WO2021017318A1

WO2021017318A1 - Cross-site scripting attack protection method and apparatus, device and storage medium

Info

Publication number: WO2021017318A1
Application number: PCT/CN2019/119113
Authority: WO
Inventors: 孙强; 黄国华
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-08-01
Filing date: 2019-11-18
Publication date: 2021-02-04
Also published as: CN110650117B; CN110650117A

Abstract

A cross-site scripting attack protection method and apparatus, a device, and a storage medium, relate to the technical field of network security. The method comprises: performing detection on a code of an external network access request by means of a preset lexical combination rule, providing an access identifier in the external network access request to mark whether malicious attack characters exist in the code, and performing attack defense processing on the external network access request having a code that does not satisfy the lexical combination rule and/or having the access identifier. The marking in such way not only improves the identification efficiency of an access script code, but also improves the accuracy of identification, and if there are malicious attack characters, the attack of the external network access request is disabled by shielding, replacing, etc. so as to achieve the function of cross-site scripting attack defense, thereby improving the security of a system and ensuring the data security of websites.

Description

Cross-site attack protection method, device, equipment and storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on August 1, 2019, the application number is 201910706703.9, and the invention title is "cross-site attack protection methods, devices, equipment and storage media", the entire content of which is incorporated by reference Incorporate in the application.

Technical field

This application relates to the field of network security technology, and in particular to a method, device, equipment, and computer-readable storage medium for preventing cross-site attacks.

Background technique

With the continuous development of network technology, the network has become a part of people's real life. Now various services are realized through the network, and with the development, it will become an important platform and carrier for the realization of intelligence in the future. In order to improve the user experience, scripting languages are widely used in network applications. With the continuous open use of network design code, the script code has been tampered with to form a Cross Site Script (XSS) attack, which has become one of the most serious security problems on the Internet.

An XSS attack refers to a malicious attacker inserting malicious script program code into a web page (Web). The inventor found that when a user browses the page, the malicious script program code embedded in the Web will be executed, thereby maliciously attacking the user, making User privacy leaks, client computers infected with viruses, control of corporate data, theft of important corporate data with commercial value, illegal transfers, forced emails, website hacking, and control of victims’ machines to send attacks to other websites.

Summary of the invention

The main purpose of this application is to provide a cross-site attack protection method, device, equipment, and computer-readable storage medium, aiming to solve the technical problem of low accuracy of the existing cross-site access defense.

To achieve the above objective, this application provides a cross-site attack protection method. The cross-site attack protection method includes the following steps:

Acquiring an external network access request received by the network side, where the external network access request is a collection containing at least one cross-site access script code for implementing cross-site data access;

According to a predefined lexical combination rule, detect whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request, where the lexical combination rule is to pass the current A model obtained by analyzing a known malicious attack program;

If a malicious program is detected, detecting whether there is an access identifier in the cross-site access script code, where the access identifier is defined based on a preset user rule;

If the access identifier exists, it is determined whether there are characters with attack capability in the cross-site access script code;

If the character exists in the cross-site access script code, the characters with attack capabilities in the cross-site access script code are filtered out according to the access identifier, and cross-site scripting defense is performed on the cross-site access script code deal with.

Optionally, the step of detecting whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request according to a predefined lexical combination rule includes:

Execute the cross-site access script code for simulation operation, and capture the active tags on each access page of the HTTP data packet during operation;

Calculate the inverse of the tag probability of the active tag in the cross-site access script code, and add the inverse numbers to obtain an arithmetic average as the embedded JavaScript reasonable index of the active tag;

Classify the cross-site access script code according to the reasonable index;

Wherein, the active tag is a tag with no other active tags between the active tag and the cross-site access script code, and the tag probability is the probability of the active tag directly appearing on the cross-site access script code.

Optionally, the step of screening characters with attack capabilities in the cross-site access script code according to the access identifier, and performing cross-site scripting defense processing on the cross-site access script code includes:

Extracting attack-capable characters in the cross-site access script code;

Calculating the character probability of the character appearing in the external network access request;

Comparing the magnitude relationship between the character probability and the preset probability level of information leakage;

If the character probability is greater than the probability level, the access protection program is started to perform cross-site scripting defense processing on the access request.

Optionally, the calculating the character probability that the character appears in the external network access request includes:

Retrieve all historical access records of cross-site attacks on the network side, and count the total number of cross-site access script codes of all historical access records;

Counting the number of occurrences of the character in all the historical visit records;

According to the number of occurrences and the total number, the probability of the character appearing in the external network access request is calculated.

