【作者】 马楠；

【导师】 邹仕洪；

【作者基本信息】 北京邮电大学 ， 计算机技术（专业学位）， 2019， 硕士

【摘要】 自国家实施“互联网+”战略以来,信息化的生活方式给人们带来便利的同时也带来了诸多重大的安全隐患,安全事件频发、高危漏洞逐年递增。研究渗透测试技术对提升Web应用系统的安全性有重要意义。渗透测试采用模拟攻击方式发现系统中存在的漏洞,其关键问题是模拟攻击阶段会增加网络负担,触发防火墙等安全设备;且攻击脚本针对性不强,导致测试过程效率低下。针对上述问题,论文提出基于端口和网站指纹来感知系统安全威胁的方法,主要工作包括:(1)设计并实现了Web指纹识别及威胁感知系统。系统包括端口指纹识别、网站指纹识别、威胁感知、任务调度等模块。其中,任务调度模块基于Gearman框架开发,为提升系统性能的关键点。论文研究分析该框架,发现并解决了其单点故障问题和任务队列持久化存储问题,提升系统多任务处理能力。(2)研究分析现有端口指纹识别工具Nmap和Zmap的优缺点,设计实现基于TCP SYN的无状态端口扫描技术,引入异步思想独立发送包线程与接收包线程,识别目标系统开放端口,大幅度提高了端口指纹识别速率。研究端口服务识别技术,将目标网站Banner信息与服务的签名进行正则匹配从而识别端口运行的服务。(3)研究分析HTTP响应数据包头部和HTML源代码,总结网站指纹特征的提取规则,设计各个组件指纹并建立网站指纹库,识别过程通过正则匹配将获取的目标指纹特征与指纹库中各组件指纹进行匹配,从而提高了系统网站指纹识别的性能。另外,研究机器学习多元分类算法,使用GBDT(Gradient Boosting Decision Tree,梯度提升树)多元分类算法进一步对Web服务器的版本范围进行识别,从而缩小了威胁感知的范围。更多还原

【Abstract】 Since the implementation of the "Internet +" strategy,informatized lifestyle not only brings convenience to people,but also causes many maj or security risks.Security incidents and high-risk vulnerabilities are increasing year by year.Researching penetration testing technology has great significance to improve the security of Web application systems.Penetration testing uses the simulated attack method to detect the vulnerabilities in system.The key problem is that the simulation attack phase will increase the network burden and trigger security devices such as fir-ewalls.And the attack script is not targeted,which leads to low scanning efficiency.In response to the above problems,the paper proposes a method based on port and website fingerprint to awareness system security threats.The main work includes:(1)This paper designs and implements Web fingerprint indentification and threat awareness system,which includes port fingerprint identification module,website fingerprint identification module,threat awareness module and task scheduling module.Among them,the task scheduling module is based on the Gearman framework development,which is a key point to improve system performance.By studying and analyzing the framework,this paper finds and solves its single point of failure problem and persistent store of task queue problem,which improves the multitasking ability of system.(2)By studying and analyzing the advantages and disadvantages of the existing port fingerprint identification tools-Nmap and Zmap,this paper designs and implements the stateless port scanning technology based on TCP SYN scanning.By introducing the asynchronous idea to independently send the packet thread and the receiving packet thread,the system identifies the open port of the target system,which increases port fingerprint identification rate.Resear-ching port service identification technology,the system uses regex match to match the target website Banner information with the signature of the service,which identifies the service running on the port.(3)This paper researches and analyzes the HTTP response packet header and HTML source code to summary the extracting rules of website fingerprint features.This paper designs component fingerprint and establishes the website fingerprint database.Then the target fingerprint features are matched with each component fingerprint in the fingerprint database by regex match to identify the website fingerprint,which improve the performance of the website fingerprint identification.In addition,by studying machine learning multi-classification algorithm,the system uses the GBDT(Gradient Boosting Decision Tree)multi-classification algorithm to further identify the version range of the Web server,which narrows the scope of threat awareness.更多还原