Web application intrusion detection method, system, computer equipment and storage medium

Abstract

The application relates to a Web application intrusion detection method and system, computer equipment and a storage medium. The method includes the following steps: when a Web application is started,loading an intrusion detection component and a toolkit including multiple byte code files according to a pre-configured startup parameter, wherein each byte code file includes a business function andan interface function; adding a detection code in the interface function by using the intrusion detection component; when an HTTP request sent by a client terminal through a proxy server is received,executing the corresponding business function according to the HTTP request, and performing business processing on a request body that carries an intrusion simulation character string added by the proxy server; when the business function calls the corresponding interface function, adopting the detection code in the interface function to detect whether the processed request body still includes theintrusion simulation character string, if yes, determining that a detection result is that the Web application has an intrusion risk; and generating an HTTP response according to the detection result, and returning the HTTP response to the proxy server. By adopting the method, the detection efficiency can be improved.

Description

technical field [0001] The present application relates to the field of computer technology, in particular to a web application intrusion detection method, system, computer equipment and storage medium. Background technique [0002] In recent years, with the wide application of network technology, more and more enterprises regard web application program (hereinafter referred to as "web application") as an important business approach, thus putting forward higher requirements for the security of web application. In order to improve the security of web applications, it is necessary to perform intrusion detection on web applications to find possible security holes in web applications. Intrusion detection is to detect the attack events (also known as "intrusion events") in the corresponding data stream of the Web application. At present, attacks against web applications cover all levels from operating systems, web applications to web application databases. The forms of attack ma...

AI Technical Summary

Problems solved by technology

Manual triggering to detect intrusion events has poor timeliness, it is difficult to realize real-time detection of intrusion events, and the detection efficiency is low

Images