脚本程序安全漏洞的动态防御方法  

Dynamic defense method of scripts security vulnerability

作　　者：史伟奇[1] 

机构地区：[1]湖南公安高等专科学校计算机系,湖南长沙410138

出　　处：《计算机工程与设计》2007年第17期4126-4128,4174,共4页Computer Engineering and Design

基　　金：公安部应用创新基金项目(2005YYCXHNST095);湖南省高校科学研究优秀青年基金项目(07B061)

摘　　要：脚本程序漏洞经常引起安全问题,导致出现网络攻击。对常见脚本程序漏洞进行了分类研究,分析了漏洞产生机理,总结出参数引用(参数未过滤、数据未判断、数据未过滤)和逻辑考虑不足(逻辑推理缺陷、逻辑运算符滥用)两类主要的脚本安全问题。在此基础上,提出一种针对脚本源代码漏洞的动态防御方法,阐明了防御原理及方法,设计了攻击字符库。实验表明,该方法可以有效地防范脚本漏洞攻击,提高了Web系统的安全性。The vulnerability of script that brings on network attack is very danger to web security. Based on the analysis of the scripts security, thevulnerability of script is classified astwo categories-parameterreference and insufficiency of logicalanalysis. The parameter reference invalidation includes three type of bugs- none-filtering of parameter, none-verifying of data and none-filtering of data. The logical invalidation contains the reason deducing bug and the abuse of logical operator. Moreover, a dynamic defense method by tho- roughly analyzing the vulnerability in source code is put forward and the attack characteristic code database is designed also, The experi- ment result shows that the present method can effectively defense the attacks of script vulnerability and improve the security performance of web system.

关 键 词：脚本程序 WEB安全 脚本漏洞 漏洞分析 网络攻击 动态防御 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]