上一步创建的消息队列中，采用list的数据格式；
(5.5)现场信息存储完毕之后关闭redis连接，按照HTTP框架中的顺序执行将HTTP响应包头和包体转发给下一个HTTP过滤模块；
(5.6)现场信息已经存入日志审计信息备份模块中的消息队列，接下来完成现场信息的读取。读取方式可以是多次读取和一次性消费，取决于消费方如邮件服务、短信服务、日志备份服务等不同的需求。此步骤分为以下几个子步骤：
(5.6.1)在本地客户端的PHP中安装phpredis扩展，也可以根据本地服务器所采用的语言类型安装相应的redis扩展，例如Java、C#等等；
(5.6.2)初始化redis连接，主机地址为反向代理服务器所在的IP地址，使用PING命令确保连接成功；
(5.6.3)指定需要读取的消息队列名称，即为步骤5.3中指定的队列名称，设定读取方式之后读取现场信息，可以单条读取也可设定读取区间进行批量读取，可以看到现场信息在反向代理服务器中也得到了完整的保存；
步骤6：将HTTP响应包头和响应包体发送给用户，客户端收到的是经过内容混扰和日志审计信息备份模块处理过的响应消息，从而实现内容混扰和日志审计信息备份，达到有效保护服务器信息的目的。
本发明实施例达到了以下技术效果：在攻击者扫描Web应用网站结构、敏感页面信息时实现返回信息混扰，混淆攻击者获取的有效信息，增加攻击者的探测扫描成本。在攻击者通过漏洞完成攻击之后，也可以通过日志审计信息备份对攻击者发起攻击的现场信息进行隐蔽性的异地备份， 防止现场信息被破坏。本发明与传统Web安全防御相比，既可以在攻击发生之前混淆攻击者的视听，也可以在攻击完成之后保存攻击现场信息，而且可灵活配置，面向正常用户透明，具有良好的可扩展性、可移植性。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；
S2，从目的服务器获取对应HTTP请求的HTTP响应信息，对HTTP响应信息进行混扰处理；
S3，将经过混扰处理后的HTTP响应信息发送至攻击方。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明 的保护范围之内。
工业实用性
本发明实施例提供的上述技术方案，可以应用于请求的响应过程中，当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；从所述目的服务器获取对应所述HTTP请求的HTTP响应信息，对所述HTTP响应信息进行混扰处理；将经过混扰处理后的HTTP响应信息发送至所述攻击方，采用上述技术方案，解决了相关技术中，防攻击手段总是在攻击发生之后才做出相应的补救措施的问题，进而能够在攻击者发起攻击时，就能够作出相应的补救措施。

Claims (10)

  1. 一种请求的响应方法，包括：
    当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；
    从所述目的服务器获取对应所述HTTP请求的HTTP响应信息，对所述HTTP响应信息进行混扰处理；
    将经过混扰处理后的HTTP响应信息发送至所述攻击方。
  2. 根据权利要求1所述的方法，其中，对所述HTTP响应信息进行混扰处理之前，所述方法还包括：
    判断所述HTTP请求是否处于混扰处理的作用域内，如果是，对所述HTTP响应信息进行混扰处理。
  3. 根据权利要求1所述的方法，其中，对所述HTTP响应信息进行混扰处理，包括：
    对所述HTTP响应信息的包头和包体进行混扰处理。
  4. 根据权利要求3所述的方法，其中，对所述HTTP响应信息的包头和包体进行混扰处理，包括：
    将预先定义的混扰内容添加至所述HTTP响应信息的包体中；
    将所述包头信息中的内容长度字段修改为增加了所述混扰内容之后的内容长度。
  5. 根据权利要求4所述的方法，其中，所述混扰内容包括：隐藏属性信息、虚假超链接。
  6. 根据权利要求1所述的方法，其中，所述方法还包括：
    将日志审计信息备份到基于内存数据库实现的消息队列中。
  7. 一种请求的响应装置，包括：
    转发模块，设置为当接收到攻击方发送的携带有攻击信息的超文本传输协议HTTP请求时，将该HTTP请求转发至目的服务器；
    获取模块，设置为从所述目的服务器获取对应所述HTTP请求的HTTP响应信息；
    混扰处理模块，设置为对所述HTTP响应信息进行混扰处理；
    发送模块，设置为将经过混扰处理后的HTTP响应信息发送至所述攻击方。
  8. 根据权利要求7所述的装置，其中，所述装置还包括：
    判断模块，设置为判断所述HTTP请求是否处于混扰处理的作用域内，如果是，对所述HTTP响应信息进行混扰处理。
  9. 根据权利要求7所述的装置，其中，所述混扰处理模块，设置为对所述HTTP响应信息的包头和包体进行混扰处理。
  10. 根据权利要求9所述的装置，其中，所述混扰处理模块，包括：
    添加单元，设置为将预先定义的混扰内容添加至所述HTTP响应信息的包体中；
    修改单元，设置为将所述包头信息中的内容长度字段修改为增加了所述混扰内容之后的内容长度。
PCT/CN2017/079731 2016-06-21 2017-04-07 请求的响应方法及装置 WO2017219733A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610450731.5A CN107528811A (zh) 2016-06-21 2016-06-21 请求的响应方法及装置
CN201610450731.5 2016-06-21

Publications (1)

Publication Number Publication Date
WO2017219733A1 true WO2017219733A1 (zh) 2017-12-28

