组合Web服务劫持攻击的研究与实现  

Research and Implementation of Service Hijack Attacks on Composite Web Services

作　　者：黄康宇[1] 郑成辉[1] 吴海佳[1] 吴礼发[1] 

机构地区：[1]解放军理工大学指挥自动化学院,江苏南京210007

出　　处：《小型微型计算机系统》2011年第2期258-261,共4页Journal of Chinese Computer Systems

基　　金：国防预研基金项目(51406020105JB8103)资助

摘　　要：组合Web服务在给基于异构平台的应用集成带来极大便利的同时,其自身面临着各种恶意攻击的威胁.根据组合Web服务开放性、分布式的特点,提出了针对组合Web服务的服务劫持攻击方案,包括劫持洪泛攻击、服务假冒攻击和服务重放攻击.详细介绍了这些攻击方式的设计思想,模拟实验结果表明设计的攻击方案对组合Web服务产生了严重影响.论文的研究成果有助于设计针对组合Web服务的攻击检测方法.Composite Web Services greatly facilitates the application-to-application integration based on heterogeneous platform, but they are faced with threats of various malicious attacks. Base on the open and distributed characteristics of Composite Web Services, this paper puts forward the Service Hijack attacks on Composite Web Services which include Hijack Flooding attack, Service Counter- feiting attack and Service Replay attack. This paper detailedly introduces the design principles, and the results of simulate experiments shows that these attacks have great impact on Composite Web Services. The research of this paper can help to design the attack detection methods of Composite Web Services.

关 键 词：WEB服务 组合WEB服务 安全 服务劫持攻击 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]