本文選題：Fuzzing　切入點(diǎn)：漏洞檢測(cè)　出處：《大連海事大學(xué)》2017年碩士論文

【摘要】：隨著網(wǎng)絡(luò)技術(shù)的迅速發(fā)展,Web技術(shù)被廣泛應(yīng)用到了各個(gè)領(lǐng)域,比如網(wǎng)上購(gòu)物、繳費(fèi)充值、網(wǎng)上銀行以及各種社交網(wǎng)站。這些Web應(yīng)用給我們帶來(lái)便利的同時(shí)也存在一定的安全隱患。因?yàn)殚_(kāi)發(fā)系統(tǒng)的程序員技術(shù)水平不同,導(dǎo)致其開(kāi)發(fā)的Web應(yīng)用難免會(huì)存在漏洞,SQL注入漏洞是最常見(jiàn)的漏洞之一。黑客往往會(huì)利用這些漏洞通過(guò)SQL注入的方式挖掘用戶(hù)信息,盜取敏感數(shù)據(jù)以謀取巨大利益。所以,對(duì)于檢測(cè)SQL注入漏洞問(wèn)題的研究有非常重要的現(xiàn)實(shí)意義。本文首先介紹Web應(yīng)用在安全問(wèn)題上的嚴(yán)峻形勢(shì),研究和學(xué)習(xí)國(guó)內(nèi)外在檢測(cè)Web應(yīng)用SQL注入漏洞方面所使用方法的優(yōu)點(diǎn)并分析它們的不足,了解SQL注入漏洞產(chǎn)生的原因、SQL注入攻擊原理以及常用的SQL注入漏洞檢測(cè)方法。針對(duì)目前存在的SQL注入漏洞檢測(cè)系統(tǒng)存在漏報(bào)、誤報(bào)率高的問(wèn)題,采用多線程的爬蟲(chóng)技術(shù),并使用MD5算法對(duì)爬取的鏈接進(jìn)行過(guò)濾和去重;提出一種基于Fuzzing技術(shù)的生成測(cè)試用例方法。首先,根據(jù)用例特征的不同建立不同的特征模板。然后,隨機(jī)組合這些測(cè)試用例特征模板,動(dòng)態(tài)生成許多的測(cè)試用例。最后,根據(jù)Web應(yīng)用過(guò)濾規(guī)則生成變形規(guī)則對(duì)測(cè)試用例進(jìn)行變形處理。這樣,測(cè)試用例就可以繞過(guò)Web應(yīng)用的過(guò)濾機(jī)制,提高檢測(cè)出漏洞的準(zhǔn)確率;采用基于DOM樹(shù)序列值比對(duì)的頁(yè)面對(duì)比算法檢測(cè)是否存在漏洞;通過(guò)使用漏洞量化評(píng)估方法,對(duì)Web應(yīng)用的安全狀況進(jìn)行量化評(píng)估,判斷該Web應(yīng)用的安全等級(jí)。在此基礎(chǔ)上,設(shè)計(jì)并實(shí)現(xiàn)基于Fuzzing的SQL注入漏洞檢測(cè)系統(tǒng)。將本文設(shè)計(jì)實(shí)現(xiàn)的系統(tǒng)與其他檢測(cè)工具進(jìn)行對(duì)比實(shí)驗(yàn),并通過(guò)檢出量、漏報(bào)率以及誤報(bào)率三個(gè)評(píng)價(jià)指標(biāo)進(jìn)行對(duì)比分析。實(shí)驗(yàn)結(jié)果表明本文實(shí)現(xiàn)的SQL注入漏洞檢測(cè)系統(tǒng)能夠較準(zhǔn)確地檢測(cè)出漏洞,能夠有效降低漏洞的漏報(bào)率和誤報(bào)率。
[Abstract]:With the rapid development of network technology, Web technology has been widely used in various fields, such as online shopping, charging, online banking and various social networking sites.These Web applications bring us convenience, but also there are certain security risks.Because of the different technical level of the programmers in the development system, it is inevitable that there will be vulnerabilities in the Web applications developed by them. SQL injection vulnerability is one of the most common vulnerabilities.Hackers often exploit these vulnerabilities to mine user information through SQL injection and steal sensitive data for huge profits.Therefore, the research on detecting SQL injection vulnerability has very important practical significance.This paper first introduces the severe situation of Web application in security issues, studies and studies the advantages and disadvantages of the methods used in detecting SQL injection vulnerabilities in Web applications, and analyzes their shortcomings.Understand the cause of SQL injection vulnerability and the principle of SQL injection vulnerability detection.Aiming at the problem of high false alarm rate and false alarm rate in the existing SQL injection vulnerability detection system, the crawler technique of multi-thread is adopted, and the MD5 algorithm is used to filter and remove the crawling link.A test case generation method based on Fuzzing technology is proposed.Firstly, different feature templates are established according to the features of use cases.Then, these test case feature templates are randomly combined to generate many test cases dynamically.Finally, the test cases are deformed according to the deformation rules generated by the filter rules applied by Web.In this way, test cases can bypass the filtering mechanism of Web application, improve the accuracy of detecting vulnerabilities; use page comparison algorithm based on DOM tree sequence value alignment to detect whether there are vulnerabilities;The security status of Web application is evaluated quantitatively and the security grade of the Web application is judged.On this basis, SQL injection vulnerability detection system based on Fuzzing is designed and implemented.The system designed and implemented in this paper is compared with other detection tools, and compared with three evaluation indexes: detection quantity, false alarm rate and false alarm rate.The experimental results show that the proposed SQL injection vulnerability detection system can detect the vulnerabilities accurately and reduce the false alarm rate and false alarm rate effectively.
【學(xué)位授予單位】：大連海事大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2017
【分類(lèi)號(hào)】：TP393.08

【相似文獻(xiàn)】

相關(guān)期刊論文 前10條

1 趙現(xiàn)軍;董明武;;漏洞檢測(cè)類(lèi)產(chǎn)品核心指標(biāo)淺析[J];網(wǎng)絡(luò)安全技術(shù)與應(yīng)用;2006年11期

2 ;漏洞檢測(cè)代表產(chǎn)品[J];每周電腦報(bào);2003年46期

3 楊闊朝,蔣凡;模擬攻擊測(cè)試方式的漏洞檢測(cè)系統(tǒng)的設(shè)計(jì)與實(shí)現(xiàn)[J];計(jì)算機(jī)應(yīng)用;2005年07期

4 龍銀香;一種新的漏洞檢測(cè)系統(tǒng)方案[J];微計(jì)算機(jī)信息;2005年05期

5 賈永杰,王恩堂;一種新的漏洞檢測(cè)系統(tǒng)方案[J];中國(guó)科技信息;2005年09期

6 劉完芳;;基于網(wǎng)絡(luò)的漏洞檢測(cè)系統(tǒng)的設(shè)計(jì)[J];湘潭師范學(xué)院學(xué)報(bào)(自然科學(xué)版);2006年03期

7 金怡;蔡勉;王亞軍;;基于中間件的漏洞檢測(cè)系統(tǒng)設(shè)計(jì)[J];信息安全與通信保密;2007年04期

8 花青;高嶺;張林;;分布式漏洞檢測(cè)系統(tǒng)的設(shè)計(jì)與實(shí)現(xiàn)[J];東南大學(xué)學(xué)報(bào)(自然科學(xué)版);2008年S1期

9 張林;高嶺;湯聲潮;楊e，

本文編號(hào)：1713874