• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>IEEE transactions on dependable and secure computing >Defending Against Web Application Attacks: Approaches, Challenges and Implications
【24h】

Defending Against Web Application Attacks: Approaches, Challenges and Implications

机译：防止Web应用程序攻击：方法，挑战和含义

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Some of the most dangerous web attacks, such as Cross-Site Scripting and SQL injection, exploit vulnerabilities in web applications that may accept and process data of uncertain origin without proper validation or filtering, allowing the injection and execution of dynamic or domain-specific language code. These attacks have been constantly topping the lists of various security bulletin providers despite the numerous countermeasures that have been proposed over the past 15 years. In this paper, we provide an analysis on various defense mechanisms against web code injection attacks. We propose a model that highlights the key weaknesses enabling these attacks, and that provides a common perspective for studying the available defenses. We then categorize and analyze a set of 41 previously proposed defenses based on their accuracy, performance, deployment, security, and availability characteristics. Detection accuracy is of particular importance, as our findings show that many defense mechanisms have been tested in a poor manner. In addition, we observe that some mechanisms can be bypassed by attackers with knowledge of how the mechanisms work. Finally, we discuss the results of our analysis, with emphasis on factors that may hinder the widespread adoption of defenses in practice.
机译：一些最危险的Web攻击，例如跨站点脚本和SQL注入，在Web应用程序中利用漏洞，可以接受和处理不确定原点的数据而无需正确验证或过滤，允许注入和执行动态或特定于域语言代码。尽管过去15年来提出了许多对策，但这些攻击一直在不断调整各种安全公告提供商的列表。在本文中，我们对Web代码注入攻击的各种防御机制提供了分析。我们提出了一种模型，突出了能够实现这些攻击的关键弱点，并为研究可用防御提供了共同的视角。然后，我们根据他们的准确性，性能，部署，安全性和可用性特征进行分析和分析一组41个先前提出的防御。检测准确性特别重要，因为我们的研究结果表明，许多防御机制已经以较差的方式进行了测试。此外，我们观察到，攻击者可以通过了解机制如何工作的攻击者来绕过一些机制。最后，我们讨论了我们分析的结果，重点是可能阻碍在实践中普遍采用防御的因素。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号