Design And Implementation Of The Web Security System

Abstract:With the development of Web technology, Web application meets more and more safety problems, especially SQL injection attack and webpage tamper attack, which are serious threats to data privacy and service availability of Web application.This thesis proposes a Web security reinforcement solution according to the actual demand in the management of campus network. This solution adopts the distributed client deployment, provides management and configuration of uniform view for administrators, and is more suitable to provide security services for a large number of discrete state Web servers. Based on the solution, this thesis designs and realizes a security system, which is officially deployed in the environment of campus network.For the SQL injection attacks, this thesis puts forward a multi-faceted detection and prevention scheme. This scheme is based on HTTP request data detection and classification, improves the filtering method of using keywords or rules, and is a combination of HTTP anomalous response shield and dynamic interception mechanism of attack source IP. Using this scheme, this thesis designs and implements a SQL injection defense reinforcement module on the Tomcat server, which is based on the detailed analysis of data processing flow of the Tomcat server. Compared with the traditional keyword filtering and rule matching method, this scheme can effectively reduce the detection rate and false positives, and avoid the leakage of sensitive information in Web application.For the webpage tamper attacks, this thesis designs and implements a webpage tamper-proofing scheme based on characteristics of Linux operating system, which can conduct a comprehensive monitoring of tampering process. The scheme realizes safety protection on the webpage files and directories in the tampering occurred before, during, after three critical control points by three kind of defense mechanism, including intercepting system calls, controlling file anti-modified bit, and event-triggered warning. At the same time, this thesis considers the webpage tamper-proof security program itself in the design and Implementation, discusses the related key technologies, and analyzes its security. Analysis and test results show that the scheme has strong protective ability, low consumption of protective performance, and ease of deployment.This thesis makes functional experiments and performance experiments through the deployment of the system in the laboratory environment and campus network. And the experimental results show that the scheme can effectively prevent SQL injection attacks, prevent the protected webpage file tampering, and protect the safety of their own program, but has little effect on the Web application service quality.