基于指令集随机化的XSS检测系统研究

发布时间：2018-05-09 15:11

本文选题：Web安全 + 跨站脚本攻击　；参考：《中国科学技术大学》2014年硕士论文

【摘要】：随着Web2.0技术的兴起,互联网成为交流的主要媒介和商业活动渠道,Web应用程序的数量得到了极大的增加,这些Web应用程序提供了人们日常所需的各种服务,如购物、银行、娱乐等等。但同时,这些Web应用程序包含了许多潜在的安全漏洞,且每天都以惊人的速度被发现和利用。跨站脚本(XSS)作为Web安全漏洞的一种,被研究者和业内人士普遍认为是Web应用程序中最普遍和流行的安全漏洞。以实现功能为导向的这种自然而简单的软件开发思路来指导开发Web应用程序是很容易导致XSS以及其他安全漏洞的。为了应对这种情况,多年来各种安全工具被开发出来,用于避免开发过程中常见的Web应用程序漏洞。然而,现有的技术工具,包括一些新兴防御技术,都存在着各种不尽如人意的缺陷,如实用性不佳,部署方式欠灵活,性能损失较大以及较大的误报率和漏检率等。理想情况下,一个可靠、高效和可配置的服务器端工具应该可以无缝地用来保护任何组织的系统,防御不断进化的XSS威胁,无论是已被发现的还是未被发现的。在本文中,我们详细介绍了XSS的定义和常见类型,阐述了可能导致XSS的来源和载体,以及XSS攻击的原因,影响和特别之处。介绍了XSS的典型利用场景和危害,探讨了现实世界中可能被攻击者所使用的工具,逃避当前网络防御机制的方法和流程。对过去已有的和新兴的保护解决方案根据他们的部署点进行了分类介绍和总结。最后,根据软件工程、安全编码,和防火墙的理论,我们提出了一套设计原则。我们的框架系统根据这些原则开发,在实用性、检测率和性能开销上都有令人满意的表现,能够为企业的Web应用程序提供实时的安全防护。该框架采用面向方面的程序设计(Aspected Oriented Programming)方法和开源技术实现。与期望的相同,在不影响和损害被评估Web应用程序功能的情况下,所有的测试用例和注入攻击都被成功地识别和化解。
[Abstract]:With the rise of Web2.0 technology, the number of web applications that have become the main medium for communication and a conduit for business activities has increased dramatically. These Web applications provide a variety of services that people need on a daily basis, such as shopping, banking, and so on. Entertainment, etc. But at the same time, these Web applications contain many potential security vulnerabilities and are discovered and exploited at an alarming rate every day. As one of the Web security vulnerabilities, cross-site scripting (XSS) is widely regarded by researchers and industry as the most common and popular security vulnerability in Web applications. This natural and simple idea of software development, which is oriented towards implementation, can easily lead to XSS and other security vulnerabilities to guide the development of Web applications. To deal with this situation, various security tools have been developed over the years to avoid common vulnerabilities in Web applications during development. However, the existing technical tools, including some emerging defense technologies, all have some shortcomings, such as poor practicability, less flexible deployment mode, large performance loss, large false alarm rate and false detection rate, etc. Ideally, a reliable, efficient, and configurable server-side tool should be seamlessly used to protect any organizational system against evolving XSS threats, whether discovered or not. In this paper, we introduce the definition and common types of XSS in detail, explain the source and carrier of XSS, and the reason, influence and special place of XSS attack. This paper introduces the typical utilization scenarios and harms of XSS, discusses the tools that may be used by attackers in the real world, and discusses the methods and processes of escaping the current network defense mechanism. The existing and emerging protection solutions are introduced and summarized according to their deployment points. Finally, according to the theory of software engineering, security coding, and firewall, we propose a set of design principles. Our framework system is developed according to these principles and has satisfactory performance in practicability, detection rate and performance overhead, which can provide real-time security protection for enterprise Web applications. The framework is implemented by aspect-oriented Oriented programming and open source technology. As expected, all test cases and injection attacks were successfully identified and resolved without affecting and compromising the functionality of the evaluated Web application.
【学位授予单位】：中国科学技术大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.09

【相似文献】