WO2018018699A1

WO2018018699A1 - Website scripting attack prevention method and device

Info

Publication number: WO2018018699A1
Application number: PCT/CN2016/097198
Authority: WO
Inventors: 赖旭东; 杨冠文
Original assignee: 广州市乐商软件科技有限公司
Priority date: 2016-07-29
Filing date: 2016-08-29
Publication date: 2018-02-01
Also published as: CN106060090A

Abstract

The present invention relates to a website scripting attack prevention method and device. The website scripting attack prevention method comprises the following steps: intercepting request data packets received by a website, the request data packets comprising data contained in network requests which are received by the website and transmitted based on a hypertext transfer protocol; unpacking the request data packets to obtain to-be-checked format data; carrying out a matching check on the to-be-checked format data according to a preset security rule, and outputting security data; and packing the security data to obtain security data packets, and transmitting the security data packets to a core component of the website, the core component comprising a management component and a payment component of the website. According to the present invention, scripting attacks to an e-commerce website can be efficiently and effectively prevented.

Description

Website script attack prevention method and device

Technical field

The present invention relates to the field of computer and network technologies, and in particular, to a website script attack prevention method and apparatus.

Background technique

At present, the amount of e-commerce transactions in the world has risen sharply. This phenomenon is also accompanied by various attacks against e-commerce and its payment system. The attack method from WEB (Internet) gives users protection or repair. Both bring a lot of inconvenience.

In the process of actually defending against the above attacks, the inventors found that at least the following problems exist in the conventional technology:

Traditional attack defense measures are not perfect. Attack designers can often evade existing attack defense measures by adopting some targeted strategies. Attacks are mostly based on general weaknesses of common WEB applications, such as: SQL (structured query). Language: Structured Query Language) Injects or cross-site scripting vulnerabilities that cause arbitrary scripts to be executed in the client browser. In short, traditional techniques cannot effectively and effectively prevent website scripting attacks.

Summary of the invention

Based on this, it is necessary to provide a website script attack prevention method and device for the problem that the traditional attack prevention measures are inefficient and cannot be effectively prevented.

In order to achieve the above object, an embodiment of the technical solution of the present invention is:

On the one hand, a website script attack prevention method is provided, which includes the following steps:

Intercepting each request data packet received by the website; requesting the data packet to be included in the network request received by the website based on the hypertext transfer protocol;

Unpacking the request data packet to obtain data in a format to be verified;

According to the preset security rules, the check format data is matched and verified, and the security data is output;

Packing security data, obtaining secure data packets, and transmitting secure data packets to the core of the website Core components; core components include the management components and payment components of the website.

In another aspect, a website script attack prevention device is provided, including:

An intercepting unit, configured to intercept each request data packet received by the website; and requesting the data packet to be data included in the network request received by the website based on the hypertext transfer protocol;

An unpacking unit is configured to unpack the request data packet to obtain data to be verified;

a matching check unit, configured to perform matching check on the data to be verified according to a preset security rule, and output security data;

A packet transfer unit for packaging security data, obtaining a secure data packet, and transmitting the secure data packet to a core component of the website; the core component includes a management component and a payment component of the website.

The above technical solution has the following beneficial effects:

The website script attack prevention method and device of the invention are applied to j2ee (Java 2 Platform, Enterprise Edition: enterprise application software of java2 platform), and the user accesses the website by using HTTP (HyperText Transfer Protocol) protocol, and finally reaches a specific application. Before the resource is used, the interceptor is used to filter the content transmitted by using the HTTP protocol to ensure that the protocol content transmitted to each core component is in a secure state; the present invention can effectively and effectively prevent script attacks on the e-commerce website.

DRAWINGS

1 is a schematic flowchart of Embodiment 1 of a method for defending a website script attack according to the present invention;

2 is a schematic structural diagram of Embodiment 2 of a website script attack defense method according to the present invention;

FIG. 3 is a schematic structural diagram of Embodiment 1 of a website script attack defense apparatus according to the present invention.

detailed description

In order to facilitate the understanding of the present invention, the present invention will be described more fully hereinafter with reference to the accompanying drawings. Preferred embodiments of the invention are given in the drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that this disclosure will be thorough and comprehensive.

Unless otherwise defined, all technical and scientific terms used herein and the techniques pertaining to the invention Those skilled in the art generally understand the same meaning. The terminology used in the description of the present invention is for the purpose of describing particular embodiments and is not intended to limit the invention. The term "and/or" used herein includes any and all combinations of one or more of the associated listed items.

Embodiment 1 of the website script attack defense method of the present invention:

In order to solve the problem that the traditional attack defense measures are inefficient and cannot be effectively prevented, the present invention provides a method for preventing a website script attack defense. FIG. 1 is a schematic flowchart of Embodiment 1 of a website script attack defense method according to the present invention; As shown, the following steps can be included:

Step S110: intercepting each request data packet received by the website; requesting the data packet to be data included in the network request transmitted by the website based on the hypertext transfer protocol;

Step S120: Unpacking the request data packet to obtain data to be verified;

Step S130: Perform matching verification on the data to be checked according to the preset security rule, and output security data.

