Judgment method of executive in mimicry WAF

Abstract

The invention discloses a judgment method for an executor in a mimicry WAF, and the method can carry out the judgment of a plurality of processing results with the same flow, thereby discovering and blocking an unknown attack. The flow synchronization module, the multi-mode judgment module, the judgment result and data recording module and the like are mainly designed to realize a judgment function in the mimicry WAF, the mimicry WAF can identify unknown attacks through the judgment function, and the unknown attacks are blocked through operations such as offline self-cleaning of a WAF executor, so that the mimicry WAF has an active defense capability. The method comprises the steps that firstly, a flow synchronization module synchronizes k heterogeneous WAF processing results, then a multi-mode judgment module judges judgment of the processing results, records the judgment results and data into logs and updates corresponding values of a database, and finally, when the judgment resultsare passed, flow is sent to a back-end server, and when the judgment results are not passed, the flow is sent to a honeypot or a sandbox.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a judgment method of an executive in a mimic WAF. Background technique [0002] With the rapid development of Internet technology, the key business of many users is increasingly based on WEB applications. While displaying and interacting through the browser, the threat to the user's business system also follows. With the complexity of business systems and changes in the Internet environment, threats are also growing rapidly. Attack methods such as tampering with web pages, implanting backdoors, and denial of service attacks emerge in an endless stream. Attackers use these methods to paralyze the business of the target server, steal user sensitive information, or control related equipment and resources for their own use. [0003] WAF is called web application firewall. It is a product that protects web applications by implementing a series of security policie...

AI Technical Summary

Problems solved by technology

However, there are still problems such as malicious bypass of the protection rule base, exploiting the vulnerabilities of the WAF platform, the operating system, or the cloud platform to attack, so it faces serious security threats.

Images