面向web系统的安全信息搜集平台的设计与实现

发布时间：2018-10-29 18:52

【摘要】：从2011年开始的“十二五”规划已于2015年收官,网络在我国大量普及,已有6.88亿网民连入互联网,成为互联网大军的一员。互联网已融入人民的生活。但随之而来的互联网安全问题也愈演愈烈,信息安全愈发受到大众关注。国家也针对网络空间开始大力推行法制化。虽然网络安全防护水平有所提升,但各种针对web系统的网络安全事件依旧层出不穷,并多次出现由信息泄露所引发的精准网络诈骗和勒索事件。如何提升web系统的安全防护,是十分值得探讨的问题。网络技术多种多样,针对web系统的攻击亦多种多样,但传统的web系统安全工具主要集中在漏洞扫描,通过对发现的漏洞进行修复来提升安全性,但是并未纵观web系统全局安全。而且目前很多漏洞器基于C/S架构,通常情况下,并不易于部署和使用,且对新漏洞更新不及时。虽有商用软件支持较好,但是却很昂贵,并不适用于众多中小型企业对小型网站的安全保障工作。针对上述问题,本文分析并研究了 web系统的基本安全信息搜集和漏洞信息搜集及其关键技术,并设计并实现了一个高可用性、高扩展性的面向web系统的安全信息搜集平台。此平台可搜集web系统的全局安全信息,协助管理员评估网站安全风险。主要工作如下:1.对web系统的安全信息搜集方式进行调研,从web系统安全入手,对web系统的基本的安全信息进行分析,完成对面向web系统的安全信息搜集平台进行可行性分析和需求分析。2.对web系统的主要安全漏洞进行研究,分析了不同web系统漏洞特性和漏洞扫描技术,并深入分析了 SQL注入和XSS漏洞的形成原理、漏洞利用、漏洞危害、防御方法等。3.对web服务器端的过滤机制进行研究,并分析与其对应的反过滤规则集。并使用此方法对XSS漏洞测试用例库进行拓展、优化,从而提升XSS漏洞的扫描覆盖率。4.最后对安全信息搜集平台进行逻辑设计,并对平台的不同模块进行详细设计并实现,同时完成对平台进行信息搜集、漏洞扫描等方面的测试工作,验证平台的可用性与有效性。并使用本平台对大量网站进行基本安全信息搜集,完成对应信息统计、分析工作。
[Abstract]:The 12th Five-Year Plan, which began in 2011, ended in 2015. The Internet has been widely used in China, and 688 million netizens have joined the Internet and become a member of the Internet army. The Internet has been integrated into people's lives. However, the problem of Internet security has become more and more serious, and information security has become more and more concerned by the public. The country also aims at cyberspace to begin energetically to carry out legalization. Although the level of network security has been improved, a variety of network security incidents against web system are still emerging in endlessly, and there are many accurate network fraud and extortion incidents caused by information disclosure. How to improve the security protection of web system is a problem worth discussing. There are a variety of network technologies and attacks against web systems, but the traditional web system security tools mainly focus on vulnerability scanning, through the detection of vulnerabilities to improve the security, but do not look at the overall security of web system. At present, many vulnerabilities are based on C / S architecture, which is not easy to deploy and use, and is not timely to update new vulnerabilities. Although commercial software support is good, but it is very expensive, not suitable for many small and medium-sized enterprises to small site security. Aiming at the above problems, this paper analyzes and studies the basic security information collection, vulnerability information collection and their key technologies of web system, and designs and implements a high availability and high scalability security information collection platform for web system. This platform can collect the global security information of web system and help administrators to assess the security risks. The main work is as follows: 1. This paper investigates the security information collection method of web system, starts with the security of web system, analyzes the basic security information of web system, and completes the feasibility analysis and requirement analysis of the security information collection platform for web system. 2. The main security vulnerabilities of web system are studied, the vulnerability characteristics and vulnerability scanning techniques of different web systems are analyzed, and the forming principle, vulnerability exploitation, vulnerability harm and defense methods of SQL injection and XSS vulnerability are analyzed in depth. 3. The filtering mechanism of web server is studied, and the corresponding backfiltering rule set is analyzed. This method is used to extend and optimize the XSS vulnerability test case library, so as to improve the scanning coverage of XSS vulnerability. 4. 4. Finally, the logical design of the security information collection platform is carried out, and the different modules of the platform are designed and implemented in detail. At the same time, the platform information collection, vulnerability scanning and other aspects of the testing work are completed to verify the availability and effectiveness of the platform. And use this platform to collect basic security information of a large number of websites, complete the corresponding information statistics, analysis work.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】