基于RASP的SQL注入和XSS攻击的检测技术  

Research on SQL injection and XSS detection technology based on RASP

作　　者：沈伍强 张小陆 杨春松 许明杰 SHEN Wu-qiang;ZHANG Xiao-lu;YANG Chun-song;XU Ming-jie(Guangdong Power Grid Co.,Ltd.,Information Center,Guangzhou 510000,China;Guodian NARI Technology Co.,Ltd.,Nanjing 210000,China)

机构地区：[1]广东电网有限责任公司信息中心,广州510000 [2]国电南瑞科技股份有限公司,南京210000

出　　处：《信息技术》2022年第10期91-96,共6页Information Technology

基　　金：南方电网公司科技项目资助(037800KK52190012)。

摘　　要：针对电力信息系统面对SQL注入和XSS攻击时检测效率低、防御效果不佳等问题,提出一种基于RASP技术的SQL注入和XSS漏洞检测与防御技术,直接将数据库函数、校验函数等通过RASP探针注入Web服务应用内部进行有效监测;针对攻击和程序交互较少的情况,基于KMP算法和过滤机制将输入字符串与注入字符串的存储模式匹配,对恶意攻击代码进行检测与防御。实验结果表明,提出的方法可以有效对SQL注入和XSS攻击进行检测和防御,且效率较高。Based on the problem of low detection efficiency and poor defense effect of the power information system when faced with SQL injection and XSS attacks, this paper proposes a SQL injection and XSS vulnerability detection and defense technology based on RASP technology to directly monitor the database functions, and check functions, etc, effectively through RASP probe injection, protecting the system from the code level. Based on the situation of less interaction between attacks and programs, this article matches the input string with the stored pattern of the injected string based on the KMP algorithm and filtering mechanism to detect and defend malicious attack codes. Experiment results show that the proposed method can defend against SQL injection and XSS attacks with high efficieney.

关 键 词：RASP KMP算法 过滤机制 SQL注入 XSS攻击 

分 类 号：TP333[自动化与计算机技术—计算机系统结构]