Step S140: Packing the security data, obtaining the security data packet, and transmitting the security data packet to the core component of the website; the core component includes a management component and a payment component of the website.

In particular, the present invention relates to a website access interceptor that checks and filters harmful scripts through an interceptor to achieve the purpose of protecting a website application. The purpose of the interceptor to unpack the HTTP request data is to split the data packet into a regular data format that can be processed by the validator (ie, the data to be verified). For example, the data packet is originally submitted as a stream to the electronic The business website, the interceptor splits the data stream into a string data format. The purpose of packaging the filtered security data is to restore the data to the original data format. The core components may specifically include a member management component of an e-commerce website, a commodity management component, an order management component, a payment component, a marketing management component, and a report management component.

In a specific embodiment, the step of checking the format data to be checked in step S130, the step of outputting the security data may include:

Matching the preset security rules and the data to be verified by the regular expression to obtain an attack script; the preset security rules may include dangerous characters and dangerous strings;

The attack script is filtered, and the filtered format data to be checked is output as security data.

In a specific embodiment, the step of filtering the attack script may include:

Escape the characters of the attack script.

Specifically, the interceptor's checker can use the regular expression to match the security rules and the unpacked data. If the attack script is found, it is filtered, that is, the characters of the attack script are escaped.

In a specific embodiment, the step may further include before step S140:

An audit log is generated according to the request packet; the audit log may include access address data, access mode data, and access content data of the requesting access to the website.

Specifically, after the verification is completed, an audit log record can be generated into the storage for inspection by the management personnel. The audit log records the access IP (Internet Protocol), the access method, and the access content. The administrator can perform attack defense analysis and modify and upgrade the security rules based on the audit log.

In a specific embodiment, the step may further include before step S120:

Generate preset security rules according to the characteristics of the website attack script;

Modify and update the preset security rules according to the contents of the audit log.

Specifically, the attack script has characteristics that are quite different from the normal service request parameters, so the security rules can be pre-written according to the characteristics of the attack script. Security rules can include some dangerous characters or dangerous strings, as follows:

[1]|(vertical symbol)

[2]&(&symbol)

[3]; (semicolon)

[4]$(dollar sign)

[5]% (percentage symbol)

[6]@(at symbol)

[7]' (single quotes)

[8]" (quotation marks)

[9]\'(backslash escaped single quotes)

[10]\" (backslash escaped quotes)

[11]<>(angle brackets)

[12]() (brackets)

[13]+ (plus sign)

[14]CR (carriage return, ASCII 0x0d)

[15]LF (line feed, ASCII 0x0a)

[16], (comma)

[17]\(backslash)

An example of a security rule can be as follows (separated by spaces between symbols):

|&;$%@’”\’\”<>()+CR LF,\

In a specific operation, it is possible to perform an audit detection on whether an attack script is matched by a set security rule. If it is detected that it is not matched, it is necessary to improve the old security rule or write a new security rule for the attack script. Therefore, security rules can be saved in configurable files to facilitate administrators to modify and upgrade security rules. The administrator can enter the e-commerce website back-end web interface, and then click "Security Rule Management Menu" to open the web editor. The web editor reads the security rule file and displays it on the editor to enter the editable mode. After the manager has edited the security rules, click the Save button. The editor will update the data to the security rules file.

Embodiment 1 of the website script attack defense method of the present invention provides an efficient and effective method for preventing script attacks in a j2ee application based on the HTTP protocol. When a user accesses a website using the HTTP protocol, the interceptor is used to filter the content transmitted by using the HTTP protocol before the specific application resource is finally obtained, so that the protocol content transmitted to each core component is in a secure state; and the security rule can be continued. Obtaining an upgrade and meeting daily security audits will log the interception logs to the store for webmasters to provide data analysis convenience.

Embodiment 2 of the website script attack defense method of the present invention:

In order to solve the problem that the traditional attack defense measures are inefficient and cannot be effectively prevented, the present invention also provides a second embodiment of the website script attack defense method, and FIG. 2 is a schematic structural diagram of the second embodiment of the website script attack defense method according to the present invention; 2, browser, IOS APP, Android APP and external subsystem, all HTTP requests will eventually be intercepted by the interceptor, the interceptor can handle the following:

(1) The interceptor unpacks the intercepted HTTP request data.

(2) The interceptor's checker can use the regular expression to match the security rules and the unpacked data. If the attack script is found, it is filtered.

(3) Attack scripts have characteristics that are quite different from normal service request parameters. Therefore, security rules can be set in advance according to the characteristics of the attack script. Security rules can be saved in a configurable file to facilitate the modification of security rules.

(4) After the verification is completed, the audit log record is generated into the storage for review.

(5) After the audit log is generated, the filtered security data is packaged and transmitted to each core component.

(6) The audit log records the access IP, access method, and access content, and can be analyzed according to the audit log and the security rules are modified and upgraded.

The external subsystem may specifically refer to a sub-application that is connected to an e-commerce website. The browser, IOS app, Android APP, and external subsystem are all visitors who send requests for data acquisition or requests for data to the e-commerce website. The core component is the core part of the e-commerce website.

