论文部分内容阅读
提出一种在服务器部署前端脚本程序的监控方案,对移动端HTTP流量注入行为进行监控.基于监控数据,对注入内容、注入主体进行分析.分析结果显示,超过4%的移动端Web客户端会话在传输过程中被篡改,这样的篡改包括注入普通广告、注入恶意广告、网络运营商增值服务、恶意代码、虚假访问代码、页面重定向等,注入主体和网络运营商、地域、网络环境有关.基于此,提出了4项针对这些注入的屏蔽方案,包括在服务器部署HTTPS、CSP、部署检测脚本与HTTPS以及在客户端部署访问限制程序等方案,并对这些方案进行测试.测试结果表明,在服务器部署CSP的方案成本低且准确率较高;针对高性能客户端,在客户端部署访问限制程序的方案能有效屏蔽流量注入.
This paper proposes a monitoring program for front-end scripting in server deployment to monitor HTTP traffic injection behavior on mobile terminal.Analysis of injected content and injected subject based on monitoring data shows that more than 4% of mobile Web client sessions In the transmission process has been tampered with, such tampering, including the injection of ordinary advertising, into malicious ads, network operators value-added services, malicious code, fake access code, page redirection, the main injection and network operators, geographical, network environment. Based on this, we propose four scenarios for these injections, including scenarios such as deploying HTTPS, CSP, deploying detection scripts and HTTPS on the server, and deploying access restriction procedures on the client, etc. The test results show that at Scenarios for deploying CSPs in servers are low cost and high accuracy. For high-performance clients, deploying access-restricted programs on the client can effectively shield traffic injection.