Family

ID=60735032

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/079731 WO2017219733A1 (zh) 2016-06-21 2017-04-07 请求的响应方法及装置

Country Status (2)

Country Link
CN (1) CN107528811A (zh)
WO (1) WO2017219733A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106878472A (zh) * 2017-04-20 2017-06-20 广东马良行科技发展有限公司 一种分布式集群数据服务方法及系统
CN112153001A (zh) * 2020-08-21 2020-12-29 杭州安恒信息技术股份有限公司 基于waf的网络通信方法、系统、电子装置和存储介质

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111083066B (zh) * 2018-10-19 2022-04-29 北京奇虎科技有限公司 物联网系统、设备消息流转方法及装置
CN109672744A (zh) * 2018-12-28 2019-04-23 中电福富信息科技有限公司 一种用户无感知的图像堡垒机方法及系统
CN109756501B (zh) * 2019-01-02 2020-05-22 中国科学院信息工程研究所 一种基于http协议的高隐匿网络代理方法及系统
CN113542302B (zh) * 2021-08-02 2023-05-02 北京知道创宇信息技术股份有限公司 攻击干扰方法、装置、网关及可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101304418A (zh) * 2007-05-09 2008-11-12 赛门铁克公司 客户端侧经由提交者核查来防止偷渡式域欺骗
US20090292925A1 (en) * 2006-04-13 2009-11-26 Alexander Meisel Method for providing web application security
CN104135507A (zh) * 2014-06-30 2014-11-05 北京奇艺世纪科技有限公司 一种防盗链的方法和装置
CN104378363A (zh) * 2014-10-30 2015-02-25 中国科学院信息工程研究所 一种动态应用地址转换方法及其网关系统
CN104994104A (zh) * 2015-07-06 2015-10-21 浙江大学 基于web安全网关的服务器指纹拟态和敏感信息拟态方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110138453A1 (en) * 2009-12-03 2011-06-09 Samsung Electronics Co., Ltd. Single sign-on in mixed http and sip environments
US9055100B2 (en) * 2013-04-06 2015-06-09 Citrix Systems, Inc. Systems and methods for HTTP-Body DoS attack prevention with adaptive timeout
CN105354269B (zh) * 2015-10-27 2019-07-12 中通服公众信息产业股份有限公司 基于反向代理及内容过滤的Web应用语言本地化方法和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090292925A1 (en) * 2006-04-13 2009-11-26 Alexander Meisel Method for providing web application security
CN101304418A (zh) * 2007-05-09 2008-11-12 赛门铁克公司 客户端侧经由提交者核查来防止偷渡式域欺骗
CN104135507A (zh) * 2014-06-30 2014-11-05 北京奇艺世纪科技有限公司 一种防盗链的方法和装置
CN104378363A (zh) * 2014-10-30 2015-02-25 中国科学院信息工程研究所 一种动态应用地址转换方法及其网关系统
CN104994104A (zh) * 2015-07-06 2015-10-21 浙江大学 基于web安全网关的服务器指纹拟态和敏感信息拟态方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106878472A (zh) * 2017-04-20 2017-06-20 广东马良行科技发展有限公司 一种分布式集群数据服务方法及系统
CN112153001A (zh) * 2020-08-21 2020-12-29 杭州安恒信息技术股份有限公司 基于waf的网络通信方法、系统、电子装置和存储介质
CN112153001B (zh) * 2020-08-21 2023-06-23 杭州安恒信息技术股份有限公司 基于waf的网络通信方法、系统、电子装置和存储介质

Also Published As

Publication number Publication date
CN107528811A (zh) 2017-12-29

Similar Documents

Publication Publication Date Title
WO2017219733A1 (zh) 请求的响应方法及装置
US10728274B2 (en) Method and system for injecting javascript into a web page
US9712560B2 (en) Web page and web browser protection against malicious injections
Gupta et al. Cross-site scripting (XSS) abuse and defense: exploitation on several testing bed environments and its defense
US9509714B2 (en) Web page and web browser protection against malicious injections
US8819819B1 (en) Method and system for automatically obtaining webpage content in the presence of javascript
US11886619B2 (en) Apparatus and method for securing web application server source code
US20180183749A1 (en) Automated message security scanner detection system
Kirda et al. Client-side cross-site scripting protection
WO2017101865A1 (zh) 一种数据处理方法和装置
JP5801437B2 (ja) フィッシング通知サービス
Senol et al. Leaky forms: A study of email and password exfiltration before form submission
US20190222587A1 (en) System and method for detection of attacks in a computer network using deception elements
US11503072B2 (en) Identifying, reporting and mitigating unauthorized use of web code
Sun et al. Model checking for the defense against cross-site scripting attacks
US20130160132A1 (en) Cross-site request forgery protection
CN113645234B (zh) 基于蜜罐的网络防御方法、系统、介质及装置
US11082437B2 (en) Network resources attack detection
Wedman et al. An analytical study of web application session management mechanisms and HTTP session hijacking attacks
Tedyyana et al. A real-time hypertext transfer protocol intrusion detection system on web server
US10686834B1 (en) Inert parameters for detection of malicious activity
Priyadarshini et al. A cross platform intrusion detection system using inter server communication technique
CN114048483A (zh) Xss漏洞的检测方法、装置、设备及介质
Gadient et al. Phish What You Wish
Bindra Efficacy of Anti-phishing Measures and Strategies-A research Analysis

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17814472

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17814472

Country of ref document: EP

Kind code of ref document: A1