Optionally, the calculating the character probability that the character appears in the external network access request according to the number of appearances and the total number includes:

Divide the number of occurrences by the total number to obtain a percentage value;

Multiply the percentage value by a weight coefficient to obtain the final character probability. The calculation formula is as follows:

Where, P is the probability of occurrence of characters with attack capability, m is the number of occurrences, M is the total number of cross-site access script codes, and α is the weight coefficient.

Optionally, the probability level includes three levels of attack degree from low to high, and performing cross-site scripting defense processing on the cross-site access script code includes:

If the character probability is greater than the first probability level and less than the second probability level, perform shielding processing on the corresponding character or the entire code in the cross-site access script code;

If the character probability is greater than the second probability level and less than the third probability level, replace the characters or the entire code in the cross-site access script code;

If the character probability is greater than the third probability level, the cross-site access script code is deleted from the external network access request.

Optionally, the performing cross-site scripting defense processing on the cross-site access script code further includes:

When the character probability is greater than the third probability level, perform a functional evaluation on the cross-site access script code to determine whether the cross-site access script code is a necessary function access code in the external network access request;

If yes, keep the cross-site access script code in the extranet access request, and replace the attack-capable character with a preset security character, the security character only realizes the code digit filling function symbol.

In addition, in order to achieve the above objective, this application also provides a cross-site attack protection device, the cross-site attack protection device including:

The obtaining module is used to obtain the external network access request received by the network side, the external network access request is a collection containing at least one cross-site access script code for implementing cross-site data access;

The detection module is configured to detect whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request according to the predefined lexical combination rule, wherein the lexical combination The rule is a model obtained through analysis of currently known malicious attack programs; and is used to detect whether there is an access identifier in the cross-site access script code when a malicious program is detected, wherein the access identifier is based on a preset User rules are defined;

A judging module, for judging whether there are characters with attack capabilities in the cross-site access script code if the access identifier exists;

The defense processing module is configured to, if the character exists in the cross-site access script code, filter out the characters with attack capability in the cross-site access script code according to the access identifier, and check the cross-site access script The code performs cross-site scripting defense processing.

In addition, in order to achieve the above-mentioned purpose, the present application also provides a cross-site attack protection device. The cross-site attack protection device includes a memory, a processor, and a cross-site attack that is stored on the memory and can run on the processor. An attack protection program, which, when executed by the processor, implements the steps of the cross-site attack protection method described in any one of the above.

In addition, in order to achieve the above-mentioned object, the present application also provides a computer-readable storage medium that stores a cross-site attack protection program, and when the cross-site attack protection program is executed by a processor, any of the above One of the steps of the cross-site attack protection method.

This application performs cross-site attack protection processing through external network access requests, specifically by setting the access identifier in the request and detecting the lexical combination of the code. Marking based on this method not only improves the identification efficiency of the access script code, but also Improved the accuracy of recognition. For characters that are maliciously attacked, the external network access request is disabled by shielding, replacing, etc., so as to achieve the role of cross-site attack defense, improve the security of the system and protect the data of the website Safety.

Description of the drawings

FIG. 1 is a schematic structural diagram of a base station operating environment involved in a solution according to an embodiment of the application;

2 is a schematic flowchart of the first embodiment of the cross-site attack protection method according to this application;

3 is a schematic flowchart of a second embodiment of the cross-site attack protection method according to this application;

Figure 4 is a schematic diagram of the functional modules of the cross-site attack protection device of this application.

The realization, functional characteristics, and advantages of the purpose of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the application, and not used to limit the application.

This application provides a cross-site attack protection device.

Referring to FIG. 1, FIG. 1 is a schematic structural diagram of the operating environment of the cross-site attack protection equipment involved in the solution of the embodiment of the application.

As shown in FIG. 1, the cross-site attack protection device includes: a processor 101, such as a CPU, a communication bus 102, a user interface 103, a network interface 104, and a memory 105. Among them, the communication bus 102 is used to implement connection and communication between these components. The user interface 103 may include a display screen (Display) and an input unit such as a keyboard (Keyboard), and the network interface 104 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 105 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as a magnetic disk memory. Optionally, the memory 105 may also be a storage device independent of the aforementioned processor 101.

Those skilled in the art can understand that the hardware structure of the cross-site attack protection device shown in FIG. 1 does not constitute a limitation on the cross-site attack protection device in this application, and may include more or less components than shown in the figure, or Combining certain components, or different component arrangements.

As shown in FIG. 1, the memory 105 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a cross-site attack-based protection program. Among them, the operating system is a program that manages and controls cross-site attack protection equipment and software resources, and supports the operation of cross-site attack protection programs and other software and/or programs.

