针对现有Web服务器识别(WSI)方法存在识别正确率低且对指纹库依赖性强的问题,依据不同服务器对15种畸形Http请求处理机制的差异,提出一种新的识别方法。使用朴素贝叶斯分类模型计算待测Web服务器各分类属性在状态码特征属性下的后验概率,选择后验概率最大的类型作为Web服务器类型,根据该类型选择特定版本特征库,利用朴素贝叶斯分类模型得到Web服务器类型对应的具体版本,以此设计和实现Web服务器识别系统。与现有HMAP,Httprecon,Httprint识别工具进行对比实验的结果表明,随着训练样本的增加,该系统的准确率、召回率和F-measure值更高,识别性能更好。

XSS exploit is prevalent in current web application.Many web applications are vulnerable to attack for existence of XSS exploit in their applications.On the different occasions where the web applications security exploit appears,the attack ways are different,so Web administrators pay little attention to this attack.This paper gives the forming principles and detection methods of XSS exploit.Through analyzing the utilization ways of XSS attack,that is,stealing the cookie and forging identity for logging in,getting the plain-text password in browser,some corresponding measures for preventing the cross-site scripting attack are proposed.