Multi-dimensional Monitoring System for Website Security Based on Cloud Platform

doi:10.3969/j.issn.1006-2475.2016.01.009

Abstract

Abstract: A multi-dimensional monitoring system for website security based on cloud platform utilizes cloud computing technology and monitors website security from three dimensions including availability, security events and Web vulnerabilities. Correlation analysis of the monitoring data is conducted meanwhile. The system concurrently and periodically monitors the large-scale websites comprehensively utilizing several key technologies including rapid detection technology based on static source code analysis towards website hang cockhorse, hidden chain detection technology based on native Bayes, SQL injection attack blind detection technology based on page similarity and XSS detection technology based on high precision DOM locator. The system improves the accuracy, rates of missing report and false alarm in the detection of website defacement which provides timely and accurate basis for the website security administration and maintenance.


Key words: cloud computing, multi-dimensional monitoring, website security, vulnerability scanning, security incident

CLC Number:

TP393.08

ZHENG Sheng-jun1， GUO Long-hua2， LI Jian-hua2, WANG Hong-kai3, LIU Yun4. Multi-dimensional Monitoring System for Website Security Based on Cloud Platform[J]. Computer and Modernization, doi: 10.3969/j.issn.1006-2475.2016.01.009.

References

［1］中国互联网信息中心. 第36次中国互联网络发展状况统计报告［EB/OL］. http://www.cnnic.net.cn/hlwfzyj/hlwxzbg/ hlwtjbg P020150723549500667087.pdf, 2015-07-23.
［2］国际电信联盟. 2014年信息与通信技术［EB/OL］. http://www.itu.int/en/ITU-D/Statistics/Documents/facts/ICTFactsFigures2014-e.pdf, 2014-05-08.
［3］国家互联网应急中心. 互联网安全威胁报告［EB/OL］. http://www.cert.org.cn/publish/main/upload/File/2015 monthly08.pdf, 2015-08-10.
［4］梁业裕,徐钽,宁建创,等. Web网站安全综合监控管理目标实现［J］. 计算机安全， 2013(11):72-78.
［5］赵鑫,朱东来,杨宏,等. 一种高效的移动互联网网站安全监测方法研究与实现［J］. 电信工程技术与标准化， 2013,26(12):28-31.
［6］吴秋萍. 云计算在电子政务系统中的应用研究［J］. 计算机与现代化， 2011(7):116-120.
［7］韩杰,冯骏,肖岩军. 建设laaS模式的可信网站云平台［J］. 计算机安全， 2014(11):40-44.
［8］李连,朱爱红. 云计算入侵检测数据融合技术［J］. 计算机与现代化， 2013(9):179-182.
［9］ Wang Cong, Wang Qian, Ren Kui, et al. Toward secure and dependable storage services in cloud computing［J］. IEEE Transactions on Services Computing， 2012,5(2):220-232.
［10］罗军舟,金嘉晖,宋爱波,等. 云计算:体系架构与关键技术［J］. 通信学报， 2011,32(7):3-21.
［11］张慧琳，邹维，韩心慧. 网页木马机理与防御技术［J］. 软件学报， 2013,24(4):843-858．
［12］吴润浦,方勇,吴少华. 基于统计与代码特征分析的网页木马检测模型［J］. 信息与电子工程， 2009,7(1):71-75.
［13］朱克楠,尹宝林,冒亚明,等. 基于有效窗口和朴素贝叶斯的恶意代码分类［J］. 计算机研究与发展， 2014,51(2):373-381.
［14］徐鹏,林森. 基于C4.5决策树的流量分类方法［J］. 软件学报， 2009,20(10):2692-2704.
［15］Shar L K, Tan H B K. Defeating SQL injection［J］. IEEE Computer Society, 2013,46(3):69-77.
［16］张晨,汪永益,王雄,等. 基于网页DOM树比对的SQL注入漏洞检测［J］. 计算机工程, 2012,38(18):111-115.
［17］W3C. Document Object Model(DOM)［EB/OL］. http://www.w3.org/DOM/, 2005-02-19.
［18］曹文,郭帆,余敏,等. 基于哈希树和有限状态机的XSS检测模型［J］. 计算机工程, 2013,39(6):154-161.
［19］王春东,邱晓华. 基于特征策略的XSS漏洞检测技术研究［J］. 天津理工大学学报， 2013,29(5):25-29.
［20］Fonseca J, Seixas N, Vieira M, et al. Analysis of field data on Web security vulnerabilities［J］. IEEE Transactions on Dependable and Secure Computing, 2014,11(2):89-100.