In the hardware structure of the cross-site attack protection equipment shown in Figure 1, the network interface 104 is mainly used to access the network; the user interface 103 is mainly used to detect and confirm the user terminal’s code scanning operation instructions and payment input instructions, etc. The processor 101 may be used to call a cross-site attack protection program stored in the memory 105, and perform operations in the following embodiments of the cross-site attack protection method.

In the embodiment of the present application, the implementation of FIG. 1 may also be a mobile terminal, and the processor of the mobile terminal reads the program code stored in the buffer or the storage unit that can implement the cross-site attack protection method. Cross-site data access.

Based on the foregoing hardware structure of the cross-site attack protection device, various embodiments of the cross-site attack protection method of the present application are proposed.

Referring to FIG. 2, FIG. 2 is a flowchart of a cross-site attack protection method provided by an embodiment of this application. In this embodiment, the cross-site attack protection method specifically includes the following steps:

Step S210: Obtain an external network access request received by the network side, where the external network access request is a collection containing at least one cross-site access script code for implementing cross-site data access;

In this step, the external network access request refers to a request sent by a user on the side of a non-visited network, such as the relationship between an internal local area network and an Internet network in a certain company. The external network access request is composed of some script codes, which can be a script code that contains multiple data access methods; it can also be composed of multiple script codes, and each script code corresponds to a type of data. Access. In actual applications, the access script code in the extranet access request can also be understood as a completed access code. When access is required, the code is downloaded to the corresponding accessed terminal; it can also be a triggered script code. That is to say, the actual access script code is stored in the accessed terminal, and the execution needs to be controlled by the trigger code in the request.

Step S220: According to a predefined lexical combination rule, detect whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request, where the lexical combination rule is A model obtained through analysis of currently known malicious attack programs;

In this step, the specific principle of detecting whether there is a malicious webpage program is to first perform a cluster analysis of the cross-site access script code in the extranet access request, where the specific analysis code is the access interface of the webpage based on Interface to preliminarily determine the lexical combination form of the access program, and classify it into the same family, and then analyze the lexical combination rules according to all access programs in the same family (that is, access code), and find out that all programs in the same family are called Which dangerous functions, system resources, suspicious tags, key categories and objects, etc., are finally defined according to the word order of these elements to define lexical analysis and detection rules, and finally determine whether the access code is a malicious webpage program. Compared with the traditional IPS rules and WAF rules, the detection method in this step can effectively prevent a single feature from being bypassed, leading to the problem of misjudgment of malicious programs.

Step S230, if there is a malicious program, detect whether there is an access identifier in the cross-site access script code, where the access identifier is defined based on a preset user rule;

In this step, the user rule definition should be understood as an access rule customized for different web access methods and information storage methods, and an access identifier is set through the access rule. When the web server or user terminal receives After the access identifier is reached, it is possible to query and select an access mode matching the access identifier according to the pre-defined corresponding relationship to achieve data access to the webpage.

Furthermore, there are some webpage settings that require special access. For example, some codes or characters defined as illegal access by the network are used to achieve special access, but these codes or characters are set as trusted access terms by the system. It is set through the access identifier to realize the filtering of special codes or characters.

In this embodiment, the malicious webpage program detected in step S20 may be the result of preliminary identification as malicious, and then the judgment of marking the access identifier in step S30 realizes the accurate judgment of the preliminary identification result and avoids misidentification of malicious The phenomenon.

Step S240, if the access identifier exists, determine whether there are characters with attack capability in the cross-site access script code;

In practical applications, since the code settings for external network access requests are all public settings, the difference is that some verification parameters or encryption are added to the code, and these security processing methods are basically the same, often It will be cracked, and some malicious code will be added to obtain user information. For this, in this step, the external network access request is coded. The coding process here is to convert the programmatic request into one by one. The access script code is the access script code, and the converted access script code refers to the code source program.

Then, after decomposing the source program, the keywords are divided into one by one, and the method of dividing the keywords is based on the data that can be accessed. That is to say, the divided keywords can be separated. The little endian of the visit.

For judging whether there are characters with attack capabilities in the access script code, specifically the detection of keywords, it can be determined by the comparison of the feature library or the network definition of each keyword in the network;

When judging by the comparison of the signature database, each of the divided keywords is queried from the pre-set attack information database. If the attack information database is queried, the external network access requests will be filtered according to the keywords. The script code with the queried keywords in, then execute step S50 for script defense processing.

In practical applications, the establishment of the attack information database is specifically based on the malicious code keywords obtained from the server’s usual tests. At the same time, it is also formed by obtaining the offensive keywords identified on the network from the network. Of course, it can also be formed based on the user The source code development habit is to choose some infrequently used or relatively uncommon code words to form. When this type of code field is detected, special attention and judgment are required.

