基于内容的Ajax异常检测技术.pdfVIP

2012年第01期，第45卷 通 信 技 术 Vol.45，No.01,2012 总第 241 期 Communications Technology No.241,Totally 基于内容的 Ajax 异常检测技术研究 吕景旭， 吴 静 （西南科技大学 信息工程学院，四川 绵阳 621010） 【摘 要】Ajax 技术不断增加的复杂度、透明度以及代码量，大大增加了 Ajax应用系统的攻击面和信 息泄露的可能性。针对 Ajax 架构的漏洞特点和攻击行为，从数据包载荷内容的角度上对 Ajax 异常请求做 出分析研究，总结出 Ajax 异常数据包的特征，并通过改进的 BM 算法进行特征提取，最后通过评估算法对 提取的特征进行异常判断。实验结果表明，相对于传统的入侵检测方法，采用提出的 Ajax 异常检测技术能 够比较高效准确地完成对Ajax 异常请求的检测。 【关键词】Ajax攻击；JavaScript代码；特征提取；异常检测 【中图分类号】TP393.4 【文献标识码】A 【文章编号】1002-0802(2012)01-0119-03 Ajax Anomaly Detecting Technology based on Payload Data LV Jing-xu， WU Jing (School of Information Engineering, Southwest University of Science and Technology, Mianyang Sichuan 621010, China) 【Abstract】With the increasing complexity, transparency and code of Ajax technology, the attack surface and possibility of information leakage for Ajax application system is greatly enhanced. Aiming at the loophole characteristics of and aggressive behavior against Ajax structure, this paper, from the content of data packets payload, analyzes and studies the anomalous request packet by Ajax, summarizes the characteristics of anomalous data packets of Ajax, and the feature extraction is implemented with the improved BM algorithm. Finally an anomaly judgment on these extracted characteristics is done through the evaluation algorithm. The experimental results show that, compared with the traditional intrusion detection methods, the Ajax anomaly detecting technology proposed in this paper could accurately and efficiently complete the d