基于HTML5的Web平台安全技术研究

发布时间：2019-01-23 12:35

【摘要】：HTML5技术由于其对移动设备的良好支持、跨浏览器、易使用等特点,已经在Web应用中越来越流行。然而HTML5兴起的同时也带来了一些安全问题。HTML5中仍然存在着旧的攻击形式例如跨站脚本攻击、点击劫持攻击、跨站请求伪造攻击等,同时HTML也引入了一些新的攻击方式,例如API的滥用、离线应用缓存中毒、本地存储攻击等等。因此在HTML5越来越流行的同时,其带来的安全漏洞导致的危害的也越来越严重,本文所研究的基于HTML5的Web安全及防御也有重要的意义。本文针对当前HTML5最主要的攻击即跨站脚本攻击进行了详细的研究和分析,深入研究了跨站脚本攻击的入侵检测算法,设计了基于跨站脚本攻击的防御模型,并实现了防御系统,本文主要的工作如下:(1)提出了基于HTML5的XSS攻击防御模型。对该模型的总体架构进行了设计,防御模型分为客户端、入侵检测以及服务端三部分,详细阐述了各部分的工作原理。(2)研究并实现了 XSS入侵检测算法。采用字符串匹配算法对XSS攻击进行入侵检测,并对常见的KMP算法进行改进,将改进后的算法应用到XSS防御系统中。(3)设计并实现了基于HTML5的XSS攻击防御系统。对系统总体框架进行设计,并对三个主要模块客户端防御模块、入侵检测模块和服务端防御模块进行了详细设计,并给出具体的实现方案。(4)对XSS攻击防御模型进行试验和评测。评测表明,本文提出的基于HTML5的XSS攻击防御模型能够满足一般的Web应用对于跨站脚本攻击的防御要求。
[Abstract]:HTML5 technology has become more and more popular in Web applications because of its good support for mobile devices, cross-browser, easy to use and so on. However, the rise of HTML5 also brings some security problems. There are still some old attack forms in HTML5, such as cross-site script attack, click-hijacking attack, cross-station request forgery attack, etc. At the same time, HTML also introduces some new attack methods. For example, API abuse, offline application cache poisoning, local storage attacks, and so on. Therefore, as HTML5 becomes more and more popular, the harm caused by security vulnerabilities is becoming more and more serious. The research on Web security and defense based on HTML5 in this paper is also of great significance. This paper makes a detailed study and analysis on the most important attack of HTML5, I. e., cross-station script attack, deeply studies the intrusion detection algorithm of cross-station script attack, designs a defense model based on cross-station script attack, and implements a defense system. The main work of this paper is as follows: (1) A XSS attack defense model based on HTML5 is proposed. The overall architecture of the model is designed. The defense model is divided into three parts: client, intrusion detection and service. The working principle of each part is described in detail. (2) the XSS intrusion detection algorithm is studied and implemented. The string matching algorithm is used to detect the XSS attack, and the common KMP algorithm is improved. The improved algorithm is applied to the XSS defense system. (3) the XSS attack defense system based on HTML5 is designed and implemented. The overall framework of the system is designed, and the three main modules, the client defense module, the intrusion detection module and the server defense module, are designed in detail. The implementation scheme is given. (4) the XSS attack defense model is tested and evaluated. The evaluation results show that the proposed XSS attack defense model based on HTML5 can meet the requirements of general Web applications for cross-site scripting attacks.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【参考文献】