Further, when determining by the definition in the network, it is to obtain the general or special definition of the network from the network through the keyword to be detected, and determine whether it can be used for attacking through the definition. Some attack code programs or special-purpose code programs will be published, and access requests can also be made through these codes.

Step S250: If the character exists in the cross-site access script code, the characters with attack capability in the cross-site access script code are filtered out according to the access identifier, and the cross-site access script code is cross-referenced. Site script defense processing.

In this embodiment, the cross-site scripting defense processing is mainly through shielding, deleting, or replacing the characters with attack capability or the entire cross-site access script code in which they are located; and shielding refers to removing characters Hidden from the code by some special means, so as to weaken the attack ability of the code, or even remove its attack ability.

In actual applications, the specific processing methods for shielding, deletion and replacement need to be selected according to the performance of the code. If the code has a special function definition, the delete processing method cannot be used. The deletion is usually The code loses the ability to execute, and shielding and replacement can retain the original function of the code.

In this embodiment, when the access identifier is set, it can be specifically implemented in the following ways: Detect user information carried in the external network access request, and determine whether the user information is a preset user rule that requires protection User information;

If yes, add an access identifier to the external network access request according to the protection policy and access policy defined by the user rule. Preferably, the access identifier is mainly used to define the access method, or it can be for information security The definition of protection, through the setting of the access identifier, the protection of user information can be realized at the same time, and the special characters in the access can also be set.

In this embodiment, in step S240, screening and selecting characters with attack capabilities in the access script code according to the access identifier can be specifically implemented in the following ways:

According to the access identifier, the corresponding relationship between the access identifier and the access rule, the access rule corresponding to the current access identifier is queried, where the access rule contains special characters for realizing cross-site access and cross-site access the way;

The characters with attack capabilities in the access script code are filtered according to the special characters, so as to eliminate characters that do not meet the requirements of the access rules from the access script for subsequent cross-site scripting defense processing .

In this embodiment, the specific implementation process for detecting whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request according to the predefined lexical combination rule can be for:

Perform simulation operation according to the cross-site access script code, and capture the active tag on each access page of the HTTP data packet at runtime;

Calculating the reciprocal of the probability of the active tag in the cross-site access script code, and adding the reciprocal to obtain an arithmetic average as the embedded JavaScript reasonable index of the active tag;

Classify the cross-site access script code according to the reasonable index;

Wherein, the active tag is a tag without other active tags between the active tag and the cross-site access script code, and the probability of the tag is the probability of the active tag directly appearing on the cross-site access script code.

In this embodiment, the steps of screening out characters with attack capabilities in the cross-site access script code according to the access identifier, and performing cross-site scripting defense processing on the cross-site access script code include:

Extracting attack-capable characters in the cross-site access script code;

Calculating the probability of the character appearing in the external network access request;

Comparing the magnitude relationship between the probability and the preset probability level of information leakage;

If the probability is greater than the probability level, the access protection program is activated to perform cross-site scripting defense processing on the access request.

In practical applications, in order to reduce the probability of misjudgment, if certain keywords in the code are determined to be offensive through comparison, the keyword can also be used to calculate the probability of an attack. Used to achieve the probability of an attack to further determine whether it needs to be processed.

Further, calculating the probability that the character appears in the external network access request includes:

The probability is calculated based on the number of occurrences and the total number.

In practical applications, for attack detection, the terminal or server will generally generate an attack log, in which all records of the terminal or server being attacked are stored, and the record can contain keywords or the entire Script code, which calculates and judges whether it is possible to data attack characters on the network side by calculating the keywords that are initially judged to be offensive from the historical records. If the calculated probability is greater than the preset upper limit of probability, the If the character is a high-risk code character, step S240 is executed to defend against XSS by cross-site attack.

In this embodiment, the calculating the probability according to the number of occurrences and the total number includes:

Multiply the percentage value by a weighting coefficient to get the final probability. The calculation formula is as follows:

In this embodiment, after the final probability is obtained by the above-mentioned method, it is also necessary to judge the risk level of the probability. According to the actual situation, the probability level is generally set from low to three levels according to the degree of attack. The cross-site scripting code for cross-site scripting defense processing includes:

If the probability is greater than the first probability level and less than the second probability level, perform shielding processing on the corresponding character or the entire code in the cross-site access script code;

If the probability is greater than the second probability level and less than the third probability level, replace the characters or the entire code in the cross-site access script code;

If the probability is greater than the third probability level, the cross-site access script code is deleted from the external network access request.

