Method and device for generating data defense components for actively defending against xss attacks

Abstract

The invention discloses a method and a device for generating a data defense assembly for actively defending XSS (Cross Site Script) attack. The method comprises the following steps of forming a simple data transmission target and adding a defense mark; customizing a defense compiler assembly code; inserting the defense compiler assembly code into a standard compiler assembly sequence; and forming the data defense assembly. The device comprises a data structure reading module, a defense code identifying module, a defense compiler, a standard compiler and a defense code management module, wherein the data structure reading module, the defense code identifying module, the defense compiler and the standard compiler are connected in sequence; and the defense code management module is connected with the defense compiler. By utilizing the method and the device, the defense code can be adjusted and expanded in time, so that a website can rapidly defend constantly changed XSS attack in real time. According to the method and the device, the generality is strong, the development efficiency of the website is greatly improved, and the security of the website is improved.

Description

technical field [0001] The invention belongs to the field of website security, in particular to a method and device for generating a data defense component for actively defending against XSS attacks. Background technique [0002] Among various website security vulnerabilities, cross-site scripting attacks (CrossSiteScript, XSS attacks) are more serious. Cross-site scripting attack means that attackers insert malicious executable scripts (including javascript, flash, css, etc.) into vulnerable websites to trick users into executing them. Once the user browses this page, the malicious script embedded in it will be executed. In this way, the attacker can maliciously endanger the user, such as stealing various user accounts and controlling corporate data, including functions that can be read, tampered, added, and deleted. The ability of sensitive data of enterprises, theft of important and commercially valuable information of enterprises, illegal transfer of funds, forced sendi...

AI Technical Summary

Problems solved by technology

Because this method implants the analysis module and the XSS information database into the local computer, it is necessary to keep updating the XSS database from time to time, otherwise it cannot effectively defend against new XSS attacks, and this defense method is a passive defense, and the XSS information database is updated The time difference may lead to the success of XSS attacks, so you cannot take the initiative to defend

[0006] For large websites, the number of daily visits is quite large. If you cannot actively defend against XSS attacks in advance and leave them to deal with them after the event, it will pose a potential threat to website visitors.

Images