Web应用防火墙关于gzip文件的检测研究  

Research on the detection of gzip files in Web application firewall

作　　者：张林 ZHANG Lin(Wuhan Research Institute of Posts and Telecommunications,Wuhan 430074,China)

机构地区：[1]武汉邮电科学研究院,湖北武汉430074

出　　处：《电子设计工程》2020年第19期113-117,125,共6页Electronic Design Engineering

摘　　要：基于传统Web应用防火墙只能使用正则或语义分析的方式去匹配明文攻击特征的HTTP流量,而无法对服务器返回给客户端的压缩文件数据进行检测的目的,提出对WAF关于gzip压缩文件的检测研究思想,使得WAF在对服务器返回给客户端的压缩文件检测提供了一种新思路。通过WAF结合分块传输以及deflate无损压缩算法来对服务器返回给客户端的gzip文件类型的数据进行检测并返回给客户端,在不影响传输时间和带宽的前提下,提高了WAF对于Web攻击的防护能力,有效地保障了Web应用程序的安全。Based on the purpose of traditional web application firewalls,which can only use regular or semantic analysis to match HTTP traffic with plaintext attack characteristics,but cannot detect the compressed file data returned from the server to the client,a research idea for detection of gzip compressed files in WAF is proposed This makes WAF provide a new idea for detecting compressed files returned from the server to the client.Through WAF combined with block transmission and deflate lossless compression algorithm,the gzip file type data returned from the server to the client is detected and returned to the client.Under the premise of not affecting the transmission time and bandwidth,it improves the WAF for web attacks The protection ability effectively guarantees the security of Web applications.

关 键 词：WEB应用防火墙 GZIP 分块传输 防护 

分 类 号：TN918.9[电子电信—通信与信息系统]