In practical applications, different defense processing methods are selected according to different attack levels. For example, in the replacement processing method, when replacing, you can replace it according to the following example. The XSS attack information database contains 1, 2, and 3. The descriptive characteristics of XSS attack information. If the extranet access request contains "<", then the "<" will be replaced with a space according to the replacement definition of the feature; if the extranet access request contains ">", the replacement definition of the feature will be changed ">" is replaced with a space; if the external network access request contains a content string conforming to the regular expression <\s*script\sW.*<\s*/\s*script\s*>, it will be replaced according to the characteristics Definition, replace it with "com.pingan.xxxx" in a custom way.

In this embodiment, the malicious attack levels are distinguished according to the above three levels. However, in actual applications, not all script codes can be directly deleted. For the script codes necessary for cross-site access It cannot be protected by deleting or escaping. For script code with a higher level of malicious attack, it can be implemented in the following ways:

When the result of the comparison is that the probability is greater than the third probability level, the detection of the script access function can be started to select a safer protection method to achieve it. The implementation process is as follows:

Perform functional evaluation on the cross-site access script code, and determine whether the cross-site access script code is a necessary function access code in the external network access request;

Further, replacing the character with attack capability or the entire cross-site access script code in which it is located includes:

The keywords in the characters are replaced, or the keywords in the characters are converted into blank Chinese characters through Chinese character conversion rules, so that the characters lose the ability to attack.

In practical applications, it is generally rare to directly implant a complete script for the attack code, but insert a character or a script into the original script of the external network access request. In this case, after detection, Just delete or block it directly; but in the case of tampering with the original script, you need to replace it to ensure the invalidation of the external network access request. To ensure security, you can also ignore this request directly, and return the message to resend the request, and get it again a request.

Further, when the request has a special function, or when it is a non-repetitive request, replacement can be used to ensure the normal execution of the request, and at the same time, the ability for cross-site attacks is removed.

Cross-site access is achieved through the above-provided method, which realizes the attack detection of malicious scripts in external network access requests, and shields or replaces malicious code characters to disable attack capabilities, ensuring the security of access and information security Sex.

Attacks on cross-site access are generally carried out on the side of the base station, and the attacker intercepts the access data sent by the user by monitoring the base station, and then modifies part of the code in the access data or adds some functions to achieve malicious For attacks, this embodiment proposes the cross-site attack protection method based on the base station. The specific implementation process is shown in Figure 3 below:

Step S310, the base station is receiving the cross-site access request sent by the user through the terminal;

In this step, the cross-site access request carries identification information pre-negotiated by the base station and the user terminal through a handshake protocol or an encrypted communication protocol, and the setting rule for the identification information may be a check value. Algorithm, that is, a check value is automatically generated based on the access script code constructed by the user, and the calculation object of the check value is the code of the script code itself. When the code changes, the check value is natural Changes will occur, and will be reflected in the cross-site access request through identification information.

Step S320, the base station recognizes the identification information of the cross-site access request;

In this embodiment, if it is identified, it is proved that the script code in the cross-site access request has been modified, otherwise, it is not.

Step S330: Obtain lexical combination rules, and perform code phrase detection on the cross-site access script code in the cross-site access request;

In this step, the lexical combination rule is mainly to detect the combination between the function in the script code and the applet, and if it is modified, the function or applet in the script code must be changed. , And the lexical combination rule is equivalent to secondary malicious detection, thus ensuring the accuracy of malicious attack detection.

Step S340, extracting attack characters in the cross-site access script code;

In this embodiment, the above attack character can be understood as a code function or a small program, or some code bytes, etc.

In this embodiment, if in step S320 and step S330, only the identification information is detected or the script code combination method is incorrect, step S350 is executed, otherwise, step S360 is executed.

Step S350, calculating the attack level of the attacking character;

Step S360, evaluating the function level of the cross-site access script code;

Step S370: Perform protection processing on the cross-site access script code.

In this step, the calculation of the attack level can be specifically calculated by calculating the probability of the character, specifically:

Wherein, P is the probability of occurrence of characters with attack ability, m is the number of occurrences, M is the total number of cross-site access script codes, and α is the weight coefficient;

The relationship between the probability of comparing characters and the preset probability of attack level;

In this embodiment, the functional evaluation of the cross-site access script code is performed to determine whether the cross-site access script code is a necessary function access code in the external network access request;

In order to solve the above-mentioned problems, an embodiment of the present application also provides a cross-site attack protection device. Refer to FIG. 4, which is a schematic diagram of functional modules of the cross-site attack protection device provided by an embodiment of the application. In this embodiment, the device includes:

The obtaining module 41 is configured to obtain an external network access request received by the network side, where the external network access request is a collection containing at least one cross-site access script code for implementing cross-site data access;

The detection module 42 is configured to detect whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request according to the predefined lexical combination rule, wherein the lexical method The combination rule is a model obtained through analysis of currently known malicious attack programs; and is used to detect whether there is an access identifier in the cross-site access script code, wherein the access identifier is defined based on a preset user rule;

The judging module 43 is configured to judge whether there are characters with attacking ability in the cross-site access script code if the access identifier exists;

The defense processing module 44 is configured to, if the character exists in the cross-site access script code, filter out characters with attack capabilities in the cross-site access script code according to the access identifier, and perform access to the cross-site access The script code performs cross-site scripting defense processing.

