PHP application self-protection method based on decision tree classifier

Abstract

The invention relates to a PHP application self-protection method based on a decision tree classifier. The protection method comprises the following steps: step 1, marking data from an untrusted data source, such as input data of a user, as taint data; 2, analyzing a taint propagation path; and step 3, carrying out attack traffic identification on incoming data at a specific function execution settlement point. According to the method, current mainstream website attack modes can be effectively intercepted, in addition, based on the characteristic that the acting position of the method provided by the invention is located at the bottom layer of the program, the method has a more comprehensive effect on interception, attacks directly injected into the program from the outside can be intercepted, and the security of the program is improved. Meanwhile, attacks caused by logic errors of program contexts can be intercepted, and the method is different from a method for judging by using a large number of databases in the past, so that the efficiency is improved.

Description

technical field [0001] The invention belongs to the technical field of network application security protection, in particular to a PHP application self-protection method based on a decision tree classifier. Background technique [0002] With the rapid development of Internet technology, network security issues have become increasingly important. PHP is a powerful server-side scripting language for creating dynamic interactive sites. About 70% of the world's top one million sites use PHP to develop. There are many kinds of WEB vulnerabilities in PHP applications, corresponding to The defense against each vulnerability is different. Most of these vulnerabilities are caused by the fact that the developers did not add enough security processing logic to many input points, such as the vulnerability CVE-2018-18546 exposed by the famous PHP framework THINKPHP, because the developers are not aware of the framework file Library / Think / Db / Driver The key parameter in .class.php is not...

AI Technical Summary

Problems solved by technology

Most of these vulnerabilities are caused by the fact that the developers did not add sufficient security processing logic to many input points, such as the vulnerability CVE-2018-18546 exposed by the famous PHP framework THINKPHP. The key parameter in .class.php is not properly filtered, which eventually leads to a SQL injection vulnerability here, which brings great harm to the program using this framework. From the perspective of the PHP kernel level, no matter what kind of data, eventually will be passed to certain types of functions for execution

Images