基于正则表达式的java web程序漏洞检测技术分析-analysis of java web program vulnerability detection technology based on regular expression.docxVIP

AbstractManyWebapplicationssufferfromnetworkattackpatternssuchasXSSandSQLinjectionattackduetothelackofthevalidationforuserinput.TheattackerslaunchtheattackbyconstructingmaliciousandpreciseSQLstatementandthensubmittothedatabaseserverinordertodeceivetheservertoperformthestatementstoachievetheirpurpose,ortheyembedthemaliciousscriptintotheWebpageHTMLtagstodeceivetheclientbrowsertoexecuteforachievingthetheftofcookie.SQLinjectionandXSSattackhavetheirownfeature,butthesamereasonofthesetwoattackmodesisthelackofvalidationandfilteringmechanismforuserinput.RegularexpressionhasbeenwidelyusedindetectingWebapplicationvulnerabilitybecauseofitssimpleformandpowerfulfunction.ThispapermainlyfocusesonhowtodetecttheexistenceofSQLinjectionattacksandXSSvulnerabilitybyusingregularexpressionanditsautomataformtomaketheintersectionwiththevaluesetofthestringatcertainprogrampoint.Inordertodetectwhetherthevulnerabilitiesexist,weneedtoconstructtheregularexpressionwhichstandsforattackmodeaselaborateaspossible.Atthesametimeweneedtoconstructthestringmanipulationlibrarywhichsimulatesthestringoperationtogetthevalueofthestringattheprogrampoints.Wegetthedependenceinformationofthesourcecodebasedonstaticanalysis,andthendothedependenceanalysisforthevulnerablepointoftheprogramtoconstructthecorrespondingvulnerablepointdependencegraphforthepotentialvulnerablepointsoastoobtainthesetvalueofthestringindifferentprogrampoints.AndthenwecandeterminetheexistenceofSQLinjectionandXSSattacksvulnerabilityintheprogrampoints.Finallythesystemfiltersthecharactersintheattackstringandgivesthedescriptionsandproposedoperationstoguaranteethesafetyoftheprogrameffectively.TheexperimentalresultsshowthatwecandetectthemajorityofSQLinjectionandXSSattacksaccuratelyandmakeeffectivetreatmentonthebasisoftheelaboratelyconstructedregularexpressions,automataoperationlibraryandstaticanalysisfortheprogram.Keywords:InjectionAttack,XSSAttack,Regularexpression,Programvulnerability目录摘要IAbstractII1绪论1.1研究背景及意义(1)1.2国内外研究现状(1)1.3主要内容及组织结构(4)2攻击模式2.1SQ