Based on the description content of the same embodiment as the cross-site attack protection method in the embodiment of the present application, the content of the embodiment of the cross-site attack protection device in this embodiment will not be repeated.

In this embodiment, by setting the access identifier in the request and detecting the lexical combination of the code, marking based on this method not only improves the identification efficiency of the access script code, but also improves the accuracy of recognition, and for characters with malicious attacks At the same time, through shielding, replacement, etc., the external network access request loses the ability to attack, so as to achieve the role of cross-site attack defense, improve the security of the system and ensure the data security of the website.

The present application also provides a computer-readable storage medium, where the computer-readable storage medium may be volatile or non-volatile, which is not specifically limited by the present application.

In this embodiment, a cross-site attack protection program is stored on the computer-readable storage medium, and the cross-site attack protection program is executed by a processor to implement the cross-site attack protection method described in any of the above embodiments A step of. Among them, the method implemented when the cross-site attack protection program is executed by the processor can refer to the various embodiments of the cross-site attack protection method of the present application, so the details are not repeated here.

The embodiments of the present application are described based on the above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific embodiments. The above-mentioned specific embodiments are only illustrative and not restrictive. Those of ordinary skill in the art Under the enlightenment of this application, without departing from the purpose of this application and the scope of protection of the claims, many forms can be made. Any equivalent structure or equivalent process transformation made by using the content of the description and drawings of this application, Or directly or indirectly used in other related technical fields, these are all within the protection of this application.

Claims

A cross-site attack protection method, which includes the following steps:

Acquiring an external network access request received by the network side, where the external network access request is a collection containing at least one cross-site access script code for implementing cross-site data access;

According to a predefined lexical combination rule, detect whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request, where the lexical combination rule is to pass the current A model obtained by analyzing a known malicious attack program;

If a malicious program is detected, detecting whether there is an access identifier in the cross-site access script code, where the access identifier is defined based on a preset user rule;

If the access identifier exists, it is determined whether there are characters with attack capability in the cross-site access script code;

If the character exists in the cross-site access script code, the characters with attack capabilities in the cross-site access script code are filtered out according to the access identifier, and cross-site scripting defense is performed on the cross-site access script code deal with.
The cross-site attack protection method according to claim 1, said detecting whether there is an HTTP data packet used to respond to cross-site access in the cross-site access script code carried in the external network access request according to a predefined lexical combination rule The steps for the presence of malicious programs include:

Execute the cross-site access script code for simulation operation, and capture the active tags on each access page of the HTTP data packet during operation;

Calculate the inverse of the tag probability of the active tag in the cross-site access script code, and add the inverse numbers to obtain an arithmetic average as the embedded JavaScript reasonable index of the active tag;

Classify the cross-site access script code according to the reasonable index;

Wherein, the active tag is a tag with no other active tags between the active tag and the cross-site access script code, and the tag probability is the probability of the active tag directly appearing on the cross-site access script code.
3. The cross-site attack protection method according to claim 2, wherein the characters with attack capability in the cross-site access script code are filtered out according to the access identifier, and cross-site scripting defense is performed on the cross-site access script code The processing steps include:

Extracting attack-capable characters in the cross-site access script code;

Calculating the character probability of the character appearing in the external network access request;

Comparing the magnitude relationship between the character probability and the preset probability level of information leakage;

If the character probability is greater than the probability level, the access protection program is started to perform cross-site scripting defense processing on the access request.
8. The cross-site attack protection method according to claim 3, wherein the calculating the character probability of the character appearing in the external network access request comprises:

Retrieve all historical access records of cross-site attacks on the network side, and count the total number of cross-site access script codes of all historical access records;

Counting the number of occurrences of the character in all the historical visit records;

According to the number of occurrences and the total number, the probability of the character appearing in the external network access request is calculated.
8. The cross-site attack protection method according to claim 4, wherein the calculation of the character probability of the character in the external network access request based on the number of appearances and the total number comprises:

Divide the number of occurrences by the total number to obtain a percentage value;