[1]	HE Yu-peng, TAO Yong, WANG Bing-heng, ZHAO Ying-nan. Research Status and Prospect of Edge Computing in Smart Distribution Network [J]. Computer and Modernization, 2023, 0(08): 87-92.
[2]	YANG Bo, XU Sheng-chao. Security Protection Method of Cloud Network Special Line Scenarios Based on SRv6#br# Service Chain [J]. Computer and Modernization, 2023, 0(08): 107-111.
[3]	MAO Ming-yang, XU Sheng-chao. Communication Terminal Attack Behavior Identification Algorithm Based on Trusted Cloud Computing#br# [J]. Computer and Modernization, 2022, 0(11): 37-42.
[4]	CAO Yu, LI Xiao-hui, LIU Zhong-lin, JIA He, FEI Zhi-wei. Review of Big Data Workflow Orchestration and Management System in Cloud Environment [J]. Computer and Modernization, 2022, 0(01): 41-53.
[5]	ZHANG Xiao-min. An Attribute-based Multi-keyword Searchable Scheme Based on Bloom Filters [J]. Computer and Modernization, 2021, 0(08): 104-111.
[6]	DENG Bin-tao, XU Sheng-chao. A Differential Evolution K-mediods Clustering Algorithm Based on Dynamic Gemini Population [J]. Computer and Modernization, 2021, 0(07): 54-59.
[7]	WU Jun-cai, LIU Xue-fang . Digital Resource Allocation Based on Cloud Computing and Deep Belief Network [J]. Computer and Modernization, 2021, 0(05): 78-82.
[8]	LU Ge-hao, YANG Dan-ni. Development Status and Prospect of Blockchain as a Service [J]. Computer and Modernization, 2020, 0(10): 31-35.
[9]	LIANG Ci1, CHEN Shi-ping2. Packet Drift Strategy Based on Packet Cluster Mapping Architecture [J]. Computer and Modernization, 2019, 0(11): 112-.
[10]	DING Shun1, CHEN Shi-ping2. Construction and Application of Experimental Platform #br# Based on Packet Cluster Mapping Mechanism [J]. Computer and Modernization, 2019, 0(11): 120-.
[11]	WEN Ting-ting, LI Hong-zhe. Elastic Load Balancing Algorithm for Cloud Computing Service [J]. Computer and Modernization, 2019, 0(10): 28-.
[12]	YUAN Min-fu, LI Yin， CHEN Sheng-jian， ZHENG Xiang-wei. Cloud platform Based Blockchain Networking and Data Storage Mechanism [J]. Computer and Modernization, 2019, 0(09): 46-.
[13]	WANG Shao-qiang, WANG Yu. New Data Processing System Based on Edge Computing [J]. Computer and Modernization, 2019, 0(07): 15-.
[14]	ZHOU Bo1， LI Ya-qiong1， LIU Yong-bo1， LI Shou-chao1， SONG Yun-kui2. Deadline Constrained MapReduce Jobs Scheduling for Cloud Computing [J]. Computer and Modernization, 2018, 0(11): 51-.
[15]	WANG Xu1,2, NI Hong2, HAN Rui2. Auction-based Resource Match Algorithm in Data Centers [J]. Computer and Modernization, 2018, 0(10): 114-.