| With the development of Information Technology, enterprises and even whole countries are dependent on computer systems. But the security situation of enterprise information is not optimistic. With external hacking and internal misuse, the online applications are facing certain security risks, which need applying the data audit to further enhance the security of information systems.This thesis introduces the concept of application security auditing platform, implements enterprises internal application security audits, and establishes a standardized and efficient security auditing platform for applied information systems.The main work of the thesis includes:First, it presents the analysis and design of the function of application security auditing platform, system architecture, system deployment, data storage, permissions, data interface and auditing policy. A light quantitative JSON format interface has established to fix audit interface address of domain name access, achieve secure and stable data mapping with many information system; a multi-dimensional audit strategy is designed using pattern matching algorithm and random sampling algorithm to achieve application access permission, application audit management and user audit management, and make audit work more reasonable and formal; a disk array for data shared storage is constructed to meet requirements of stable and robust data storage and data service; a software development toolset is designed based on.NET to develop system auditing functions quickly and easily.Next, we research on the middleware in the application security audit platform, and analyze seven-stage design method of the WEBAPI. By using lightweight WEBAPI middleware interface, message-oriented middleware, SMS Gateway Middleware, as well as single sign-on middleware, the architecture of the platform is more rational, and the development is more efficient, the usage is easier, and the performance of the platform is more stable.Finally, an application security auditing platform is built which makes the full use of log data to perform security audits. We present the implementation process and result of the platform intuitively, and introduce the definition and implementation of the data interface in detail,together with the functions of data storage, audit policies, system authorization, software development toolset, and audit alerts etc. |
