By analyzing the HTTP protocol identification document upload operation
In general, most of the files are uploaded, such as the browser to upload files, network disk upload files via HTTP protocol. Accurately identify the file upload operation and can be blocked, it has important implications for data leak prevention (DLP) field. This article provides a method for identifying the identification file upload behavior, and its technical ideas blocked. This idea has been applied in Ping32 terminal security management system can effectively help customers identify sensitive terminal operations, audit and supports blocked.
First, HTTP upload files need to achieve through the POST method. Because the GET method and compared, POST data does not show will be safer in the URL. Secondly POST data transmission and no length limit, so POST general application in the user login, upload files and other occasions. Because in anti-phishing data scene, uploaded files are usually quite large, so we can set a threshold, such as Content-Length field to identify HTTP POST header, exceeds a specified threshold value, such as 10k, can be considered It is a file upload operation.