Defense system and method for blocking file uploading through feature code capable of automatically learning updating

[0047] Such as figure 1As shown, a feature code blocking file upload defense system that can automatically learn and update is communicated with the business system to be tested. Among them, the file upload defense system includes several clouds, and the cloud includes a data monitoring module and a packet size judgment module. , a data discrimination module, a feature code extraction module, a data analysis module, a learning update module, a data deletion module and a large message cache module, and a file upload filtering rule file is saved on the cloud.

[0048] Specifically, the file upload filter rule file is used to collect feature codes that can characterize file upload vulnerabilities, and several feature code units corresponding to illegal messages are stored in the file upload filter rule file.

[0049] The data monitoring module can manage the corresponding data message of the request message for file upload in the business system to be tested. The request message inc

[0062] A feature code blocking file upload defense method that can automatically learn and update is mainly based on the file upload defense system of Embodiment 1, and specifically includes the following steps:

[0063] Step 1: Upload the file and establish a communication connection between the defense system and the business system to be tested, and install or integrate the cloud in the form of a code plug-in on the business system to be tested, wherein the business system to be tested includes a request report text, and the request message specifically includes response data and data flow information.

[0064] The second step: the data monitoring module judges whether there is a file upload message by monitoring the response data of the message of the file upload request in the business system to be tested, and grabs the message when the message is monitored;

[0065] Step 3: The message size judging module judges whether the message captured by the data monitoring module is