Dynamic application protection system and method based on attack load and attack behavior

Abstract

The invention relates to the field of computer information security, and discloses a dynamic application protection system based on attack load and attack behavior, which comprises a flow receiver, a flow controller, a basic configuration module, a behavior model research and development module, a first analysis module and a second analysis module for setting parameters through the behavior model research and development module. The invention further discloses a protection method of the dynamic application protection system based on the attack load and the attack behavior. According to the method, the attacker behavior judgment model is established, so that the problem that attacker requests are insufficient and easy to leak due to the fact that a traditional WAF completely depends on load attack recognition is solved.

Description

technical field [0001] The invention relates to the field of computer information security, in particular to a dynamic application protection system and method based on attack load and attack behavior. Background technique [0002] WAF is a common technical facility for application layer security protection. It analyzes each HTTP / HTTPS request and identifies the attack field contained in a single request. If an attack is detected, the request will be blocked once. It will let the request go to the business machine and provide blocking protection for the web application. [0003] Traditional WAF only requests a single identification of a request traffic packet from the outside, and the attack behavior can only be blocked or released. For example, when an attacker tries to scan the web application system, the attack process includes probing and analysis. , Precise attack, during the trial process, the regular attack load will be placed on the request traffic multiple times an...

AI Technical Summary

Problems solved by technology

[0003] The traditional WAF will only identify a single request for a single request from the outside, and the attack behavior can only be intercepted or released. For example: when an attacker tries to scan the web application system, the attack process includes probing and analysis. , Precise attack, during the trial process, the conventional attack load will be placed on the request traffic multiple times and sent to the web application system. Traditional WAF can only block and intercept a single request traffic once, and the attacker may frequently adjust the attack After the payload is tried, the correct attack payload is analyzed, and the attack request traffic is reconstructed to achieve precise attacks, causing pressure or even damage to the web application system. IP is blackened and permanently banned. When a normal user A uses a mobile phone to access the system, the IP used may inherit the proxy IP used by an attacker B. At this time, the IP has been intercepted and blocked by WAF due to previous attacks. , so user A will not be able to access successfully and needs to manually unblock

Images