Cross-site request forgery CSRF attack recognition method and device

Abstract

The present invention discloses a cross-site request forgery CSRF attack recognition method and device. When a source src in a load of an obtained HTTP request is detected to be at an abnormal state, whether an abnormal GET request whose source IP is the same as a source IP of the HTTP request is received within a preset time is determined, and if is, a CSRF attack is confirmed. By this means, srcs at abnormal states and the abnormal GET requests are continuously detected to commonly confirm whether CSRF attacks based on forged srcs are received, thereby realizing recognition of the CSRF attacks based on the forged srcs.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of communications, and in particular, to a method and device for identifying a cross-site forgery request (CSRF) attack. Background technique [0002] The core of the CSRF (Cross-Site Request Forgery, cross-site forgery request) attack is to forge the form, add any administrator to the affected application system through the forgery form, for example, the added administrator is named X1, and some key parameters are set Good value, for example, when adding an administrator, you need to set good values ​​for key parameters such as the new user name, user password, and user mailbox. In this way, when a user visits a malicious website, the malicious website will steal the authority of a normal user to send a forged form to the system server, and then attack after the system server executes the forged form. [0003] The most common CSRF attack is to attack by forging the form, but if th...

AI Technical Summary

Problems solved by technology

[0003] The most common CSRF attack is to attack by forging the form, but if the target server is deployed with an intrusion prevention device, this attack method may be recognized by the intrusion prevention system, resulting in the attack failure; some attackers may continue to use some escape methods Intrusion prevention device detection method to attack; for example, use forged src (Source, source of information) instead of forged form to carry out CSRF attack, replace the forged form used in the attack with the src form of img, so that when the normal website administrator is in After logging in to a normal website as an administrator, and then clicking on a malicious website containing an img tag, the administrator constructed by the attacker (such as X1) will be added, and the user's permissions will be stolen, so that the stolen user permissions can be used to target The normal website conducts CSRF attack

[0004] In the prior art, the measures taken can only identify CSRF attacks based on forged forms, but cannot identify CSRF attacks based on forged src

Images