System and Method of Monitoring Attacks of Cross Site Script

• US 20140165192A1
• Filed: 12/02/2013
• Published: 06/12/2014
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: Alibaba Group Holding Ltd.
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: Zhu, Rong, Li, Xiaoshuan, Yi, Ziyi, Xu, Tianhe
• Granted Patent: US 9,378,362 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

The present disclosure provides techniques for monitoring a cross site scripting attack. These techniques may receive and reply to, by a computing device, a service request from a client terminal. The computing device may then redefine a scripting internal function applied by the cross site scripting attack, and return redefined information for the scripting internal function to the client terminal. The computing device may monitor calling information of the client terminal in relation to the redefined scripting internal function, and analyze the security of the calling information. The computing device may monitor an attacking source, an attacking time period, leakage information in the attack, and/or a vulnerability point in the attack that are associated with the cross site scripting attack.

Claims

1. A system for monitoring cross site scripting attacks, comprising:

one or more processors; and

memory to maintain a plurality of components executable by the one or more processors, the plurality of components comprising;

a business module configured to receive and reply to a service request from a client terminal,

a redefining module configured to;

redefine a scripting internal function applied by a cross site scripting attack, and

return redefined information for the scripting internal function to the client terminal,

a monitoring module configured to monitor calling information of the client terminal in relation to the redefined scripting internal function, and

an analyzing module configured to analyze security of the calling information of the client terminal.

2. The system of claim 1, wherein the redefining of the scripting internal function comprises adding a monitoring code to monitor the calling of the scripting internal function.

3. The system of claim 1, wherein the redefined information in relation to the scripting internal function is formed in a head section of a corresponding webpage associated with a networking server that responds to the service request.

4. The system of claim 1, wherein the redefined scripting internal function comprises at least one of an internal function of a scripting language, a function for creating a page element, a function for executing an external link code, or a function for displaying a page.

5. The system of claim 4, wherein the scripting language is a JavaScript language.

6. The system as claimed in claim 1, wherein the redefined scripting internal function is associated with at least one of a documenting creating function, a document writing function, an object locating function, an alerting message function, a user confirmation function, or a user input function.

7. The system of claim 1, wherein the calling information of the redefined scripting internal function comprises at least one of a context environment of the scripting internal function, a calling time period of the redefined scripting internal function, a number of calling times for the redefined scripting internal function, a behavior of a client that calls the redefined scripting internal function, or one or more accounts and IP addresses associated with the client.

8. The system of claim 1, wherein the analyzing module is configured to further determine whether the calling of the redefined scripting internal function is a cross site scripting attack according to a behavior characteristic, the behavior characteristic includes at least one of an application that is called by the redefined scripting internal function, a number of times that the scripting internal function is called, a sensitive information in a visit, or a sensitive information in a transmission.

9. The system of claim 1, wherein the plurality of components further comprise a warning module configured to issue a security warning in response to a determination that the calling of the redefined scripting internal function is the cross site scripting attack.

10. The system of claim 1, wherein the plurality of components further comprise an intercepting module configured to:

intercept a subsequent execution of the redefined scripting internal function,

terminate rendering of a webpage associated with the service request; and

replace an attacked webpage with a safe page in response to a determination that a calling of the redefined scripting internal function is a cross site scripting attack.

11. A method for monitoring cross site scripting attacks, comprising:

receiving and replying to a service request from a client terminal;

redefining a scripting internal function applied by a cross site scripting attack;

returning redefined information for the scripting internal function to the client terminal;

monitoring calling information of the client terminal in relation to the redefined scripting internal function; and

analyzing security of the calling information of the client terminal.

12. The method of claim 11, wherein the redefining the scripting internal function comprises adding a monitoring code to monitor the calling of the scripting internal function.

13. The method of claim 11, wherein the redefined information in relation to the scripting internal function is formed in a head section of a corresponding webpage associated with a networking server that responds to the service request.

14. The method of claim 11, wherein the calling information of the redefined scripting internal function comprises at least one of a context environment of the scripting internal function, a calling time period of the redefined scripting internal function, a number of calling times for the redefined scripting internal function, a behavior of a client that calls the redefined scripting internal function, or one or more accounts and IP addresses associated with the client.

15. The method of claim 11, further comprising determining whether the calling of the redefined scripting internal function is a cross site scripting attack according to a behavior characteristic, the behavior characteristic includes at least one of an application that is called by the redefined scripting internal function, a number of times that the scripting internal function is called, a sensitive information that the redefined scripting internal function visits, or a sensitive information that the redefined scripting internal function transmits.

16. One or more computer-readable media storing computer-executable instructions that, when executed by one or more processors, instruct the one or more processors to perform acts comprising:

receiving a service request from a client terminal;

redefining a scripting internal function applied a cross site scripting attack;

returning redefined information for the scripting internal function to the client terminal;

monitoring calling information of the client terminal in relation to the redefined scripting internal function; and

analyzing security of the calling information of the client terminal.

17. The one or more computer-readable media of claim 16, wherein the acts further comprises issuing a security warning in response to a determination that the calling of the redefined scripting internal function is the cross site scripting attack.

18. The one or more computer-readable media of claim 17, wherein the acts further comprises intercepting a subsequent execution of the redefined scripting internal function;

terminating rendering of a webpage associated with the webpage; and

replacing an attacked webpage with a safe page in response to a determination that a calling of the redefined scripting internal function is a cross site scripting attack.

19. The one or more computer-readable media of claim 16, wherein the redefining the scripting internal function comprises adding a monitoring code to monitor the calling of the scripting internal function.

20. The one or more computer-readable media of claim 16, wherein the redefined information in relation to the scripting internal function is formed in a head section of a corresponding webpage associated with a networking server that responds to the service request.