Website safety protection method and website safety protection device based on form scrambling

Abstract

The invention discloses a website safety protection method and a website safety protection device based on form scrambling. A form on a webpage is deformed. Deformation manners comprise randomizing field names in the form, namely changing the field names to a ruleless character string; changing positions between the fields; and adding interference fields in the form. Through the manner of the invention, a user can use the service which is provided by a website without difference, but on the condition that a malicious behavior which applies automatic attacks occurs, no rule of the deformed webpage form can be found, thereby realizing high difficulty in performing attacks by a hacker according to the field names of the form. The website safety protection method and the website safety protection device can effectively prevent malicious attacking behaviors of CSRF, SQL injection, hit-the-base, browser middleman attacks and information leakage.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a method and device for website security protection based on form scrambling. The invention improves website security by randomizing field names in forms, moving parameter names, and increasing interference parameters. security. [0002] technical background [0003] With the rapid development of the Internet, cloud computing, and mobile computing, attack methods such as XSS attacks, SQL injection attacks, CSRF attacks, click hijacking, file uploads, and directory traversal seriously threaten the security of websites. The current security situation is very serious. More than half of websites and web application data are leaked, causing significant financial losses. Corporate website security incidents occur frequently, and they are subject to blackmail from hackers and malicious attacks from competitors. According to the 360 ​​Security Big Data report, ...

AI Technical Summary

Problems solved by technology

[0005] The current method still can not effectively guarantee the security of the website

If only defense devices such as WAF / IDS (Web Application Defense System / Intrusion Detection System) are deployed for the website, then the security of the entire website depends entirely on these devices, but WAF / IDS devices cannot guarantee that there are no security holes

If the hacker exploits the vulnerability of the WAF / IDS device, the hacker can still break through the website

At the same time, there are endless new attack methods and attack methods. Attackers will transform malicious code or malware according to the current WAF / IDS defense rules to escape security detection.

All current security products cannot provide a safe deployment method to ensure that the website will not be attacked by malicious scanning, credential library and browser man-in-the-middle

Images