The website script attack defense device of the present invention is Embodiment 1:

Based on the technical solution of the above-mentioned website script attack prevention method, and in order to solve the problem that the traditional attack defense measures are inefficient and cannot be effectively prevented, the present invention also provides a website script attack defense device embodiment 1; FIG. 3 is a website script of the present invention; The schematic diagram of the structure of the attack defense device embodiment 1, as shown in FIG. 3, may include:

The intercepting unit 310 is configured to intercept each request data packet received by the website; and request the data packet to be data included in the network request received by the website based on the hypertext transfer protocol;

The unpacking unit 320 is configured to unpack the request data packet to obtain data to be verified;

The matching check unit 330 is configured to perform matching check on the data to be checked according to the preset security rule, and output security data.

The packet transmission unit 340 is configured to package the security data, obtain the security data packet, and transmit the security data packet to the core component of the website; the core component includes a management component and a payment component of the website.

In a specific embodiment, the matching check unit 330 can include:

The matching module 332 is configured to match the preset security rule and the to-be-checked format data by using a regular expression to obtain an attack script; the preset security rule may include a dangerous character and a dangerous character string;

The filtering module 334 is configured to filter the attack script and use the filtered format data to be verified. Output for secure data.

In a specific embodiment, the filtering module 334 is configured to escape the characters of the attack script.

In a specific embodiment, the website script attack defense device may further include:

The auditing unit 360 is configured to generate an audit log according to the request data packet; the audit log may include access address data, access mode data, and access content data of the requesting website.

The preset update unit 350 is configured to generate a preset security rule according to the characteristics of the website attack script, and modify and update the preset security rule according to the content of the audit log.

Embodiment 1 of the website script attack defense device of the present invention provides an efficient and effective method for preventing script attacks in a j2ee application based on the HTTP protocol. When a user accesses a website using the HTTP protocol, the interceptor is used to filter the content transmitted by using the HTTP protocol before the specific application resource is finally obtained, so that the protocol content transmitted to each core component is in a secure state; and the security rule can be continued. Obtaining an upgrade and meeting daily security audits will log the interception logs to the store for webmasters to provide data analysis convenience.

The technical features of the above-described embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction between the combinations of these technical features, All should be considered as the scope of this manual.

The above-described embodiments are merely illustrative of several embodiments of the present invention, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of the invention should be determined by the appended claims.

Claims

A website script attack prevention method is characterized in that it comprises the following steps:

Blocking each request data packet received by the website; the request data packet is data included in the network request received by the website based on the hypertext transfer protocol;

Unpacking the request data packet to obtain data to be verified;

Performing matching verification on the data to be verified according to a preset security rule, and outputting security data;

The security data is packaged, a secure data package is obtained, and the secure data package is transmitted to a core component of the website; the core component includes a management component and a payment component of the website.
The method for defending a website script attack according to claim 1, wherein the step of performing matching verification on the data to be checked according to a preset security rule, and the step of outputting the security data includes:

Matching the preset security rule and the to-be-checked format data to obtain an attack script by using a regular expression; the preset security rule includes a dangerous character and a dangerous character string;

Filtering the attack script, and outputting the filtered format data to be checked as the security data.
The method for defending a website script attack according to claim 2, wherein the step of filtering the attack script comprises:

Escape the characters of the attack script.
The method for defending a website script attack according to any one of claims 1 to 3, characterized in that the security data is packaged to obtain a secure data packet, and the secure data packet is transmitted to a core of the website. The steps of the component also include the steps:

And generating an audit log according to the request data packet and the security data packet; the audit log includes access address data, access mode data, and access content data that request access to the website.
The method for defending a website script attack according to claim 4, wherein the step of unpacking the intercepted request data packet to obtain data to be verified includes steps:

Generating the preset security rule according to a feature of the website attack script;

Modifying and updating the preset security rule according to the content of the audit log.
A website script attack defense device, comprising:

An intercepting unit, configured to intercept each request data packet received by the website; the request data packet is The data received by the web site received by the website based on the hypertext transfer protocol;

An unpacking unit, configured to unpack the request data packet to obtain data to be verified;

a matching check unit, configured to perform matching verification on the data to be verified according to a preset security rule, and output security data;

a packet transmission unit, configured to package the security data, obtain a security data packet, and transmit the security data packet to a core component of the website; the core component includes a management component and a payment of the website Component.
The website script attack defense apparatus according to claim 6, wherein the matching check unit comprises:

a matching module, configured to match the preset security rule and the to-be-checked format data by using a regular expression to obtain an attack script; the preset security rule includes a dangerous character and a dangerous character string;

The filtering module is configured to filter the attack script, and output the filtered format data to be checked as the security data.
The website script attack defense apparatus according to claim 7, wherein the filtering module is configured to escape characters of the attack script.
The website script attack defense device according to any one of claims 6 to 8, further comprising:

An auditing unit, configured to generate an audit log according to the request data packet; the audit log includes access address data, access mode data, and access content data that request access to the website.
The website script attack defense device according to claim 9, further comprising:

The preset update unit is configured to generate the preset security rule according to the feature of the website attack script, and modify and update the preset security rule according to the content of the audit log.