CAJ | 학술논문

当前XSS攻击是对Web邮箱系统的最大威胁之一，为更好保证邮箱系统的安全性，提出一种基于改进的污点分析算法的监测方法。对Web邮箱系统应用程序中的敏感数据进行标记，并对标记数据进行跟踪分析，防止敏感数据被发送到第三方U RL的同时，防止将敏感数据在用户不知情的情况下发给同站点的其他用户。实验分析结果表明，该方法可以有效防止敏感数据被窃取，达到成功防御XSS攻击的目的。
당전XSS공격시대Web유상계통적최대위협지일，위경호보증유상계통적안전성，제출일충기우개진적오점분석산법적감측방법。대Web유상계통응용정서중적민감수거진행표기，병대표기수거진행근종분석，방지민감수거피발송도제삼방U RL적동시，방지장민감수거재용호불지정적정황하발급동참점적기타용호。실험분석결과표명，해방법가이유효방지민감수거피절취，체도성공방어XSS공격적목적。
At present ,the XSS attack is one of the biggest threats to the Web mail system .To better guarantee the security of E‐mail system ,a monitoring method based on the improved taint analysis algorithm was put forward .Sensitive data of Web E‐mail system application were tagged ,and the tag data points were tracked .The algorithm can prevent sensitive data from sending to the third party URL and other users in the site while the user is unwitting .Experimental analysis shows that the method can effectively prevent sensitive data from being stolen ,so as to achieve the purpose of successfully defending XSS attacks .