基于行为的XSS攻击防范方法  

XSS attack defense method based on behavior

作　　者：蒋华[1] 徐中原[1] 王鑫[1] 

机构地区：[1]桂林电子科技大学计算机科学与工程学院,广西桂林541004

出　　处：《计算机工程与设计》2014年第6期1911-1914,1925,共5页Computer Engineering and Design

基　　金：国家自然科学基金重点基金项目(61262074)

摘　　要：为了更好地防范XSS攻击以及由此所衍生的XSS蠕虫攻击,提出了一种结合动态污点分析和HTTP请求分析处理相结合的方法。对应用程序中的敏感数据进行标记,对标记数据的流向进行跟踪,防止敏感数据被发送到第三方,同时从XSS蠕虫传播所必需的POST请求入手,对HTTP数据包中的POST请求数据包进行拦截并分析,防止XSS蠕虫的繁衍。实验分析结果表明,该方法能有效地防御XSS攻击和0-Day XSS蠕虫的传播及攻击。The cross site scripting （XSS） vulnerability had become one of the biggest threats to Internet security,to prevent XSS attacks and XSS worm derived from XSS attacks,a method combined with dynamic taint analysis and HTTP request analysis was presented,the application of sensitive data was marked,the flow of the tag data to prevent sensitive data sent to the third party.At the same time because the XSS worm propagation must submit a POST request,POST request data in the HTTP data packet was intercepted and analysised to prevent XSS worms.Experimental analysis showed that this method could effectively defense XSS attacks and propagation and attacks of 0-Day XSS worm.

关 键 词：跨站脚本攻击 动态污点分析 跨站脚本蠕虫 请求数据包 控制依赖 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]