Web应⽤安全演进从WAF到WAAPYunWU吴赟Akamai大中华区高级技术顾问!"#$%135!"#/$%1,400 !&'4,200 !()&'()*+1 *!IP $+/,13*-./01/,7.5 PB23456/,,-./01234564 78-9:/;<=2 8*-0>/,<=100Tb/;789:8,500 ?@AB60 ?!CDEF48!CDC,GHIJK © 2021 Akamai3Akamai –!"#$#%&'()*+ !"#$%Akamai Intelligent Edge Platform&2021 '1 (&攻击越来越大、越来越复杂、越来越无法预测 DDoS攻击的目的性和行业属性愈加明显 4/14/215/4/215/24/21500 Gbps300 Gbps200 Gbps0 Gbps400 GbpsDDoS AttacksFinancial ServicesMedia & Entertainment GamingInternet & TelecomEducationPublic SectorHotel & TravelRetail & ConsumerSoftware & TechnologyBusiness Services 100 Gbps6/13/21© 2021 Akamai Web应用攻击依旧在攀升27亿次2021Q2WAF告警(+26% Q/Q)安全研究团队每天要分析290TB的攻击数据 Web attacks spiked in June 2021, with a peak of 113.8 million attacks in a single dayAPI攻击成为了新的攻击途径 由于第三方API的集成导致的风险的增加利用JSON/XML和Parser的攻击不断增长，并且导致了严重的业务中断基于API的应用是HTML应用的3倍之多 攻击者利用了脆弱的认证和授权的实现攻击界面在转换 Specific attacks on JSON / XML and parser based Application vulnerabilities 3rdparty integration Login abuseDoS / DDoSAuthUnauthorized useAPI 注入类型的攻击始终相关和普遍© 2021 Akamai 精密而复杂的爬虫攻击 Akamai已经探测到多次单日峰值超过10亿次的恶意登录行为700亿 Credential stuffing attacks remained steady over the past 18 months, but two days in Q1 and Q2 2021 hit peaks of over 1 billion daily attacks2021Q2账户滥用攻击(+15% Q/Q)