论文部分内容阅读
为提升面向Web应用的跨站脚本(XSS)漏洞检测方法的检测效果,提出了基于隐马尔科夫模型(HMM)的攻击向量动态生成和优化方案。通过使用决策树模型对攻击向量进行分类,并使用代码混淆策略对攻击向量进行变形,用生成变形后的攻击向量组成攻击向量库用于XSS漏洞的渗透测试。测试前,使用探子算法去除一部分不存在XSS漏洞的页面,以减少测试阶段与Web服务器的交互次数。此外,还对获取的注入点进行了去重处理,以避免重复检测不同Web页面中相同的注入点,进一步采用XPath路径定位技术提高漏洞检测中结果分析的效率。实验结果表明,该方法能够有效改善XSS漏洞的检测效率。
In order to improve the detection effect of cross-site scripting (XSS) vulnerability detection methods for web applications, a dynamic generation and optimization scheme of attack vectors based on Hidden Markov Model (HMM) is proposed. The attack vectors are classified by using the decision tree model, and the attack vectors are transformed by using the code obfuscation strategy. The attack vector vectors are generated by using the transformed attack vectors for penetration testing of the XSS vulnerabilities. Before the test, use the probe algorithm to remove a portion of the pages that do not contain XSS vulnerabilities to reduce the number of interactions with the Web server during the test phase. In addition, the acquired injection points are deduplicated to avoid repeated detection of the same injection points in different Web pages, and further XPath path localization technology is used to improve the efficiency of the result analysis in the vulnerability detection. Experimental results show that this method can effectively improve the detection efficiency of XSS vulnerabilities.