Multiply the percentage value by a weight coefficient to obtain the final character probability. The calculation formula is as follows:

Wherein, P is the probability of the appearance of characters with attack capability, m is the number of occurrences, M is the total number of cross-site access script codes, and α is the weight coefficient.
8. The cross-site attack protection method according to claim 3, wherein the probability levels include three levels from low to high attack levels, and performing cross-site scripting defense processing on the cross-site access script code includes:

If the character probability is greater than the first probability level and less than the second probability level, perform shielding processing on the corresponding character or the entire code in the cross-site access script code;

If the character probability is greater than the second probability level and less than the third probability level, replace the characters or the entire code in the cross-site access script code;

If the character probability is greater than the third probability level, the cross-site access script code is deleted from the external network access request.
7. The cross-site attack protection method according to claim 6, wherein said performing cross-site scripting defense processing on said cross-site access script code further comprises:

If the character probability is greater than the third probability level, perform functional evaluation on the cross-site access script code to determine whether the cross-site access script code is a necessary function access code in the external network access request;

If yes, keep the cross-site access script code in the extranet access request, and replace the attack-capable character with a preset security character, the security character only realizes the code digit filling function symbol.
A cross-site attack protection device, which includes:

The obtaining module is used to obtain the external network access request received by the network side, the external network access request is a collection containing at least one cross-site access script code for implementing cross-site data access;

The detection module is configured to detect whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request according to the predefined lexical combination rule, wherein the lexical combination The rule is a model obtained through analysis of currently known malicious attack programs; and is used to detect whether there is an access identifier in the cross-site access script code when a malicious program is detected, wherein the access identifier is based on a preset User rules are defined;

A judging module, for judging whether there are characters with attack capabilities in the cross-site access script code if the access identifier exists;

The defense processing module is configured to, if the character exists in the cross-site access script code, filter out the characters with attack capability in the cross-site access script code according to the access identifier, and check the cross-site access script The code performs cross-site scripting defense processing.
8. The cross-site attack protection device according to claim 8, wherein the detection module includes a simulation operation unit, a calculation unit and a classification unit;

The simulation running unit is configured to execute the cross-site access script code for simulation operation, and capture the active label on each access page of the HTTP data packet during runtime;

The calculation unit is configured to calculate the reciprocal of the tag probability of the active tag in the cross-site access script code, and add the reciprocal to obtain an arithmetic average as the embedded JavaScript reasonable index of the active tag ；

The classification unit is configured to classify the cross-site access script code according to the reasonable index;

Wherein, the active tag is a tag with no other active tags between the active tag and the cross-site access script code, and the tag probability is the probability of the active tag directly appearing on the cross-site access script code.
9. The cross-site attack protection device according to claim 9, wherein the defense processing module includes an extraction unit, a probability calculation unit, a comparison unit, and a protection unit;

The extraction unit is configured to extract characters with attack capabilities in the cross-site access script code;

The probability calculation unit is configured to calculate the character probability of the character appearing in the external network access request;

The comparison unit is configured to compare the magnitude relationship between the character probability and the preset probability level of information leakage;

The protection unit is configured to start an access protection program to perform cross-site scripting defense processing on the access request when the character probability is greater than the probability level.
The cross-site attack protection device according to claim 10, wherein the probability calculation unit is used for:

Retrieve all historical access records of cross-site attacks on the network side, and count the total number of cross-site access script codes of all historical access records; count the number of occurrences of the character in all historical access records ; According to the number of occurrences and the total number, the probability of the character appearing in the external network access request is calculated.
The cross-site attack protection device according to claim 11, wherein the probability calculation unit is further configured to:

Divide the number of occurrences by the total number to obtain a percentage value; multiply the percentage value by a weight coefficient to obtain the final character probability. The calculation formula is as follows:

Where, P is the probability of occurrence of characters with attack capability, m is the number of occurrences, M is the total number of cross-site access script codes, and α is the weight coefficient.
The cross-site attack protection device according to claim 10, wherein the probability level includes three levels from low to high attack degree, and the defense unit is used for:

When the character probability is greater than the first probability level and less than the second probability level, perform shielding processing on the corresponding character or the entire code in the cross-site access script code;

When the character probability is greater than the second probability level and less than the third probability level, replace the character or the entire code in the cross-site access script code;

When the character probability is greater than the third probability level, the cross-site access script code is deleted from the external network access request.
The cross-site attack protection device of claim 13, wherein the cross-site attack protection device further comprises:

