面向SOAP消息的Web服务注入攻击检测方法  

Detection of SOAP message-oriented injection attacks on Web services

作　　者：吴长勤[1] 王传安[1] 

机构地区：[1]安徽科技学院数学与信息学院

出　　处：《武汉工程大学学报》2015年第7期60-64,共5页Journal of Wuhan Institute of Technology

基　　金：安徽科技学院青年科研研究项目(ZRC2014426);安徽省自然科学研究项目(KJ2013Z048)

摘　　要：面向SOAP消息的注入攻击对Web服务的发展前景和应用产生重要的影响,而目前尚缺乏有效的检测方法,为此我们提出了一种基于行为模式的注入攻击检测方法.该方法在Web服务访问日志行为建模阶段采用长度不同的特征子串来表示行为模式,并通过序列模式的支持度来建立正常消息行为模式轮廓;针对注入攻击复杂多变的特点,进一步提出基于矩阵相似匹配结合相似判决阈值的注入攻击检测模型.实验结果表明,与多种其他经典检测方法相比,该检测方法在检测率和误报率等方面检测效果好,可有效地检测出注入攻击.SOAP message-oriented injection attacks have great impacts on prospects and applications of Web services; however, there is not an effective injection attacks detection method now. We proposed a method to detect injection attacks based on behavior patterns. In this method, the behavioral patterns of the legal behavior were characterized by characteristic substring sequences of different lengths, and the sequence supports were used to construct the normal behavior profiles in modeling stage of Web-access log message behavior.According to the complex and volatile features of injection attacks, a detection model based on matrix similarity matching and decision threshold was proposed. Compared with other classical detection models in experiments, the proposed method has better detection rate and false positive rate, showing good detection effects on injection attacks.

关 键 词：注入攻击 SOAP消息 WEB服务 行为模式 

分 类 号：TB35[一般工业技术—材料科学与工程]