The evaluation module is configured to perform a functional evaluation of the cross-site access script code after the character probability is greater than the third probability level, and determine whether the cross-site access script code is necessary in the external network access request Function access code; if it is, keep the cross-site access script code in the extranet access request, and replace the attack-capable characters with preset security characters, which are only implementation code bits Symbol for number filling.
A cross-site attack protection device, which includes a memory, a processor, and a cross-site attack protection program stored on the memory and running on the processor, the cross-site attack protection When the program is executed by the processor, the steps of the cross-site attack protection method described below are implemented:

Acquiring an external network access request received by the network side, where the external network access request is a collection containing at least one cross-site access script code for implementing cross-site data access;

According to a predefined lexical combination rule, detect whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request, where the lexical combination rule is to pass the current A model obtained by analyzing a known malicious attack program;

If a malicious program is detected, detecting whether there is an access identifier in the cross-site access script code, where the access identifier is defined based on a preset user rule;

If the access identifier exists, it is determined whether there are characters with attack capability in the cross-site access script code;

If the character exists in the cross-site access script code, the characters with attack capabilities in the cross-site access script code are filtered out according to the access identifier, and cross-site scripting defense is performed on the cross-site access script code deal with.
The cross-site attack protection device according to claim 15, wherein the cross-site attack protection program is executed by the processor to realize the detection of the cross-site carried in the external network access request according to the predefined lexical combination rule When accessing the steps in the script code for responding to whether there is a malicious program in the HTTP data packet for cross-site access, the following steps are also included:

Execute the cross-site access script code for simulation operation, and capture the active tags on each access page of the HTTP data packet during operation;

Calculate the inverse of the tag probability of the active tag in the cross-site access script code, and add the inverse numbers to obtain an arithmetic average as the embedded JavaScript reasonable index of the active tag;

Classify the cross-site access script code according to the reasonable index;

Wherein, the active tag is a tag with no other active tags between the active tag and the cross-site access script code, and the tag probability is the probability of the active tag directly appearing on the cross-site access script code.
The cross-site attack protection device according to claim 16, wherein the cross-site attack protection program is executed by the processor to realize the screening out of the cross-site access script codes with attack capabilities according to the access identifier Characters, and the steps of performing cross-site scripting defense processing on the cross-site access script code include the following steps:

Extracting attack-capable characters in the cross-site access script code;

Calculating the character probability of the character appearing in the external network access request;

Comparing the magnitude relationship between the character probability and the preset probability level of information leakage;

If the character probability is greater than the probability level, the access protection program is started to perform cross-site scripting defense processing on the access request.
A computer-readable storage medium having a cross-site attack protection program stored on the computer-readable storage medium, and when the cross-site attack protection program is executed by a processor, the steps of the cross-site attack protection method described below are implemented:

Acquiring an external network access request received by the network side, where the external network access request is a collection containing at least one cross-site access script code for implementing cross-site data access;

According to a predefined lexical combination rule, detect whether there is a malicious program in the HTTP data packet used to respond to the cross-site access in the cross-site access script code carried in the external network access request, where the lexical combination rule is to pass the current A model obtained by analyzing a known malicious attack program;

If a malicious program is detected, detecting whether there is an access identifier in the cross-site access script code, where the access identifier is defined based on a preset user rule;

If the access identifier exists, it is determined whether there are characters with attack capability in the cross-site access script code;

If the character exists in the cross-site access script code, the characters with attack capabilities in the cross-site access script code are filtered out according to the access identifier, and cross-site scripting defense is performed on the cross-site access script code deal with.
The computer-readable storage medium of claim 18, wherein the cross-site attack protection program is executed by a processor to realize the detection of the cross-site access script code carried in the external network access request according to a predefined lexical combination rule The steps used to respond to the presence of malicious programs in the HTTP data packets of cross-site access include the following steps:

Execute the cross-site access script code for simulation operation, and capture the active tags on each access page of the HTTP data packet during operation;

Calculate the inverse of the tag probability of the active tag in the cross-site access script code, and add the inverse numbers to obtain an arithmetic average as the embedded JavaScript reasonable index of the active tag;

Classify the cross-site access script code according to the reasonable index;

Wherein, the active tag is a tag with no other active tags between the active tag and the cross-site access script code, and the tag probability is the probability of the active tag directly appearing on the cross-site access script code.
The computer-readable storage medium of claim 19, wherein the cross-site attack protection program is executed by the processor to realize the screening of characters with attack capabilities in the cross-site access script code according to the access identifier , And the steps of performing cross-site scripting defense processing on the cross-site access script code include the following steps:

Extracting attack-capable characters in the cross-site access script code;

Calculating the character probability of the character appearing in the external network access request;

Comparing the magnitude relationship between the character probability and the preset probability level of information leakage;

If the character probability is greater than the probability level, the access protection program is started to perform cross-site scripting defense processing on the access request.